wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity
Files
5343d4627bc0c765e6045eb0ecdb5b55869fb310
awoooi/docs/security/public-gateway-owner-response-acceptance.snapshot.json

611 lines
21 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
{
"acceptance_candidates": [
{
"acceptance_candidate_id": "public_gateway_owner_response_acceptance:host188_all_sites",
"acceptance_fields": [
"acceptance_candidate_id",
"diff_gate_id",
"intake_id",
"export_request_id",
"config_id",
"control_tier",
"host",
"live_path",
"owner_response_ref",
"owner_role_or_team",
"decision",
"decision_reason",
"affected_routes",
"redacted_live_conf_ref",
"source_to_live_rendered_diff_ref",
"nginx_test_plan_ref",
"route_smoke_plan_ref",
"maintenance_window",
"rollback_owner",
"postcheck_plan",
"reviewer_outcome",
"followup_owner",
"not_approval"
],
"accepted_redacted_export": false,
"action_buttons_allowed": false,
"affected_routes": [],
"blocked_actions": [
"read_live_conf_over_ssh",
"store_raw_live_conf",
"accept_unredacted_live_conf",
"collect_secret_value",
"render_diff_from_unredacted_payload",
"mark_owner_response_accepted_without_reviewer_record",
"nginx_test_without_separate_approval",
"nginx_reload_without_separate_approval",
"route_smoke_without_matrix",
"dns_probe_without_approval",
"tls_probe_without_approval",
"certbot_renew_without_approval",
"modify_nginx_conf",
"modify_dns_tls_config",
"change_public_route",
"write_production_host",
"open_runtime_gate",
"add_action_button"
],
"certbot_renew_authorized": false,
"config_id": "host188_all_sites",
"control_tier": "C0",
"decision": "pending_owner_response",
"decision_reason": "pending_owner_response",
"diff_gate_id": "public_gateway_rendered_diff_gate:host188_all_sites",
"dns_tls_probe_authorized": false,
"export_request_id": "public_gateway_live_conf_export:host188_all_sites",
"followup_owner": "pending_owner_response",
"host": "192.168.0.188",
"intake_id": "public_gateway_redacted_export_intake:host188_all_sites",
"live_path": "/etc/nginx/sites-enabled/all-sites.conf",
"maintenance_window": "pending_owner_response",
"maintenance_window_accepted": false,
"nginx_reload_authorized": false,
"nginx_reload_executed": false,
"nginx_test_authorized": false,
"nginx_test_executed": false,
"nginx_test_plan_ref": null,
"not_approval": true,
"outcome_lanes": [
"waiting_owner_response",
"quarantine_raw_payload",
"reject_secret_or_unredacted_conf",
"request_supplement",
"ready_for_rendered_diff_review",
"owner_review_only_update",
"waiting_runtime_gate"
],
"owner_response_accepted": false,
"owner_response_quarantined": false,
"owner_response_received": false,
"owner_response_ref": null,
"owner_response_rejected": false,
"owner_role_or_team": "pending_owner_response",
"postcheck_plan": "pending_owner_response",
"production_write_authorized": false,
"recipient_confirmed": false,
"redacted_export_received": false,
"redacted_live_conf_ref": null,
"rendered_diff_candidate": false,
"rendered_diff_ready": false,
"request_sent": false,
"required_owner_response_fields": [
"owner_role_or_team",
"decision",
"decision_reason",
"affected_routes",
"redacted_live_conf_ref",
"source_to_live_rendered_diff_ref",
"nginx_test_plan_ref",
"route_smoke_plan_ref",
"maintenance_window",
"rollback_owner",
"postcheck_plan",
"followup_owner"
],
"reviewer_checks": [
"owner_identity_present",
"decision_reason_present",
"redacted_refs_only",
"raw_conf_absent",
"secret_value_absent",
"route_scope_matches_snapshot",
"rendered_diff_ref_not_payload",
"nginx_test_separate_approval",
"route_smoke_plan_present",
"maintenance_window_present",
"rollback_owner_present",
"counts_transition_safe"
],
"reviewer_outcome": "waiting_owner_response",
"rollback_owner": "pending_owner_response",
"rollback_owner_accepted": false,
"route_smoke_authorized": false,
"route_smoke_executed": false,
"route_smoke_plan_ref": null,
"runtime_gate": false,
"source_to_live_rendered_diff_ref": null,
"status": "waiting_owner_response",
"supplement_requested": false
},
{
"acceptance_candidate_id": "public_gateway_owner_response_acceptance:host188_internal_tools_https",
"acceptance_fields": [
"acceptance_candidate_id",
"diff_gate_id",
"intake_id",
"export_request_id",
"config_id",
"control_tier",
"host",
"live_path",
"owner_response_ref",
"owner_role_or_team",
"decision",
"decision_reason",
"affected_routes",
"redacted_live_conf_ref",
"source_to_live_rendered_diff_ref",
"nginx_test_plan_ref",
"route_smoke_plan_ref",
"maintenance_window",
"rollback_owner",
"postcheck_plan",
"reviewer_outcome",
"followup_owner",
"not_approval"
],
"accepted_redacted_export": false,
"action_buttons_allowed": false,
"affected_routes": [],
"blocked_actions": [
"read_live_conf_over_ssh",
"store_raw_live_conf",
"accept_unredacted_live_conf",
"collect_secret_value",
"render_diff_from_unredacted_payload",
"mark_owner_response_accepted_without_reviewer_record",
"nginx_test_without_separate_approval",
"nginx_reload_without_separate_approval",
"route_smoke_without_matrix",
"dns_probe_without_approval",
"tls_probe_without_approval",
"certbot_renew_without_approval",
"modify_nginx_conf",
"modify_dns_tls_config",
"change_public_route",
"write_production_host",
"open_runtime_gate",
"add_action_button"
],
"certbot_renew_authorized": false,
"config_id": "host188_internal_tools_https",
"control_tier": "C0",
"decision": "pending_owner_response",
"decision_reason": "pending_owner_response",
"diff_gate_id": "public_gateway_rendered_diff_gate:host188_internal_tools_https",
"dns_tls_probe_authorized": false,
"export_request_id": "public_gateway_live_conf_export:host188_internal_tools_https",
"followup_owner": "pending_owner_response",
"host": "192.168.0.188",
"intake_id": "public_gateway_redacted_export_intake:host188_internal_tools_https",
"live_path": "owner_confirmation_required",
"maintenance_window": "pending_owner_response",
"maintenance_window_accepted": false,
"nginx_reload_authorized": false,
"nginx_reload_executed": false,
"nginx_test_authorized": false,
"nginx_test_executed": false,
"nginx_test_plan_ref": null,
"not_approval": true,
"outcome_lanes": [
"waiting_owner_response",
"quarantine_raw_payload",
"reject_secret_or_unredacted_conf",
"request_supplement",
"ready_for_rendered_diff_review",
"owner_review_only_update",
"waiting_runtime_gate"
],
"owner_response_accepted": false,
"owner_response_quarantined": false,
"owner_response_received": false,
"owner_response_ref": null,
"owner_response_rejected": false,
"owner_role_or_team": "pending_owner_response",
"postcheck_plan": "pending_owner_response",
"production_write_authorized": false,
"recipient_confirmed": false,
"redacted_export_received": false,
"redacted_live_conf_ref": null,
"rendered_diff_candidate": false,
"rendered_diff_ready": false,
"request_sent": false,
"required_owner_response_fields": [
"owner_role_or_team",
"decision",
"decision_reason",
"affected_routes",
"redacted_live_conf_ref",
"source_to_live_rendered_diff_ref",
"nginx_test_plan_ref",
"route_smoke_plan_ref",
"maintenance_window",
"rollback_owner",
"postcheck_plan",
"followup_owner"
],
"reviewer_checks": [
"owner_identity_present",
"decision_reason_present",
"redacted_refs_only",
"raw_conf_absent",
"secret_value_absent",
"route_scope_matches_snapshot",
"rendered_diff_ref_not_payload",
"nginx_test_separate_approval",
"route_smoke_plan_present",
"maintenance_window_present",
"rollback_owner_present",
"counts_transition_safe"
],
"reviewer_outcome": "waiting_owner_response",
"rollback_owner": "pending_owner_response",
"rollback_owner_accepted": false,
"route_smoke_authorized": false,
"route_smoke_executed": false,
"route_smoke_plan_ref": null,
"runtime_gate": false,
"source_to_live_rendered_diff_ref": null,
"status": "waiting_owner_response",
"supplement_requested": false
},
{
"acceptance_candidate_id": "public_gateway_owner_response_acceptance:host110_ollama_proxy",
"acceptance_fields": [
"acceptance_candidate_id",
"diff_gate_id",
"intake_id",
"export_request_id",
"config_id",
"control_tier",
"host",
"live_path",
"owner_response_ref",
"owner_role_or_team",
"decision",
"decision_reason",
"affected_routes",
"redacted_live_conf_ref",
"source_to_live_rendered_diff_ref",
"nginx_test_plan_ref",
"route_smoke_plan_ref",
"maintenance_window",
"rollback_owner",
"postcheck_plan",
"reviewer_outcome",
"followup_owner",
"not_approval"
],
"accepted_redacted_export": false,
"action_buttons_allowed": false,
"affected_routes": [],
"blocked_actions": [
"read_live_conf_over_ssh",
"store_raw_live_conf",
"accept_unredacted_live_conf",
"collect_secret_value",
"render_diff_from_unredacted_payload",
"mark_owner_response_accepted_without_reviewer_record",
"nginx_test_without_separate_approval",
"nginx_reload_without_separate_approval",
"route_smoke_without_matrix",
"dns_probe_without_approval",
"tls_probe_without_approval",
"certbot_renew_without_approval",
"modify_nginx_conf",
"modify_dns_tls_config",
"change_public_route",
"write_production_host",
"open_runtime_gate",
"add_action_button"
],
"certbot_renew_authorized": false,
"config_id": "host110_ollama_proxy",
"control_tier": "C1",
"decision": "pending_owner_response",
"decision_reason": "pending_owner_response",
"diff_gate_id": "public_gateway_rendered_diff_gate:host110_ollama_proxy",
"dns_tls_probe_authorized": false,
"export_request_id": "public_gateway_live_conf_export:host110_ollama_proxy",
"followup_owner": "pending_owner_response",
"host": "192.168.0.110",
"intake_id": "public_gateway_redacted_export_intake:host110_ollama_proxy",
"live_path": "/etc/nginx/sites-enabled/110-ollama-proxy.conf",
"maintenance_window": "pending_owner_response",
"maintenance_window_accepted": false,
"nginx_reload_authorized": false,
"nginx_reload_executed": false,
"nginx_test_authorized": false,
"nginx_test_executed": false,
"nginx_test_plan_ref": null,
"not_approval": true,
"outcome_lanes": [
"waiting_owner_response",
"quarantine_raw_payload",
"reject_secret_or_unredacted_conf",
"request_supplement",
"ready_for_rendered_diff_review",
"owner_review_only_update",
"waiting_runtime_gate"
],
"owner_response_accepted": false,
"owner_response_quarantined": false,
"owner_response_received": false,
"owner_response_ref": null,
"owner_response_rejected": false,
"owner_role_or_team": "pending_owner_response",
"postcheck_plan": "pending_owner_response",
"production_write_authorized": false,
"recipient_confirmed": false,
"redacted_export_received": false,
"redacted_live_conf_ref": null,
"rendered_diff_candidate": false,
"rendered_diff_ready": false,
"request_sent": false,
"required_owner_response_fields": [
"owner_role_or_team",
"decision",
"decision_reason",
"affected_routes",
"redacted_live_conf_ref",
"source_to_live_rendered_diff_ref",
"nginx_test_plan_ref",
"route_smoke_plan_ref",
"maintenance_window",
"rollback_owner",
"postcheck_plan",
"followup_owner"
],
"reviewer_checks": [
"owner_identity_present",
"decision_reason_present",
"redacted_refs_only",
"raw_conf_absent",
"secret_value_absent",
"route_scope_matches_snapshot",
"rendered_diff_ref_not_payload",
"nginx_test_separate_approval",
"route_smoke_plan_present",
"maintenance_window_present",
"rollback_owner_present",
"counts_transition_safe"
],
"reviewer_outcome": "waiting_owner_response",
"rollback_owner": "pending_owner_response",
"rollback_owner_accepted": false,
"route_smoke_authorized": false,
"route_smoke_executed": false,
"route_smoke_plan_ref": null,
"runtime_gate": false,
"source_to_live_rendered_diff_ref": null,
"status": "waiting_owner_response",
"supplement_requested": false
}
],
"acceptance_fields": [
"acceptance_candidate_id",
"diff_gate_id",
"intake_id",
"export_request_id",
"config_id",
"control_tier",
"host",
"live_path",
"owner_response_ref",
"owner_role_or_team",
"decision",
"decision_reason",
"affected_routes",
"redacted_live_conf_ref",
"source_to_live_rendered_diff_ref",
"nginx_test_plan_ref",
"route_smoke_plan_ref",
"maintenance_window",
"rollback_owner",
"postcheck_plan",
"reviewer_outcome",
"followup_owner",
"not_approval"
],
"blocked_actions": [
"read_live_conf_over_ssh",
"store_raw_live_conf",
"accept_unredacted_live_conf",
"collect_secret_value",
"render_diff_from_unredacted_payload",
"mark_owner_response_accepted_without_reviewer_record",
"nginx_test_without_separate_approval",
"nginx_reload_without_separate_approval",
"route_smoke_without_matrix",
"dns_probe_without_approval",
"tls_probe_without_approval",
"certbot_renew_without_approval",
"modify_nginx_conf",
"modify_dns_tls_config",
"change_public_route",
"write_production_host",
"open_runtime_gate",
"add_action_button"
],
"execution_boundaries": {
"action_buttons_allowed": false,
"certbot_renew_authorized": false,
"dns_tls_probe_authorized": false,
"host_live_conf_read_authorized": false,
"nginx_reload_authorized": false,
"nginx_reload_executed": false,
"nginx_test_authorized": false,
"nginx_test_executed": false,
"not_authorization": true,
"owner_response_accepted": false,
"production_write_authorized": false,
"raw_live_conf_storage_allowed": false,
"rendered_diff_authorized": false,
"request_dispatch_authorized": false,
"route_smoke_authorized": false,
"route_smoke_executed": false,
"runtime_execution_authorized": false,
"secret_value_collection_allowed": false
},
"generated_at": "2026-06-14T23:58:00+08:00",
"git_commit": "233ee934",
"next_steps": [
"等待 owner response；未收到前不得更新 accepted count。",
"收到回覆後先走 raw payload / secret / scope / evidence ref 檢查，不合格即隔離、拒收或補件。",
"metadata 合格也只能進 rendered diff reviewer review；`nginx -t`、reload、route smoke 與 production write 仍需獨立人工批准。"
],
"outcome_lanes": [
{
"lane_id": "waiting_owner_response",
"meaning": "尚未收到 owner response；所有 accepted / runtime count 維持 0。"
},
{
"lane_id": "quarantine_raw_payload",
"meaning": "收到 raw conf、payload 或不可保存內容時，只能隔離，不得進 reviewer review。"
},
{
"lane_id": "reject_secret_or_unredacted_conf",
"meaning": "出現 secret value、未脫敏 live conf 或 credential derivative 時直接拒收。"
},
{
"lane_id": "request_supplement",
"meaning": "欄位不足、scope 不清或 evidence ref 不可追溯時要求補件。"
},
{
"lane_id": "ready_for_rendered_diff_review",
"meaning": "metadata 合格後，只能進 rendered diff reviewer review，不自動執行。"
},
{
"lane_id": "owner_review_only_update",
"meaning": "只允許更新只讀 owner review ledger，不得修改 Nginx、DNS、TLS 或 workflow。"
},
{
"lane_id": "waiting_runtime_gate",
"meaning": "即使 owner response accepted，runtime gate 仍等待獨立人工批准。"
}
],
"required_owner_response_fields": [
"owner_role_or_team",
"decision",
"decision_reason",
"affected_routes",
"redacted_live_conf_ref",
"source_to_live_rendered_diff_ref",
"nginx_test_plan_ref",
"route_smoke_plan_ref",
"maintenance_window",
"rollback_owner",
"postcheck_plan",
"followup_owner"
],
"reviewer_checks": [
{
"check_id": "owner_identity_present",
"instruction": "owner role / team 必須可追溯，不能只寫個人暱稱或聊天同意。"
},
{
"check_id": "decision_reason_present",
"instruction": "decision 與 decision reason 必須同時存在，且不得包含機敏值。"
},
{
"check_id": "redacted_refs_only",
"instruction": "evidence 只能是脫敏 ref、hash、ticket、commit 或 artifact pointer。"
},
{
"check_id": "raw_conf_absent",
"instruction": "不得出現 raw live Nginx conf、完整 upstream payload 或未遮蔽 host secret。"
},
{
"check_id": "secret_value_absent",
"instruction": "不得出現 token、cookie、private key、完整憑證內容或 secret derivative。"
},
{
"check_id": "route_scope_matches_snapshot",
"instruction": "affected routes 必須能對回 committed public gateway snapshot 的 config_id。"
},
{
"check_id": "rendered_diff_ref_not_payload",
"instruction": "rendered diff 只能是 ref，不得把 diff payload 直接貼進 owner response。"
},
{
"check_id": "nginx_test_separate_approval",
"instruction": "`nginx -t` 只能作為後續人工批准包，不得由 owner response 自動觸發。"
},
{
"check_id": "route_smoke_plan_present",
"instruction": "route smoke plan 必須列 affected routes、預期 status、TLS / WebSocket / ACME checks。"
},
{
"check_id": "maintenance_window_present",
"instruction": "任何未來變更都必須有維護窗口或明確禁止窗口。"
},
{
"check_id": "rollback_owner_present",
"instruction": "rollback owner 與 rollback ref 必須存在，且不可指向 raw secret。"
},
{
"check_id": "counts_transition_safe",
"instruction": "只有 reviewer record 可更新 received / accepted / rejected；不得同時開 runtime gate。"
}
],
"schema_version": "public_gateway_owner_response_acceptance_v1",
"source_export_request_schema_version": "public_gateway_live_conf_export_request_v1",
"source_export_request_status": "live_conf_export_request_ready_not_dispatched",
"source_intake_preflight_schema_version": "public_gateway_redacted_export_intake_preflight_v1",
"source_intake_preflight_status": "redacted_export_intake_preflight_ready_no_payload_received",
"source_rendered_diff_gate_schema_version": "public_gateway_rendered_diff_gate_draft_v1",
"source_rendered_diff_gate_status": "rendered_diff_gate_draft_ready_no_runtime_action",
"status": "owner_response_acceptance_ledger_ready_no_runtime_action",
"summary": {
"acceptance_candidate_count": 3,
"acceptance_field_count": 23,
"accepted_redacted_export_count": 0,
"action_button_count": 0,
"blocked_action_count": 18,
"c0_acceptance_candidate_count": 2,
"c1_acceptance_candidate_count": 1,
"certbot_renew_authorized_count": 0,
"dns_tls_probe_authorized_count": 0,
"maintenance_window_accepted_count": 0,
"nginx_reload_authorized_count": 0,
"nginx_reload_executed_count": 0,
"nginx_test_authorized_count": 0,
"nginx_test_executed_count": 0,
"outcome_lane_count": 7,
"owner_response_accepted_count": 0,
"owner_response_quarantined_count": 0,
"owner_response_received_count": 0,
"owner_response_rejected_count": 0,
"recipient_confirmed_count": 0,
"redacted_export_received_count": 0,
"rendered_diff_candidate_count": 0,
"rendered_diff_ready_count": 0,
"request_sent_count": 0,
"required_owner_response_field_count": 12,
"reviewer_check_count": 12,
"rollback_owner_accepted_count": 0,
"route_smoke_authorized_count": 0,
"route_smoke_executed_count": 0,
"runtime_gate_count": 0,
"source_diff_gate_candidate_count": 3,
"source_export_request_count": 3,
"source_intake_candidate_count": 3,
"supplement_requested_count": 0
}
}
Reference in New Issue View Git Blame Copy Permalink