{ "allowed_decisions": [ "confirm", "defer", "reject", "request_more_evidence" ], "blocked_requests": [ "repo_create", "visibility_change", "refs_sync", "refs_delete", "force_push", "workflow_modify", "runner_enable", "secret_value_submit", "ssh_host_modify", "nginx_reload", "dns_tls_modify", "argocd_sync", "kubectl_apply", "active_scan", "agent_bounty_runtime_execute", "payout_or_withdrawal" ], "canonical_owner_fields": [ "owner_role_or_team", "decision", "decision_reason", "affected_scope", "redacted_evidence_refs", "followup_owner", "rollback_owner", "maintenance_window", "validation_plan" ], "completion": { "owner_request_sent_percent": 0, "owner_response_received_percent": 0, "request_dispatch_preflight_artifact_percent": 100, "reviewer_accepted_percent": 0, "runtime_gate_percent": 0 }, "dispatch_preflight_checks": [ { "check_id": "baseline_commit_synced", "gate_effect": "不增加 request_sent / received / accepted / runtime gate。", "instruction": "使用最新 gitea/main 與 owner packet snapshot；不得用過期 packet 送件。", "label": "基線 commit 已同步", "required": true, "status": "preflight_required_before_request_dispatch" }, { "check_id": "source_snapshot_current", "gate_effect": "不增加 request_sent / received / accepted / runtime gate。", "instruction": "來源必須是 committed high-value-config-owner-packet snapshot，不讀 live 主機。", "label": "來源 snapshot 目前有效", "required": true, "status": "preflight_required_before_request_dispatch" }, { "check_id": "packet_scope_mapped", "gate_effect": "不增加 request_sent / received / accepted / runtime gate。", "instruction": "每包需有 category、priority、control tier、required gate 與 affected files。", "label": "Packet scope 已映射", "required": true, "status": "preflight_required_before_request_dispatch" }, { "check_id": "canonical_fields_present", "gate_effect": "不增加 request_sent / received / accepted / runtime gate。", "instruction": "每包需要求 owner role、decision、reason、scope、evidence refs、followup、rollback、window、validation。", "label": "Canonical 欄位已固定", "required": true, "status": "preflight_required_before_request_dispatch" }, { "check_id": "redacted_evidence_refs_only", "gate_effect": "不增加 request_sent / received / accepted / runtime gate。", "instruction": "只收文件路徑、snapshot id、ticket id、commit、hash 或 metadata pointer。", "label": "Evidence refs 只允許脫敏參照", "required": true, "status": "preflight_required_before_request_dispatch" }, { "check_id": "no_sensitive_payload", "gate_effect": "不增加 request_sent / received / accepted / runtime gate。", "instruction": "不得收 token、secret、private key、cookie、session、authorization header、runner token 或 webhook secret。", "label": "禁止敏感 payload", "required": true, "status": "preflight_required_before_request_dispatch" }, { "check_id": "no_execution_request", "gate_effect": "不增加 request_sent / received / accepted / runtime gate。", "instruction": "不得夾帶 reload、deploy、sync、host write、active scan、payout 或 withdrawal。", "label": "拒收執行要求", "required": true, "status": "preflight_required_before_request_dispatch" }, { "check_id": "maintenance_and_rollback_fields_present", "gate_effect": "不增加 request_sent / received / accepted / runtime gate。", "instruction": "C0 / P0 仍需獨立人工批准、維護窗口與 rollback owner，不能由 packet 自動授權。", "label": "維護窗口與回滾 owner 欄位存在", "required": true, "status": "preflight_required_before_request_dispatch" }, { "check_id": "validation_plan_present", "gate_effect": "不增加 request_sent / received / accepted / runtime gate。", "instruction": "必須能說明 preflight、post-check、rollback check；只讀文件變更則對應 guard / JSON / doc sanity。", "label": "驗證計畫欄位存在", "required": true, "status": "preflight_required_before_request_dispatch" } ], "execution_boundaries": { "action_buttons_allowed": false, "active_scan_authorized": false, "dispatch_authorized": false, "dns_tls_change_authorized": false, "host_write_authorized": false, "nginx_reload_authorized": false, "not_authorization": true, "production_write_authorized": false, "request_sent": false, "reviewer_queue_write": false, "runtime_execution_authorized": false, "secret_value_collection_allowed": false, "workflow_modification_authorized": false }, "generated_at": "2026-06-14T18:25:00+08:00", "git_commit": "3de776f4", "intake_packets": [ { "accepted_response": false, "action_buttons_allowed": false, "affected_file_count": 2, "affected_files": [ "scripts/ops/188-registry-certbot-fix.sh", "scripts/ops/fix-188-registry-certbot-renewal.sh" ], "category_id": "dns_tls_certbot", "control_tier": "C0", "label": "DNS / TLS / certbot / certificate path", "not_authorization": true, "packet_id": "high_value_config_owner_packet:dns_tls_certbot", "priority": "P0", "production_write_authorized": false, "received_response": false, "rejected_response": false, "request_sent": false, "required_gate": "domain_tls_owner_response_required", "required_owner_fields": [ "owner_role_or_team", "decision", "decision_reason", "affected_scope", "redacted_evidence_refs", "followup_owner", "rollback_owner", "maintenance_window", "validation_plan" ], "required_validation": [ "domain_inventory", "certificate_path_check", "renewal_window", "acme_path_smoke", "public_https_smoke", "rollback_ref" ], "reviewer_queue_write": false, "runtime_gate": false, "secret_value_collection_allowed": false, "status": "waiting_request_dispatch_preflight" }, { "accepted_response": false, "action_buttons_allowed": false, "affected_file_count": 1, "affected_files": [ "k8s/nginx/awoooi-prod.conf" ], "category_id": "nginx_public_gateway", "control_tier": "C0", "label": "Nginx / reverse proxy / public route", "not_authorization": true, "packet_id": "high_value_config_owner_packet:nginx_public_gateway", "priority": "P0", "production_write_authorized": false, "received_response": false, "rejected_response": false, "request_sent": false, "required_gate": "public_gateway_owner_response_required", "required_owner_fields": [ "owner_role_or_team", "decision", "decision_reason", "affected_scope", "redacted_evidence_refs", "followup_owner", "rollback_owner", "maintenance_window", "validation_plan" ], "required_validation": [ "rendered_diff", "nginx_t", "affected_route_smoke", "admin_route_smoke_if_affected", "acme_path_smoke_if_affected", "rollback_ref" ], "reviewer_queue_write": false, "runtime_gate": false, "secret_value_collection_allowed": false, "status": "waiting_request_dispatch_preflight" }, { "accepted_response": false, "action_buttons_allowed": false, "affected_file_count": 3, "affected_files": [ "docs/security/HIGH-VALUE-CONFIG-CHANGE-GATE.md", "docs/security/high-value-config-change-gate.snapshot.json", "scripts/security/high-value-config-change-gate.py" ], "category_id": "security_evidence_tooling", "control_tier": "C3", "label": "Security evidence / snapshot / guard tooling", "not_authorization": true, "packet_id": "high_value_config_owner_packet:security_evidence_tooling", "priority": "P3", "production_write_authorized": false, "received_response": false, "rejected_response": false, "request_sent": false, "required_gate": "security_evidence_owner_review_required", "required_owner_fields": [ "owner_role_or_team", "decision", "decision_reason", "affected_scope", "redacted_evidence_refs", "followup_owner", "rollback_owner", "maintenance_window", "validation_plan" ], "required_validation": [ "snapshot_parse", "guard_smoke", "doc_secret_sanity", "no_runtime_gate_increase" ], "reviewer_queue_write": false, "runtime_gate": false, "secret_value_collection_allowed": false, "status": "waiting_request_dispatch_preflight" } ], "next_steps": [ "先由 reviewer 確認預檢 snapshot 與 owner packet snapshot 皆為最新 committed evidence。", "送件前只準備脫敏欄位與禁止條款，不送 secret value、不附 raw payload。", "收到回覆後先依 intake lanes 分流；通過 reviewer validation 之前 received / accepted 不得增加。", "任何 runtime、Nginx reload、DNS / TLS、workflow、runner、host 或 payout 動作都必須切獨立人工批准。" ], "reviewer_intake_lanes": [ { "gate_effect": "request / received / accepted / rejected 維持 0。", "instruction": "尚未收到 owner response 或只有空白 / 口頭同意時維持等待。", "lane_id": "keep_waiting_owner_response", "status": "reviewer_intake_lane_defined" }, { "gate_effect": "不得增加 accepted 或 runtime gate。", "instruction": "欄位缺漏、scope 不清或 redacted evidence refs 不足時補件。", "lane_id": "request_more_evidence", "status": "reviewer_intake_lane_defined" }, { "gate_effect": "不得保存 raw payload、不得渲染到前端或 LOGBOOK。", "instruction": "疑似含敏感 payload、raw log、未脫敏截圖或 private credential URL 時隔離。", "lane_id": "quarantine_sensitive_payload", "status": "reviewer_intake_lane_defined" }, { "gate_effect": "不得建立 action button、不得轉成執行批准。", "instruction": "夾帶 repo / refs / workflow / runner / host / scan / runtime 執行要求時拒收。", "lane_id": "reject_execution_request", "status": "reviewer_intake_lane_defined" }, { "gate_effect": "仍不是 accepted，也不是 runtime authorization。", "instruction": "欄位完整、證據脫敏、無敏感 payload 且無執行要求時才可進 reviewer checklist。", "lane_id": "ready_for_reviewer_validation", "status": "reviewer_intake_lane_defined" } ], "schema_version": "high_value_config_owner_packet_intake_preflight_v1", "source_false_flags": { "action_buttons_allowed": false, "active_scan_authorized": false, "dns_tls_change_authorized": false, "force_push_authorized": false, "host_write_authorized": false, "nginx_reload_authorized": false, "refs_sync_authorized": false, "request_sent": false, "response_accepted": false, "response_received": false, "runner_change_authorized": false, "runtime_execution_authorized": false, "secret_value_collection_allowed": false, "workflow_modification_authorized": false }, "source_owner_packet_schema_version": "high_value_config_owner_packet_v1", "source_owner_packet_status": "draft_waiting_owner_response", "status": "request_dispatch_preflight_ready", "summary": { "accepted_response_count": 0, "action_button_count": 0, "blocked_request_count": 16, "c0_packet_count": 2, "c1_packet_count": 0, "canonical_owner_field_count": 9, "dispatch_preflight_check_count": 9, "packet_count": 3, "received_response_count": 0, "rejected_response_count": 0, "request_sent_count": 0, "required_owner_field_total": 27, "reviewer_intake_lane_count": 5, "reviewer_queue_write_count": 0, "runtime_gate_count": 0 } }