308 lines
12 KiB
JSON
308 lines
12 KiB
JSON
{
|
||
"schema_version": "github_target_repo_approval_package_v1",
|
||
"status": "draft",
|
||
"source_snapshot": "docs/security/github-target-decision.snapshot.json",
|
||
"package_count": 9,
|
||
"approval_items": [
|
||
{
|
||
"github_repo": "owenhytsai/awoooi",
|
||
"source_key": "wooo/awoooi",
|
||
"risk": "HIGH",
|
||
"approval_action": "reconcile_refs_after_full_inventory",
|
||
"approval_status": "pending",
|
||
"required_reviewers": [
|
||
"migration-engineer",
|
||
"security-commander",
|
||
"human-owner"
|
||
],
|
||
"blocked_until": [
|
||
"Gitea server-side 全量 repo inventory status=ok",
|
||
"branches/tags/workflows/webhooks/secrets 名稱 inventory 完成",
|
||
"部署真相來源已決定",
|
||
"GitHub primary ADR 與 rollback plan 完成"
|
||
],
|
||
"allowed_after_approval": [
|
||
"產生 refs reconcile plan",
|
||
"產生 draft migration PR 或 ADR",
|
||
"更新 migration matrix 與 evidence"
|
||
],
|
||
"still_forbidden": [
|
||
"直接 push refs",
|
||
"直接切 GitHub primary",
|
||
"直接停用 Gitea",
|
||
"搬 secret value"
|
||
],
|
||
"evidence_refs": [
|
||
"docs/security/GITEA-GITHUB-MIGRATION-SNAPSHOT.md",
|
||
"docs/security/GITHUB-TARGET-VISIBILITY-DECISION-TABLE.md",
|
||
"docs/security/github-target-owner-decision-response.snapshot.json"
|
||
],
|
||
"notes": "Gitea/GitHub main SHA、branches、tags 未對齊，必須先做 reconcile plan。"
|
||
},
|
||
{
|
||
"github_repo": "owenhytsai/clawbot-v5",
|
||
"source_key": "wooo/clawbot-v5",
|
||
"risk": "MEDIUM",
|
||
"approval_action": "reconcile_refs_after_full_inventory",
|
||
"approval_status": "pending",
|
||
"required_reviewers": [
|
||
"migration-engineer",
|
||
"human-owner"
|
||
],
|
||
"blocked_until": [
|
||
"Gitea/GitHub main SHA 對齊或人工指定真相來源",
|
||
"GitHub 缺 Gitea tag 的處理方式已決定"
|
||
],
|
||
"allowed_after_approval": [
|
||
"產生 refs reconcile plan",
|
||
"更新 migration matrix"
|
||
],
|
||
"still_forbidden": [
|
||
"直接 push refs",
|
||
"直接切 primary",
|
||
"刪除任一端 repo"
|
||
],
|
||
"evidence_refs": [
|
||
"docs/security/SOURCE-CONTROL-CLAWBOT-V5-SNAPSHOT.md",
|
||
"docs/security/GITHUB-TARGET-VISIBILITY-DECISION-TABLE.md",
|
||
"docs/security/github-target-owner-decision-response.snapshot.json"
|
||
],
|
||
"notes": "GitHub repo 可見，但 main SHA 與 tag 狀態未對齊。"
|
||
},
|
||
{
|
||
"github_repo": "owenhytsai/wooo-aiops",
|
||
"source_key": "wooo/wooo-aiops",
|
||
"risk": "MEDIUM",
|
||
"approval_action": "reconcile_refs_after_full_inventory",
|
||
"approval_status": "pending",
|
||
"required_reviewers": [
|
||
"migration-engineer",
|
||
"human-owner"
|
||
],
|
||
"blocked_until": [
|
||
"Gitea/GitHub main SHA 對齊或人工指定真相來源",
|
||
"GitHub-only branch 與 tags 的來源已釐清"
|
||
],
|
||
"allowed_after_approval": [
|
||
"產生 refs reconcile plan",
|
||
"更新 migration matrix"
|
||
],
|
||
"still_forbidden": [
|
||
"直接 push refs",
|
||
"直接切 primary",
|
||
"刪除 GitHub-only refs"
|
||
],
|
||
"evidence_refs": [
|
||
"docs/security/SOURCE-CONTROL-WOOO-AIOPS-SNAPSHOT.md",
|
||
"docs/security/GITHUB-TARGET-VISIBILITY-DECISION-TABLE.md",
|
||
"docs/security/github-target-owner-decision-response.snapshot.json"
|
||
],
|
||
"notes": "GitHub tags 比 Gitea 多，需先釐清真相來源。"
|
||
},
|
||
{
|
||
"github_repo": "owenhytsai/wooo-infra-config",
|
||
"source_key": "wooo/wooo-infra-config",
|
||
"risk": "MEDIUM",
|
||
"approval_action": "confirm_internal_remote_purpose",
|
||
"approval_status": "pending",
|
||
"required_reviewers": [
|
||
"migration-engineer",
|
||
"security-commander",
|
||
"human-owner"
|
||
],
|
||
"blocked_until": [
|
||
"110 internal remote 用途已確認",
|
||
"若 110 remote 為舊主控，已降級或移除",
|
||
"infra secrets 名稱 inventory 完成"
|
||
],
|
||
"allowed_after_approval": [
|
||
"標記 110 remote 為 mirror、legacy 或 active source",
|
||
"更新 canonical decision table"
|
||
],
|
||
"still_forbidden": [
|
||
"直接刪除 remote",
|
||
"直接同步 refs",
|
||
"搬 infra secret value"
|
||
],
|
||
"evidence_refs": [
|
||
"docs/security/GIT-REMOTE-REFS-WOOO-INFRA-CONFIG-SNAPSHOT.md",
|
||
"docs/security/GITHUB-TARGET-VISIBILITY-DECISION-TABLE.md",
|
||
"docs/security/github-target-owner-decision-response.snapshot.json"
|
||
],
|
||
"notes": "GitHub 與本機 main 對齊，但 110 internal remote 不可讀，需判斷用途。"
|
||
},
|
||
{
|
||
"github_repo": "owenhytsai/ewoooc",
|
||
"source_key": "wooo/ewoooc / root/momo-pro-system / momo working trees",
|
||
"risk": "HIGH",
|
||
"approval_action": "create_or_grant_access_after_canonical_approval",
|
||
"approval_status": "pending",
|
||
"required_reviewers": [
|
||
"migration-engineer",
|
||
"security-commander",
|
||
"human-owner"
|
||
],
|
||
"blocked_until": [
|
||
"ewoooc/momo-pro-system canonical 關係人工確認",
|
||
"server-side refs diff 完成",
|
||
"GitHub repo owner 與 visibility 決策完成"
|
||
],
|
||
"allowed_after_approval": [
|
||
"決定建立 GitHub repo 或授權既有 private repo",
|
||
"產生 migration plan"
|
||
],
|
||
"still_forbidden": [
|
||
"自動建立 mirror",
|
||
"自動合併 unrelated histories",
|
||
"刪除任一 momo/ewoooc working tree",
|
||
"切 GitHub primary"
|
||
],
|
||
"evidence_refs": [
|
||
"docs/security/GITEA-REPO-INVENTORY-SNAPSHOT.md",
|
||
"docs/security/LOCAL-REPO-CANONICAL-EWOOOC-MOMO-SNAPSHOT.md",
|
||
"docs/security/GITHUB-TARGET-VISIBILITY-DECISION-TABLE.md",
|
||
"docs/security/github-target-owner-decision-response.snapshot.json"
|
||
],
|
||
"notes": "momo/ewoooc lineage sample 目前 unrelated，不能自動視為同 repo。"
|
||
},
|
||
{
|
||
"github_repo": "owenhytsai/bitan-pharmacy",
|
||
"source_key": "bitan-pharmacy",
|
||
"risk": "MEDIUM",
|
||
"approval_action": "create_or_grant_access_after_canonical_approval",
|
||
"approval_status": "pending",
|
||
"required_reviewers": [
|
||
"migration-engineer",
|
||
"human-owner"
|
||
],
|
||
"blocked_until": [
|
||
"確認 repo 是否仍 active",
|
||
"GitHub repo owner 與 visibility 決策完成"
|
||
],
|
||
"allowed_after_approval": [
|
||
"決定建立 GitHub repo 或授權既有 private repo",
|
||
"產生 migration plan"
|
||
],
|
||
"still_forbidden": [
|
||
"自動建立 repo",
|
||
"自動 push refs",
|
||
"刪除 110 remote"
|
||
],
|
||
"evidence_refs": [
|
||
"docs/security/GIT-REMOTE-REFS-BITAN-TSENYANG-SNAPSHOT.md",
|
||
"docs/security/GITHUB-TARGET-VISIBILITY-DECISION-TABLE.md",
|
||
"docs/security/github-target-owner-decision-response.snapshot.json"
|
||
],
|
||
"notes": "110 remote 與本機 main 對齊，可作 source candidate；GitHub target 未確認。"
|
||
},
|
||
{
|
||
"github_repo": "owenhytsai/tsenyang-website",
|
||
"source_key": "tsenyang-website",
|
||
"risk": "MEDIUM",
|
||
"approval_action": "create_or_grant_access_after_canonical_approval",
|
||
"approval_status": "pending",
|
||
"required_reviewers": [
|
||
"migration-engineer",
|
||
"human-owner"
|
||
],
|
||
"blocked_until": [
|
||
"確認 repo 是否仍 active",
|
||
"GitHub repo owner 與 visibility 決策完成"
|
||
],
|
||
"allowed_after_approval": [
|
||
"決定建立 GitHub repo 或授權既有 private repo",
|
||
"產生 migration plan"
|
||
],
|
||
"still_forbidden": [
|
||
"自動建立 repo",
|
||
"自動 push refs",
|
||
"刪除 110 remote"
|
||
],
|
||
"evidence_refs": [
|
||
"docs/security/GIT-REMOTE-REFS-BITAN-TSENYANG-SNAPSHOT.md",
|
||
"docs/security/GITHUB-TARGET-VISIBILITY-DECISION-TABLE.md",
|
||
"docs/security/github-target-owner-decision-response.snapshot.json"
|
||
],
|
||
"notes": "110 remote 與本機 main 對齊，可作 source candidate；GitHub target 未確認。"
|
||
},
|
||
{
|
||
"github_repo": "owenhytsai/VibeWork",
|
||
"source_key": "vibework",
|
||
"risk": "HIGH",
|
||
"approval_action": "create_or_grant_access_after_product_boundary_approval",
|
||
"approval_status": "pending",
|
||
"required_reviewers": [
|
||
"migration-engineer",
|
||
"security-commander",
|
||
"product-owner",
|
||
"human-owner"
|
||
],
|
||
"blocked_until": [
|
||
"VibeWork 產品 / repo / surface owner 與 canonical source 決策完成",
|
||
"確認是否存在 private GitHub target 或需要建立候選 repo",
|
||
"保留 VibeWork 獨立產品邊界，不得由 AWOOOI primary readiness 直接併入",
|
||
"workflow / CODEOWNERS / deploy key / repository secret name parity owner response 完成"
|
||
],
|
||
"allowed_after_approval": [
|
||
"決定授權既有 private target 或建立候選 GitHub repo 計畫",
|
||
"補 repo / product / surface owner metadata",
|
||
"更新 source-control primary readiness 的 VibeWork read-only 欄位"
|
||
],
|
||
"still_forbidden": [
|
||
"自動建立 repo",
|
||
"自動 push refs",
|
||
"修改 workflow 或 CODEOWNERS",
|
||
"搬移 secret value",
|
||
"把 VibeWork 產品邊界併入 AWOOOI",
|
||
"切 GitHub primary"
|
||
],
|
||
"evidence_refs": [
|
||
"docs/security/source-control-workflow-secret-name-local-evidence.snapshot.json",
|
||
"docs/security/GITHUB-TARGET-VISIBILITY-DECISION-TABLE.md",
|
||
"docs/security/github-target-owner-decision-response.snapshot.json"
|
||
],
|
||
"notes": "GitHub unauthenticated probe 為 not_found_or_private；只能代表公開未授權看不到，不得視為 repo 不存在或可直接建立。VibeWork 仍維持獨立產品邊界。"
|
||
},
|
||
{
|
||
"github_repo": "owenhytsai/agent-bounty-protocol",
|
||
"source_key": "agent-bounty-protocol",
|
||
"risk": "HIGH",
|
||
"approval_action": "create_or_grant_access_after_agent_runtime_boundary_approval",
|
||
"approval_status": "pending",
|
||
"required_reviewers": [
|
||
"migration-engineer",
|
||
"security-commander",
|
||
"product-owner",
|
||
"treasury-owner",
|
||
"human-owner"
|
||
],
|
||
"blocked_until": [
|
||
"agent-bounty-protocol repo / deployment / external agent / treasury owner 決策完成",
|
||
"確認是否存在 private GitHub target 或需要建立候選 repo",
|
||
"A2A / MCP / bounty / treasury / payout / withdrawal runtime gate 維持 0",
|
||
"branch protection / CODEOWNERS / repository secret name parity owner response 完成"
|
||
],
|
||
"allowed_after_approval": [
|
||
"決定授權既有 private target 或建立候選 GitHub repo 計畫",
|
||
"補 agent / bounty / treasury / execution surface owner metadata",
|
||
"更新 source-control primary readiness 的 agent-bounty-protocol read-only 欄位"
|
||
],
|
||
"still_forbidden": [
|
||
"自動建立 repo",
|
||
"自動 push refs",
|
||
"修改 workflow",
|
||
"啟用 agent claim / submit / daemon",
|
||
"執行 payout 或 withdrawal",
|
||
"搬移 secret value",
|
||
"切 GitHub primary"
|
||
],
|
||
"evidence_refs": [
|
||
"docs/security/source-control-workflow-secret-name-local-evidence.snapshot.json",
|
||
"docs/security/GITHUB-TARGET-VISIBILITY-DECISION-TABLE.md",
|
||
"docs/security/github-target-owner-decision-response.snapshot.json"
|
||
],
|
||
"notes": "GitHub unauthenticated probe 為 not_found_or_private；只能代表公開未授權看不到，不得視為 repo 不存在或可直接建立。agent / bounty / treasury / execution surface 仍需 owner response。"
|
||
}
|
||
]
|
||
}
|