# IwoooS Public Gateway Redacted Export 收件預檢

| 項目 | 內容 |
|------|------|
| 日期 | 2026-06-14 |
| 狀態 | `redacted_export_intake_preflight_ready_no_payload_received` |
| 工具 | `scripts/security/public-gateway-redacted-export-intake-preflight.py` |
| 輸入 | `docs/security/public-gateway-live-conf-export-request.snapshot.json` |
| Snapshot | `docs/security/public-gateway-redacted-export-intake-preflight.snapshot.json` |
| runtime gate | `0` |

## 1. 目的

P0-15 已建立 Public Gateway live conf 脫敏匯出請求包，但尚未送件，也尚未收到 owner-provided redacted export ref。P0-16 的目的，是先定義未來收到 ref 時的收件預檢、拒收規則與 reviewer 分流，避免 raw Nginx live conf、secret payload 或未授權 `nginx -t` / reload 要求流入 repo、LOGBOOK、前端或 runtime。

本文件只定義 redacted export intake preflight。它不是 request sent、不是 recipient confirmed、不是 redacted export received、不是 raw conf stored、不是 rendered diff ready、不是 `nginx -t`、不是 reload、不是 route smoke，也不是 production write 或 runtime gate 授權。

## 2. 摘要

| 指標 | 值 | 說明 |
|------|----|------|
| intake candidate count | `3` | 對應三份 live conf export request |
| C0 intake candidate count | `2` | 188 all sites、188 internal tools HTTPS |
| intake field count | `11` | 每份收件候選欄位 |
| validation check count | `10` | 收件前必跑檢查 |
| rejection guard count | `12` | 必須拒收或隔離的 payload / action 類型 |
| reviewer intake lane count | `5` | waiting、補件、隔離、拒收、進 rendered diff preflight |
| request sent / recipient confirmed | `0 / 0` | 尚未送件、尚未確認收件人 |
| redacted export received / accepted | `0 / 0` | 尚未收到，尚未接受 |
| quarantined / rejected | `0 / 0` | 尚無 payload 進入隔離或拒收紀錄 |
| rendered diff / raw live conf stored | `0 / 0` | 尚未產生 diff，不保存 raw conf |
| runtime gate / action button | `0 / 0` | 未開啟 |

## 3. 收件欄位

| 欄位 | 內容規則 |
|------|----------|
| `intake_id` | 固定對應 redacted export intake，不建立 runtime action id |
| `export_request_id` | 對應 P0-15 匯出請求 |
| `config_id` | 對應 public gateway preflight row |
| `control_tier` | 保留 C0 / C1 風險分級 |
| `redacted_live_conf_ref` | 未收到前為空；只可填脫敏 ref |
| `ref_owner_role_or_team` | 只填 role / team，不填私人聯絡或 credential |
| `received_metadata_ref` | 只填送件 / 收件 metadata，不放 raw payload |
| `sensitive_payload_review` | 未檢查前為 `not_started` |
| `quarantine_ref` | 只有敏感 payload 隔離 metadata 可填 |
| `rendered_diff_candidate_ref` | 收件通過後仍需另建 rendered diff preflight candidate |
| `not_approval` | 必須為 `true` |

## 4. Validation Checks

| Check | 規則 |
|-------|------|
| `source_export_request_snapshot_current` | 來源匯出請求 snapshot 必須是 committed 最新版本 |
| `request_sent_metadata_required` | 沒有可稽核 request sent metadata 時，不得標記 received |
| `recipient_confirmed_metadata_required` | 沒有 owner / recipient role 確認時，不得標記 recipient confirmed |
| `redacted_export_ref_required` | 只接受脫敏 export ref；不得貼 raw live conf |
| `raw_live_conf_payload_blocked` | raw conf、私鑰、token、cookie、session 或 authorization header 必須拒收或隔離 |
| `redaction_policy_attestation_required` | owner 需聲明已依 redaction policy 處理 credential 與 sensitive payload |
| `secret_marker_scan_required` | 可存入 repo 的 metadata 必須先通過 secret marker / sensitive marker 檢查 |
| `scope_matches_export_request` | host、config id、live path metadata 必須與匯出請求一致 |
| `quarantine_before_storage` | 疑似敏感 payload 只可留下 quarantine metadata |
| `rendered_diff_gate_separate` | 收件通過只代表可進 rendered diff preflight |

## 5. Rejection Guards

以下內容必須拒收或隔離，不得寫入 repo、LOGBOOK、前端或 runtime：

| Guard | 處理 |
|-------|------|
| `raw_live_conf_payload` | 拒收或隔離，只留 metadata |
| `tls_private_key` | 拒收或隔離 |
| `token_secret_cookie_session` | 拒收或隔離 |
| `authorization_header_or_basic_auth` | 拒收或隔離 |
| `unredacted_upstream_credential` | 要求重新脫敏 |
| `db_url_or_env_dump` | 拒收或隔離 |
| `shell_history_or_private_key` | 拒收或隔離 |
| `unredacted_log_or_screenshot` | 拒收或隔離 |
| `nginx_test_execution_request` | 拒收執行要求 |
| `nginx_reload_or_route_change_request` | 拒收執行要求 |
| `dns_tls_certbot_request` | 拒收執行要求 |
| `ssh_host_write_or_runtime_request` | 拒收執行要求 |

## 6. Reviewer Intake Lanes

| Lane | 分流 |
|------|------|
| `keep_waiting_redacted_export` | 尚未送件、尚未確認 recipient 或尚未收到 ref 時維持等待 |
| `request_more_metadata` | 缺欄位、scope 或 redaction attestation 時補件 |
| `quarantine_sensitive_payload` | 疑似敏感 payload 時只留 quarantine metadata |
| `reject_execution_request` | 夾帶執行要求時拒收 |
| `ready_for_rendered_diff_preflight` | 欄位完整且只有脫敏 ref 時，才可進 rendered diff preflight |

## 6.1 2026-06-14 Rendered Diff Gate Draft

已新增 `docs/security/PUBLIC-GATEWAY-RENDERED-DIFF-GATE-DRAFT.md` 與 `docs/security/public-gateway-rendered-diff-gate-draft.snapshot.json`，將三份 redacted export intake candidate 轉成 rendered diff / `nginx -t` / reload / route smoke 分階段 gate 草稿。

目前固定為 `diff_gate_candidate_count=3`、`c0_diff_gate_candidate_count=2`、`preflight_stage_count=7`、`blocked_action_count=14`、`rendered_diff_ready_count=0`、`nginx_test_executed_count=0`、`runtime_gate_count=0`。此 artifact 只表示未來收件 accepted 後的下一層 gate 形狀，不代表 redacted export accepted、rendered diff ready、`nginx -t`、reload、route smoke、DNS / TLS probe、certbot renew、host write 或 production write。

## 7. 指令

產生 committed snapshot：

```bash
python3 scripts/security/public-gateway-redacted-export-intake-preflight.py \
  --root . \
  --export-request-report docs/security/public-gateway-live-conf-export-request.snapshot.json \
  --output docs/security/public-gateway-redacted-export-intake-preflight.snapshot.json \
  --generated-at 2026-06-14T19:35:00+08:00
```

驗證 guard：

```bash
python3 scripts/security/security-mirror-progress-guard.py --root .
```

## 8. 完成度

| 工作 | 完成度 | 說明 |
|------|--------|------|
| redacted export intake preflight artifact | `100%` | 產生器、snapshot 與文件已固定 |
| request sent / recipient confirmed | `0%` | 尚未送件，尚未確認 |
| redacted export received / accepted | `0%` | 尚未收到，尚未接受 |
| quarantine / rejected | `0%` | 尚無 payload |
| rendered diff / nginx -t / route smoke | `0%` | 尚未批准且未執行 |
| runtime reload / host write | `0%` | 未授權且未執行 |
