awoooi/docs/security/K8S-ARGOCD-OWNER-RESPONSE-ACCEPTANCE.md

# IwoooS K8s / ArgoCD Owner Response Acceptance 只讀帳本

| 項目 | 內容 |
|------|------|
| 日期 | 2026-06-15 |
| 狀態 | `owner_response_acceptance_ledger_ready_no_runtime_action` |
| 工具 | `scripts/security/k8s-argocd-owner-response-acceptance.py` |
| Snapshot | `docs/security/k8s-argocd-owner-response-acceptance.snapshot.json` |
| 來源 | `k8s-argocd-manifest-inventory.snapshot.json`、`k8s-argocd-owner-request-draft.snapshot.json` |
| runtime gate | `0` |

## 1. 目的

本文件把 K8s / ArgoCD manifest repo-only 清冊與 owner request draft 串成 owner response acceptance 只讀帳本。目的不是讀 live cluster，也不是執行 ArgoCD sync 或 `kubectl`，而是固定未來 owner 回覆要如何被 reviewer 收件、補件、隔離、拒收或進入 rendered manifest review。

本階段不呼叫 ArgoCD API、不讀 live cluster、不執行 `kubectl`、不套用 manifest、不跑 Helm、不讀 Secret value、不重啟 Pod、不 scale workload、不改 RBAC / NetworkPolicy、不 restore backup、不寫 production。

## 2. 摘要

| 指標 | 目前值 | 說明 |
|------|--------|------|
| source scan group | `4` | production、ArgoCD、Velero、monitoring |
| source request draft | `4` | 承接 owner request draft |
| acceptance candidate | `4` | 對應四個 scan group |
| C0 / C1 acceptance candidate | `3 / 1` | production、ArgoCD、Velero 為 C0；monitoring 為 C1 |
| acceptance field | `20` | 每份 acceptance candidate 固定欄位數 |
| required owner field | `11` | 承接 owner request draft 的必填欄位 |
| reviewer check | `12` | reviewer 收件前必檢項 |
| outcome lane | `7` | 等待、隔離、拒收、補件、review、只讀更新、等待 runtime gate |
| blocked action | `18` | 驗收前全部禁止 |
| owner response received / accepted | `0 / 0` | 不得假性拉高 |
| ArgoCD API read / sync / kubectl | `0` | 未授權且未執行 |
| runtime gate / action button | `0 / 0` | 不開任何執行入口 |

## 3. Owner 必填欄位

| 欄位 | 說明 |
|------|------|
| `owner_role_or_team` | GitOps / Kubernetes / ArgoCD owner role 或 team |
| `decision` | 對本 scan group 的回覆判定 |
| `decision_reason` | 決策理由，不得包含機敏值 |
| `affected_scope` | 受影響 namespace、Application、manifest group 或 workload scope |
| `redacted_evidence_refs` | 文件、hash、ticket、commit 或脫敏 artifact pointer |
| `argocd_health_readback_ref` | owner-provided health readback ref；不得觸發 live API read |
| `argocd_sync_revision_ref` | sync revision / desired revision ref；不代表 sync 授權 |
| `rollback_revision` | rollback revision 或明確禁止窗口 |
| `followup_owner` | 補件、隔離、拒收或下一步 review owner |
| `maintenance_window` | 維護窗口或禁止窗口 |
| `validation_plan` | health、rollout、metric、alert、rollback post-check plan |

## 4. Reviewer Checks

| Check | 規則 |
|-------|------|
| `owner_identity_present` | owner role / team 必須可追溯 |
| `decision_reason_present` | decision 與 decision reason 必須同時存在 |
| `affected_scope_matches_group` | affected scope 必須能對回 committed scan group 與 root path |
| `redacted_refs_only` | evidence 只能是脫敏 ref、hash、ticket、commit 或 artifact pointer |
| `secret_value_absent` | 不得出現 Secret value、token、cookie、private key、完整 kubeconfig 或 credential derivative |
| `argocd_health_readback_ref_shape` | ArgoCD health readback 只能是 owner-provided redacted ref |
| `argocd_sync_revision_ref_not_execution` | sync revision ref 只做 rollback / diff 判讀，不得自動 sync |
| `rollback_revision_present` | C0 / C1 回覆都必須有 rollback revision 或明確禁止窗口 |
| `rendered_manifest_diff_ref_not_payload` | rendered manifest diff 只能是 ref，不得貼 manifest payload |
| `maintenance_window_present` | 未來 ArgoCD sync / kubectl action 必須另有維護窗口 |
| `validation_plan_present` | validation plan 必須列 health、rollout、metric、alert 與 rollback post-check |
| `counts_transition_safe` | 只有 reviewer record 可更新 received / accepted / rejected；不得同時開 runtime gate |

## 5. Outcome Lanes

| Lane | 意義 |
|------|------|
| `waiting_owner_response` | 尚未收到 owner response；所有 accepted / runtime count 維持 0 |
| `quarantine_raw_payload` | 收到 raw manifest、kubeconfig、Secret value 或不可保存內容時只能隔離 |
| `reject_secret_or_unredacted_manifest` | 出現 secret value、未脫敏 manifest payload 或 credential derivative 時直接拒收 |
| `request_supplement` | 欄位不足、scope 不清、rollback 缺失或 evidence ref 不可追溯時要求補件 |
| `ready_for_rendered_manifest_review` | metadata 合格後，只能進 rendered manifest diff reviewer review |
| `owner_review_only_update` | 只允許更新只讀 owner review ledger |
| `waiting_runtime_gate` | 即使 owner response accepted，runtime gate 仍等待獨立人工批准 |

## 6. Blocked Actions

```text
argocd_api_read_without_approval
live_cluster_read_without_approval
argocd_sync
kubectl_apply
kubectl_patch
kubectl_delete
helm_upgrade
secret_value_collection
live_cluster_write
manual_pod_restart
scale_workload
change_network_policy
change_rbac
restore_backup
render_manifest_diff_from_untrusted_payload
mark_owner_response_accepted_without_reviewer_record
open_runtime_gate
add_action_button
```

## 7. 指令

固定 committed snapshot：

```bash
python3 scripts/security/k8s-argocd-owner-response-acceptance.py \
  --root . \
  --output docs/security/k8s-argocd-owner-response-acceptance.snapshot.json \
  --generated-at 2026-06-15T00:08:00+08:00
```

只讀 guard：

```bash
python3 scripts/security/security-mirror-progress-guard.py --root .
python3 scripts/security/source-control-owner-response-guard.py --root .
```

## 8. 完成度

| 工作 | 完成度 | 說明 |
|------|--------|------|
| owner response acceptance ledger artifact | `100%` | 4 個 scan group 已有只讀收件判定帳本 |
| owner response received / accepted | `0%` | 尚未收到或接受任何 owner response |
| rendered manifest diff / ArgoCD readback | `0%` | 未產生、未接收、未讀 live API |
| ArgoCD sync / kubectl / Helm | `0%` | 未授權且未執行 |
| Secret / live cluster / production write | `0%` | 未讀 Secret value、未寫 cluster |
| runtime gate / production write | `0%` | 無 action button，無 production write |

## 9. 邊界

這份帳本不是 live cluster truth、不是 ArgoCD health readback、不是 ArgoCD sync 批准、不是 `kubectl` 授權、不是 Helm upgrade、不是 Secret collection、不是 RBAC / NetworkPolicy 變更，也不是 restore backup 或 runtime gate。不得把 owner response acceptance ledger、snapshot、LOGBOOK、IwoooS UI 或 AwoooP approval 解讀成可以讀 live cluster、sync ArgoCD、套用 manifest、重啟 Pod、scale workload、讀 secret、寫 production 或開 action button。