7.0 KiB
IwoooS Public Gateway Redacted Export 收件預檢
| 項目 | 內容 |
|---|---|
| 日期 | 2026-06-14 |
| 狀態 | redacted_export_intake_preflight_ready_no_payload_received |
| 工具 | scripts/security/public-gateway-redacted-export-intake-preflight.py |
| 輸入 | docs/security/public-gateway-live-conf-export-request.snapshot.json |
| Snapshot | docs/security/public-gateway-redacted-export-intake-preflight.snapshot.json |
| runtime gate | 0 |
1. 目的
P0-15 已建立 Public Gateway live conf 脫敏匯出請求包，但尚未送件，也尚未收到 owner-provided redacted export ref。P0-16 的目的，是先定義未來收到 ref 時的收件預檢、拒收規則與 reviewer 分流，避免 raw Nginx live conf、secret payload 或未授權 nginx -t / reload 要求流入 repo、LOGBOOK、前端或 runtime。
本文件只定義 redacted export intake preflight。它不是 request sent、不是 recipient confirmed、不是 redacted export received、不是 raw conf stored、不是 rendered diff ready、不是 nginx -t、不是 reload、不是 route smoke，也不是 production write 或 runtime gate 授權。
2. 摘要
| 指標 | 值 | 說明 |
|---|---|---|
| intake candidate count | 3 |
對應三份 live conf export request |
| C0 intake candidate count | 2 |
188 all sites、188 internal tools HTTPS |
| intake field count | 11 |
每份收件候選欄位 |
| validation check count | 10 |
收件前必跑檢查 |
| rejection guard count | 12 |
必須拒收或隔離的 payload / action 類型 |
| reviewer intake lane count | 5 |
waiting、補件、隔離、拒收、進 rendered diff preflight |
| request sent / recipient confirmed | 0 / 0 |
尚未送件、尚未確認收件人 |
| redacted export received / accepted | 0 / 0 |
尚未收到，尚未接受 |
| quarantined / rejected | 0 / 0 |
尚無 payload 進入隔離或拒收紀錄 |
| rendered diff / raw live conf stored | 0 / 0 |
尚未產生 diff，不保存 raw conf |
| runtime gate / action button | 0 / 0 |
未開啟 |
3. 收件欄位
| 欄位 | 內容規則 |
|---|---|
intake_id |
固定對應 redacted export intake，不建立 runtime action id |
export_request_id |
對應 P0-15 匯出請求 |
config_id |
對應 public gateway preflight row |
control_tier |
保留 C0 / C1 風險分級 |
redacted_live_conf_ref |
未收到前為空；只可填脫敏 ref |
ref_owner_role_or_team |
只填 role / team，不填私人聯絡或 credential |
received_metadata_ref |
只填送件 / 收件 metadata，不放 raw payload |
sensitive_payload_review |
未檢查前為 not_started |
quarantine_ref |
只有敏感 payload 隔離 metadata 可填 |
rendered_diff_candidate_ref |
收件通過後仍需另建 rendered diff preflight candidate |
not_approval |
必須為 true |
4. Validation Checks
| Check | 規則 |
|---|---|
source_export_request_snapshot_current |
來源匯出請求 snapshot 必須是 committed 最新版本 |
request_sent_metadata_required |
沒有可稽核 request sent metadata 時，不得標記 received |
recipient_confirmed_metadata_required |
沒有 owner / recipient role 確認時，不得標記 recipient confirmed |
redacted_export_ref_required |
只接受脫敏 export ref；不得貼 raw live conf |
raw_live_conf_payload_blocked |
raw conf、私鑰、token、cookie、session 或 authorization header 必須拒收或隔離 |
redaction_policy_attestation_required |
owner 需聲明已依 redaction policy 處理 credential 與 sensitive payload |
secret_marker_scan_required |
可存入 repo 的 metadata 必須先通過 secret marker / sensitive marker 檢查 |
scope_matches_export_request |
host、config id、live path metadata 必須與匯出請求一致 |
quarantine_before_storage |
疑似敏感 payload 只可留下 quarantine metadata |
rendered_diff_gate_separate |
收件通過只代表可進 rendered diff preflight |
5. Rejection Guards
以下內容必須拒收或隔離，不得寫入 repo、LOGBOOK、前端或 runtime：
| Guard | 處理 |
|---|---|
raw_live_conf_payload |
拒收或隔離，只留 metadata |
tls_private_key |
拒收或隔離 |
token_secret_cookie_session |
拒收或隔離 |
authorization_header_or_basic_auth |
拒收或隔離 |
unredacted_upstream_credential |
要求重新脫敏 |
db_url_or_env_dump |
拒收或隔離 |
shell_history_or_private_key |
拒收或隔離 |
unredacted_log_or_screenshot |
拒收或隔離 |
nginx_test_execution_request |
拒收執行要求 |
nginx_reload_or_route_change_request |
拒收執行要求 |
dns_tls_certbot_request |
拒收執行要求 |
ssh_host_write_or_runtime_request |
拒收執行要求 |
6. Reviewer Intake Lanes
| Lane | 分流 |
|---|---|
keep_waiting_redacted_export |
尚未送件、尚未確認 recipient 或尚未收到 ref 時維持等待 |
request_more_metadata |
缺欄位、scope 或 redaction attestation 時補件 |
quarantine_sensitive_payload |
疑似敏感 payload 時只留 quarantine metadata |
reject_execution_request |
夾帶執行要求時拒收 |
ready_for_rendered_diff_preflight |
欄位完整且只有脫敏 ref 時，才可進 rendered diff preflight |
6.1 2026-06-14 Rendered Diff Gate Draft
已新增 docs/security/PUBLIC-GATEWAY-RENDERED-DIFF-GATE-DRAFT.md 與 docs/security/public-gateway-rendered-diff-gate-draft.snapshot.json，將三份 redacted export intake candidate 轉成 rendered diff / nginx -t / reload / route smoke 分階段 gate 草稿。
目前固定為 diff_gate_candidate_count=3、c0_diff_gate_candidate_count=2、preflight_stage_count=7、blocked_action_count=14、rendered_diff_ready_count=0、nginx_test_executed_count=0、runtime_gate_count=0。此 artifact 只表示未來收件 accepted 後的下一層 gate 形狀，不代表 redacted export accepted、rendered diff ready、nginx -t、reload、route smoke、DNS / TLS probe、certbot renew、host write 或 production write。
7. 指令
產生 committed snapshot：
python3 scripts/security/public-gateway-redacted-export-intake-preflight.py \
--root . \
--export-request-report docs/security/public-gateway-live-conf-export-request.snapshot.json \
--output docs/security/public-gateway-redacted-export-intake-preflight.snapshot.json \
--generated-at 2026-06-14T19:35:00+08:00
驗證 guard：
python3 scripts/security/security-mirror-progress-guard.py --root .
8. 完成度
| 工作 | 完成度 | 說明 |
|---|---|---|
| redacted export intake preflight artifact | 100% |
產生器、snapshot 與文件已固定 |
| request sent / recipient confirmed | 0% |
尚未送件，尚未確認 |
| redacted export received / accepted | 0% |
尚未收到，尚未接受 |
| quarantine / rejected | 0% |
尚無 payload |
| rendered diff / nginx -t / route smoke | 0% |
尚未批准且未執行 |
| runtime reload / host write | 0% |
未授權且未執行 |