wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity
Files
main
awoooi/docs/security/public-gateway-redacted-export-intake-preflight.snapshot.json

446 lines
18 KiB
JSON
Raw Permalink Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"execution_boundaries": {
"action_buttons_allowed": false,
"certbot_renew_authorized": false,
"dns_query_executed": false,
"host_live_conf_read_authorized": false,
"live_tls_probe_executed": false,
"nginx_reload_authorized": false,
"nginx_reload_executed": false,
"nginx_test_authorized": false,
"nginx_test_executed": false,
"not_authorization": true,
"production_write_authorized": false,
"raw_live_conf_storage_allowed": false,
"recipient_confirmed": false,
"redacted_export_received": false,
"rendered_diff_authorized": false,
"request_sent": false,
"route_smoke_authorized": false,
"route_smoke_executed": false,
"runtime_execution_authorized": false,
"secret_value_collection_allowed": false,
"ssh_read_authorized": false
},
"generated_at": "2026-06-14T19:35:00+08:00",
"git_commit": "5068654d",
"intake_candidates": [
{
"accepted_redacted_export": false,
"action_buttons_allowed": false,
"config_id": "host188_all_sites",
"control_tier": "C0",
"export_request_id": "public_gateway_live_conf_export:host188_all_sites",
"host": "192.168.0.188",
"intake_fields": [
"intake_id",
"export_request_id",
"config_id",
"control_tier",
"redacted_live_conf_ref",
"ref_owner_role_or_team",
"received_metadata_ref",
"sensitive_payload_review",
"quarantine_ref",
"rendered_diff_candidate_ref",
"not_approval"
],
"intake_id": "public_gateway_redacted_export_intake:host188_all_sites",
"live_path": "/etc/nginx/sites-enabled/all-sites.conf",
"nginx_reload_authorized": false,
"nginx_test_authorized": false,
"nginx_test_executed": false,
"not_approval": true,
"owner_gate": "public_gateway_owner_response_required",
"production_write_authorized": false,
"quarantine_ref": null,
"quarantine_written": false,
"raw_live_conf_stored": false,
"received_metadata_ref": null,
"recipient_confirmed": false,
"redacted_export_received": false,
"redacted_live_conf_ref": null,
"redaction_policy_ref": "docs/security/PUBLIC-GATEWAY-LIVE-CONF-EXPORT-REQUEST.md#3-redaction-policy",
"ref_owner_role_or_team": "pending_owner_role_or_team",
"rejected_intake": false,
"rejection_guards": [
"raw_live_conf_payload",
"tls_private_key",
"token_secret_cookie_session",
"authorization_header_or_basic_auth",
"unredacted_upstream_credential",
"db_url_or_env_dump",
"shell_history_or_private_key",
"unredacted_log_or_screenshot",
"nginx_test_execution_request",
"nginx_reload_or_route_change_request",
"dns_tls_certbot_request",
"ssh_host_write_or_runtime_request"
],
"rendered_diff_authorized": false,
"rendered_diff_candidate": false,
"rendered_diff_candidate_ref": null,
"request_sent": false,
"reviewer_intake_lanes": [
"keep_waiting_redacted_export",
"request_more_metadata",
"quarantine_sensitive_payload",
"reject_execution_request",
"ready_for_rendered_diff_preflight"
],
"role": "public_gateway_all_sites",
"route_smoke_authorized": false,
"route_smoke_executed": false,
"runtime_gate": false,
"secret_value_collection_allowed": false,
"sensitive_payload_review": "not_started",
"source_snapshot_ref": "docs/security/public-gateway-live-conf-export-request.snapshot.json",
"status": "waiting_redacted_export_ref",
"validation_checks": [
"source_export_request_snapshot_current",
"request_sent_metadata_required",
"recipient_confirmed_metadata_required",
"redacted_export_ref_required",
"raw_live_conf_payload_blocked",
"redaction_policy_attestation_required",
"secret_marker_scan_required",
"scope_matches_export_request",
"quarantine_before_storage",
"rendered_diff_gate_separate"
]
},
{
"accepted_redacted_export": false,
"action_buttons_allowed": false,
"config_id": "host188_internal_tools_https",
"control_tier": "C0",
"export_request_id": "public_gateway_live_conf_export:host188_internal_tools_https",
"host": "192.168.0.188",
"intake_fields": [
"intake_id",
"export_request_id",
"config_id",
"control_tier",
"redacted_live_conf_ref",
"ref_owner_role_or_team",
"received_metadata_ref",
"sensitive_payload_review",
"quarantine_ref",
"rendered_diff_candidate_ref",
"not_approval"
],
"intake_id": "public_gateway_redacted_export_intake:host188_internal_tools_https",
"live_path": "owner_confirmation_required",
"nginx_reload_authorized": false,
"nginx_test_authorized": false,
"nginx_test_executed": false,
"not_approval": true,
"owner_gate": "public_tools_owner_response_required",
"production_write_authorized": false,
"quarantine_ref": null,
"quarantine_written": false,
"raw_live_conf_stored": false,
"received_metadata_ref": null,
"recipient_confirmed": false,
"redacted_export_received": false,
"redacted_live_conf_ref": null,
"redaction_policy_ref": "docs/security/PUBLIC-GATEWAY-LIVE-CONF-EXPORT-REQUEST.md#3-redaction-policy",
"ref_owner_role_or_team": "pending_owner_role_or_team",
"rejected_intake": false,
"rejection_guards": [
"raw_live_conf_payload",
"tls_private_key",
"token_secret_cookie_session",
"authorization_header_or_basic_auth",
"unredacted_upstream_credential",
"db_url_or_env_dump",
"shell_history_or_private_key",
"unredacted_log_or_screenshot",
"nginx_test_execution_request",
"nginx_reload_or_route_change_request",
"dns_tls_certbot_request",
"ssh_host_write_or_runtime_request"
],
"rendered_diff_authorized": false,
"rendered_diff_candidate": false,
"rendered_diff_candidate_ref": null,
"request_sent": false,
"reviewer_intake_lanes": [
"keep_waiting_redacted_export",
"request_more_metadata",
"quarantine_sensitive_payload",
"reject_execution_request",
"ready_for_rendered_diff_preflight"
],
"role": "public_internal_tools_https",
"route_smoke_authorized": false,
"route_smoke_executed": false,
"runtime_gate": false,
"secret_value_collection_allowed": false,
"sensitive_payload_review": "not_started",
"source_snapshot_ref": "docs/security/public-gateway-live-conf-export-request.snapshot.json",
"status": "waiting_redacted_export_ref",
"validation_checks": [
"source_export_request_snapshot_current",
"request_sent_metadata_required",
"recipient_confirmed_metadata_required",
"redacted_export_ref_required",
"raw_live_conf_payload_blocked",
"redaction_policy_attestation_required",
"secret_marker_scan_required",
"scope_matches_export_request",
"quarantine_before_storage",
"rendered_diff_gate_separate"
]
},
{
"accepted_redacted_export": false,
"action_buttons_allowed": false,
"config_id": "host110_ollama_proxy",
"control_tier": "C1",
"export_request_id": "public_gateway_live_conf_export:host110_ollama_proxy",
"host": "192.168.0.110",
"intake_fields": [
"intake_id",
"export_request_id",
"config_id",
"control_tier",
"redacted_live_conf_ref",
"ref_owner_role_or_team",
"received_metadata_ref",
"sensitive_payload_review",
"quarantine_ref",
"rendered_diff_candidate_ref",
"not_approval"
],
"intake_id": "public_gateway_redacted_export_intake:host110_ollama_proxy",
"live_path": "/etc/nginx/sites-enabled/110-ollama-proxy.conf",
"nginx_reload_authorized": false,
"nginx_test_authorized": false,
"nginx_test_executed": false,
"not_approval": true,
"owner_gate": "ai_provider_proxy_owner_response_required",
"production_write_authorized": false,
"quarantine_ref": null,
"quarantine_written": false,
"raw_live_conf_stored": false,
"received_metadata_ref": null,
"recipient_confirmed": false,
"redacted_export_received": false,
"redacted_live_conf_ref": null,
"redaction_policy_ref": "docs/security/PUBLIC-GATEWAY-LIVE-CONF-EXPORT-REQUEST.md#3-redaction-policy",
"ref_owner_role_or_team": "pending_owner_role_or_team",
"rejected_intake": false,
"rejection_guards": [
"raw_live_conf_payload",
"tls_private_key",
"token_secret_cookie_session",
"authorization_header_or_basic_auth",
"unredacted_upstream_credential",
"db_url_or_env_dump",
"shell_history_or_private_key",
"unredacted_log_or_screenshot",
"nginx_test_execution_request",
"nginx_reload_or_route_change_request",
"dns_tls_certbot_request",
"ssh_host_write_or_runtime_request"
],
"rendered_diff_authorized": false,
"rendered_diff_candidate": false,
"rendered_diff_candidate_ref": null,
"request_sent": false,
"reviewer_intake_lanes": [
"keep_waiting_redacted_export",
"request_more_metadata",
"quarantine_sensitive_payload",
"reject_execution_request",
"ready_for_rendered_diff_preflight"
],
"role": "ollama_proxy_gateway",
"route_smoke_authorized": false,
"route_smoke_executed": false,
"runtime_gate": false,
"secret_value_collection_allowed": false,
"sensitive_payload_review": "not_started",
"source_snapshot_ref": "docs/security/public-gateway-live-conf-export-request.snapshot.json",
"status": "waiting_redacted_export_ref",
"validation_checks": [
"source_export_request_snapshot_current",
"request_sent_metadata_required",
"recipient_confirmed_metadata_required",
"redacted_export_ref_required",
"raw_live_conf_payload_blocked",
"redaction_policy_attestation_required",
"secret_marker_scan_required",
"scope_matches_export_request",
"quarantine_before_storage",
"rendered_diff_gate_separate"
]
}
],
"intake_fields": [
"intake_id",
"export_request_id",
"config_id",
"control_tier",
"redacted_live_conf_ref",
"ref_owner_role_or_team",
"received_metadata_ref",
"sensitive_payload_review",
"quarantine_ref",
"rendered_diff_candidate_ref",
"not_approval"
],
"next_steps": [
"只有收到可稽核 request sent metadata 與 owner-provided redacted export ref 後，才能另建收件紀錄。",
"任何疑似 raw conf 或 sensitive payload 必須先 quarantine，不得寫入 repo、LOGBOOK 或前端。",
"收件通過後仍只能進 rendered diff preflight；nginx -t、reload、route smoke 需另行人工批准。"
],
"rejection_guards": [
"raw_live_conf_payload",
"tls_private_key",
"token_secret_cookie_session",
"authorization_header_or_basic_auth",
"unredacted_upstream_credential",
"db_url_or_env_dump",
"shell_history_or_private_key",
"unredacted_log_or_screenshot",
"nginx_test_execution_request",
"nginx_reload_or_route_change_request",
"dns_tls_certbot_request",
"ssh_host_write_or_runtime_request"
],
"reviewer_intake_lanes": [
{
"gate_effect": "request_sent / received / accepted / rendered diff / runtime gate 全部維持 0。",
"instruction": "尚未送件、尚未確認 recipient 或尚未收到脫敏 export ref 時維持等待。",
"lane_id": "keep_waiting_redacted_export",
"status": "redacted_export_intake_lane_defined"
},
{
"gate_effect": "不得保存 raw payload，不得增加 accepted。",
"instruction": "缺 owner role、received metadata ref、scope 對應、redaction attestation 或 followup owner 時補件。",
"lane_id": "request_more_metadata",
"status": "redacted_export_intake_lane_defined"
},
{
"gate_effect": "只可留下 quarantine metadata，不得寫入 repo、LOGBOOK 或前端。",
"instruction": "疑似含敏感 payload、raw conf、未脫敏 log 或 credential URL 時隔離。",
"lane_id": "quarantine_sensitive_payload",
"status": "redacted_export_intake_lane_defined"
},
{
"gate_effect": "不得轉成 action button 或 runtime approval。",
"instruction": "夾帶 nginx -t、reload、route smoke、DNS / TLS、certbot、SSH 或 host write 要求時拒收。",
"lane_id": "reject_execution_request",
"status": "redacted_export_intake_lane_defined"
},
{
"gate_effect": "仍不是 rendered diff ready，也不是 nginx / route / runtime 授權。",
"instruction": "欄位完整、只有脫敏 ref、無敏感 payload 且無執行要求時，才可進 rendered diff preflight。",
"lane_id": "ready_for_rendered_diff_preflight",
"status": "redacted_export_intake_lane_defined"
}
],
"schema_version": "public_gateway_redacted_export_intake_preflight_v1",
"source_export_request_schema_version": "public_gateway_live_conf_export_request_v1",
"source_export_request_status": "live_conf_export_request_ready_not_dispatched",
"status": "redacted_export_intake_preflight_ready_no_payload_received",
"summary": {
"accepted_redacted_export_count": 0,
"action_button_count": 0,
"c0_intake_candidate_count": 2,
"c1_intake_candidate_count": 1,
"intake_candidate_count": 3,
"intake_field_count": 11,
"nginx_reload_authorized_count": 0,
"nginx_test_authorized_count": 0,
"nginx_test_executed_count": 0,
"quarantined_payload_count": 0,
"raw_live_conf_stored_count": 0,
"recipient_confirmed_count": 0,
"redacted_export_received_count": 0,
"rejected_intake_count": 0,
"rejection_guard_count": 12,
"rendered_diff_candidate_count": 0,
"request_sent_count": 0,
"reviewer_intake_lane_count": 5,
"route_smoke_authorized_count": 0,
"route_smoke_executed_count": 0,
"runtime_gate_count": 0,
"validation_check_count": 10
},
"validation_checks": [
{
"check_id": "source_export_request_snapshot_current",
"gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
"instruction": "來源匯出請求 snapshot 必須是 committed 最新版本。",
"required": true,
"status": "required_before_redacted_export_intake"
},
{
"check_id": "request_sent_metadata_required",
"gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
"instruction": "沒有可稽核 request sent metadata 時，不得標記 received。",
"required": true,
"status": "required_before_redacted_export_intake"
},
{
"check_id": "recipient_confirmed_metadata_required",
"gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
"instruction": "沒有 owner / recipient role 確認時，不得標記 recipient confirmed。",
"required": true,
"status": "required_before_redacted_export_intake"
},
{
"check_id": "redacted_export_ref_required",
"gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
"instruction": "只接受脫敏 export ref；不得貼 raw live conf 內容。",
"required": true,
"status": "required_before_redacted_export_intake"
},
{
"check_id": "raw_live_conf_payload_blocked",
"gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
"instruction": "若內容含完整 live conf、私鑰、token、cookie、session 或 authorization header，必須拒收或隔離。",
"required": true,
"status": "required_before_redacted_export_intake"
},
{
"check_id": "redaction_policy_attestation_required",
"gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
"instruction": "owner 需聲明已依 redaction policy 處理 upstream credential、secret path 與敏感 payload。",
"required": true,
"status": "required_before_redacted_export_intake"
},
{
"check_id": "secret_marker_scan_required",
"gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
"instruction": "任何可存入 repo 的 metadata 必須先通過 secret marker / sensitive marker 檢查。",
"required": true,
"status": "required_before_redacted_export_intake"
},
{
"check_id": "scope_matches_export_request",
"gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
"instruction": "host、config_id、live path metadata 必須與匯出請求一致；不一致先補件。",
"required": true,
"status": "required_before_redacted_export_intake"
},
{
"check_id": "quarantine_before_storage",
"gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
"instruction": "疑似敏感 payload 只可留下 quarantine metadata，不得寫入 LOGBOOK、前端或 repo artifact。",
"required": true,
"status": "required_before_redacted_export_intake"
},
{
"check_id": "rendered_diff_gate_separate",
"gate_effect": "不增加 received / accepted / rendered diff / runtime gate。",
"instruction": "收件通過只代表可進 rendered diff preflight，不授權 nginx -t、reload 或 route smoke。",
"required": true,
"status": "required_before_redacted_export_intake"
}
]
}
Reference in New Issue View Git Blame Copy Permalink