340 lines
12 KiB
JSON
340 lines
12 KiB
JSON
{
|
||
"allowed_decisions": [
|
||
"confirm",
|
||
"defer",
|
||
"reject",
|
||
"request_more_evidence"
|
||
],
|
||
"blocked_requests": [
|
||
"repo_create",
|
||
"visibility_change",
|
||
"refs_sync",
|
||
"refs_delete",
|
||
"force_push",
|
||
"workflow_modify",
|
||
"runner_enable",
|
||
"secret_value_submit",
|
||
"ssh_host_modify",
|
||
"nginx_reload",
|
||
"dns_tls_modify",
|
||
"argocd_sync",
|
||
"kubectl_apply",
|
||
"active_scan",
|
||
"agent_bounty_runtime_execute",
|
||
"payout_or_withdrawal"
|
||
],
|
||
"canonical_owner_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"redacted_evidence_refs",
|
||
"followup_owner",
|
||
"rollback_owner",
|
||
"maintenance_window",
|
||
"validation_plan"
|
||
],
|
||
"completion": {
|
||
"owner_request_sent_percent": 0,
|
||
"owner_response_received_percent": 0,
|
||
"request_dispatch_preflight_artifact_percent": 100,
|
||
"reviewer_accepted_percent": 0,
|
||
"runtime_gate_percent": 0
|
||
},
|
||
"dispatch_preflight_checks": [
|
||
{
|
||
"check_id": "baseline_commit_synced",
|
||
"gate_effect": "不增加 request_sent / received / accepted / runtime gate。",
|
||
"instruction": "使用最新 gitea/main 與 owner packet snapshot；不得用過期 packet 送件。",
|
||
"label": "基線 commit 已同步",
|
||
"required": true,
|
||
"status": "preflight_required_before_request_dispatch"
|
||
},
|
||
{
|
||
"check_id": "source_snapshot_current",
|
||
"gate_effect": "不增加 request_sent / received / accepted / runtime gate。",
|
||
"instruction": "來源必須是 committed high-value-config-owner-packet snapshot，不讀 live 主機。",
|
||
"label": "來源 snapshot 目前有效",
|
||
"required": true,
|
||
"status": "preflight_required_before_request_dispatch"
|
||
},
|
||
{
|
||
"check_id": "packet_scope_mapped",
|
||
"gate_effect": "不增加 request_sent / received / accepted / runtime gate。",
|
||
"instruction": "每包需有 category、priority、control tier、required gate 與 affected files。",
|
||
"label": "Packet scope 已映射",
|
||
"required": true,
|
||
"status": "preflight_required_before_request_dispatch"
|
||
},
|
||
{
|
||
"check_id": "canonical_fields_present",
|
||
"gate_effect": "不增加 request_sent / received / accepted / runtime gate。",
|
||
"instruction": "每包需要求 owner role、decision、reason、scope、evidence refs、followup、rollback、window、validation。",
|
||
"label": "Canonical 欄位已固定",
|
||
"required": true,
|
||
"status": "preflight_required_before_request_dispatch"
|
||
},
|
||
{
|
||
"check_id": "redacted_evidence_refs_only",
|
||
"gate_effect": "不增加 request_sent / received / accepted / runtime gate。",
|
||
"instruction": "只收文件路徑、snapshot id、ticket id、commit、hash 或 metadata pointer。",
|
||
"label": "Evidence refs 只允許脫敏參照",
|
||
"required": true,
|
||
"status": "preflight_required_before_request_dispatch"
|
||
},
|
||
{
|
||
"check_id": "no_sensitive_payload",
|
||
"gate_effect": "不增加 request_sent / received / accepted / runtime gate。",
|
||
"instruction": "不得收 token、secret、private key、cookie、session、authorization header、runner token 或 webhook secret。",
|
||
"label": "禁止敏感 payload",
|
||
"required": true,
|
||
"status": "preflight_required_before_request_dispatch"
|
||
},
|
||
{
|
||
"check_id": "no_execution_request",
|
||
"gate_effect": "不增加 request_sent / received / accepted / runtime gate。",
|
||
"instruction": "不得夾帶 reload、deploy、sync、host write、active scan、payout 或 withdrawal。",
|
||
"label": "拒收執行要求",
|
||
"required": true,
|
||
"status": "preflight_required_before_request_dispatch"
|
||
},
|
||
{
|
||
"check_id": "maintenance_and_rollback_fields_present",
|
||
"gate_effect": "不增加 request_sent / received / accepted / runtime gate。",
|
||
"instruction": "C0 / P0 仍需獨立人工批准、維護窗口與 rollback owner，不能由 packet 自動授權。",
|
||
"label": "維護窗口與回滾 owner 欄位存在",
|
||
"required": true,
|
||
"status": "preflight_required_before_request_dispatch"
|
||
},
|
||
{
|
||
"check_id": "validation_plan_present",
|
||
"gate_effect": "不增加 request_sent / received / accepted / runtime gate。",
|
||
"instruction": "必須能說明 preflight、post-check、rollback check；只讀文件變更則對應 guard / JSON / doc sanity。",
|
||
"label": "驗證計畫欄位存在",
|
||
"required": true,
|
||
"status": "preflight_required_before_request_dispatch"
|
||
}
|
||
],
|
||
"execution_boundaries": {
|
||
"action_buttons_allowed": false,
|
||
"active_scan_authorized": false,
|
||
"dispatch_authorized": false,
|
||
"dns_tls_change_authorized": false,
|
||
"host_write_authorized": false,
|
||
"nginx_reload_authorized": false,
|
||
"not_authorization": true,
|
||
"production_write_authorized": false,
|
||
"request_sent": false,
|
||
"reviewer_queue_write": false,
|
||
"runtime_execution_authorized": false,
|
||
"secret_value_collection_allowed": false,
|
||
"workflow_modification_authorized": false
|
||
},
|
||
"generated_at": "2026-06-14T18:25:00+08:00",
|
||
"git_commit": "3de776f4",
|
||
"intake_packets": [
|
||
{
|
||
"accepted_response": false,
|
||
"action_buttons_allowed": false,
|
||
"affected_file_count": 2,
|
||
"affected_files": [
|
||
"scripts/ops/188-registry-certbot-fix.sh",
|
||
"scripts/ops/fix-188-registry-certbot-renewal.sh"
|
||
],
|
||
"category_id": "dns_tls_certbot",
|
||
"control_tier": "C0",
|
||
"label": "DNS / TLS / certbot / certificate path",
|
||
"not_authorization": true,
|
||
"packet_id": "high_value_config_owner_packet:dns_tls_certbot",
|
||
"priority": "P0",
|
||
"production_write_authorized": false,
|
||
"received_response": false,
|
||
"rejected_response": false,
|
||
"request_sent": false,
|
||
"required_gate": "domain_tls_owner_response_required",
|
||
"required_owner_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"redacted_evidence_refs",
|
||
"followup_owner",
|
||
"rollback_owner",
|
||
"maintenance_window",
|
||
"validation_plan"
|
||
],
|
||
"required_validation": [
|
||
"domain_inventory",
|
||
"certificate_path_check",
|
||
"renewal_window",
|
||
"acme_path_smoke",
|
||
"public_https_smoke",
|
||
"rollback_ref"
|
||
],
|
||
"reviewer_queue_write": false,
|
||
"runtime_gate": false,
|
||
"secret_value_collection_allowed": false,
|
||
"status": "waiting_request_dispatch_preflight"
|
||
},
|
||
{
|
||
"accepted_response": false,
|
||
"action_buttons_allowed": false,
|
||
"affected_file_count": 1,
|
||
"affected_files": [
|
||
"k8s/nginx/awoooi-prod.conf"
|
||
],
|
||
"category_id": "nginx_public_gateway",
|
||
"control_tier": "C0",
|
||
"label": "Nginx / reverse proxy / public route",
|
||
"not_authorization": true,
|
||
"packet_id": "high_value_config_owner_packet:nginx_public_gateway",
|
||
"priority": "P0",
|
||
"production_write_authorized": false,
|
||
"received_response": false,
|
||
"rejected_response": false,
|
||
"request_sent": false,
|
||
"required_gate": "public_gateway_owner_response_required",
|
||
"required_owner_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"redacted_evidence_refs",
|
||
"followup_owner",
|
||
"rollback_owner",
|
||
"maintenance_window",
|
||
"validation_plan"
|
||
],
|
||
"required_validation": [
|
||
"rendered_diff",
|
||
"nginx_t",
|
||
"affected_route_smoke",
|
||
"admin_route_smoke_if_affected",
|
||
"acme_path_smoke_if_affected",
|
||
"rollback_ref"
|
||
],
|
||
"reviewer_queue_write": false,
|
||
"runtime_gate": false,
|
||
"secret_value_collection_allowed": false,
|
||
"status": "waiting_request_dispatch_preflight"
|
||
},
|
||
{
|
||
"accepted_response": false,
|
||
"action_buttons_allowed": false,
|
||
"affected_file_count": 3,
|
||
"affected_files": [
|
||
"docs/security/HIGH-VALUE-CONFIG-CHANGE-GATE.md",
|
||
"docs/security/high-value-config-change-gate.snapshot.json",
|
||
"scripts/security/high-value-config-change-gate.py"
|
||
],
|
||
"category_id": "security_evidence_tooling",
|
||
"control_tier": "C3",
|
||
"label": "Security evidence / snapshot / guard tooling",
|
||
"not_authorization": true,
|
||
"packet_id": "high_value_config_owner_packet:security_evidence_tooling",
|
||
"priority": "P3",
|
||
"production_write_authorized": false,
|
||
"received_response": false,
|
||
"rejected_response": false,
|
||
"request_sent": false,
|
||
"required_gate": "security_evidence_owner_review_required",
|
||
"required_owner_fields": [
|
||
"owner_role_or_team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"redacted_evidence_refs",
|
||
"followup_owner",
|
||
"rollback_owner",
|
||
"maintenance_window",
|
||
"validation_plan"
|
||
],
|
||
"required_validation": [
|
||
"snapshot_parse",
|
||
"guard_smoke",
|
||
"doc_secret_sanity",
|
||
"no_runtime_gate_increase"
|
||
],
|
||
"reviewer_queue_write": false,
|
||
"runtime_gate": false,
|
||
"secret_value_collection_allowed": false,
|
||
"status": "waiting_request_dispatch_preflight"
|
||
}
|
||
],
|
||
"next_steps": [
|
||
"先由 reviewer 確認預檢 snapshot 與 owner packet snapshot 皆為最新 committed evidence。",
|
||
"送件前只準備脫敏欄位與禁止條款，不送 secret value、不附 raw payload。",
|
||
"收到回覆後先依 intake lanes 分流；通過 reviewer validation 之前 received / accepted 不得增加。",
|
||
"任何 runtime、Nginx reload、DNS / TLS、workflow、runner、host 或 payout 動作都必須切獨立人工批准。"
|
||
],
|
||
"reviewer_intake_lanes": [
|
||
{
|
||
"gate_effect": "request / received / accepted / rejected 維持 0。",
|
||
"instruction": "尚未收到 owner response 或只有空白 / 口頭同意時維持等待。",
|
||
"lane_id": "keep_waiting_owner_response",
|
||
"status": "reviewer_intake_lane_defined"
|
||
},
|
||
{
|
||
"gate_effect": "不得增加 accepted 或 runtime gate。",
|
||
"instruction": "欄位缺漏、scope 不清或 redacted evidence refs 不足時補件。",
|
||
"lane_id": "request_more_evidence",
|
||
"status": "reviewer_intake_lane_defined"
|
||
},
|
||
{
|
||
"gate_effect": "不得保存 raw payload、不得渲染到前端或 LOGBOOK。",
|
||
"instruction": "疑似含敏感 payload、raw log、未脫敏截圖或 private credential URL 時隔離。",
|
||
"lane_id": "quarantine_sensitive_payload",
|
||
"status": "reviewer_intake_lane_defined"
|
||
},
|
||
{
|
||
"gate_effect": "不得建立 action button、不得轉成執行批准。",
|
||
"instruction": "夾帶 repo / refs / workflow / runner / host / scan / runtime 執行要求時拒收。",
|
||
"lane_id": "reject_execution_request",
|
||
"status": "reviewer_intake_lane_defined"
|
||
},
|
||
{
|
||
"gate_effect": "仍不是 accepted，也不是 runtime authorization。",
|
||
"instruction": "欄位完整、證據脫敏、無敏感 payload 且無執行要求時才可進 reviewer checklist。",
|
||
"lane_id": "ready_for_reviewer_validation",
|
||
"status": "reviewer_intake_lane_defined"
|
||
}
|
||
],
|
||
"schema_version": "high_value_config_owner_packet_intake_preflight_v1",
|
||
"source_false_flags": {
|
||
"action_buttons_allowed": false,
|
||
"active_scan_authorized": false,
|
||
"dns_tls_change_authorized": false,
|
||
"force_push_authorized": false,
|
||
"host_write_authorized": false,
|
||
"nginx_reload_authorized": false,
|
||
"refs_sync_authorized": false,
|
||
"request_sent": false,
|
||
"response_accepted": false,
|
||
"response_received": false,
|
||
"runner_change_authorized": false,
|
||
"runtime_execution_authorized": false,
|
||
"secret_value_collection_allowed": false,
|
||
"workflow_modification_authorized": false
|
||
},
|
||
"source_owner_packet_schema_version": "high_value_config_owner_packet_v1",
|
||
"source_owner_packet_status": "draft_waiting_owner_response",
|
||
"status": "request_dispatch_preflight_ready",
|
||
"summary": {
|
||
"accepted_response_count": 0,
|
||
"action_button_count": 0,
|
||
"blocked_request_count": 16,
|
||
"c0_packet_count": 2,
|
||
"c1_packet_count": 0,
|
||
"canonical_owner_field_count": 9,
|
||
"dispatch_preflight_check_count": 9,
|
||
"packet_count": 3,
|
||
"received_response_count": 0,
|
||
"rejected_response_count": 0,
|
||
"request_sent_count": 0,
|
||
"required_owner_field_total": 27,
|
||
"reviewer_intake_lane_count": 5,
|
||
"reviewer_queue_write_count": 0,
|
||
"runtime_gate_count": 0
|
||
}
|
||
}
|