# IwoooS 高價值配置 Owner Packet 收件預檢

| 項目 | 內容 |
|------|------|
| 日期 | 2026-06-14 |
| 狀態 | `request_dispatch_preflight_ready` |
| 工具 | `scripts/security/high-value-config-owner-packet-intake-preflight.py` |
| 輸入 | `docs/security/high-value-config-owner-packet.snapshot.json` |
| Snapshot | `docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json` |
| runtime gate | `0` |

## 1. 目的

本文件承接高價值配置 Owner Packet 草案，建立送件前的只讀預檢與 reviewer 收件分流。它的目標是讓 Nginx public gateway、DNS / TLS / certbot 與 security evidence tooling 三包在送 owner request 前先完成欄位、脫敏、拒收執行要求與 reviewer lane 的一致框架。

本階段仍不是 request sent、不是 owner response received、不是 accepted record、不是 reviewer queue write，也不是 Nginx reload、DNS / TLS 變更、workflow 修改、host write、active scan、agent-bounty runtime、payout / withdrawal 或 production write 授權。

## 1.1 2026-06-14 Request Draft

已新增 `docs/security/HIGH-VALUE-CONFIG-OWNER-REQUEST-DRAFT.md` 與 `docs/security/high-value-config-owner-request-draft.snapshot.json`，將三包預檢結果轉成人工送件前可核對的 request draft 與 handoff envelope。

目前固定為 `request_draft_count=3`、`c0_request_draft_count=2`、`handoff_envelope_field_count=11`、`required_owner_field_total=27`、`forbidden_payload_count=12`。此 artifact 只表示草稿包已準備，不代表 request sent、recipient confirmed、audit event emitted、owner response received、reviewer accepted、queue write、runtime execution、Nginx reload、DNS / TLS 變更、workflow 修改、host write、active scan 或 production write。

## 2. 目前摘要

| 指標 | 值 | 說明 |
|------|----|------|
| packet count | `3` | `dns_tls_certbot`、`nginx_public_gateway`、`security_evidence_tooling` |
| C0 packet count | `2` | DNS / TLS / certbot 與 Nginx public gateway |
| canonical owner fields | `9` | 對齊 Owner Packet 的九欄補件要求 |
| required owner field total | `27` | 三包各九欄 |
| dispatch preflight checks | `9` | 送件前必查項 |
| reviewer intake lanes | `5` | waiting、補件、隔離、拒收、進 reviewer validation |
| blocked request count | `16` | repo / refs / workflow / runner / host / scan / runtime / payout 等要求全部拒收 |
| request sent | `0` | 尚未送 request |
| received / accepted / rejected | `0 / 0 / 0` | 尚未收到或驗收任何 owner response |
| runtime gate | `0` | 未開啟 |

## 3. 送件前預檢

| Check | 說明 |
|-------|------|
| `baseline_commit_synced` | 使用最新 `gitea/main` 與 committed snapshot，不用過期 packet 送件 |
| `source_snapshot_current` | 來源必須是 repo 內 committed owner packet snapshot，不讀 live 主機 |
| `packet_scope_mapped` | 每包都有 category、priority、control tier、required gate 與 affected files |
| `canonical_fields_present` | 每包都要求九個 canonical owner 欄位 |
| `redacted_evidence_refs_only` | Evidence 只允許脫敏參照 |
| `no_sensitive_payload` | 禁止 token、secret、private key、cookie、session、authorization header、runner token、webhook secret |
| `no_execution_request` | 拒收 reload、deploy、sync、host write、active scan、payout 或 withdrawal |
| `maintenance_and_rollback_fields_present` | C0 / P0 仍需維護窗口與 rollback owner，不由 packet 自動授權 |
| `validation_plan_present` | 必須有 preflight、post-check、rollback check 或文件 guard 驗證計畫 |

## 4. Reviewer 收件分流

| Lane | 使用時機 | Gate 影響 |
|------|----------|-----------|
| `keep_waiting_owner_response` | 尚未收到 owner response、只有空白或口頭資訊 | request / received / accepted / rejected 維持 `0` |
| `request_more_evidence` | 欄位缺漏、scope 不清、evidence refs 不足 | 不增加 accepted |
| `quarantine_sensitive_payload` | 疑似含敏感 payload、raw log、未脫敏截圖或 private credential URL | 不保存 raw payload，不渲染到前端或 LOGBOOK |
| `reject_execution_request` | 夾帶 git、workflow、runner、host、scan、runtime、payout 等執行要求 | 不建立 action button、不進 runtime gate |
| `ready_for_reviewer_validation` | 欄位完整、證據脫敏、無敏感 payload 且無執行要求 | 只進 reviewer checklist，仍非 accepted |

## 5. 指令

產生 committed snapshot：

```bash
python3 scripts/security/high-value-config-owner-packet-intake-preflight.py \
  --root . \
  --owner-packet-report docs/security/high-value-config-owner-packet.snapshot.json \
  --output docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json \
  --generated-at 2026-06-14T18:25:00+08:00
```

驗證 guard：

```bash
python3 scripts/security/security-mirror-progress-guard.py --root .
```

## 6. 絕對邊界

1. 預檢完成不代表 request sent。
2. Packet 完整不代表 owner response received。
3. Reviewer lane 存在不代表 reviewer accepted。
4. `confirm` 不代表 runtime reload、deploy、sync、scan、payout 或 host write。
5. 任何敏感 payload 都只能隔離 metadata，不得保存 raw value。
6. 任何執行要求都必須切獨立人工批准與維護窗口。

## 7. 完成度

| 工作 | 完成度 | 說明 |
|------|--------|------|
| 收件預檢 artifact | `100%` | 產生器、snapshot 與 guard 已固定 |
| request dispatch | `0%` | 尚未送 owner request |
| owner response received | `0%` | 尚未收到正式回覆 |
| reviewer accepted | `0%` | 尚未建立 security acceptance record |
| runtime gate | `0%` | 未授權且未開啟 |
