170 lines
10 KiB
Markdown
170 lines
10 KiB
Markdown
# IwoooS Public Gateway Owner Response Acceptance 只讀帳本
|
||
|
||
| 項目 | 內容 |
|
||
|------|------|
|
||
| 日期 | 2026-06-15 |
|
||
| 狀態 | `owner_response_acceptance_ledger_ready_no_runtime_action` |
|
||
| 工具 | `scripts/security/public-gateway-owner-response-acceptance.py` |
|
||
| Snapshot | `docs/security/public-gateway-owner-response-acceptance.snapshot.json` |
|
||
| 來源 | `public-gateway-live-conf-export-request.snapshot.json`、`public-gateway-redacted-export-intake-preflight.snapshot.json`、`public-gateway-rendered-diff-gate-draft.snapshot.json` |
|
||
| runtime gate | `0` |
|
||
|
||
## 1. 目的
|
||
|
||
本文件把 Public Gateway live conf 匯出請求、redacted export 收件預檢、rendered diff / `nginx -t` gate 草稿串成 owner response acceptance 只讀帳本。目的不是執行 Nginx，而是固定未來 owner 回覆要如何被 reviewer 收件、補件、隔離、拒收或進入 rendered diff review。
|
||
|
||
本階段不讀 live Nginx conf、不 SSH、不執行 `nginx -t`、不 reload Nginx、不做 route smoke、不做 DNS / TLS probe、不 renew certbot、不改 Nginx / DNS / TLS 設定、不寫 production host、不開 action button。
|
||
|
||
2026-06-15 起，本帳本也負責處理手動或緊急 Public Gateway 變更的最小可追溯 metadata。任何疑似未授權 Nginx / route / upstream / port / proxy 變更，都必須先補脫敏 change actor/source ref、change time window、cross-project impact ref、communication sync ref、change intent / ticket ref、pre-change approval 或 break-glass reason ref、route health impact ref、rollback validation ref 與 post-change monitoring window；這些欄位只用於責任、影響與回復追蹤，不代表允許讀 live conf、reload 或改 route。
|
||
|
||
## 2. 摘要
|
||
|
||
| 指標 | 目前值 | 說明 |
|
||
|------|--------|------|
|
||
| source export request | `3` | 來自 live conf 匯出請求包 |
|
||
| source intake candidate | `3` | 來自 redacted export 收件預檢 |
|
||
| source diff gate candidate | `3` | 來自 rendered diff gate 草稿 |
|
||
| acceptance candidate | `3` | 對應三份 public gateway config |
|
||
| C0 / C1 acceptance candidate | `2 / 1` | 188 公開入口兩份為 C0，110 Ollama proxy 為 C1 |
|
||
| acceptance field | `33` | 每份 acceptance candidate 固定欄位數 |
|
||
| required owner response field | `22` | owner 必須提供的最小欄位 |
|
||
| reviewer check | `22` | reviewer 收件前必檢項 |
|
||
| outcome lane | `8` | 等待、隔離、拒收、補件、review、只讀更新、緊急變更補件、等待 runtime gate |
|
||
| blocked action | `28` | 驗收前全部禁止 |
|
||
| owner response received / accepted | `0 / 0` | 不得假性拉高 |
|
||
| rendered diff / `nginx -t` / reload / route smoke | `0` | 未授權且未執行 |
|
||
| runtime gate / action button | `0 / 0` | 不開任何執行入口 |
|
||
|
||
## 3. Owner 必填欄位
|
||
|
||
| 欄位 | 說明 |
|
||
|------|------|
|
||
| `owner_role_or_team` | Public Gateway / Nginx owner role 或 team |
|
||
| `decision` | 對本 config scope 的回覆判定 |
|
||
| `decision_reason` | 決策理由，不得包含機敏值 |
|
||
| `affected_routes` | 受影響 domain / route / upstream scope |
|
||
| `redacted_live_conf_ref` | 脫敏 live conf evidence ref；不得貼 raw conf |
|
||
| `source_to_live_rendered_diff_ref` | source-to-live rendered diff ref；不得貼 raw diff payload |
|
||
| `nginx_test_plan_ref` | 後續 `nginx -t` 計畫或 evidence ref；不代表已授權 |
|
||
| `route_smoke_plan_ref` | route smoke matrix ref |
|
||
| `maintenance_window` | 維護窗口或禁止窗口 |
|
||
| `rollback_owner` | rollback 負責人與 rollback ref |
|
||
| `postcheck_plan` | reload / route smoke 後的 post-check plan |
|
||
| `change_actor_or_source_ref` | 若有手動或緊急變更，提供脫敏 actor / source ref，不得貼帳密或 raw shell history |
|
||
| `change_time_window` | 變更或事故時間窗，讓 route smoke、告警與跨專案影響能對齊 |
|
||
| `cross_project_impact_ref` | 跨產品 / 跨專案影響 ref，避免只修單一路由卻造成其他服務中斷 |
|
||
| `communication_sync_ref` | 通知或協調 ref，證明相關專案 owner 已收到影響與回復狀態 |
|
||
| `change_intent_or_ticket_ref` | 變更意圖、維護單、事故單或 ticket ref；不得只用聊天口頭同意 |
|
||
| `pre_change_approval_ref` | 正常變更的事前批准 ref；緊急變更不得用此欄偽造批准 |
|
||
| `break_glass_reason_ref` | 緊急變更的 break-glass 事由 ref；只代表事後補件，不代表已批准 |
|
||
| `route_health_impact_ref` | route health / service health impact ref，需能對齊 affected routes |
|
||
| `rollback_validation_ref` | rollback validation ref，需能追溯 rollback owner 與回滾後驗證方式 |
|
||
| `post_change_monitoring_window` | 事後觀察窗口，讓告警、route smoke 與跨專案回復狀態能對齊 |
|
||
| `followup_owner` | 補件、隔離、拒收或下一步 review owner |
|
||
|
||
## 4. Reviewer Checks
|
||
|
||
| Check | 規則 |
|
||
|-------|------|
|
||
| `owner_identity_present` | owner role / team 必須可追溯 |
|
||
| `decision_reason_present` | decision 與 decision reason 必須同時存在 |
|
||
| `redacted_refs_only` | evidence 只能是脫敏 ref、hash、ticket、commit 或 artifact pointer |
|
||
| `raw_conf_absent` | 不得出現 raw live Nginx conf、完整 upstream payload 或未遮蔽 host secret |
|
||
| `secret_value_absent` | 不得出現 token、cookie、private key、完整憑證內容或 secret derivative |
|
||
| `route_scope_matches_snapshot` | affected routes 必須能對回 committed public gateway snapshot |
|
||
| `rendered_diff_ref_not_payload` | rendered diff 只能是 ref，不得把 payload 直接貼進 owner response |
|
||
| `nginx_test_separate_approval` | `nginx -t` 必須另走人工批准，不得自動觸發 |
|
||
| `route_smoke_plan_present` | route smoke plan 必須列 affected routes、預期 status、TLS / WebSocket / ACME checks |
|
||
| `maintenance_window_present` | 必須有維護窗口或明確禁止窗口 |
|
||
| `rollback_owner_present` | rollback owner 與 rollback ref 必須存在 |
|
||
| `change_actor_or_source_ref_present` | 手動或緊急變更必須有脫敏 actor / source ref |
|
||
| `change_time_window_present` | 必須提供變更或事故時間窗 |
|
||
| `cross_project_impact_review_present` | 必須提供跨產品 / 跨專案影響 ref |
|
||
| `communication_sync_ref_present` | 必須提供通知或協調 ref |
|
||
| `change_intent_or_ticket_ref_present` | 每次 Public Gateway / Nginx 變更都必須有 change intent、ticket、incident 或 maintenance ref |
|
||
| `pre_change_approval_or_break_glass_present` | 正常變更需有 pre-change approval ref；緊急變更需有 break-glass reason ref，且不得把 break-glass 當成事前批准 |
|
||
| `route_health_impact_present` | 必須提供 route health / service health impact ref，確認受影響 domain、upstream、WebSocket、ACME 與 API 是否恢復 |
|
||
| `rollback_validation_present` | 必須提供 rollback validation ref，證明回滾路徑、回滾 owner 與回滾後驗證方式可追溯 |
|
||
| `post_change_monitoring_window_present` | 必須提供 post-change monitoring window |
|
||
| `manual_change_not_silent` | 任何手動或緊急 gateway 變更不得靜默收件；缺 actor、意圖、影響、通知或回滾驗證就必須補件或拒收 |
|
||
| `counts_transition_safe` | 只有 reviewer record 可更新 received / accepted / rejected；不得同時開 runtime gate |
|
||
|
||
## 5. Outcome Lanes
|
||
|
||
| Lane | 意義 |
|
||
|------|------|
|
||
| `waiting_owner_response` | 尚未收到 owner response；所有 accepted / runtime count 維持 0 |
|
||
| `quarantine_raw_payload` | 收到 raw conf、payload 或不可保存內容時只能隔離 |
|
||
| `reject_secret_or_unredacted_conf` | 出現 secret value、未脫敏 live conf 或 credential derivative 時直接拒收 |
|
||
| `request_supplement` | 欄位不足、scope 不清或 evidence ref 不可追溯時要求補件 |
|
||
| `ready_for_rendered_diff_review` | metadata 合格後，只能進 rendered diff reviewer review |
|
||
| `owner_review_only_update` | 只允許更新只讀 owner review ledger |
|
||
| `emergency_change_backfill_required` | 手動或緊急 gateway 變更只能進事後補件，不得因 break-glass 而自動接受或開 runtime gate |
|
||
| `waiting_runtime_gate` | 即使 owner response accepted，runtime gate 仍等待獨立人工批准 |
|
||
|
||
## 6. Blocked Actions
|
||
|
||
```text
|
||
read_live_conf_over_ssh
|
||
store_raw_live_conf
|
||
accept_unredacted_live_conf
|
||
collect_secret_value
|
||
render_diff_from_unredacted_payload
|
||
mark_owner_response_accepted_without_reviewer_record
|
||
nginx_test_without_separate_approval
|
||
nginx_reload_without_separate_approval
|
||
route_smoke_without_matrix
|
||
dns_probe_without_approval
|
||
tls_probe_without_approval
|
||
certbot_renew_without_approval
|
||
modify_nginx_conf
|
||
modify_dns_tls_config
|
||
change_public_route
|
||
write_production_host
|
||
accept_unknown_change_actor
|
||
accept_missing_change_time_window
|
||
skip_cross_project_impact_review
|
||
skip_incident_communication_sync
|
||
accept_silent_manual_nginx_change
|
||
treat_break_glass_as_approval
|
||
mark_gateway_change_resolved_without_route_health
|
||
skip_rollback_validation
|
||
skip_post_change_monitoring
|
||
hide_cross_project_route_impact
|
||
open_runtime_gate
|
||
add_action_button
|
||
```
|
||
|
||
## 7. 指令
|
||
|
||
固定 committed snapshot：
|
||
|
||
```bash
|
||
python3 scripts/security/public-gateway-owner-response-acceptance.py \
|
||
--root . \
|
||
--output docs/security/public-gateway-owner-response-acceptance.snapshot.json \
|
||
--generated-at 2026-06-15T14:10:00+08:00
|
||
```
|
||
|
||
只讀 guard：
|
||
|
||
```bash
|
||
python3 scripts/security/security-mirror-progress-guard.py --root .
|
||
python3 scripts/security/source-control-owner-response-guard.py --root .
|
||
```
|
||
|
||
## 8. 完成度
|
||
|
||
| 工作 | 完成度 | 說明 |
|
||
|------|--------|------|
|
||
| owner response acceptance ledger artifact | `100%` | 3 份 public gateway config 已有只讀收件判定帳本 |
|
||
| 手動 / 緊急 gateway 變更 metadata gate | `100%` | 已要求 actor/source、time window、cross-project impact、communication sync、change intent、approval / break-glass、route health impact、rollback validation 與 post-change monitoring；不收 raw payload |
|
||
| owner response received / accepted | `0%` | 尚未收到或接受任何 owner response |
|
||
| rendered diff / `nginx -t` / reload / route smoke | `0%` | 未授權且未執行 |
|
||
| DNS / TLS / certbot | `0%` | 未授權且未執行 |
|
||
| runtime gate / production write | `0%` | 無 action button，無 host write |
|
||
|
||
## 9. 邊界
|
||
|
||
這份帳本不是 live gateway truth、不是 Nginx 變更批准、不是 `nginx -t` 授權、不是 reload 授權、不是 DNS / TLS / certbot 授權，也不是 route smoke 或 runtime gate。不得把 owner response acceptance ledger、snapshot、LOGBOOK、IwoooS UI 或 AwoooP approval 解讀成可以讀 live conf、改 Nginx、改公開路由、收 secret、寫 production host、開 action button 或執行任何 gateway 操作。
|