117 lines
5.1 KiB
JSON
117 lines
5.1 KiB
JSON
{
|
||
"execution_boundaries": {
|
||
"agent_identity_public_display_allowed": false,
|
||
"force_push_allowed": false,
|
||
"host_read_authorized": false,
|
||
"host_write_authorized": false,
|
||
"internal_ip_public_display_allowed": false,
|
||
"kali_active_scan_authorized": false,
|
||
"not_authorization": true,
|
||
"production_deploy_authorized": false,
|
||
"raw_wazuh_payload_storage_allowed": false,
|
||
"runtime_execution_authorized": false,
|
||
"secret_value_collection_allowed": false,
|
||
"wazuh_active_response_authorized": false,
|
||
"wazuh_api_live_query_authorized": false
|
||
},
|
||
"generated_at": "2026-06-24T22:48:00+08:00",
|
||
"missing_required_source_paths": [],
|
||
"mode": "repo_release_gate_no_runtime_no_secret_collection",
|
||
"operator_interpretation": [
|
||
"此 gate 通過不代表 production 已部署，只代表 source-side Wazuh read-only API 與 guard 可交接。",
|
||
"正式 release 前不得用 predeploy 404 當成功，也不得為了修 404 直接改 Nginx、Docker、K8s、firewall 或 Wazuh secret。",
|
||
"乾淨套用 proof 通過只代表 release patch 可落在最新主線，不代表已 push、已部署或已啟用 Wazuh live metadata。",
|
||
"live Wazuh metadata query 必須另走 owner gate 與 server-side env；active response、host write、Kali active scan 仍為 0 / false。"
|
||
],
|
||
"release_gates": [
|
||
{
|
||
"gate_id": "source_side_fastapi_route",
|
||
"required_evidence": "FastAPI /api/iwooos/wazuh 與 /api/v1/iwooos/wazuh source path present",
|
||
"runtime_authorized": false,
|
||
"status": "passed"
|
||
},
|
||
{
|
||
"gate_id": "source_boundary_guard",
|
||
"required_evidence": "wazuh-readonly-route-boundary-guard.py 通過",
|
||
"runtime_authorized": false,
|
||
"status": "passed"
|
||
},
|
||
{
|
||
"gate_id": "production_readback_script",
|
||
"required_evidence": "wazuh-readonly-production-readback.py 可在 release 後不接受 404",
|
||
"runtime_authorized": false,
|
||
"status": "passed"
|
||
},
|
||
{
|
||
"gate_id": "release_patch_apply_proof",
|
||
"required_evidence": "同等 patch 已可乾淨套用到最新 gitea/main 並通過同組 guard",
|
||
"runtime_authorized": false,
|
||
"status": "passed"
|
||
},
|
||
{
|
||
"gate_id": "gitea_branch_push",
|
||
"required_evidence": "具備正式權限的 lane 推送或合併 codex/iwooos-wazuh-boundary-guard-20260624",
|
||
"runtime_authorized": false,
|
||
"status": "blocked_credential_required"
|
||
},
|
||
{
|
||
"gate_id": "production_deploy",
|
||
"required_evidence": "Gitea CD / deploy marker 指向已合併 Wazuh fix 的 commit",
|
||
"runtime_authorized": false,
|
||
"status": "blocked_waiting_release_lane"
|
||
},
|
||
{
|
||
"gate_id": "production_readback",
|
||
"required_evidence": "python3 scripts/security/wazuh-readonly-production-readback.py --json 通過且不回 404",
|
||
"runtime_authorized": false,
|
||
"status": "blocked_waiting_deploy"
|
||
},
|
||
{
|
||
"gate_id": "wazuh_live_metadata_env",
|
||
"required_evidence": "server-side env 與 owner gate；不得硬編 secret",
|
||
"runtime_authorized": false,
|
||
"status": "blocked_owner_gate_required"
|
||
}
|
||
],
|
||
"release_lane_evidence": {
|
||
"apply_check_status": "passed_external_readback_required_after_final_commit",
|
||
"base_commit_readback": "run git rev-parse gitea/main before release; do not hardcode a moving main commit",
|
||
"base_ref": "gitea/main",
|
||
"gitea_push_blocker": "https_noninteractive_credential_required",
|
||
"production_readback_status": "predeploy_404_observed",
|
||
"release_patch_set_readback": "generate with git format-patch gitea/main..HEAD after the final docs commit, then record sha256 outside the committed file",
|
||
"source_branch": "codex/iwooos-wazuh-boundary-guard-20260624",
|
||
"source_fix_commit_readback": "run git log --oneline gitea/main..HEAD before release; do not hardcode a rebase-sensitive commit hash",
|
||
"source_head_readback": "run git rev-parse HEAD after the final docs commit; do not hardcode a self-referential commit hash"
|
||
},
|
||
"required_source_paths": [
|
||
"apps/api/src/api/v1/iwooos.py",
|
||
"apps/api/tests/test_iwooos_wazuh_api.py",
|
||
"apps/web/src/app/api/iwooos/wazuh/route.ts",
|
||
"docs/security/IWOOOS-WAZUH-READONLY-API-RELEASE-HANDOFF.md",
|
||
"scripts/security/wazuh-readonly-production-readback.py",
|
||
"scripts/security/wazuh-readonly-route-boundary-guard.py"
|
||
],
|
||
"schema_version": "iwooos_wazuh_readonly_release_gate_v1",
|
||
"status": "blocked_waiting_gitea_push_and_production_deploy",
|
||
"summary": {
|
||
"active_response_authorized_count": 0,
|
||
"gitea_push_blocker_observed_count": 1,
|
||
"gitea_push_complete_count": 0,
|
||
"host_forensics_ref_accepted_count": 0,
|
||
"host_write_authorized_count": 0,
|
||
"missing_required_source_path_count": 0,
|
||
"predeploy_404_observed_count": 1,
|
||
"production_deploy_complete_count": 0,
|
||
"production_readback_passed_count": 0,
|
||
"production_readback_script_complete_count": 1,
|
||
"release_handoff_complete_count": 1,
|
||
"release_patch_apply_proof_complete_count": 1,
|
||
"route_boundary_guard_complete_count": 1,
|
||
"runtime_gate_count": 0,
|
||
"source_side_fix_complete_count": 1,
|
||
"wazuh_event_ref_accepted_count": 0,
|
||
"wazuh_server_side_env_enabled_count": 0
|
||
}
|
||
}
|