199 lines
8.0 KiB
JSON
199 lines
8.0 KiB
JSON
{
|
||
"schema_version": "security_rollout_policy_v1",
|
||
"status": "draft",
|
||
"default_mode": "observe",
|
||
"enforcement_level": "mirror_only",
|
||
"non_blocking_escalation_lane_count": 7,
|
||
"non_blocking_escalation_lanes": [
|
||
{
|
||
"lane_id": "lane-low-medium-observation",
|
||
"display_order": 1,
|
||
"trigger": "LOW / MEDIUM finding 且不涉及不可逆變更、secret value、repo / refs / deploy / primary control plane。",
|
||
"initial_mode": "warn",
|
||
"allowed_action": "標記風險、建立 follow-up、補 evidence_ref 或準備草案。",
|
||
"forbidden_escalation": "不得阻擋 deploy、不得自動 patch、不得自動 merge、不得建立 runtime blocker。",
|
||
"owner_review_required_before_blocking": true,
|
||
"runtime_blocking_allowed": false,
|
||
"awooop_display_mode": "display_low_friction_non_blocking_lane_only",
|
||
"not_authorization": true
|
||
},
|
||
{
|
||
"lane_id": "lane-owner-response-missing",
|
||
"display_order": 2,
|
||
"trigger": "S4.9 / S4.10 / S4.11 / S4.12 owner response 尚未收到或尚未 accepted。",
|
||
"initial_mode": "observe",
|
||
"allowed_action": "顯示 missing lane、next collection candidate、template status 與 request packet。",
|
||
"forbidden_escalation": "不得把未回覆當成拒絕、不得停止產品流程、不得自動補 owner response。",
|
||
"owner_review_required_before_blocking": true,
|
||
"runtime_blocking_allowed": false,
|
||
"awooop_display_mode": "display_low_friction_non_blocking_lane_only",
|
||
"not_authorization": true
|
||
},
|
||
{
|
||
"lane_id": "lane-mirror-data-incomplete",
|
||
"display_order": 3,
|
||
"trigger": "mirror snapshot、redacted payload 或 contract coverage 不完整，但未涉及 raw secret / token / exploit payload。",
|
||
"initial_mode": "warn",
|
||
"allowed_action": "顯示 partial / quarantine reason、要求補 redacted snapshot、保留 retry gate。",
|
||
"forbidden_escalation": "不得阻擋無關 runtime、不得把 partial mirror 當 production incident、不得吞入未脫敏 payload。",
|
||
"owner_review_required_before_blocking": true,
|
||
"runtime_blocking_allowed": false,
|
||
"awooop_display_mode": "display_low_friction_non_blocking_lane_only",
|
||
"not_authorization": true
|
||
},
|
||
{
|
||
"lane_id": "lane-source-control-drift-draft",
|
||
"display_order": 4,
|
||
"trigger": "GitHub / Gitea refs、target、visibility 或 canonical decision 存在差異，但尚未 owner approved。",
|
||
"initial_mode": "warn",
|
||
"allowed_action": "維持 draft reconcile plan、ADR、read-only diff 與 owner review lane。",
|
||
"forbidden_escalation": "不得 sync refs、delete refs、force push、建立 repo、修改 visibility 或切 GitHub primary。",
|
||
"owner_review_required_before_blocking": true,
|
||
"runtime_blocking_allowed": false,
|
||
"awooop_display_mode": "display_low_friction_non_blocking_lane_only",
|
||
"not_authorization": true
|
||
},
|
||
{
|
||
"lane_id": "lane-kali-observe-finding",
|
||
"display_order": 5,
|
||
"trigger": "Kali finding 或 scan scope 仍在 observe / approval package 階段。",
|
||
"initial_mode": "warn",
|
||
"allowed_action": "只顯示 redacted finding summary、evidence_ref、scan scope approval candidate 與 block reason。",
|
||
"forbidden_escalation": "不得自動啟動 active scan、不得呼叫 /execute、不得把 finding 直接變 deploy blocker。",
|
||
"owner_review_required_before_blocking": true,
|
||
"runtime_blocking_allowed": false,
|
||
"awooop_display_mode": "display_low_friction_non_blocking_lane_only",
|
||
"not_authorization": true
|
||
},
|
||
{
|
||
"lane_id": "lane-workflow-secret-name-gap",
|
||
"display_order": 6,
|
||
"trigger": "workflow、webhook、runner、deploy key、branch protection、CODEOWNERS 或 secret 名稱 parity 尚缺 redacted evidence。",
|
||
"initial_mode": "warn",
|
||
"allowed_action": "要求 redacted export、顯示 owner response template 與只讀 readiness blocker wording。",
|
||
"forbidden_escalation": "不得收集 secret value、不得啟用 GitHub hosted runner、不得修改 workflow / webhook / repository secret。",
|
||
"owner_review_required_before_blocking": true,
|
||
"runtime_blocking_allowed": false,
|
||
"awooop_display_mode": "display_low_friction_non_blocking_lane_only",
|
||
"not_authorization": true
|
||
},
|
||
{
|
||
"lane_id": "lane-progress-display-holding",
|
||
"display_order": 7,
|
||
"trigger": "headline progress 維持 58%，但 framework detail ledger 持續增加。",
|
||
"initial_mode": "observe",
|
||
"allowed_action": "顯示 micro progress、latest delta、not_authorization 與下一個高層 gate。",
|
||
"forbidden_escalation": "不得把 progress holding 解讀成卡住、不得把 micro progress 當 runtime approval。",
|
||
"owner_review_required_before_blocking": true,
|
||
"runtime_blocking_allowed": false,
|
||
"awooop_display_mode": "display_low_friction_non_blocking_lane_only",
|
||
"not_authorization": true
|
||
}
|
||
],
|
||
"allowed_awooop_outputs": [
|
||
"display_non_blocking_escalation_lanes",
|
||
"create_followup_without_blocking",
|
||
"show_owner_review_required_before_blocking",
|
||
"keep_runtime_blocking_false"
|
||
],
|
||
"policy_items": [
|
||
{
|
||
"condition": "read_only_inventory_or_evidence_mirror",
|
||
"mode": "observe",
|
||
"allowed": [
|
||
"collect_metadata",
|
||
"write_redacted_snapshot",
|
||
"update_docs",
|
||
"mirror_to_awooop_runtime_state"
|
||
],
|
||
"forbidden": [
|
||
"change_runtime",
|
||
"write_to_remote_system",
|
||
"delete_or_archive_repo",
|
||
"sync_refs"
|
||
],
|
||
"reason": "初期先建立可見性與追溯性，不阻擋產品與架構推進。"
|
||
},
|
||
{
|
||
"condition": "low_or_medium_observation_without_irreversible_change",
|
||
"mode": "warn",
|
||
"allowed": [
|
||
"label_risk",
|
||
"create_followup_item",
|
||
"add_evidence_ref",
|
||
"prepare_draft_plan"
|
||
],
|
||
"forbidden": [
|
||
"block_deploy",
|
||
"force_owner_decision",
|
||
"auto_patch",
|
||
"auto_merge"
|
||
],
|
||
"reason": "LOW / MEDIUM observation 先累積 evidence，不把日常流程變成審批地獄。"
|
||
},
|
||
{
|
||
"condition": "uses_readonly_token_or_admin_export",
|
||
"mode": "approve_required",
|
||
"allowed": [
|
||
"request_human_approval",
|
||
"run_once_after_approval",
|
||
"store_token_present_boolean_only",
|
||
"write_redacted_inventory"
|
||
],
|
||
"forbidden": [
|
||
"store_token_value",
|
||
"reuse_write_token",
|
||
"write_to_gitea",
|
||
"create_repo"
|
||
],
|
||
"reason": "只讀 token 與管理匯出會碰敏感邊界，需 approval，但仍不授權任何同步或寫入。"
|
||
},
|
||
{
|
||
"condition": "repo_creation_visibility_change_or_refs_sync",
|
||
"mode": "approve_required",
|
||
"allowed": [
|
||
"create_approval_candidate",
|
||
"prepare_migration_plan",
|
||
"prepare_rollback_plan"
|
||
],
|
||
"forbidden": [
|
||
"execute_without_owner_approval",
|
||
"push_refs",
|
||
"change_visibility",
|
||
"switch_primary"
|
||
],
|
||
"reason": "這些動作會改供應鏈控制面，必須逐 repo 核准。"
|
||
},
|
||
{
|
||
"condition": "secret_rbac_network_firewall_deploy_or_primary_switch",
|
||
"mode": "approve_required",
|
||
"allowed": [
|
||
"create_approval_required_event",
|
||
"prepare_dry_run_plan",
|
||
"define_rollback"
|
||
],
|
||
"forbidden": [
|
||
"auto_execute",
|
||
"store_secret_value",
|
||
"skip_human_review"
|
||
],
|
||
"reason": "這些動作有生產、權限或安全 blast radius，不進入初期自動化。"
|
||
},
|
||
{
|
||
"condition": "destructive_action_without_rollback_or_secret_value_storage",
|
||
"mode": "block_candidate",
|
||
"allowed": [
|
||
"record_block_reason",
|
||
"request_manual_exception"
|
||
],
|
||
"forbidden": [
|
||
"force_push",
|
||
"delete_repo",
|
||
"store_raw_secret",
|
||
"disable_audit"
|
||
],
|
||
"reason": "不可逆且無 rollback 的動作不屬於初期框架建置範圍。"
|
||
}
|
||
]
|
||
}
|