601 lines
20 KiB
JSON
601 lines
20 KiB
JSON
{
|
|
"schema_version": "iwooos_posture_projection_v1",
|
|
"status": "draft",
|
|
"date": "2026-05-19",
|
|
"product_id": "iwooos",
|
|
"display_name": "IwoooS",
|
|
"mode": "mirror_only",
|
|
"source_paths": [
|
|
"docs/security/security-mirror-status-rollup.snapshot.json",
|
|
"docs/security/security-rollout-policy.snapshot.json",
|
|
"docs/security/source-control-owner-response-validation-rollup.snapshot.json",
|
|
"docs/security/kali-integration-status.snapshot.json",
|
|
"apps/web/src/app/[locale]/iwooos/page.tsx",
|
|
"apps/web/src/app/[locale]/security-compliance/page.tsx",
|
|
"apps/web/src/app/[locale]/security/page.tsx",
|
|
"apps/web/src/app/[locale]/compliance/page.tsx",
|
|
"apps/web/src/app/[locale]/alerts/page.tsx",
|
|
"apps/web/src/app/[locale]/errors/page.tsx",
|
|
"apps/web/src/app/[locale]/authorizations/page.tsx",
|
|
"apps/web/src/app/[locale]/governance/page.tsx",
|
|
"apps/web/src/app/[locale]/alert-operation-logs/page.tsx",
|
|
"apps/web/src/app/[locale]/awooop/approvals/page.tsx",
|
|
"apps/web/src/app/[locale]/code-review/page.tsx"
|
|
],
|
|
"summary": {
|
|
"route_path": "/iwooos",
|
|
"nav_entry_added": true,
|
|
"command_palette_entry_added": true,
|
|
"contract_count": 36,
|
|
"active_runtime_gate_count": 0,
|
|
"approval_queue_total": 8,
|
|
"pending_approval_count": 7,
|
|
"block_candidate_count": 1,
|
|
"owner_response_validation_received_count": 0,
|
|
"owner_response_validation_accepted_count": 0,
|
|
"github_primary_ready_count": 0,
|
|
"action_buttons_allowed": false,
|
|
"existing_frontend_surface_count": 10,
|
|
"frontend_surface_coverage_group_count": 4,
|
|
"frontend_surface_conflict_control_count": 5,
|
|
"operator_journey_step_count": 6,
|
|
"owner_evidence_readiness_item_count": 7
|
|
},
|
|
"progress": {
|
|
"overall_percent": 58,
|
|
"framework_percent_min": 80,
|
|
"framework_percent_max": 85,
|
|
"runtime_landing_percent_min": 35,
|
|
"runtime_landing_percent_max": 40,
|
|
"headline_status": "holding_until_owner_response_or_runtime_gate",
|
|
"not_authorization": true
|
|
},
|
|
"posture_pillars": [
|
|
{
|
|
"pillar_id": "exposure_posture",
|
|
"display_order": 1,
|
|
"display_state": "waiting_evidence",
|
|
"source_contract": "security_mirror_status_rollup_v1",
|
|
"display_mode": "posture_only",
|
|
"runtime_execution_authorized": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"pillar_id": "source_control_supply_chain",
|
|
"display_order": 2,
|
|
"display_state": "draft_gated",
|
|
"source_contract": "source_control_owner_response_validation_rollup_v1",
|
|
"display_mode": "posture_only",
|
|
"runtime_execution_authorized": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"pillar_id": "kali_112_mesh",
|
|
"display_order": 3,
|
|
"display_state": "observe_only",
|
|
"source_contract": "kali_integration_status_v1",
|
|
"display_mode": "posture_only",
|
|
"runtime_execution_authorized": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"pillar_id": "approval_boundary",
|
|
"display_order": 4,
|
|
"display_state": "locked",
|
|
"source_contract": "security_approval_gate_v1",
|
|
"display_mode": "posture_only",
|
|
"runtime_execution_authorized": false,
|
|
"not_authorization": true
|
|
}
|
|
],
|
|
"non_blocking_lane_ids": [
|
|
"lane-low-medium-observation",
|
|
"lane-owner-response-missing",
|
|
"lane-mirror-data-incomplete",
|
|
"lane-source-control-drift-draft",
|
|
"lane-kali-observe-finding",
|
|
"lane-workflow-secret-name-gap",
|
|
"lane-progress-display-holding"
|
|
],
|
|
"evidence_refs": [
|
|
"docs/security/iwooos-posture-projection.snapshot.json",
|
|
"docs/security/security-rollout-policy.snapshot.json",
|
|
"docs/security/security-mirror-status-rollup.snapshot.json",
|
|
"docs/security/source-control-owner-response-validation-rollup.snapshot.json",
|
|
"docs/security/kali-integration-status.snapshot.json"
|
|
],
|
|
"allowed_frontend_outputs": [
|
|
"display_security_posture",
|
|
"display_progress_estimate",
|
|
"display_non_blocking_lanes",
|
|
"display_existing_frontend_security_surfaces",
|
|
"display_frontend_surface_coverage_matrix",
|
|
"display_frontend_surface_conflict_controls",
|
|
"display_operator_journey_steps",
|
|
"display_owner_evidence_readiness_board",
|
|
"display_evidence_refs",
|
|
"display_next_gate",
|
|
"display_forbidden_actions"
|
|
],
|
|
"forbidden_frontend_outputs": [
|
|
"add_scan_button",
|
|
"add_execute_button",
|
|
"add_repair_button",
|
|
"start_kali_scan",
|
|
"call_kali_execute_endpoint",
|
|
"create_github_repo",
|
|
"change_repo_visibility",
|
|
"sync_git_refs",
|
|
"modify_workflow_or_secret",
|
|
"enable_runner",
|
|
"switch_github_primary",
|
|
"production_deploy",
|
|
"treat_progress_as_authorization"
|
|
],
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true,
|
|
"existing_frontend_surfaces": [
|
|
{
|
|
"surface_id": "security_compliance",
|
|
"route_path": "/security-compliance",
|
|
"display_order": 1,
|
|
"source_page": "apps/web/src/app/[locale]/security-compliance/page.tsx",
|
|
"source_components": [
|
|
"SecurityPanel",
|
|
"CompliancePanel"
|
|
],
|
|
"source_api_routes": [
|
|
"/api/v1/errors/stats",
|
|
"/api/v1/errors/issues",
|
|
"/api/v1/stats/incidents/summary",
|
|
"/api/v1/auto-repair/stats"
|
|
],
|
|
"display_mode": "link_only",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"surface_id": "legacy_security",
|
|
"route_path": "/security",
|
|
"display_order": 2,
|
|
"source_page": "apps/web/src/app/[locale]/security/page.tsx",
|
|
"source_components": [],
|
|
"source_api_routes": [
|
|
"/api/v1/errors/stats",
|
|
"/api/v1/errors/issues"
|
|
],
|
|
"display_mode": "link_only",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"surface_id": "legacy_compliance",
|
|
"route_path": "/compliance",
|
|
"display_order": 3,
|
|
"source_page": "apps/web/src/app/[locale]/compliance/page.tsx",
|
|
"source_components": [],
|
|
"source_api_routes": [
|
|
"/api/v1/stats/incidents/summary",
|
|
"/api/v1/auto-repair/stats"
|
|
],
|
|
"display_mode": "link_only",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"surface_id": "alerts",
|
|
"route_path": "/alerts",
|
|
"display_order": 4,
|
|
"source_page": "apps/web/src/app/[locale]/alerts/page.tsx",
|
|
"source_components": [
|
|
"IncidentCard"
|
|
],
|
|
"source_api_routes": [
|
|
"/api/v1/incidents",
|
|
"/api/v1/approvals/pending"
|
|
],
|
|
"display_mode": "link_only",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"surface_id": "errors",
|
|
"route_path": "/errors",
|
|
"display_order": 5,
|
|
"source_page": "apps/web/src/app/[locale]/errors/page.tsx",
|
|
"source_components": [
|
|
"ErrorsPanel"
|
|
],
|
|
"source_api_routes": [
|
|
"/api/v1/errors/stats",
|
|
"/api/v1/errors/issues",
|
|
"/api/v1/errors/trends",
|
|
"/api/v1/errors/ux-audit"
|
|
],
|
|
"display_mode": "link_only",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"surface_id": "authorizations",
|
|
"route_path": "/authorizations",
|
|
"display_order": 6,
|
|
"source_page": "apps/web/src/app/[locale]/authorizations/page.tsx",
|
|
"source_components": [
|
|
"LiveApprovalPanel"
|
|
],
|
|
"source_api_routes": [
|
|
"/api/v1/approvals/pending"
|
|
],
|
|
"display_mode": "link_only",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"surface_id": "governance",
|
|
"route_path": "/governance",
|
|
"display_order": 7,
|
|
"source_page": "apps/web/src/app/[locale]/governance/page.tsx",
|
|
"source_components": [
|
|
"SloTab",
|
|
"EventsTab",
|
|
"QueueTab"
|
|
],
|
|
"source_api_routes": [
|
|
"/api/v1/ai/slo",
|
|
"/api/v1/ai/governance/summary",
|
|
"/api/v1/ai/governance/events",
|
|
"/api/v1/ai/governance/queue",
|
|
"/api/v1/ai/slo/remediation/history"
|
|
],
|
|
"display_mode": "link_only",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"surface_id": "alert_operation_logs",
|
|
"route_path": "/alert-operation-logs",
|
|
"display_order": 8,
|
|
"source_page": "apps/web/src/app/[locale]/alert-operation-logs/page.tsx",
|
|
"source_components": [],
|
|
"source_api_routes": [
|
|
"/api/v1/alert-operation-logs",
|
|
"/api/v1/alert-operation-logs/stats"
|
|
],
|
|
"display_mode": "link_only",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"surface_id": "awooop_approvals",
|
|
"route_path": "/awooop/approvals",
|
|
"display_order": 9,
|
|
"source_page": "apps/web/src/app/[locale]/awooop/approvals/page.tsx",
|
|
"source_components": [],
|
|
"source_api_routes": [
|
|
"/api/v1/platform/approvals"
|
|
],
|
|
"display_mode": "link_only",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"surface_id": "code_review",
|
|
"route_path": "/code-review",
|
|
"display_order": 10,
|
|
"source_page": "apps/web/src/app/[locale]/code-review/page.tsx",
|
|
"source_components": [],
|
|
"source_api_routes": [],
|
|
"display_mode": "link_only",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
}
|
|
],
|
|
"frontend_surface_coverage_groups": [
|
|
{
|
|
"group_id": "signals_and_exposure",
|
|
"display_order": 1,
|
|
"responsibility_plane": "detect_and_measure",
|
|
"surface_ids": [
|
|
"security_compliance",
|
|
"legacy_security",
|
|
"legacy_compliance",
|
|
"alerts",
|
|
"errors"
|
|
],
|
|
"display_mode": "coverage_only",
|
|
"overlap_control": "original_surface_retains_ownership",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"group_id": "human_control_boundary",
|
|
"display_order": 2,
|
|
"responsibility_plane": "human_gate_visibility",
|
|
"surface_ids": [
|
|
"authorizations",
|
|
"awooop_approvals"
|
|
],
|
|
"display_mode": "coverage_only",
|
|
"overlap_control": "approval_state_not_runtime_authorization",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"group_id": "governance_and_audit",
|
|
"display_order": 3,
|
|
"responsibility_plane": "governance_evidence",
|
|
"surface_ids": [
|
|
"governance",
|
|
"alert_operation_logs"
|
|
],
|
|
"display_mode": "coverage_only",
|
|
"overlap_control": "audit_event_not_execution_authorization",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"group_id": "engineering_review",
|
|
"display_order": 4,
|
|
"responsibility_plane": "code_review_followup",
|
|
"surface_ids": [
|
|
"code_review"
|
|
],
|
|
"display_mode": "coverage_only",
|
|
"overlap_control": "code_review_not_deploy_approval",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
}
|
|
],
|
|
"frontend_surface_conflict_controls": [
|
|
{
|
|
"control_id": "preserve_original_route_ownership",
|
|
"display_order": 1,
|
|
"control_scope": "route_ownership",
|
|
"blocked_misread": "iwooos_replaces_original_surface_owner",
|
|
"display_mode": "conflict_control_only",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"control_id": "no_runtime_lift_from_index",
|
|
"display_order": 2,
|
|
"control_scope": "runtime_authority",
|
|
"blocked_misread": "coverage_matrix_creates_runtime_gate",
|
|
"display_mode": "conflict_control_only",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"control_id": "code_review_not_deploy_gate",
|
|
"display_order": 3,
|
|
"control_scope": "engineering_review",
|
|
"blocked_misread": "code_review_link_is_deploy_approval",
|
|
"display_mode": "conflict_control_only",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"control_id": "awooop_approval_not_security_approval",
|
|
"display_order": 4,
|
|
"control_scope": "approval_semantics",
|
|
"blocked_misread": "awooop_approval_equals_security_gate_approval",
|
|
"display_mode": "conflict_control_only",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"control_id": "frontend_index_does_not_call_kali",
|
|
"display_order": 5,
|
|
"control_scope": "kali_boundary",
|
|
"blocked_misread": "frontend_index_authorizes_active_scan_or_execute",
|
|
"display_mode": "conflict_control_only",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
}
|
|
],
|
|
"operator_journey_steps": [
|
|
{
|
|
"step_id": "read_current_posture",
|
|
"display_order": 1,
|
|
"responsibility_plane": "iwooos_posture",
|
|
"source_refs": [
|
|
"security_mirror_status_rollup_v1",
|
|
"iwooos_posture_projection_v1"
|
|
],
|
|
"display_mode": "journey_only",
|
|
"allowed_outcome": "display_posture_only",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"step_id": "open_existing_security_surface",
|
|
"display_order": 2,
|
|
"responsibility_plane": "frontend_surface_index",
|
|
"source_refs": [
|
|
"existing_frontend_surfaces",
|
|
"frontend_surface_coverage_groups"
|
|
],
|
|
"display_mode": "journey_only",
|
|
"allowed_outcome": "navigate_to_existing_surface_without_changing_ownership",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"step_id": "triage_non_blocking_lane",
|
|
"display_order": 3,
|
|
"responsibility_plane": "low_friction_rollout",
|
|
"source_refs": [
|
|
"security_rollout_policy_v1"
|
|
],
|
|
"display_mode": "journey_only",
|
|
"allowed_outcome": "create_followup_without_blocking",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"step_id": "collect_owner_evidence",
|
|
"display_order": 4,
|
|
"responsibility_plane": "owner_response_validation",
|
|
"source_refs": [
|
|
"source_control_owner_response_validation_rollup_v1"
|
|
],
|
|
"display_mode": "journey_only",
|
|
"allowed_outcome": "update_received_or_accepted_state_after_redacted_review",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"step_id": "wait_for_human_decision",
|
|
"display_order": 5,
|
|
"responsibility_plane": "security_approval_decision_record",
|
|
"source_refs": [
|
|
"security_approval_gate_v1",
|
|
"security_approval_decision_record_v1"
|
|
],
|
|
"display_mode": "journey_only",
|
|
"allowed_outcome": "record_human_decision_only",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"step_id": "prepare_followup_runtime_gate",
|
|
"display_order": 6,
|
|
"responsibility_plane": "followup_runtime_gate",
|
|
"source_refs": [
|
|
"security_followup_runtime_gate_v1"
|
|
],
|
|
"display_mode": "journey_only",
|
|
"allowed_outcome": "wait_for_separate_runtime_gate_after_approval",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
}
|
|
],
|
|
"owner_evidence_readiness_items": [
|
|
{
|
|
"item_id": "s4_9_gitea_owner_attestation_response",
|
|
"display_order": 1,
|
|
"stage_id": "S4.9",
|
|
"source_contract": "source_control_owner_response_validation_rollup_v1",
|
|
"readiness_state": "next_collection_candidate",
|
|
"received_count": 0,
|
|
"accepted_count": 0,
|
|
"display_mode": "readiness_only",
|
|
"unlock_condition": "redacted_owner_response_received_and_accepted",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"item_id": "s4_10_github_target_owner_response",
|
|
"display_order": 2,
|
|
"stage_id": "S4.10",
|
|
"source_contract": "source_control_owner_response_validation_rollup_v1",
|
|
"readiness_state": "waiting_owner_response",
|
|
"received_count": 0,
|
|
"accepted_count": 0,
|
|
"display_mode": "readiness_only",
|
|
"unlock_condition": "github_target_owner_response_accepted",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"item_id": "s4_11_refs_truth_owner_response",
|
|
"display_order": 3,
|
|
"stage_id": "S4.11",
|
|
"source_contract": "source_control_owner_response_validation_rollup_v1",
|
|
"readiness_state": "waiting_owner_response",
|
|
"received_count": 0,
|
|
"accepted_count": 0,
|
|
"display_mode": "readiness_only",
|
|
"unlock_condition": "refs_truth_owner_response_accepted",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"item_id": "s4_12_workflow_secret_owner_response",
|
|
"display_order": 4,
|
|
"stage_id": "S4.12",
|
|
"source_contract": "source_control_owner_response_validation_rollup_v1",
|
|
"readiness_state": "waiting_owner_response",
|
|
"received_count": 0,
|
|
"accepted_count": 0,
|
|
"display_mode": "readiness_only",
|
|
"unlock_condition": "workflow_secret_name_owner_response_accepted",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"item_id": "s1_6_redacted_finding_ingestion",
|
|
"display_order": 5,
|
|
"stage_id": "S1.6",
|
|
"source_contract": "security_finding_v1",
|
|
"readiness_state": "approval_required",
|
|
"received_count": 0,
|
|
"accepted_count": 0,
|
|
"display_mode": "readiness_only",
|
|
"unlock_condition": "human_approved_redacted_finding_ingestion",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"item_id": "s1_6_kali_scan_scope_approval",
|
|
"display_order": 6,
|
|
"stage_id": "S1.6",
|
|
"source_contract": "kali_scan_scope_approval_v1",
|
|
"readiness_state": "approval_required",
|
|
"received_count": 0,
|
|
"accepted_count": 0,
|
|
"display_mode": "readiness_only",
|
|
"unlock_condition": "scan_scope_approval_and_followup_runtime_gate",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
},
|
|
{
|
|
"item_id": "s3_4_followup_runtime_gate",
|
|
"display_order": 7,
|
|
"stage_id": "S3.4",
|
|
"source_contract": "security_followup_runtime_gate_v1",
|
|
"readiness_state": "locked_until_human_decision",
|
|
"received_count": 0,
|
|
"accepted_count": 0,
|
|
"display_mode": "readiness_only",
|
|
"unlock_condition": "decision_record_accepted_then_separate_runtime_gate",
|
|
"runtime_execution_authorized": false,
|
|
"action_buttons_allowed": false,
|
|
"not_authorization": true
|
|
}
|
|
]
|
|
}
|