awoooi/docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET.md

IwoooS 高價值配置 Owner Response Packet

項目	內容
日期	2026-06-14
狀態	owner_packet_draft_ready_p0_path_sync
工具	scripts/security/high-value-config-owner-packet.py
輸入	docs/security/high-value-config-change-gate.snapshot.json
Snapshot	docs/security/high-value-config-owner-packet.snapshot.json
runtime gate	0

1. 目的

P0.2 已能將變更分類成 C0 / C1 / C2 / C3。本文件與工具負責下一步：把分類結果轉成 owner response packet 草案，讓 Nginx、DNS / TLS、K8s、secret、workflow、runner、backup、monitoring、host service、network、AI provider、agent-bounty-protocol 等高價值配置變更有一致補件欄位。

本階段仍是只讀草案，不送 request、不收 owner response、不標記 received / accepted、不建立 action button、不接 blocking CI、不執行 runtime。

1.1 2026-06-14 P0 path sync

本輪 owner packet snapshot 已跟隨高價值配置 Gate 的 P0 pattern 補強重產：

Packet	affected files	邊界
nginx_public_gateway	k8s/nginx/awoooi-prod.conf	只要求 public gateway owner response、rendered diff、nginx -t 計畫、route smoke 計畫與 rollback ref，不代表已讀 live conf 或 reload
dns_tls_certbot	scripts/ops/188-registry-certbot-fix.sh、scripts/ops/fix-188-registry-certbot-renewal.sh	只要求 domain / TLS owner response、renewal window、ACME smoke 計畫、public HTTPS smoke 計畫與 rollback ref，不代表 certbot renew 或 DNS / TLS 變更
security_evidence_tooling	Gate 文件、snapshot 與工具	只要求 snapshot parse、guard smoke、doc secret sanity 與 no runtime gate increase

重產結果為 packet_count=3、c0_packet_count=2、c1_packet_count=0、runtime_gate_count=0；request / received / accepted 仍全部維持 0。

1.2 2026-06-14 收件預檢

已新增 docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET-INTAKE-PREFLIGHT.md 與 docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json，將三包草案轉成送件前預檢與 reviewer intake lanes。

目前固定為 dispatch_preflight_check_count=9、reviewer_intake_lane_count=5、required_owner_field_total=27、blocked_request_count=16。此 artifact 只表示收件框架已準備，不代表 request sent、owner response received、reviewer accepted、queue write、runtime execution、Nginx reload、DNS / TLS 變更、workflow 修改、host write、active scan 或 production write。

1.3 2026-06-14 Request draft

已新增 docs/security/HIGH-VALUE-CONFIG-OWNER-REQUEST-DRAFT.md 與 docs/security/high-value-config-owner-request-draft.snapshot.json，將三包收件預檢轉成人工送件前可核對的 request draft。

目前固定為 request_draft_count=3、c0_request_draft_count=2、handoff_envelope_field_count=11、required_owner_field_total=27、forbidden_payload_count=12。此 artifact 只表示草稿包已準備，不代表 request sent、recipient confirmed、audit event emitted、owner response received、reviewer accepted、queue write、runtime execution、Nginx reload、DNS / TLS 變更、workflow 修改、host write、active scan 或 production write。

2. Canonical 欄位

高價值配置 packet 對齊 S4.9 canonical owner response envelope，使用以下欄位：

1. owner_role_or_team
2. decision
3. decision_reason
4. affected_scope
5. redacted_evidence_refs
6. followup_owner
7. rollback_owner
8. maintenance_window
9. validation_plan

decision 只能是 confirm、defer、reject、request_more_evidence。confirm 只代表 owner 對該分類補件方向確認，不代表 reload、deploy、sync、scan、payout 或 host write。

3. 指令

使用 committed gate snapshot 產生 owner packet：

python3 scripts/security/high-value-config-owner-packet.py \
  --root . \
  --gate-report docs/security/high-value-config-change-gate.snapshot.json \
  --output docs/security/high-value-config-owner-packet.snapshot.json

查看即時分類結果的 packet：

python3 scripts/security/high-value-config-change-gate.py \
  --root . \
  --changed-file infra/ansible/roles/nginx/templates/188-all-sites.conf.j2 \
  --output /tmp/high-value-config-gate-nginx.json

python3 scripts/security/high-value-config-owner-packet.py \
  --root . \
  --gate-report /tmp/high-value-config-gate-nginx.json

4. Packet 狀態

狀態	意義	Gate 影響
draft_waiting_owner_response	只是草案，尚未送件或收件	request / received / accepted 全部維持 0
request_more_evidence	owner 欄位缺漏或 scope 不清	不增加 accepted
quarantine_sensitive_payload	疑似含 secret、token、cookie、private key、未脫敏 evidence	不保存 raw payload
reject_execution_request	夾帶 reload、deploy、sync、host write、scan、payout 等執行要求	不建立 action button
ready_for_reviewer_validation	欄位完整且無敏感 payload / 執行要求	只進 reviewer checklist，仍非 accepted

5. 絕對禁止

1. 不把 packet 草案當成 request sent。
2. 不把 owner 口頭同意當成 response received。
3. 不把 confirm 當成 runtime reload / deploy / scan / payout 授權。
4. 不收 secret value、partial token、private key、cookie、session、authorization header、runner token 或 webhook secret。
5. 不把內部工作視窗對話、抱怨或 Session 指令放入前端產品文案。
6. 不用 packet 產生器修改 .gitea/workflows、K8s、Nginx、DNS、TLS、主機或 agent-bounty runtime。

6. 完成度

工作	完成度	說明
Gate → owner packet 草案	100%	可從 gate JSON 產生 impacted category packet
Canonical 欄位對齊	100%	已對齊 S4.9 owner_role_or_team 等欄位，P0.2 gate 也接受 alias
owner response 收件	0%	尚未送 request、尚未收到 owner response
reviewer accepted	0%	尚未進 reviewer checklist
runtime gate	0%	未授權且未開啟