wooo/ewoooc
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

docs(governance): advance mainline to identity RBAC

Browse Source
This commit is contained in:
ogt
2026-07-11 20:46:55 +08:00
parent 8ef25db9bd
commit 2dcc2122c4
2 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/guides/ai_automation_mainline_work_items.md
View File

@@ -1,8 +1,8 @@
# AI Automation Mainline Work Items
> Updated: 2026-07-10
> Updated: 2026-07-11
> Governance: `global_product_governance_v2` + ADR-038
> Current P0: `SEC-P0-001 deny-by-default access control`
> Current P0: `SEC-P0-002 database identity + least-privilege RBAC`
## Source Of Truth
@@ -16,8 +16,8 @@
| Order | ID | Status | Work item | Exit evidence / next machine action |
|---:|---|---|---|---|
| 1 | `SEC-P0-001` | In progress | Deny-by-default route access control | Production anonymous matrix now denies sensitive routes and all browser headers/Secure cookie pass. Remaining exit: move `/metrics` behind edge/internal auth without breaking Prometheus. Next: `move_metrics_behind_edge_auth_with_prometheus_canary`. |
| 2 | `SEC-P0-002` | Not started | Database identity + least-privilege RBAC | Replace shared admin password, default-admin fallback, process-local lockout and spoofable proxy identity. Exit: shadow auth, role matrix, durable audit/lockout, session revocation and canary cutover. |
| 1 | `SEC-P0-001` | Completed | Deny-by-default route access control | `governance/evidence/SEC-P0-001-20260711T122758Z.json` plus the current runtime receipt prove anonymous matrix 8/8 denied, public `/metrics` 404, exact internal target up, EwoooC product markers present, Prometheus identity preserved and `momo-db` unchanged. |
| 2 | `SEC-P0-002` | In progress | Database identity + least-privilege RBAC | Replace shared admin password, default-admin fallback, process-local lockout and spoofable proxy identity. Next: inventory active users and auth call sites, then shadow database-backed auth before bounded canary cutover. Exit: role matrix, durable audit/lockout, session revocation and production readback. |
| 3 | `SEC-P0-003` | In progress | Webhook trust and replay protection | Telegram secret-token verification code exists; production secret activation remains unproven. Exit: secret provisioned outside source, required mode enabled, invalid-secret 401 and authorized callback canary pass. |
| 4 | `SUPPLY-P0-001` | In progress | Gitea-only secure software supply chain | Gitea-native checkout, secret-safe `.dockerignore`, commit-bound source receipt and governance gate are active. Exit: exact dependency lock, internal SAST/SCA/secret scan, SBOM, image digest/provenance, vulnerability SLA and production digest readback. |
| 5 | `GOV-P0-001` | In progress | Canonical full asset graph + runtime reconciliation | `governance/ewoooc_asset_inventory.json` seeds hosts, services, data, AI, routes, supply chain, observability and recovery. Exit: same-run probe receipt for every asset; drift auto-creates work items. |
@@ -25,7 +25,7 @@
| 7 | `RAG-P0-001` | Not started | Internal RAG candidate canary | V10.770 stops at candidate preview. Exit: bounded pgvector candidate canary, signature/readback/feedback receipt, no price write and no premature `ai_insights` promotion. Next: `run_internal_rag_candidate_canary`. |
| 8 | `MCP-P0-001` | In progress | MCP/RAG production runtime closure | Registry and smoke wiring exist, but runtime flags/ports must be live. Exit: MCP servers healthy, router enabled, RAG enabled, approved caller/tool boundary and production query canary pass. |
| 9 | `SEC-P0-004` | Not started | Security operations lifecycle and metrics | Add durable security incident state and publish MTTA, MTTR, recurrence, false positive, human intervention, verifier pass, rollback and freshness. Exit: detect-to-learn production receipt. |
| 10 | `REL-P0-001` | In progress | Formal deploy and visible proof discipline | V10.773 records the controlled production fallback with `momo-db` unchanged. The prior Gitea CD run was cancelled by a newer push and the latest commit-bound run remains waiting because no `ewoooc-host` runner is online; exact run identity comes from Gitea/runtime receipts, not this roadmap. Exit: restore a dedicated EwoooC-only runner, replay the same commit and close CD/readback automatically. |
| 10 | `REL-P0-001` | In progress | Formal deploy and visible proof discipline | V10.787 is healthy and the SEC-P0-001 runtime loop is closed with `momo-db` unchanged; Gitea CD #1120 remains waiting because no `ewoooc-host` runner is online. Exit: restore a dedicated EwoooC-only runner, replay the current source and close CD/readback automatically. |
## P1