From b088f77bee108cfa286fa2f576e4d557248e9583 Mon Sep 17 00:00:00 2001 From: Your Name Date: Wed, 20 May 2026 16:18:43 +0800 Subject: [PATCH] feat(web): show IwoooS security contracts in AwoooP --- apps/web/messages/en.json | 28 +++++ apps/web/messages/zh-TW.json | 28 +++++ .../app/[locale]/awooop/contracts/page.tsx | 112 ++++++++++++++++++ docs/LOGBOOK.md | 14 +++ .../security/SECURITY-MIRROR-STATUS-ROLLUP.md | 2 + .../SECURITY-SUPPLY-CHAIN-PROGRESS.md | 5 +- ...ecurity-mirror-status-rollup.snapshot.json | 31 ++++- .../security-mirror-progress-guard.py | 48 ++++++++ 8 files changed, 266 insertions(+), 2 deletions(-) diff --git a/apps/web/messages/en.json b/apps/web/messages/en.json index d6b0f561..a6e32203 100644 --- a/apps/web/messages/en.json +++ b/apps/web/messages/en.json @@ -3764,6 +3764,34 @@ "item4": "Open the AwoooP work map" } }, + "contracts": { + "securityContractCandidate": { + "title": "IwoooS Security Contract Read-only Candidate", + "subtitle": "The contract dashboard only shows the schema, snapshot, and guard semantics that IwoooS / security mirror currently depends on. This is not contract publishing and does not trigger a runtime gate.", + "badge": "Contract candidate", + "contractRefsTitle": "Read-only contract refs", + "boundaryLabel": "Contract Boundary", + "boundaryTitle": "No security contract is publishable here", + "boundaryDetail": "This panel does not publish contract revisions, change contract lifecycle, write to the platform contracts API, call GitHub / Gitea / Kali, or add scan, execute, deploy, primary switch, or refs actions.", + "openIwooos": "Open IwoooS", + "metrics": { + "totalContracts": "Total contracts", + "totalContractsDetail": "Security mirror currently rolls up 36 primary contracts.", + "readyForMirror": "Ready for mirror", + "readyForMirrorDetail": "33 ready, 2 partial, 1 contract-only, and 0 blocked.", + "partialReady": "Partial", + "partialReadyDetail": "Remaining gaps are owner response, payload ingestion, and source-control owner evidence.", + "activeRuntimeGates": "Active runtime gates", + "activeRuntimeGatesDetail": "Still 0; contract visibility is not runtime enforcement." + }, + "contractRefs": { + "statusRollup": "The shared state entrypoint for AwoooP and the Security Session; it only rolls up progress and safe gates.", + "postureProjection": "The projection contract for IwoooS posture, host coverage, owner response focus, and forbidden actions.", + "ownerValidation": "The S4.9-S4.12 owner response received / accepted separation and reviewer check semantics.", + "rolloutPolicy": "The low-friction, observe-first rollout policy with owner review before blocking." + } + } + }, "approvals": { "securityOwnerResponseGate": { "title": "IwoooS Owner Response Read-only Review Focus", diff --git a/apps/web/messages/zh-TW.json b/apps/web/messages/zh-TW.json index 4bc7cf24..a1870a63 100644 --- a/apps/web/messages/zh-TW.json +++ b/apps/web/messages/zh-TW.json @@ -3765,6 +3765,34 @@ "item4": "查看 AwoooP 工作鏈路地圖" } }, + "contracts": { + "securityContractCandidate": { + "title": "IwoooS 資安契約只讀候選", + "subtitle": "合約儀表板只顯示 IwoooS / security mirror 目前依賴的 schema、snapshot 與 guard 口徑；這不是 contract publish，也不會觸發 runtime gate。", + "badge": "契約候選", + "contractRefsTitle": "只讀 contract refs", + "boundaryLabel": "合約邊界", + "boundaryTitle": "目前沒有可發布的資安合約", + "boundaryDetail": "這個面板不發布 contract revision、不改合約生命週期、不寫入 platform contracts API、不呼叫 GitHub / Gitea / Kali，也不新增 scan、execute、deploy、primary switch 或 refs action。", + "openIwooos": "開啟 IwoooS", + "metrics": { + "totalContracts": "總 contracts", + "totalContractsDetail": "security mirror 目前彙整 36 個主要 contract。", + "readyForMirror": "Ready for mirror", + "readyForMirrorDetail": "33 個 ready、2 個 partial、1 個 contract-only、0 blocked。", + "partialReady": "Partial", + "partialReadyDetail": "缺口仍集中在 owner response、payload ingestion 與 source-control owner evidence。", + "activeRuntimeGates": "Active runtime gates", + "activeRuntimeGatesDetail": "仍為 0；合約可見性不等於 runtime enforcement。" + }, + "contractRefs": { + "statusRollup": "AwoooP / Security Session 的共同狀態入口，只彙整進度與安全 gate。", + "postureProjection": "IwoooS 前端態勢、主機覆蓋、owner response focus 與禁止動作的投影契約。", + "ownerValidation": "S4.9-S4.12 owner response received / accepted 分離與 reviewer 檢查口徑。", + "rolloutPolicy": "低摩擦、observe-first、owner review before blocking 的 rollout policy。" + } + } + }, "approvals": { "securityOwnerResponseGate": { "title": "IwoooS Owner Response 只讀審查焦點", diff --git a/apps/web/src/app/[locale]/awooop/contracts/page.tsx b/apps/web/src/app/[locale]/awooop/contracts/page.tsx index 25960035..206549e0 100644 --- a/apps/web/src/app/[locale]/awooop/contracts/page.tsx +++ b/apps/web/src/app/[locale]/awooop/contracts/page.tsx @@ -6,12 +6,16 @@ "use client"; import { useState, useEffect, useCallback } from "react"; +import { useTranslations } from "next-intl"; +import { Link } from "@/i18n/routing"; import { + ArrowRight, FileText, RefreshCw, AlertCircle, Filter, ChevronDown, + ShieldCheck, } from "lucide-react"; import { cn } from "@/lib/utils"; @@ -136,6 +140,112 @@ function ContractRow({ contract }: { contract: Contract }) { ); } +function SecurityContractCandidatePanel() { + const t = useTranslations("awooop.contracts.securityContractCandidate"); + const metrics = [ + { + label: t("metrics.totalContracts"), + value: "36", + detail: t("metrics.totalContractsDetail"), + }, + { + label: t("metrics.readyForMirror"), + value: "33", + detail: t("metrics.readyForMirrorDetail"), + }, + { + label: t("metrics.partialReady"), + value: "2", + detail: t("metrics.partialReadyDetail"), + }, + { + label: t("metrics.activeRuntimeGates"), + value: "0", + detail: t("metrics.activeRuntimeGatesDetail"), + }, + ]; + const contracts = [ + { + name: "security_mirror_status_rollup_v1", + detail: t("contractRefs.statusRollup"), + }, + { + name: "iwooos_posture_projection_v1", + detail: t("contractRefs.postureProjection"), + }, + { + name: "source_control_owner_response_validation_rollup_v1", + detail: t("contractRefs.ownerValidation"), + }, + { + name: "security_rollout_policy_v1", + detail: t("contractRefs.rolloutPolicy"), + }, + ]; + + return ( +
+
+
+
+ + {t("badge")} + +
+ +
+ {metrics.map((item) => ( +
+

{item.label}

+

{item.value}

+

{item.detail}

+
+ ))} +
+ +
+
+
+ {t("contractRefsTitle")} +
+
+ {contracts.map((item) => ( +
+

{item.name}

+

{item.detail}

+
+ ))} +
+
+ +
+

{t("boundaryLabel")}

+

{t("boundaryTitle")}

+

{t("boundaryDetail")}

+
+ contract_publish_authorized=false + contract_mutation_authorized=false + runtime_execution_authorized=false + action_buttons_allowed=false +
+ + {t("openIwooos")} +
+
+
+ ); +} + // ============================================================================= // Main Component // ============================================================================= @@ -206,6 +316,8 @@ export default function ContractsPage() { + + {/* Filters */}