From 466c4ecd3187170bc8f107954e5683e5e85698ff Mon Sep 17 00:00:00 2001 From: Your Name Date: Wed, 20 May 2026 00:21:05 +0800 Subject: [PATCH] feat(web): add IwoooS decision writeups --- apps/web/messages/en.json | 43 +++++ apps/web/messages/zh-TW.json | 43 +++++ apps/web/src/app/[locale]/iwooos/page.tsx | 65 ++++++++ docs/LOGBOOK.md | 14 ++ .../iwooos_posture_projection_v1.schema.json | 98 ++++++++++++ docs/security/IWOOOS-POSTURE-PROJECTION.md | 22 ++- .../security/SECURITY-MIRROR-STATUS-ROLLUP.md | 3 +- .../SECURITY-SUPPLY-CHAIN-PROGRESS.md | 4 +- .../iwooos-posture-projection.snapshot.json | 147 +++++++++++++++++- ...ecurity-mirror-status-rollup.snapshot.json | 13 +- .../security-mirror-progress-guard.py | 100 ++++++++++++ 11 files changed, 545 insertions(+), 7 deletions(-) diff --git a/apps/web/messages/en.json b/apps/web/messages/en.json index e4141cb0..f350c10c 100644 --- a/apps/web/messages/en.json +++ b/apps/web/messages/en.json @@ -1887,6 +1887,49 @@ "next": "active runtime gates=0; action buttons=false" } } + }, + "hostOwnerDecisionRecordWriteups": { + "title": "Host Owner Decision Record Write-Up Packets", + "subtitle": "When a draft review outcome is ready for write-up, IwoooS can still only display formal decision record write-up fields. It does not create records, mark completed / accepted, or open runtime gates.", + "packetLabel": "Write-up packet", + "fieldLabel": "Required field", + "items": { + "decisionSummaryWriteup": { + "title": "Decision summary write-up", + "body": "Only organizes the human owner decision, risk acceptance boundary, and no-execution statement.", + "field": "decision summary; write-up completed=0" + }, + "approvedScopeWriteup": { + "title": "Approved scope write-up", + "body": "Only organizes hosts, networks, services, exclusions, observation intent, and expiry.", + "field": "scope / expiry; record created=false" + }, + "scanModeLimitsWriteup": { + "title": "Scan mode limits write-up", + "body": "Only organizes limits for observe-only, future active scan, or credentialed scan modes. This is not scan approval.", + "field": "mode limits; scan authorized=false" + }, + "credentialBoundaryWriteup": { + "title": "Credential boundary write-up", + "body": "Only organizes credential handling metadata, owner, retention boundary, and forbidden collection content.", + "field": "metadata-only boundary; secret collection=false" + }, + "maintenanceRollbackWriteup": { + "title": "Maintenance and rollback write-up", + "body": "Only organizes maintenance window candidates, constraints, rollback owner, recovery path, and human contact.", + "field": "window / rollback; host update=false" + }, + "validationEvidenceWriteup": { + "title": "Validation evidence write-up", + "body": "Only organizes post-check metrics, baseline, evidence pointer, and human acceptance condition.", + "field": "metrics / evidence; accepted=0" + }, + "runtimeGatePointerWriteup": { + "title": "Runtime gate pointer write-up", + "body": "Only states that future approval still needs a separate follow-up runtime gate and cannot execute from write-up.", + "field": "runtime gate pointer; active gates=0" + } + } } }, "tickets": { diff --git a/apps/web/messages/zh-TW.json b/apps/web/messages/zh-TW.json index 6d981284..14cd198c 100644 --- a/apps/web/messages/zh-TW.json +++ b/apps/web/messages/zh-TW.json @@ -1888,6 +1888,49 @@ "next": "active runtime gates=0；action buttons=false" } } + }, + "hostOwnerDecisionRecordWriteups": { + "title": "主機 Owner Decision Record Write-Up Packets", + "subtitle": "Draft review outcome 若進入 ready for write-up，IwoooS 也只能顯示正式 decision record 撰寫欄位。不建立 record、不標示 completed / accepted、不開 runtime gate。", + "packetLabel": "Write-up packet", + "fieldLabel": "必要欄位", + "items": { + "decisionSummaryWriteup": { + "title": "Decision summary write-up", + "body": "只整理 owner 要做的人工作業判斷、風險接受邊界與不執行聲明。", + "field": "decision summary；write-up completed=0" + }, + "approvedScopeWriteup": { + "title": "Approved scope write-up", + "body": "只整理主機、網段、服務、排除範圍、觀察目的與到期時間。", + "field": "scope / expiry；record created=false" + }, + "scanModeLimitsWriteup": { + "title": "Scan mode limits write-up", + "body": "只整理 observe-only、future active scan 或 credentialed scan 的限制條件，不代表掃描批准。", + "field": "mode limits；scan authorized=false" + }, + "credentialBoundaryWriteup": { + "title": "Credential boundary write-up", + "body": "只整理 credential handling metadata、owner、保存邊界與不可收集內容。", + "field": "metadata-only boundary；secret collection=false" + }, + "maintenanceRollbackWriteup": { + "title": "Maintenance and rollback write-up", + "body": "只整理維護窗口候選、限制條件、rollback owner、復原路徑與人工聯絡點。", + "field": "window / rollback；host update=false" + }, + "validationEvidenceWriteup": { + "title": "Validation evidence write-up", + "body": "只整理 post-check metrics、baseline、evidence pointer 與人工驗收條件。", + "field": "metrics / evidence；accepted=0" + }, + "runtimeGatePointerWriteup": { + "title": "Runtime gate pointer write-up", + "body": "只標示若未來批准，仍要另開 follow-up runtime gate，不能由 write-up 執行。", + "field": "runtime gate pointer；active gates=0" + } + } } }, "tickets": { diff --git a/apps/web/src/app/[locale]/iwooos/page.tsx b/apps/web/src/app/[locale]/iwooos/page.tsx index 2e7249bf..af367544 100644 --- a/apps/web/src/app/[locale]/iwooos/page.tsx +++ b/apps/web/src/app/[locale]/iwooos/page.tsx @@ -179,6 +179,13 @@ type HostOwnerDecisionRecordDraftReviewOutcomeLane = { tone: 'steady' | 'warn' | 'locked' } +type HostOwnerDecisionRecordWriteupPacket = { + key: string + packet: string + icon: typeof ShieldCheck + tone: 'steady' | 'warn' | 'locked' +} + const postureMetrics: PostureMetric[] = [ { key: 'overall', value: '58%', tone: 'warn' }, { key: 'framework', value: '80-85%', tone: 'steady' }, @@ -420,6 +427,16 @@ const hostOwnerDecisionRecordDraftReviewOutcomeLanes: HostOwnerDecisionRecordDra { key: 'runtimeGateStillRequired', lane: 'DV7', icon: ShieldCheck, tone: 'locked' }, ] +const hostOwnerDecisionRecordWriteupPackets: HostOwnerDecisionRecordWriteupPacket[] = [ + { key: 'decisionSummaryWriteup', packet: 'WU1', icon: ClipboardCheck, tone: 'warn' }, + { key: 'approvedScopeWriteup', packet: 'WU2', icon: Radar, tone: 'warn' }, + { key: 'scanModeLimitsWriteup', packet: 'WU3', icon: Activity, tone: 'locked' }, + { key: 'credentialBoundaryWriteup', packet: 'WU4', icon: Lock, tone: 'locked' }, + { key: 'maintenanceRollbackWriteup', packet: 'WU5', icon: Clock3, tone: 'warn' }, + { key: 'validationEvidenceWriteup', packet: 'WU6', icon: CheckCircle2, tone: 'warn' }, + { key: 'runtimeGatePointerWriteup', packet: 'WU7', icon: ShieldCheck, tone: 'locked' }, +] + const evidenceItems = [ 'iwooos-posture-projection.snapshot.json', 'security-rollout-policy.snapshot.json', @@ -1090,6 +1107,34 @@ function HostOwnerDecisionRecordDraftReviewOutcomeCard({ ) } +function HostOwnerDecisionRecordWriteupCard({ item }: { item: HostOwnerDecisionRecordWriteupPacket }) { + const t = useTranslations('iwooos.hostOwnerDecisionRecordWriteups') + const Icon = item.icon + return ( +
+
+
+ + {t('packetLabel')} +
+ {item.packet} +
+

+ {t(`items.${item.key}.title` as never)} +

+

+ {t(`items.${item.key}.body` as never)} +

+
+
{t('fieldLabel')}
+
+ {t(`items.${item.key}.field` as never)} +
+
+
+ ) +} + export default function IwoooSPage({ params }: { params: { locale: string } }) { const t = useTranslations('iwooos') @@ -1462,6 +1507,26 @@ export default function IwoooSPage({ params }: { params: { locale: string } }) { +
+
+

{t('hostOwnerDecisionRecordWriteups.title')}

+

+ {t('hostOwnerDecisionRecordWriteups.subtitle')} +

+
+
+ {hostOwnerDecisionRecordWriteupPackets.map(item => ( + + ))} +
+
+
None: "s2_26_iwooos_host_owner_decision_record_draft_packets", "s2_27_iwooos_host_owner_decision_record_draft_review_checklist", "s2_28_iwooos_host_owner_decision_record_draft_review_outcome_lanes", + "s2_29_iwooos_host_owner_decision_record_writeup_packets", ] assert_equal( "progress_delta_ledger.delta_ids", @@ -478,6 +479,15 @@ def validate(root: Path) -> None: "host_decision_record_rollback_owner_incomplete_outcome_lane", "host_decision_record_runtime_gate_required_outcome_lane", ] + expected_iwooos_host_owner_decision_record_writeup_packet_ids = [ + "host_decision_record_summary_writeup_packet", + "host_decision_record_scope_writeup_packet", + "host_decision_record_scan_mode_limits_writeup_packet", + "host_decision_record_credential_boundary_writeup_packet", + "host_decision_record_maintenance_rollback_writeup_packet", + "host_decision_record_validation_evidence_writeup_packet", + "host_decision_record_runtime_gate_pointer_writeup_packet", + ] assert_equal( "iwooos_projection.summary.frontend_surface_coverage_group_count", iwooos_projection["summary"]["frontend_surface_coverage_group_count"], @@ -573,6 +583,11 @@ def validate(root: Path) -> None: iwooos_projection["summary"]["host_owner_decision_record_draft_review_outcome_lane_count"], len(expected_iwooos_host_owner_decision_record_draft_review_outcome_lane_ids), ) + assert_equal( + "iwooos_projection.summary.host_owner_decision_record_writeup_packet_count", + iwooos_projection["summary"]["host_owner_decision_record_writeup_packet_count"], + len(expected_iwooos_host_owner_decision_record_writeup_packet_ids), + ) iwooos_progress = iwooos_projection["progress"] assert_equal("iwooos_projection.progress.overall_percent", iwooos_progress["overall_percent"], progress["overall_percent"]) assert_equal( @@ -1752,6 +1767,86 @@ def validate(root: Path) -> None: f"iwooos_projection.host_owner_decision_record_draft_review_outcome_lanes.{item['lane_id']}.not_authorization", item["not_authorization"], ) + iwooos_host_owner_decision_record_writeup_packets = iwooos_projection[ + "host_owner_decision_record_writeup_packets" + ] + assert_equal( + "iwooos_projection.host_owner_decision_record_writeup_packets.ids", + [item["packet_id"] for item in iwooos_host_owner_decision_record_writeup_packets], + expected_iwooos_host_owner_decision_record_writeup_packet_ids, + ) + assert_equal( + "iwooos_projection.host_owner_decision_record_writeup_packets.display_order", + [item["display_order"] for item in iwooos_host_owner_decision_record_writeup_packets], + list(range(1, len(expected_iwooos_host_owner_decision_record_writeup_packet_ids) + 1)), + ) + expected_iwooos_host_owner_decision_record_writeup_fields = [ + "decision_summary", + "approved_scope_statement", + "scan_mode_limits_statement", + "credential_boundary_statement", + "maintenance_and_rollback_statement", + "validation_evidence_statement", + "runtime_gate_pointer_statement", + ] + assert_equal( + "iwooos_projection.host_owner_decision_record_writeup_packets.writeup_fields", + [item["writeup_field"] for item in iwooos_host_owner_decision_record_writeup_packets], + expected_iwooos_host_owner_decision_record_writeup_fields, + ) + for item in iwooos_host_owner_decision_record_writeup_packets: + assert_equal( + f"iwooos_projection.host_owner_decision_record_writeup_packets.{item['packet_id']}.display_mode", + item["display_mode"], + "owner_decision_record_writeup_only", + ) + assert_equal( + f"iwooos_projection.host_owner_decision_record_writeup_packets.{item['packet_id']}.decision_record_writeup_completed_count", + item["decision_record_writeup_completed_count"], + 0, + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_writeup_packets.{item['packet_id']}.decision_record_created", + item["decision_record_created"], + ) + assert_equal( + f"iwooos_projection.host_owner_decision_record_writeup_packets.{item['packet_id']}.owner_decision_received_count", + item["owner_decision_received_count"], + 0, + ) + assert_equal( + f"iwooos_projection.host_owner_decision_record_writeup_packets.{item['packet_id']}.owner_decision_accepted_count", + item["owner_decision_accepted_count"], + 0, + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_writeup_packets.{item['packet_id']}.owner_approval_record_created", + item["owner_approval_record_created"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_writeup_packets.{item['packet_id']}.runtime_gate_opened", + item["runtime_gate_opened"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_writeup_packets.{item['packet_id']}.raw_payload_allowed", + item["raw_payload_allowed"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_writeup_packets.{item['packet_id']}.secret_value_collection_allowed", + item["secret_value_collection_allowed"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_writeup_packets.{item['packet_id']}.runtime_execution_authorized", + item["runtime_execution_authorized"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_writeup_packets.{item['packet_id']}.action_buttons_allowed", + item["action_buttons_allowed"], + ) + assert_true( + f"iwooos_projection.host_owner_decision_record_writeup_packets.{item['packet_id']}.not_authorization", + item["not_authorization"], + ) assert_equal( "iwooos_projection.non_blocking_lane_ids", iwooos_projection["non_blocking_lane_ids"], @@ -1789,6 +1884,7 @@ def validate(root: Path) -> None: "display_host_owner_decision_record_draft_packets", "display_host_owner_decision_record_draft_review_checklist", "display_host_owner_decision_record_draft_review_outcome_lanes", + "display_host_owner_decision_record_writeup_packets", "display_evidence_refs", "display_forbidden_actions", ]: @@ -1850,6 +1946,10 @@ def validate(root: Path) -> None: "mark_host_owner_decision_record_draft_review_outcome_passed", "create_host_owner_decision_record_from_draft_review_outcome", "open_runtime_gate_from_owner_decision_record_draft_review_outcome", + "create_host_owner_decision_record_from_writeup", + "mark_host_owner_decision_record_writeup_completed", + "mark_host_owner_decision_record_accepted_from_writeup", + "open_runtime_gate_from_owner_decision_record_writeup", "apply_runtime_blocking_control", "switch_github_primary", "production_deploy",