855 lines
33 KiB
JSON
855 lines
33 KiB
JSON
{
|
||
"schema_version": "source_control_primary_rollback_adr_v1",
|
||
"status": "draft_waiting_owner_review",
|
||
"date": "2026-06-11",
|
||
"mode": "rollback_adr_only",
|
||
"runtime_execution_authorized": false,
|
||
"source_indexes": [
|
||
"docs/security/source-control-primary-readiness-gate.snapshot.json",
|
||
"docs/security/source-control-ref-truth-classification.snapshot.json",
|
||
"docs/security/source-control-workflow-secret-name-inventory.snapshot.json",
|
||
"docs/security/source-control-workflow-secret-name-export-request.snapshot.json",
|
||
"docs/security/source-control-approval-board.snapshot.json",
|
||
"docs/security/security-followup-runtime-gate.snapshot.json",
|
||
"docs/security/security-rollout-policy.snapshot.json"
|
||
],
|
||
"summary": {
|
||
"candidate_repo_count": 10,
|
||
"in_scope_repo_count": 9,
|
||
"external_scope_count": 1,
|
||
"repo_rollback_plan_count": 9,
|
||
"owner_approved_count": 0,
|
||
"dry_run_completed_count": 0,
|
||
"active_cutover_count": 0,
|
||
"rollback_owner_handoff_package_ready": true,
|
||
"rollback_owner_handoff_completion_percent": 100,
|
||
"rollback_owner_handoff_check_count": 6,
|
||
"rollback_owner_handoff_packet_field_count": 11,
|
||
"rollback_owner_request_dispatch_authorized": false,
|
||
"rollback_owner_response_received_count": 0,
|
||
"rollback_owner_response_accepted_count": 0,
|
||
"rollback_owner_response_rejected_count": 0,
|
||
"rollback_execution_authorized": false,
|
||
"github_primary_switch_authorized": false,
|
||
"gitea_disable_authorized": false,
|
||
"action_buttons_allowed": false
|
||
},
|
||
"rollback_principles": [
|
||
"GitHub primary 是長期方向，但每個 repo 必須先有 owner-approved rollback plan 才能進入 cutover review。",
|
||
"Gitea 在 cutover 前後都必須保留為本地 mirror / fallback，不得因 GitHub primary 準備而停用、刪除或封存。",
|
||
"Rollback ADR 只定義人工決策、驗證窗口與回退條件；不授權任何 refs sync、primary switch 或 webhook 修改。",
|
||
"任何回退都必須有新的 runtime gate、人工批准與 evidence snapshot，不得由本 ADR 自動觸發。",
|
||
"初期只做 observe / approval_required，不把缺 LOW / MEDIUM evidence 變成 production blocker。"
|
||
],
|
||
"cutover_preconditions": [
|
||
{
|
||
"gate_id": "gitea_authenticated_inventory_approved",
|
||
"title": "Gitea private/internal 全量 inventory 已完成",
|
||
"required_evidence": [
|
||
"Gitea authenticated inventory 或 redacted admin export status=ok",
|
||
"確認所有 private/internal repos 都在 migration matrix",
|
||
"只保存 token_present=true/false，不保存 token value"
|
||
],
|
||
"current_status": "blocked",
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"gate_id": "refs_truth_and_parity_approved",
|
||
"title": "refs truth / branch-tag parity 已由 owner 批准",
|
||
"required_evidence": [
|
||
"main/dev 真相來源已人工判定",
|
||
"release tags 保留 / 棄用決策完成",
|
||
"deprecated refs 已由 repo owner review"
|
||
],
|
||
"current_status": "waiting_owner_review",
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"gate_id": "workflow_secret_export_accepted",
|
||
"title": "workflow / runner / webhook / secret name redacted export 已驗收",
|
||
"required_evidence": [
|
||
"S4.3 export request 對應的 webhook、runner、deploy key、branch protection 與 repository secret name parity evidence 已補齊",
|
||
"任何 secret value、token value、private key 或 webhook secret 都未被保存",
|
||
"GitHub hosted runner 額度風險與 self-hosted runner owner 已確認"
|
||
],
|
||
"current_status": "draft_only",
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"gate_id": "owner_visibility_canonical_approved",
|
||
"title": "owner / visibility / canonical 已批准",
|
||
"required_evidence": [
|
||
"9 個 in-scope repos 都有 owner approval",
|
||
"not_found_or_private repo 已明確判定建立、取得權限或排除",
|
||
"ewoooc / momo-pro-system canonical 關係已定案"
|
||
],
|
||
"current_status": "waiting_owner_review",
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"gate_id": "rollback_owner_and_monitoring_approved",
|
||
"title": "rollback owner、監控窗口與通知責任已批准",
|
||
"required_evidence": [
|
||
"每個 repo 都有 rollback owner 與值班窗口",
|
||
"cutover 後 1h / 24h 的驗證項目已明確",
|
||
"失敗時的人工停損與回退 decision record 格式已確認"
|
||
],
|
||
"current_status": "draft_only",
|
||
"execution_authorized": false
|
||
}
|
||
],
|
||
"repo_rollback_plans": [
|
||
{
|
||
"repo_key": "awoooi",
|
||
"github_repo": "owenhytsai/awoooi",
|
||
"source_key": "wooo/awoooi",
|
||
"scope_status": "in_scope",
|
||
"risk": "HIGH",
|
||
"rollback_state": "draft_waiting_owner_review",
|
||
"primary_ready": false,
|
||
"fallback_role": "Gitea remains protected local fallback until owner-approved cutover and rollback drill are complete.",
|
||
"required_owner_decisions": [
|
||
"main/dev 真相來源",
|
||
"production deploy workflow canonical",
|
||
"webhook single-sender policy",
|
||
"rollback owner"
|
||
],
|
||
"rollback_evidence_required": [
|
||
"main SHA / tag parity evidence",
|
||
"deployment marker workflow evidence",
|
||
"runner owner / self-hosted evidence",
|
||
"repository secret name parity evidence",
|
||
"post-cutover health and deploy verification checklist"
|
||
],
|
||
"rollback_triggers": [
|
||
"production deploy workflow fails after primary switch",
|
||
"duplicate webhook causes duplicate deploy or duplicate notification",
|
||
"required runner label unavailable",
|
||
"secret name parity gap blocks deployment"
|
||
],
|
||
"manual_recovery_outline": [
|
||
"Freeze additional refs changes and record decision in approval audit.",
|
||
"Keep Gitea fallback intact and route deploy decision back to approved source after runtime gate approval.",
|
||
"Collect post-rollback evidence before re-entering primary readiness review."
|
||
],
|
||
"execution_authorized": false,
|
||
"still_forbidden": [
|
||
"switch_github_primary",
|
||
"disable_gitea",
|
||
"sync_refs",
|
||
"modify_workflow",
|
||
"move_secret_values"
|
||
]
|
||
},
|
||
{
|
||
"repo_key": "clawbot-v5",
|
||
"github_repo": "owenhytsai/clawbot-v5",
|
||
"source_key": "wooo/clawbot-v5",
|
||
"scope_status": "in_scope",
|
||
"risk": "MEDIUM",
|
||
"rollback_state": "draft_waiting_owner_review",
|
||
"primary_ready": false,
|
||
"fallback_role": "Gitea remains fallback until tag retention and refs truth are approved.",
|
||
"required_owner_decisions": [
|
||
"main 真相來源",
|
||
"Gitea-only tag 保留或棄用",
|
||
"是否需要 workflow / secret inventory",
|
||
"rollback owner"
|
||
],
|
||
"rollback_evidence_required": [
|
||
"branch/tag parity evidence",
|
||
"owner-approved tag policy",
|
||
"repository secret name parity or no-secret attestation",
|
||
"post-cutover smoke check"
|
||
],
|
||
"rollback_triggers": [
|
||
"GitHub target misses owner-approved tag",
|
||
"automation expects a Gitea-only ref",
|
||
"repo owner rejects target canonical decision"
|
||
],
|
||
"manual_recovery_outline": [
|
||
"Pause primary review and keep Gitea as canonical fallback.",
|
||
"Ask owner to classify missing refs before any retry.",
|
||
"Require new approval record before resuming cutover preparation."
|
||
],
|
||
"execution_authorized": false,
|
||
"still_forbidden": [
|
||
"push_refs",
|
||
"delete_refs",
|
||
"switch_github_primary",
|
||
"delete_gitea_repo"
|
||
]
|
||
},
|
||
{
|
||
"repo_key": "wooo-aiops",
|
||
"github_repo": "owenhytsai/wooo-aiops",
|
||
"source_key": "wooo/wooo-aiops",
|
||
"scope_status": "in_scope",
|
||
"risk": "MEDIUM",
|
||
"rollback_state": "draft_waiting_owner_review",
|
||
"primary_ready": false,
|
||
"fallback_role": "Gitea remains fallback until GitHub-only refs and workflow ownership are resolved.",
|
||
"required_owner_decisions": [
|
||
"GitHub-only branch / tag 來源",
|
||
"webhook owner",
|
||
"runner / workflow owner",
|
||
"rollback owner"
|
||
],
|
||
"rollback_evidence_required": [
|
||
"GitHub-only refs classification",
|
||
"webhook redacted export",
|
||
"runner owner evidence",
|
||
"repository secret name parity evidence"
|
||
],
|
||
"rollback_triggers": [
|
||
"GitHub-only refs are later classified as active source",
|
||
"webhook route changes produce duplicate events",
|
||
"workflow runner mismatch increases hosted runner usage unexpectedly"
|
||
],
|
||
"manual_recovery_outline": [
|
||
"Stop cutover review and preserve both remote states.",
|
||
"Route owner decision back through source-control approval board.",
|
||
"Re-run readiness gate only after redacted evidence is updated."
|
||
],
|
||
"execution_authorized": false,
|
||
"still_forbidden": [
|
||
"delete_github_only_refs",
|
||
"modify_webhook",
|
||
"switch_github_primary",
|
||
"force_push"
|
||
]
|
||
},
|
||
{
|
||
"repo_key": "wooo-infra-config",
|
||
"github_repo": "owenhytsai/wooo-infra-config",
|
||
"source_key": "wooo/wooo-infra-config",
|
||
"scope_status": "in_scope",
|
||
"risk": "MEDIUM",
|
||
"rollback_state": "draft_waiting_owner_review",
|
||
"primary_ready": false,
|
||
"fallback_role": "Gitea and internal 110 remote roles stay unchanged until infra owner signs off.",
|
||
"required_owner_decisions": [
|
||
"110 internal remote purpose",
|
||
"deploy key owner",
|
||
"infra secret name owner",
|
||
"rollback owner"
|
||
],
|
||
"rollback_evidence_required": [
|
||
"internal remote purpose decision",
|
||
"deploy key redacted inventory",
|
||
"branch protection / required check export",
|
||
"infra secret name parity evidence"
|
||
],
|
||
"rollback_triggers": [
|
||
"internal remote is still an active source",
|
||
"deploy key ownership is ambiguous",
|
||
"required status checks are missing on GitHub target",
|
||
"infra secret parity gap blocks validation"
|
||
],
|
||
"manual_recovery_outline": [
|
||
"Keep current infra source untouched and do not delete remotes.",
|
||
"Escalate to infra owner for manual source-of-truth decision.",
|
||
"Resume only after a new redacted export snapshot is committed."
|
||
],
|
||
"execution_authorized": false,
|
||
"still_forbidden": [
|
||
"delete_remote",
|
||
"move_secret_values",
|
||
"export_private_key",
|
||
"switch_github_primary"
|
||
]
|
||
},
|
||
{
|
||
"repo_key": "ewoooc",
|
||
"github_repo": "owenhytsai/ewoooc",
|
||
"source_key": "wooo/ewoooc / root/momo-pro-system / momo working trees",
|
||
"scope_status": "in_scope",
|
||
"risk": "HIGH",
|
||
"rollback_state": "draft_waiting_owner_review",
|
||
"primary_ready": false,
|
||
"fallback_role": "No primary decision until canonical repository and unrelated history risk are resolved.",
|
||
"required_owner_decisions": [
|
||
"GitHub target access or creation decision",
|
||
"ewoooc / momo-pro-system canonical decision",
|
||
"unrelated history handling",
|
||
"rollback owner"
|
||
],
|
||
"rollback_evidence_required": [
|
||
"canonical repo decision record",
|
||
"server-side refs diff",
|
||
"workflow / secret name redacted export",
|
||
"post-cutover web and deploy health checks"
|
||
],
|
||
"rollback_triggers": [
|
||
"target repo access remains unresolved",
|
||
"canonical decision conflicts with local lineage evidence",
|
||
"unrelated histories cannot be reconciled without data loss risk"
|
||
],
|
||
"manual_recovery_outline": [
|
||
"Keep all existing working trees untouched.",
|
||
"Do not create or merge GitHub target automatically.",
|
||
"Require canonical owner approval before any new cutover attempt."
|
||
],
|
||
"execution_authorized": false,
|
||
"still_forbidden": [
|
||
"auto_create_repo",
|
||
"auto_merge_unrelated_histories",
|
||
"delete_working_tree",
|
||
"switch_github_primary"
|
||
]
|
||
},
|
||
{
|
||
"repo_key": "bitan-pharmacy",
|
||
"github_repo": "owenhytsai/bitan-pharmacy",
|
||
"source_key": "bitan-pharmacy",
|
||
"scope_status": "in_scope",
|
||
"risk": "MEDIUM",
|
||
"rollback_state": "draft_waiting_owner_review",
|
||
"primary_ready": false,
|
||
"fallback_role": "Current local / 110 source remains evidence source until active-state and GitHub target are approved.",
|
||
"required_owner_decisions": [
|
||
"repo active or archive decision",
|
||
"GitHub target decision",
|
||
"secret name / deploy owner decision",
|
||
"rollback owner"
|
||
],
|
||
"rollback_evidence_required": [
|
||
"GitHub target visibility decision",
|
||
"repository secret name parity or no-secret attestation",
|
||
"active-state owner decision",
|
||
"post-cutover smoke check if active"
|
||
],
|
||
"rollback_triggers": [
|
||
"repo is confirmed inactive or out of scope",
|
||
"GitHub target cannot be verified",
|
||
"owner cannot confirm deploy / secret requirements"
|
||
],
|
||
"manual_recovery_outline": [
|
||
"Keep repo out of primary cutover queue until owner decision exists.",
|
||
"Do not create GitHub target automatically.",
|
||
"If inactive, record owner decision rather than deleting source."
|
||
],
|
||
"execution_authorized": false,
|
||
"still_forbidden": [
|
||
"auto_create_repo",
|
||
"push_refs",
|
||
"delete_110_remote",
|
||
"switch_github_primary"
|
||
]
|
||
},
|
||
{
|
||
"repo_key": "tsenyang-website",
|
||
"github_repo": "owenhytsai/tsenyang-website",
|
||
"source_key": "tsenyang-website",
|
||
"scope_status": "in_scope",
|
||
"risk": "MEDIUM",
|
||
"rollback_state": "draft_waiting_owner_review",
|
||
"primary_ready": false,
|
||
"fallback_role": "Current local / 110 source remains evidence source until active-state and GitHub target are approved.",
|
||
"required_owner_decisions": [
|
||
"repo active or archive decision",
|
||
"GitHub target decision",
|
||
"secret name / deploy owner decision",
|
||
"rollback owner"
|
||
],
|
||
"rollback_evidence_required": [
|
||
"GitHub target visibility decision",
|
||
"repository secret name parity or no-secret attestation",
|
||
"active-state owner decision",
|
||
"post-cutover smoke check if active"
|
||
],
|
||
"rollback_triggers": [
|
||
"repo is confirmed inactive or out of scope",
|
||
"GitHub target cannot be verified",
|
||
"owner cannot confirm deploy / secret requirements"
|
||
],
|
||
"manual_recovery_outline": [
|
||
"Keep repo out of primary cutover queue until owner decision exists.",
|
||
"Do not create GitHub target automatically.",
|
||
"If inactive, record owner decision rather than deleting source."
|
||
],
|
||
"execution_authorized": false,
|
||
"still_forbidden": [
|
||
"auto_create_repo",
|
||
"push_refs",
|
||
"delete_110_remote",
|
||
"switch_github_primary"
|
||
]
|
||
},
|
||
{
|
||
"repo_key": "open-design",
|
||
"github_repo": "nexu-io/open-design",
|
||
"source_key": "open-design",
|
||
"scope_status": "external_scope_review",
|
||
"risk": "LOW",
|
||
"rollback_state": "scope_review_only",
|
||
"primary_ready": false,
|
||
"fallback_role": "Not in AWOOOI primary cutover scope until ownership is confirmed.",
|
||
"required_owner_decisions": [
|
||
"scope ownership decision"
|
||
],
|
||
"rollback_evidence_required": [
|
||
"scope review evidence"
|
||
],
|
||
"rollback_triggers": [
|
||
"repo is later confirmed in scope and needs a separate ADR"
|
||
],
|
||
"manual_recovery_outline": [
|
||
"Keep out of primary queue.",
|
||
"Create a separate in-scope approval item if ownership changes."
|
||
],
|
||
"execution_authorized": false,
|
||
"still_forbidden": [
|
||
"加入 primary cutover queue",
|
||
"修改 repo visibility",
|
||
"sync refs"
|
||
]
|
||
},
|
||
{
|
||
"repo_key": "vibework",
|
||
"github_repo": "owenhytsai/VibeWork",
|
||
"source_key": "vibework",
|
||
"scope_status": "in_scope",
|
||
"risk": "HIGH",
|
||
"rollback_state": "draft_waiting_owner_review",
|
||
"primary_ready": false,
|
||
"fallback_role": "VibeWork remains an independent product source until owner-approved canonical, target, secret parity, and rollback decisions exist.",
|
||
"required_owner_decisions": [
|
||
"VibeWork independent product boundary decision",
|
||
"GitHub / Gitea target and canonical source decision",
|
||
"secret name / deploy owner decision",
|
||
"rollback owner"
|
||
],
|
||
"rollback_evidence_required": [
|
||
"repo / product / surface / owner evidence refs",
|
||
"workflow or no-workflow owner attestation",
|
||
"repository secret name parity or no-secret attestation",
|
||
"post-cutover product smoke checklist if later approved"
|
||
],
|
||
"rollback_triggers": [
|
||
"VibeWork product boundary becomes ambiguous",
|
||
"GitHub target or canonical source cannot be verified",
|
||
"owner cannot confirm deploy / secret requirements"
|
||
],
|
||
"manual_recovery_outline": [
|
||
"Keep VibeWork out of primary cutover queue until owner decision exists.",
|
||
"Do not create or push GitHub target automatically.",
|
||
"If out of scope or independent-only, record owner decision rather than changing source control."
|
||
],
|
||
"execution_authorized": false,
|
||
"still_forbidden": [
|
||
"auto_create_repo",
|
||
"push_refs",
|
||
"modify_workflow",
|
||
"move_secret_values",
|
||
"switch_github_primary",
|
||
"merge_product_boundary"
|
||
]
|
||
},
|
||
{
|
||
"repo_key": "agent-bounty-protocol",
|
||
"github_repo": "owenhytsai/agent-bounty-protocol",
|
||
"source_key": "agent-bounty-protocol",
|
||
"scope_status": "in_scope",
|
||
"risk": "HIGH",
|
||
"rollback_state": "draft_waiting_owner_review",
|
||
"primary_ready": false,
|
||
"fallback_role": "Current local / Gitea workflow evidence remains read-only source until owner-approved target, runner, secret parity, and execution-boundary decisions exist.",
|
||
"required_owner_decisions": [
|
||
"GitHub / Gitea target and canonical source decision",
|
||
"agent / bounty / treasury / MCP / A2A execution surface decision",
|
||
"runner label / branch protection / secret name owner decision",
|
||
"rollback owner"
|
||
],
|
||
"rollback_evidence_required": [
|
||
"workflow file and runner label evidence",
|
||
"branch protection / CODEOWNERS redacted export or no-data attestation",
|
||
"repository secret name parity or no-secret attestation",
|
||
"agent / bounty runtime gate checklist if later approved"
|
||
],
|
||
"rollback_triggers": [
|
||
"agent / bounty execution surface is mistaken for runtime authorization",
|
||
"runner owner or branch protection cannot be verified",
|
||
"GitHub target or canonical source conflicts with local workflow evidence"
|
||
],
|
||
"manual_recovery_outline": [
|
||
"Keep repository in read-only governance until owner decision exists.",
|
||
"Do not change workflow, runner, or source-control primary automatically.",
|
||
"If execution scope is unclear, hold at owner response and runtime gate remains 0."
|
||
],
|
||
"execution_authorized": false,
|
||
"still_forbidden": [
|
||
"auto_create_repo",
|
||
"push_refs",
|
||
"modify_workflow",
|
||
"enable_runner",
|
||
"move_secret_values",
|
||
"switch_github_primary",
|
||
"runtime_execute_agent_bounty"
|
||
]
|
||
}
|
||
],
|
||
"rollback_owner_handoff": {
|
||
"status": "ready_not_dispatched",
|
||
"package_ready": true,
|
||
"handoff_completion_percent": 100,
|
||
"repo_template_count": 7,
|
||
"preflight_checks": [
|
||
{
|
||
"check_id": "preflight-latest-source-control-baseline",
|
||
"title": "送件前確認 gitea/main、P1-2、P1-3、P1-4 與 S4.13 最新狀態",
|
||
"completion_state": "defined_not_dispatched",
|
||
"current_status": "已定義，未送件"
|
||
},
|
||
{
|
||
"check_id": "preflight-seven-in-scope-repos-only",
|
||
"title": "只向 9 個 in-scope repos 收 rollback owner / fallback / trigger / validation 回覆",
|
||
"completion_state": "defined_not_dispatched",
|
||
"current_status": "已定義，未送件"
|
||
},
|
||
{
|
||
"check_id": "preflight-fallback-role-kept",
|
||
"title": "回覆必須確認 Gitea 或現行來源仍保留 fallback 角色",
|
||
"completion_state": "defined_not_dispatched",
|
||
"current_status": "已定義，未送件"
|
||
},
|
||
{
|
||
"check_id": "preflight-validation-windows-bound",
|
||
"title": "每個 repo 必須對應 pre-cutover、1h、24h 三個驗證窗口",
|
||
"completion_state": "defined_not_dispatched",
|
||
"current_status": "已定義，未送件"
|
||
},
|
||
{
|
||
"check_id": "preflight-redacted-evidence-only",
|
||
"title": "只收 owner role/team、決策理由、脫敏 evidence ref 與 follow-up owner",
|
||
"completion_state": "defined_not_dispatched",
|
||
"current_status": "已定義，未送件"
|
||
},
|
||
{
|
||
"check_id": "preflight-no-cutover-or-rollback-command",
|
||
"title": "primary switch、rollback execution、refs sync、workflow/secret 變更與 Gitea disable 全部拒收",
|
||
"completion_state": "defined_not_dispatched",
|
||
"current_status": "已定義，未送件"
|
||
}
|
||
],
|
||
"handoff_packet": {
|
||
"request_id": "p1_5_primary_rollback_owner_handoff",
|
||
"stage_id": "S4.4",
|
||
"prerequisite_gates": [
|
||
"S4.9 Gitea owner response gate",
|
||
"P1-2 Gitea authenticated inventory request handoff",
|
||
"P1-3 GitHub target owner response handoff",
|
||
"P1-4 workflow / secret owner response handoff",
|
||
"S4.13 owner response validation rollup"
|
||
],
|
||
"requested_repo_templates": [
|
||
"awoooi",
|
||
"clawbot-v5",
|
||
"wooo-aiops",
|
||
"wooo-infra-config",
|
||
"ewoooc",
|
||
"bitan-pharmacy",
|
||
"tsenyang-website"
|
||
],
|
||
"recipient_role_or_team": "repo owner / release owner / fallback owner role only；不收個人 credential",
|
||
"required_response_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"fallback_role_confirmation",
|
||
"rollback_trigger_scope",
|
||
"validation_window_owner",
|
||
"redacted_evidence_refs",
|
||
"followup_owner"
|
||
],
|
||
"validation_window_refs": [
|
||
"pre_cutover_freeze_review",
|
||
"post_cutover_one_hour_observe",
|
||
"post_cutover_twenty_four_hour_review"
|
||
],
|
||
"allowed_evidence_refs": [
|
||
"docs/security/source-control-primary-readiness-gate.snapshot.json",
|
||
"docs/security/source-control-ref-truth-owner-response.snapshot.json",
|
||
"docs/security/github-target-owner-decision-response.snapshot.json",
|
||
"docs/security/source-control-workflow-secret-name-owner-response.snapshot.json",
|
||
"docs/security/source-control-owner-response-validation-rollup.snapshot.json"
|
||
],
|
||
"forbidden_inputs": [
|
||
"token value",
|
||
"secret value",
|
||
"private key",
|
||
"runner registration token",
|
||
"webhook secret",
|
||
"repo write instruction",
|
||
"refs sync or delete instruction",
|
||
"GitHub primary switch request",
|
||
"rollback execution request",
|
||
"Gitea disable or archive request",
|
||
"active scan or host maintenance request"
|
||
],
|
||
"not_approval": true,
|
||
"request_dispatch_authorized": false
|
||
},
|
||
"repo_owner_response_templates": [
|
||
{
|
||
"repo_key": "awoooi",
|
||
"github_repo": "owenhytsai/awoooi",
|
||
"rollback_owner_status": "waiting_owner_response",
|
||
"fallback_role_confirmation_required": true,
|
||
"trigger_review_required": true,
|
||
"validation_window_refs": [
|
||
"pre_cutover_freeze_review",
|
||
"post_cutover_one_hour_observe",
|
||
"post_cutover_twenty_four_hour_review"
|
||
],
|
||
"required_response_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"fallback_role_confirmation",
|
||
"rollback_trigger_scope",
|
||
"validation_window_owner",
|
||
"redacted_evidence_refs",
|
||
"followup_owner"
|
||
],
|
||
"response_received": false,
|
||
"response_accepted": false,
|
||
"primary_ready": false,
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"repo_key": "clawbot-v5",
|
||
"github_repo": "owenhytsai/clawbot-v5",
|
||
"rollback_owner_status": "waiting_owner_response",
|
||
"fallback_role_confirmation_required": true,
|
||
"trigger_review_required": true,
|
||
"validation_window_refs": [
|
||
"pre_cutover_freeze_review",
|
||
"post_cutover_one_hour_observe",
|
||
"post_cutover_twenty_four_hour_review"
|
||
],
|
||
"required_response_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"fallback_role_confirmation",
|
||
"rollback_trigger_scope",
|
||
"validation_window_owner",
|
||
"redacted_evidence_refs",
|
||
"followup_owner"
|
||
],
|
||
"response_received": false,
|
||
"response_accepted": false,
|
||
"primary_ready": false,
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"repo_key": "wooo-aiops",
|
||
"github_repo": "owenhytsai/wooo-aiops",
|
||
"rollback_owner_status": "waiting_owner_response",
|
||
"fallback_role_confirmation_required": true,
|
||
"trigger_review_required": true,
|
||
"validation_window_refs": [
|
||
"pre_cutover_freeze_review",
|
||
"post_cutover_one_hour_observe",
|
||
"post_cutover_twenty_four_hour_review"
|
||
],
|
||
"required_response_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"fallback_role_confirmation",
|
||
"rollback_trigger_scope",
|
||
"validation_window_owner",
|
||
"redacted_evidence_refs",
|
||
"followup_owner"
|
||
],
|
||
"response_received": false,
|
||
"response_accepted": false,
|
||
"primary_ready": false,
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"repo_key": "wooo-infra-config",
|
||
"github_repo": "owenhytsai/wooo-infra-config",
|
||
"rollback_owner_status": "waiting_owner_response",
|
||
"fallback_role_confirmation_required": true,
|
||
"trigger_review_required": true,
|
||
"validation_window_refs": [
|
||
"pre_cutover_freeze_review",
|
||
"post_cutover_one_hour_observe",
|
||
"post_cutover_twenty_four_hour_review"
|
||
],
|
||
"required_response_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"fallback_role_confirmation",
|
||
"rollback_trigger_scope",
|
||
"validation_window_owner",
|
||
"redacted_evidence_refs",
|
||
"followup_owner"
|
||
],
|
||
"response_received": false,
|
||
"response_accepted": false,
|
||
"primary_ready": false,
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"repo_key": "ewoooc",
|
||
"github_repo": "owenhytsai/ewoooc",
|
||
"rollback_owner_status": "waiting_owner_response",
|
||
"fallback_role_confirmation_required": true,
|
||
"trigger_review_required": true,
|
||
"validation_window_refs": [
|
||
"pre_cutover_freeze_review",
|
||
"post_cutover_one_hour_observe",
|
||
"post_cutover_twenty_four_hour_review"
|
||
],
|
||
"required_response_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"fallback_role_confirmation",
|
||
"rollback_trigger_scope",
|
||
"validation_window_owner",
|
||
"redacted_evidence_refs",
|
||
"followup_owner"
|
||
],
|
||
"response_received": false,
|
||
"response_accepted": false,
|
||
"primary_ready": false,
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"repo_key": "bitan-pharmacy",
|
||
"github_repo": "owenhytsai/bitan-pharmacy",
|
||
"rollback_owner_status": "waiting_owner_response",
|
||
"fallback_role_confirmation_required": true,
|
||
"trigger_review_required": true,
|
||
"validation_window_refs": [
|
||
"pre_cutover_freeze_review",
|
||
"post_cutover_one_hour_observe",
|
||
"post_cutover_twenty_four_hour_review"
|
||
],
|
||
"required_response_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"fallback_role_confirmation",
|
||
"rollback_trigger_scope",
|
||
"validation_window_owner",
|
||
"redacted_evidence_refs",
|
||
"followup_owner"
|
||
],
|
||
"response_received": false,
|
||
"response_accepted": false,
|
||
"primary_ready": false,
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"repo_key": "tsenyang-website",
|
||
"github_repo": "owenhytsai/tsenyang-website",
|
||
"rollback_owner_status": "waiting_owner_response",
|
||
"fallback_role_confirmation_required": true,
|
||
"trigger_review_required": true,
|
||
"validation_window_refs": [
|
||
"pre_cutover_freeze_review",
|
||
"post_cutover_one_hour_observe",
|
||
"post_cutover_twenty_four_hour_review"
|
||
],
|
||
"required_response_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"fallback_role_confirmation",
|
||
"rollback_trigger_scope",
|
||
"validation_window_owner",
|
||
"redacted_evidence_refs",
|
||
"followup_owner"
|
||
],
|
||
"response_received": false,
|
||
"response_accepted": false,
|
||
"primary_ready": false,
|
||
"execution_authorized": false
|
||
}
|
||
],
|
||
"post_handoff_invariants": [
|
||
"request dispatch authorized 仍為 false，未送件前不得增加 request_sent_count。",
|
||
"owner response received / accepted / rejected 全部維持 0。",
|
||
"owner response 通過前不得把任何 repo 標記 primary_ready。",
|
||
"dry-run completed count 與 active cutover count 維持 0。",
|
||
"不得把 rollback owner handoff 當成 GitHub primary approval、rollback execution approval 或 Gitea disable approval。",
|
||
"未來即使 owner response 通過，也只能更新 read-only rollback ADR、primary readiness wording、approval board 與 status rollup。"
|
||
]
|
||
},
|
||
"rollback_triggers": [
|
||
"main/dev SHA 或 tag parity 與 owner-approved truth 不一致",
|
||
"workflow、webhook、runner、deploy key、branch protection 或 repository secret name parity evidence 不完整",
|
||
"GitHub hosted runner 使用量或 billing risk 超出 owner-approved 範圍",
|
||
"deploy marker、release workflow 或 required status check 在 cutover 後失敗",
|
||
"duplicate webhook 造成重複部署、重複通知或 approval queue 重複事件",
|
||
"owner / visibility / canonical decision 被撤回或出現衝突",
|
||
"post-cutover 1h 或 24h validation window 未通過"
|
||
],
|
||
"validation_windows": [
|
||
{
|
||
"window_id": "pre_cutover_freeze_review",
|
||
"title": "切換前 freeze review",
|
||
"required_checks": [
|
||
"確認 refs truth、workflow / secret export、owner / visibility / canonical、rollback owner 全部已批准",
|
||
"確認沒有 unresolved HIGH risk blocker",
|
||
"確認 Gitea fallback 保持可用"
|
||
],
|
||
"failure_handling": "任何缺口都只回到 approval review，不執行 cutover。",
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"window_id": "post_cutover_one_hour_observe",
|
||
"title": "切換後 1 小時觀察窗口",
|
||
"required_checks": [
|
||
"deploy workflow / required checks 成功",
|
||
"webhook 沒有重複事件",
|
||
"runner 使用符合 owner-approved self-hosted / hosted policy",
|
||
"核心服務健康與告警量未異常升高"
|
||
],
|
||
"failure_handling": "只建立 rollback approval candidate；不得自動切回或自動改 webhook。",
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"window_id": "post_cutover_twenty_four_hour_review",
|
||
"title": "切換後 24 小時 review",
|
||
"required_checks": [
|
||
"refs、deploy、webhook、runner、secret name parity 沒有新增 drift",
|
||
"AwoooP audit evidence 完整",
|
||
"repo owner 確認可維持 GitHub primary 或要求 rollback review"
|
||
],
|
||
"failure_handling": "若未通過，保留 Gitea fallback 並等待人工 rollback decision record。",
|
||
"execution_authorized": false
|
||
}
|
||
],
|
||
"acceptance_rules": [
|
||
"本 ADR 草案完成不代表任何 repo 可切 GitHub primary。",
|
||
"每個 in-scope repo 必須有 owner-approved rollback plan、pre-cutover evidence、post-cutover validation window 與 rollback owner。",
|
||
"任何 rollback 或 primary switch 都必須另有 runtime gate 與人工批准，不得由本 snapshot 自動觸發。",
|
||
"Gitea fallback 不得在 24h review 完成前停用、刪除、封存或降級。",
|
||
"任何 secret、token、cookie、private key、webhook secret 或 runner token 都不得保存。"
|
||
],
|
||
"forbidden_actions": [
|
||
"switch_github_primary",
|
||
"execute_rollback",
|
||
"create_github_repo",
|
||
"change_repo_visibility",
|
||
"sync_git_refs",
|
||
"delete_git_refs",
|
||
"force_push",
|
||
"modify_webhook",
|
||
"modify_workflow",
|
||
"modify_branch_protection",
|
||
"move_secret_values",
|
||
"disable_gitea",
|
||
"delete_or_archive_gitea_repo",
|
||
"add_action_button"
|
||
]
|
||
}
|