{ "schema_version": "package_supply_chain_baseline_v1", "status": "repo_only_inventory_ready_needs_owner_policy", "mode": "repo_snapshot_only_no_install_no_network_no_cve_scan", "generated_at": "2026-06-15T06:20:00+08:00", "git_commit": "1ab85f51", "package_manager": "pnpm@9.0.0", "summary": { "package_json_count": 6, "pyproject_count": 4, "requirements_file_count": 2, "requirements_entry_count": 26, "requirements_unpinned_entry_count": 26, "lockfile_count": 1, "pnpm_lock_present": true, "npm_lock_present": false, "yarn_lock_present": false, "python_lockfile_count": 0, "dockerfile_count": 2, "docker_base_image_count": 3, "docker_base_digest_pinned_count": 0, "docker_copy_from_image_count": 1, "docker_copy_from_digest_pinned_count": 0, "compose_file_count": 6, "compose_image_ref_count": 16, "compose_digest_pinned_image_ref_count": 0, "gap_count": 5, "owner_response_received_count": 0, "owner_response_accepted_count": 0, "runtime_gate_count": 0, "action_button_count": 0 }, "package_json_manifests": [ { "path": "apps/web/package.json", "name": "@awoooi/web", "private": true, "package_manager": null, "dependency_count": 33, "has_scripts": true }, { "path": "package.json", "name": "awoooi", "private": true, "package_manager": "pnpm@9.0.0", "dependency_count": 5, "has_scripts": true }, { "path": "packages/eslint-config/package.json", "name": "@awoooi/eslint-config", "private": true, "package_manager": null, "dependency_count": 6, "has_scripts": false }, { "path": "packages/lewooogo-core/package.json", "name": "@awoooi/lewooogo-core", "private": true, "package_manager": null, "dependency_count": 5, "has_scripts": true }, { "path": "packages/shared-types/package.json", "name": "@awoooi/shared-types", "private": false, "package_manager": null, "dependency_count": 2, "has_scripts": true }, { "path": "packages/tsconfig/package.json", "name": "@awoooi/tsconfig", "private": true, "package_manager": null, "dependency_count": 0, "has_scripts": false } ], "pyproject_manifests": [ { "path": "apps/api/pyproject.toml", "name": "awoooi-api", "dependency_count": 33, "has_build_system": true }, { "path": "packages/lewooogo-brain/pyproject.toml", "name": "lewooogo-brain", "dependency_count": 13, "has_build_system": true }, { "path": "packages/lewooogo-data/pyproject.toml", "name": "lewooogo-data", "dependency_count": 16, "has_build_system": true }, { "path": "scripts/aider_watch_client/pyproject.toml", "name": "aider-watch-client", "dependency_count": 0, "has_build_system": true } ], "requirements_files": [ { "path": "apps/api/requirements.txt", "entry_count": 25, "pinned_entry_count": 0, "unpinned_entry_count": 25 }, { "path": "apps/sensor/requirements.txt", "entry_count": 1, "pinned_entry_count": 0, "unpinned_entry_count": 1 } ], "lockfiles": [ "pnpm-lock.yaml" ], "dockerfiles": [ { "path": "apps/api/Dockerfile", "from_images": [ "python:3.11-slim", "python:3.11-slim" ], "from_image_count": 2, "digest_pinned_from_image_count": 0, "copy_from_images": [ "ghcr.io/astral-sh/uv:0.6.9" ], "copy_from_image_count": 1, "digest_pinned_copy_from_image_count": 0 }, { "path": "apps/web/Dockerfile", "from_images": [ "node:20-alpine" ], "from_image_count": 1, "digest_pinned_from_image_count": 0, "copy_from_images": [], "copy_from_image_count": 0, "digest_pinned_copy_from_image_count": 0 } ], "compose_files": [ { "path": "apps/api/docker-compose.test.yml", "image_refs": [ "pgvector/pgvector:pg16", "redis:7-alpine", "python:3.11-slim" ], "image_ref_count": 3, "digest_pinned_image_ref_count": 0 }, { "path": "docker-compose.yml", "image_refs": [ "postgres:16-alpine", "redis:7-alpine" ], "image_ref_count": 2, "digest_pinned_image_ref_count": 0 }, { "path": "infra/langfuse/docker-compose.yml", "image_refs": [ "langfuse/langfuse:2", "postgres:15-alpine" ], "image_ref_count": 2, "digest_pinned_image_ref_count": 0 }, { "path": "k8s/monitoring/docker-compose-110.yml", "image_refs": [ "gcr.io/cadvisor/cadvisor:latest", "prom/prometheus:latest", "grafana/grafana:latest", "prom/blackbox-exporter:latest", "prom/alertmanager:latest", "promhippie/github-exporter:latest" ], "image_ref_count": 6, "digest_pinned_image_ref_count": 0 }, { "path": "ops/monitoring/docker-compose.exporters.yaml", "image_refs": [ "prometheuscommunity/postgres-exporter:v0.15.0", "oliver006/redis_exporter:v1.58.0" ], "image_ref_count": 2, "digest_pinned_image_ref_count": 0 }, { "path": "ops/sentry-self-hosted/docker-compose.yml", "image_refs": [ "alpine:latest" ], "image_ref_count": 1, "digest_pinned_image_ref_count": 0 } ], "gaps": [ "python_lockfile_absent", "docker_base_images_not_all_digest_pinned", "docker_copy_from_images_not_all_digest_pinned", "compose_images_not_all_digest_pinned", "requirements_unpinned_entries_present" ], "next_owner_evidence_fields": [ "package_manager_policy", "lockfile_owner", "python_lock_policy", "docker_base_image_policy", "compose_image_policy", "registry_owner", "cve_scan_window", "rollback_owner" ], "execution_boundaries": { "package_install_authorized": false, "dependency_upgrade_authorized": false, "lockfile_rewrite_authorized": false, "npm_audit_authorized": false, "pip_audit_authorized": false, "cve_scan_authorized": false, "docker_build_authorized": false, "docker_pull_authorized": false, "docker_push_authorized": false, "image_tag_change_authorized": false, "image_digest_pin_change_authorized": false, "registry_login_authorized": false, "secret_value_collection_allowed": false, "workflow_modification_authorized": false, "production_deploy_authorized": false, "runtime_gate_count": 0, "action_button_count": 0, "not_authorization": true }, "operator_interpretation": [ "此 baseline 只代表 repo 供應鏈來源盤點，不代表 CVE / license / SBOM 已驗收。", "Docker image 未全數 digest pinning 是 policy gap，不在本輪自動改 image tag。", "Python lockfile 缺口是 owner policy gap，不在本輪自動產生 lockfile。", "不得把此 snapshot 當成 install、upgrade、docker pull、registry login 或 deploy 授權。" ] }