{ "schema_version": "security_mirror_status_rollup_v1", "status": "draft", "date": "2026-05-13", "mode": "mirror_only", "rollup_status": "framework_ready_waiting_approval", "runtime_execution_authorized": false, "source_indexes": [ "docs/security/security-supply-chain-contract-manifest.snapshot.json", "docs/security/security-mirror-readiness.snapshot.json", "docs/security/security-mirror-intake-plan.snapshot.json", "docs/security/security-mirror-route.snapshot.json", "docs/security/security-mirror-acceptance.snapshot.json", "docs/security/security-mirror-quarantine.snapshot.json", "docs/security/security-mirror-dry-run.snapshot.json", "docs/security/security-approval-queue.snapshot.json", "docs/security/security-approval-gate.snapshot.json", "docs/security/security-approval-decision-record.snapshot.json", "docs/security/security-approval-review-packet.snapshot.json", "docs/security/security-approval-state-transition.snapshot.json", "docs/security/security-followup-runtime-gate.snapshot.json", "docs/security/source-control-primary-readiness-gate.snapshot.json", "docs/security/source-control-workflow-secret-name-inventory.snapshot.json", "docs/security/source-control-workflow-secret-name-local-evidence.snapshot.json", "docs/security/security-rollout-policy.snapshot.json" ], "summary": { "total_contracts": 34, "ready_for_mirror_count": 31, "partial_ready_count": 2, "contract_only_count": 1, "blocked_count": 0, "approval_queue_total": 8, "approval_review_packet_total": 8, "approval_state_transition_rule_total": 5, "followup_runtime_gate_template_total": 8, "active_runtime_gate_count": 0, "primary_readiness_candidate_repo_count": 8, "github_primary_ready_count": 0, "workflow_secret_inventory_candidate_repo_count": 8, "workflow_secret_inventory_complete_count": 0, "workflow_secret_inventory_local_evidence_repo_count": 4, "workflow_secret_inventory_local_workflow_file_count": 31, "workflow_secret_inventory_unique_secret_name_count": 43, "secret_value_collection_allowed": false, "secret_value_detected": false, "pending_approval_count": 7, "block_candidate_count": 1, "dry_run_status": "contract_defined_not_executed", "runtime_actions_executed": false, "payloads_ingested": false }, "phase_status": [ { "phase_id": "S0_contracts_and_boundaries", "state": "completed", "current_result": "Kali / Codex / GitHub / Gitea / AwoooP 邊界已文件化，核心 schema 草案已建立。", "next_gate": "AwoooP 只讀 mirror 消費。" }, { "phase_id": "S1_readonly_inventory", "state": "in_progress", "current_result": "已完成多項 read-only evidence；Gitea private/internal 全量 repo list 仍需批准後補齊。", "next_gate": "只讀 token 或 redacted admin export approval。" }, { "phase_id": "S2_mirror_only_consumption", "state": "draft_ready", "current_result": "Mirror readiness、intake、event、route、acceptance、quarantine、dry-run 與 status rollup 契約已建立。", "next_gate": "AwoooP 主線只建立 read-only / mirror-only UI 與 audit evidence，不新增 execution router。" }, { "phase_id": "S3_approval_gate", "state": "draft_ready", "current_result": "Approval queue 已列出 8 個候選，security_approval_gate_v1 已定義人工 gate，security_approval_decision_record_v1 已定義決策紀錄格式，security_approval_review_packet_v1 已定義人工審查封包，security_approval_state_transition_v1 已定義決策狀態轉移語義，security_followup_runtime_gate_v1 已定義後續 runtime gate 準備模板。", "next_gate": "先 review redacted finding ingestion、safe crawl 與 Gitea read-only inventory；review packet、decision record、state transition 與 follow-up runtime gate template 都不等於執行授權。" }, { "phase_id": "S4_migration_execution", "state": "not_started", "current_result": "GitHub primary 是長期方向；source_control_primary_readiness_gate_v1 已定義 8 個 candidate repos、7 個 in-scope blocked repos、0 個 primary ready；S4.1 已定義 workflow / secret 名稱 inventory 契約；S4.2 已補 4 個 repos、31 個 workflow files、43 個 referenced secret names 的本機 evidence，inventory_complete_count=0。", "next_gate": "Gitea authenticated inventory、refs truth、webhook / deploy key / branch protection / repository secret parity redacted evidence、rollback ADR 與逐 repo 人工批准。" } ], "next_safe_actions": [ { "action_id": "mirror_status_rollup_to_awooop", "title": "AwoooP 顯示資安供應鏈總覽", "mode": "observe", "source_contract": "security_mirror_status_rollup_v1", "allowed_processing": [ "顯示階段狀態、contract readiness、approval queue summary", "顯示下一個 gate", "寫入 audit evidence" ], "blocked_processing": [ "把 rollup 當成 runtime authorization", "新增 scan / execute / repo / refs action button", "把 LOW / MEDIUM observation 變成 blocking gate" ] }, { "action_id": "mirror_approval_review_packets", "title": "AwoooP 顯示 8 個人工審查封包", "mode": "approval_required", "source_contract": "security_approval_review_packet_v1", "allowed_processing": [ "顯示 review order、review lane、required reviewers 與 requested decision", "顯示仍然禁止事項與 follow-up runtime gate", "將人工決策另寫入 security_approval_decision_record_v1" ], "blocked_processing": [ "把 review packet 當成批准", "把 review packet 當成 execution authorization", "新增 scan / execute / repo / refs action button" ] }, { "action_id": "mirror_approval_state_transitions", "title": "AwoooP 顯示人工決策後狀態轉移", "mode": "approval_required", "source_contract": "security_approval_state_transition_v1", "allowed_processing": [ "顯示 approve/reject/defer/request_more_evidence/keep_blocked 的 next state", "顯示 approve_scope 仍需 follow-up runtime gate", "將實際決策另寫入 security_approval_decision_record_v1" ], "blocked_processing": [ "把 state transition 當成執行命令", "批准後立即執行 scan / execute / repo / refs 動作", "把 LOW / MEDIUM observation 變成 blocking gate" ] }, { "action_id": "mirror_followup_runtime_gate_templates", "title": "AwoooP 顯示後續 runtime gate 準備模板", "mode": "approval_required", "source_contract": "security_followup_runtime_gate_v1", "allowed_processing": [ "顯示 minimum evidence、preflight checks 與 rollback/disable requirement", "顯示 active_runtime_gates=0", "提醒 approve_scope 後仍需獨立 runtime gate" ], "blocked_processing": [ "啟用 runtime gate", "新增 scan / execute / repo / refs action button", "把 template 當成執行授權" ] }, { "action_id": "review_redacted_finding_ingestion", "title": "先審 redacted finding ingestion adapter", "mode": "approval_required", "source_contract": "security_approval_queue_v1", "allowed_processing": [ "依 security_approval_gate_v1 人工審查是否可設計 redacted security_finding_v1 ingestion", "依 security_approval_decision_record_v1 記錄人工決策", "維持只接收摘要與 evidence_ref", "保留 patch-only / review gate" ], "blocked_processing": [ "保存 raw secret/token/cookie/private key/exploit payload", "讓 AwoooP 直接啟動 scan", "自動修復或自動封鎖 deploy" ] }, { "action_id": "review_gitea_readonly_inventory", "title": "審查 Gitea private/internal 只讀 inventory", "mode": "approval_required", "source_contract": "gitea_repo_inventory_v1", "allowed_processing": [ "使用 read-only token 或 redacted admin export 補齊 repo list", "只保存 token_present=true/false", "更新 migration matrix 與 decision table" ], "blocked_processing": [ "保存 token value", "使用 write-capable token", "建立 GitHub repo 或 sync refs" ] }, { "action_id": "review_github_target_decisions", "title": "逐 repo 審 GitHub target / owner / visibility / canonical", "mode": "approval_required", "source_contract": "source_control_approval_board_v1", "allowed_processing": [ "逐 repo 更新 owner / visibility / canonical decision", "產生 draft reconcile plan 或 ADR", "維持 refs action disabled" ], "blocked_processing": [ "建立 repo", "修改 visibility", "push / delete refs", "切 GitHub primary" ] }, { "action_id": "review_github_primary_readiness_gate", "title": "審查 GitHub primary readiness blockers", "mode": "approval_required", "source_contract": "source_control_primary_readiness_gate_v1", "allowed_processing": [ "顯示 7 個 in-scope repos 仍 blocked", "顯示 Gitea inventory、refs truth、workflow/secret name parity 與 rollback ADR 缺口", "要求 repo owner 補 owner / visibility / canonical 決策" ], "blocked_processing": [ "建立 GitHub repo", "sync refs", "切 GitHub primary", "停用或封存 Gitea repo" ] }, { "action_id": "review_workflow_secret_name_inventory", "title": "審查 workflow / secret 名稱 inventory 缺口", "mode": "approval_required", "source_contract": "source_control_workflow_secret_name_inventory_v1", "allowed_processing": [ "顯示 8 個 candidate repos 的 inventory lanes 與 4 個 repos 的 local evidence", "要求 repo owner 補 redacted workflow / webhook / runner / deploy key / branch protection / CODEOWNERS / secret 名稱 snapshot", "只保存 secret name、owner 與 present/absent metadata，不保存 value" ], "blocked_processing": [ "收集或保存 secret value", "修改 workflow 或 webhook", "rotate secret", "sync refs 或切 GitHub primary" ] }, { "action_id": "keep_kali_execute_blocked", "title": "Kali /execute 維持 block candidate", "mode": "block_candidate", "source_contract": "kali_scan_scope_approval_v1", "allowed_processing": [ "只設計 disable / allowlist / audit gate", "保留人工 exception 記錄", "持續顯示 blocked reason" ], "blocked_processing": [ "AwoooP runtime 直接呼叫 /execute", "把 /execute 當成一般 MCP action", "執行 shell command 自動修復" ] } ], "session_sync_notes": [ "本 rollup 是跨 Session 的共同讀取入口，避免 AwoooP 主線與 Security Supply Chain Session 對進度與 gate 判讀不一致。", "S2/S3 目前仍屬框架期；狀態與人工 gate 可見，不代表 production ingestion、scan、repo migration 或 runtime enforcement 已啟用。", "S3.1 只新增人工決策紀錄格式；決策紀錄仍維持 execution_authorized=false，不可直接跳到執行面。", "S3.2 只新增人工審查封包格式；review packet 只讓 AwoooP 顯示與準備人審，不代表批准。", "S3.3 只新增人工決策狀態轉移語義；approve_scope 只進入 waiting runtime gate，不代表可立即執行。", "S3.4 只新增後續 runtime gate 準備模板；active_runtime_gates=0，不新增 action button。", "S4.0 只新增 GitHub primary readiness gate；github_primary_ready_count=0，不新增 repo / refs / primary switch action。", "S4.1 只新增 workflow / secret 名稱 inventory 契約；workflow_secret_inventory_complete_count=0，secret_value_collection_allowed=false，不新增 workflow、secret、repo、refs 或 primary switch action。", "S4.2 只新增本機可見 workflow / CODEOWNERS / referenced secret name evidence；local_evidence_repo_count=4、workflow_file_count=31、unique_secret_name_count=43，secret_value_detected=false。" ], "forbidden_actions": [ "start_kali_scan", "call_kali_execute_endpoint", "run_credentialed_scan", "create_github_repo", "change_repo_visibility", "sync_git_refs", "switch_github_primary", "auto_merge", "production_deploy", "store_secret_token_cookie_private_key_or_exploit_payload", "turn_low_medium_observations_into_blocking_gates" ] }