awoooi/docs/security/source-control-workflow-secret-name-inventory.snapshot.json

{
  "schema_version": "source_control_workflow_secret_name_inventory_v1",
  "status": "draft_missing_evidence",
  "date": "2026-06-11",
  "mode": "inventory_contract_only",
  "runtime_execution_authorized": false,
  "source_indexes": [
    "docs/security/source-control-primary-readiness-gate.snapshot.json",
    "docs/security/source-control-workflow-secret-name-local-evidence.snapshot.json",
    "docs/security/source-control-workflow-secret-name-export-request.snapshot.json",
    "docs/security/source-control-workflow-secret-name-owner-response.snapshot.json",
    "docs/security/github-target-decision.snapshot.json",
    "docs/security/source-control-approval-board.snapshot.json",
    "docs/security/source-control-reconcile-plan.snapshot.json",
    "docs/security/security-rollout-policy.snapshot.json"
  ],
  "summary": {
    "candidate_repo_count": 10,
    "in_scope_repo_count": 9,
    "external_scope_count": 1,
    "inventory_complete_count": 0,
    "missing_inventory_count": 9,
    "owner_response_template_count": 5,
    "owner_response_received_count": 0,
    "owner_response_accepted_count": 0,
    "secret_value_collection_allowed": false,
    "runtime_actions_authorized": false,
    "action_buttons_allowed": false
  },
  "owner_response_packet": {
    "schema_version": "source_control_workflow_secret_name_owner_response_v1",
    "snapshot_path": "docs/security/source-control-workflow-secret-name-owner-response.snapshot.json",
    "human_doc": "docs/security/SOURCE-CONTROL-WORKFLOW-SECRET-NAME-OWNER-RESPONSE.md",
    "response_template_count": 5,
    "received_response_count": 0,
    "accepted_response_count": 0,
    "rejected_response_count": 0,
    "execution_authorized": false
  },
  "inventory_lanes": [
    {
      "lane_id": "workflow_file_inventory",
      "title": "workflow 名稱與觸發條件 inventory",
      "status": "contract_defined_not_collected",
      "allowed_fields": [
        "workflow_file_path",
        "workflow_display_name",
        "trigger_names",
        "runner_label_names",
        "environment_names",
        "referenced_secret_names"
      ],
      "forbidden_fields": [
        "secret_value",
        "token_value",
        "private_key",
        "webhook_secret",
        "deploy_key_private_material"
      ],
      "required_before_primary": [
        "列出 Gitea/GitHub workflow 名稱與觸發條件差異",
        "確認 self-hosted runner label 是否一致",
        "確認 deployment marker / production deploy workflow 真相來源"
      ],
      "execution_authorized": false
    },
    {
      "lane_id": "webhook_inventory",
      "title": "webhook 名稱、目的地與事件類型 inventory",
      "status": "contract_defined_not_collected",
      "allowed_fields": [
        "webhook_name",
        "destination_host_redacted",
        "event_types",
        "active_enabled_flag",
        "owner"
      ],
      "forbidden_fields": [
        "webhook_secret",
        "full_payload_url_with_token",
        "authorization_header",
        "cookie"
      ],
      "required_before_primary": [
        "列出 Gitea/GitHub webhook 目的地與事件類型差異",
        "確認 primary cutover 後哪一端發 webhook",
        "確認不重複觸發 deploy 或 notification"
      ],
      "execution_authorized": false
    },
    {
      "lane_id": "runner_inventory",
      "title": "runner label 與 executor inventory",
      "status": "contract_defined_not_collected",
      "allowed_fields": [
        "runner_label",
        "runner_scope",
        "executor_type",
        "host_alias",
        "owner"
      ],
      "forbidden_fields": [
        "runner_registration_token",
        "ssh_private_key",
        "host_password",
        "api_token"
      ],
      "required_before_primary": [
        "確認 GitHub primary 後使用 self-hosted runner，不消耗 GitHub hosted 額度",
        "確認 runner label 與 workflow expectations 一致",
        "確認 runner owner 與維護窗口"
      ],
      "execution_authorized": false
    },
    {
      "lane_id": "deploy_key_inventory",
      "title": "deploy key / machine key 名稱 inventory",
      "status": "contract_defined_not_collected",
      "allowed_fields": [
        "key_name",
        "read_only_flag",
        "repo_scope",
        "owner",
        "last_seen_metadata"
      ],
      "forbidden_fields": [
        "private_key",
        "public_key_full_value_if_sensitive",
        "token_value",
        "password"
      ],
      "required_before_primary": [
        "確認 deploy key 是否 read-only",
        "確認 key owner 與 repo scope",
        "確認 primary cutover 不需要搬移 private key value"
      ],
      "execution_authorized": false
    },
    {
      "lane_id": "branch_protection_codeowners_inventory",
      "title": "branch protection / CODEOWNERS inventory",
      "status": "contract_defined_not_collected",
      "allowed_fields": [
        "protected_branch_name",
        "required_review_count",
        "required_status_check_names",
        "codeowners_path",
        "owner_team_names"
      ],
      "forbidden_fields": [
        "team_secret",
        "personal_access_token",
        "admin_override_token"
      ],
      "required_before_primary": [
        "確認 main/dev branch protection 差異",
        "確認 required status checks 名稱與 CI provider 對齊",
        "確認 CODEOWNERS 是否存在與 owner team 是否有效"
      ],
      "execution_authorized": false
    },
    {
      "lane_id": "secret_name_inventory",
      "title": "secret 名稱與 owner inventory",
      "status": "contract_defined_not_collected",
      "allowed_fields": [
        "secret_name",
        "secret_scope",
        "owning_team",
        "used_by_workflow_name",
        "rotation_owner"
      ],
      "forbidden_fields": [
        "secret_value",
        "secret_plaintext",
        "token_value",
        "private_key",
        "credential_value"
      ],
      "required_before_primary": [
        "只列 secret 名稱與 owner，不列 value",
        "確認 Gitea/GitHub secret name parity",
        "確認缺漏 secret 的 owner 與補證流程"
      ],
      "execution_authorized": false
    },
    {
      "lane_id": "redaction_audit_inventory",
      "title": "redaction 與 audit inventory",
      "status": "contract_defined_not_collected",
      "allowed_fields": [
        "redaction_status",
        "evidence_ref",
        "producer",
        "reviewer",
        "collection_timestamp"
      ],
      "forbidden_fields": [
        "raw_secret",
        "raw_token",
        "raw_cookie",
        "raw_private_key",
        "raw_webhook_secret"
      ],
      "required_before_primary": [
        "每份 inventory snapshot 都必須標示已脫敏",
        "敏感值掃描通過後才可 mirror",
        "失敗 payload 必須進 quarantine，不得寫入 Runtime State"
      ],
      "execution_authorized": false
    }
  ],
  "repo_inventory_readiness": [
    {
      "github_repo": "owenhytsai/awoooi",
      "source_key": "wooo/awoooi",
      "scope_status": "in_scope",
      "inventory_state": "missing_evidence",
      "risk": "HIGH",
      "required_inventory": [
        "workflow_file_inventory",
        "webhook_inventory",
        "runner_inventory",
        "secret_name_inventory",
        "branch_protection_codeowners_inventory"
      ],
      "current_gap": [
        "production deploy workflow / deployment marker 名稱 parity 尚未完成",
        "runner label 與 required status checks 尚未整理",
        "secret 只能列名稱與 owner，尚無 redacted snapshot"
      ],
      "allowed_now": [
        "建立 read-only inventory request",
        "顯示缺口與 owner",
        "等待 redacted snapshot"
      ],
      "still_forbidden": [
        "搬移 secret value",
        "修改 workflow",
        "切 GitHub primary",
        "停用 Gitea deploy path"
      ]
    },
    {
      "github_repo": "owenhytsai/clawbot-v5",
      "source_key": "wooo/clawbot-v5",
      "scope_status": "in_scope",
      "inventory_state": "missing_evidence",
      "risk": "MEDIUM",
      "required_inventory": [
        "workflow_file_inventory",
        "secret_name_inventory",
        "branch_protection_codeowners_inventory"
      ],
      "current_gap": [
        "workflow / secret 名稱 parity 尚未整理",
        "required status checks 尚未確認"
      ],
      "allowed_now": [
        "顯示 missing evidence",
        "要求 repo owner 補 redacted inventory"
      ],
      "still_forbidden": [
        "建立或修改 secrets",
        "sync refs",
        "切 primary"
      ]
    },
    {
      "github_repo": "owenhytsai/wooo-aiops",
      "source_key": "wooo/wooo-aiops",
      "scope_status": "in_scope",
      "inventory_state": "missing_evidence",
      "risk": "MEDIUM",
      "required_inventory": [
        "workflow_file_inventory",
        "webhook_inventory",
        "secret_name_inventory"
      ],
      "current_gap": [
        "GitHub-only refs 與 workflow 來源尚未釐清",
        "webhook / secret 名稱 parity 尚未整理"
      ],
      "allowed_now": [
        "顯示 source-control review lane",
        "要求 owner 補 workflow / webhook 名稱"
      ],
      "still_forbidden": [
        "delete GitHub-only refs",
        "搬 secret value",
        "切 primary"
      ]
    },
    {
      "github_repo": "owenhytsai/wooo-infra-config",
      "source_key": "wooo/wooo-infra-config",
      "scope_status": "in_scope",
      "inventory_state": "missing_evidence",
      "risk": "MEDIUM",
      "required_inventory": [
        "deploy_key_inventory",
        "secret_name_inventory",
        "branch_protection_codeowners_inventory"
      ],
      "current_gap": [
        "infra secret 名稱 inventory 尚未完成",
        "deploy key / machine key owner 尚未確認",
        "110 internal remote 用途仍需 owner 決策"
      ],
      "allowed_now": [
        "只列 key / secret 名稱與 owner",
        "顯示 internal remote purpose review"
      ],
      "still_forbidden": [
        "搬 infra secret value",
        "輸出 private key",
        "刪除 remote",
        "切 primary"
      ]
    },
    {
      "github_repo": "owenhytsai/ewoooc",
      "source_key": "wooo/ewoooc / root/momo-pro-system / momo working trees",
      "scope_status": "in_scope",
      "inventory_state": "missing_evidence",
      "risk": "HIGH",
      "required_inventory": [
        "workflow_file_inventory",
        "secret_name_inventory",
        "branch_protection_codeowners_inventory"
      ],
      "current_gap": [
        "canonical repo 尚未人工確認",
        "GitHub target 未授權 probe 看不到",
        "workflow / secret 名稱 inventory 尚未建立"
      ],
      "allowed_now": [
        "顯示 target creation/access review",
        "要求 owner 補 canonical 與 redacted inventory"
      ],
      "still_forbidden": [
        "auto_create_repo",
        "auto_merge_unrelated_histories",
        "搬 secret value",
        "切 primary"
      ]
    },
    {
      "github_repo": "owenhytsai/bitan-pharmacy",
      "source_key": "bitan-pharmacy",
      "scope_status": "in_scope",
      "inventory_state": "missing_evidence",
      "risk": "MEDIUM",
      "required_inventory": [
        "workflow_file_inventory",
        "secret_name_inventory"
      ],
      "current_gap": [
        "GitHub target 未確認",
        "repo 是否仍 active 尚未確認",
        "workflow / secret 名稱 inventory 尚未建立"
      ],
      "allowed_now": [
        "顯示 target creation/access review",
        "要求 owner 確認 active 狀態"
      ],
      "still_forbidden": [
        "auto_create_repo",
        "push refs",
        "搬 secret value",
        "切 primary"
      ]
    },
    {
      "github_repo": "owenhytsai/tsenyang-website",
      "source_key": "tsenyang-website",
      "scope_status": "in_scope",
      "inventory_state": "missing_evidence",
      "risk": "MEDIUM",
      "required_inventory": [
        "workflow_file_inventory",
        "secret_name_inventory"
      ],
      "current_gap": [
        "GitHub target 未確認",
        "repo 是否仍 active 尚未確認",
        "workflow / secret 名稱 inventory 尚未建立"
      ],
      "allowed_now": [
        "顯示 target creation/access review",
        "要求 owner 確認 active 狀態"
      ],
      "still_forbidden": [
        "auto_create_repo",
        "push refs",
        "搬 secret value",
        "切 primary"
      ]
    },
    {
      "github_repo": "nexu-io/open-design",
      "source_key": "open-design",
      "scope_status": "external_scope_review",
      "inventory_state": "scope_review_only",
      "risk": "LOW",
      "required_inventory": [
        "scope ownership only"
      ],
      "current_gap": [
        "尚未確認是否屬於 AWOOOI 資安供應鏈範圍"
      ],
      "allowed_now": [
        "顯示 scope review",
        "維持 observe-only"
      ],
      "still_forbidden": [
        "加入 primary cutover queue",
        "修改 repo visibility",
        "sync refs"
      ]
    },
    {
      "github_repo": "owenhytsai/VibeWork",
      "source_key": "vibework",
      "scope_status": "in_scope",
      "inventory_state": "missing_evidence",
      "risk": "HIGH",
      "required_inventory": [
        "workflow_file_inventory",
        "secret_name_inventory",
        "branch_protection_codeowners_inventory"
      ],
      "current_gap": [
        "本機 repo 可見但未找到 workflow / CODEOWNERS，仍需 owner 確認是否另有部署 workflow、repo secret 或外部 deploy key",
        "VibeWork 必須保留獨立產品邊界，不得被 AWOOOI source-control primary 決策直接併入",
        "GitHub / Gitea target、canonical source 與 secret name parity 尚未完成人工決策"
      ],
      "allowed_now": [
        "顯示 VibeWork 納管範圍與缺口",
        "要求 owner 補 repo / product / surface / owner / evidence refs",
        "保持只讀 evidence 與獨立產品邊界"
      ],
      "still_forbidden": [
        "auto_create_repo",
        "push_refs",
        "搬 secret value",
        "切 primary",
        "把 VibeWork 產品邊界併入 AWOOOI"
      ]
    },
    {
      "github_repo": "owenhytsai/agent-bounty-protocol",
      "source_key": "agent-bounty-protocol",
      "scope_status": "in_scope",
      "inventory_state": "missing_evidence",
      "risk": "HIGH",
      "required_inventory": [
        "workflow_file_inventory",
        "runner_inventory",
        "secret_name_inventory",
        "branch_protection_codeowners_inventory"
      ],
      "current_gap": [
        "新納入專案，本機已見 1 個 Gitea workflow、0 個 referenced secret names 與 ubuntu-latest runner label，但 owner / target / canonical 決策未完成",
        "A2A / MCP / bounty / treasury / agent execution 邊界尚未建立資安 owner response",
        "branch protection、CODEOWNERS 與 repository secret name parity 尚未完成只讀 export"
      ],
      "allowed_now": [
        "顯示 agent-bounty-protocol 新納管缺口",
        "只讀列出 workflow 名稱、runner label 與 secret name parity 缺口",
        "要求 owner 補 agent / bounty / treasury / execution surface 邊界"
      ],
      "still_forbidden": [
        "auto_create_repo",
        "push_refs",
        "修改 workflow",
        "啟用 runner",
        "搬 secret value",
        "切 primary",
        "把 bounty / agent 執行候選當 runtime 授權"
      ]
    }
  ],
  "inventory_rules": [
    "本契約只定義 workflow / runner / webhook / deploy key / secret 名稱 inventory 欄位，不代表 inventory 已完成。",
    "secret_name_inventory 只允許保存 secret_name、scope、owner 與 used_by_workflow_name，禁止保存 value。",
    "任何 raw secret、token、cookie、private key、webhook secret 或 credential value 都必須被拒收並進 quarantine。",
    "此 inventory 完成前，GitHub primary readiness gate 必須維持 blocked。",
    "S4.2 已補本機可見 workflow / CODEOWNERS / referenced secret name evidence，但 webhook、deploy key、branch protection 與 repository secret parity 仍未完成。",
    "S4.3 已補 redacted export request package，將 webhook、runner、deploy key、branch protection/CODEOWNERS 與 repository secret name parity 的 owner / read-only export 欄位、拒收欄位與 acceptance gate 文件化；它仍不是 API 執行或 primary cutover 批准。",
    "S4.12 已補 owner response request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 與收件包，將 5 類 export lanes 的 request 欄位、等待狀態、0 emitted 脫敏 audit metadata 模板、安全回覆範例、只讀收件檢查、response 欄位、驗收規則與拒收規則文件化；received_response_count=0、audit_events_emitted=0，仍不得收集 secret value 或修改 workflow。",
    "inventory snapshot 只能 mirror 成 Operator Console / Audit evidence，不得新增 execution action。"
  ],
  "forbidden_actions": [
    "collect_secret_value",
    "store_secret_token_cookie_private_key_or_exploit_payload",
    "create_github_repo",
    "change_repo_visibility",
    "sync_git_refs",
    "delete_git_refs",
    "force_push",
    "switch_github_primary",
    "disable_gitea",
    "modify_workflow",
    "rotate_secret",
    "add_action_button"
  ]
}