wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 4 Packages Projects Releases Wiki Activity

docs(iwooos): 記錄供應鏈 owner policy gate [skip ci]

Browse Source
This commit is contained in:
Your Name
2026-06-15 07:02:43 +08:00
parent c35f064d2a
commit e2ad14d34b
1 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
docs/LOGBOOK.md
View File

@@ -1,3 +1,41 @@
## 2026-06-15｜Package / Docker 供應鏈 Owner Policy Gate 完成
**背景**：前一輪已建立 Package / Docker 供應鏈 repo-only baseline，但 baseline 只回答「目前有哪些套件、lockfile、requirements、Dockerfile 與 compose image refs 需要控管」，尚未把 Python lockfile、requirements pinning、Docker digest pinning、compose image digest、CVE / license / SBOM 的 owner policy 欄位拆成可驗收的 gate。若直接從 baseline 進入套件升級、lockfile 重寫、image digest 修改或外部掃描，會違反 IwoooS 初期「只讀證據、低摩擦流程、階段性收攏」原則。
**完成項目**：
- 新增 `docs/security/PACKAGE-SUPPLY-CHAIN-OWNER-POLICY-GATE.md`，把供應鏈缺口拆成六個 owner policy request：package manager / lockfile owner、Python lockfile policy、requirements pinning policy、Dockerfile digest pinning policy、compose image digest policy、CVE / license / SBOM window。
- 新增 `docs/security/package-supply-chain-owner-policy-gate.snapshot.json`，固定 `requests=6`、`c0=2`、`fields=8`、`checks=12`、`blocked=20`、`sent=0`、`accepted=0`、`runtime=0`。
- 新增 `scripts/security/package-supply-chain-owner-policy-guard.py`，驗證 baseline 缺口、owner policy request、required owner fields、reviewer checks、blocked actions 與 `0 / false` 邊界一致。
- `scripts/security/security-mirror-progress-guard.py` 已串接新 guard，`security-mirror-dry-run.snapshot.json` 新增 `CHECK_PACKAGE_SUPPLY_CHAIN_OWNER_POLICY_GUARD`。
- 更新 `PACKAGE-SUPPLY-CHAIN-BASELINE.md`、`IWOOOS-CONFIG-CONTROL-INVENTORY.md` 與 `SECURITY-SUPPLY-CHAIN-PROGRESS.md`，明確標註 baseline 通過不代表可 install、upgrade、rewrite lockfile、pin requirements、pull / build / push image、登入 registry、掃 CVE / license / SBOM、改 workflow、部署或開 runtime gate。
**本地驗證**：
- `python3 -m py_compile scripts/security/package-supply-chain-owner-policy-guard.py scripts/security/security-mirror-progress-guard.py` 通過。
- `python3 -m json.tool docs/security/package-supply-chain-owner-policy-gate.snapshot.json` 通過。
- `python3 -m json.tool docs/security/security-mirror-dry-run.snapshot.json` 通過。
- `python3 scripts/security/package-supply-chain-owner-policy-guard.py --root .` → `PACKAGE_SUPPLY_CHAIN_OWNER_POLICY_GUARD_OK`。
- `python3 scripts/security/security-mirror-progress-guard.py --root .` → `SECURITY_MIRROR_PROGRESS_GUARD_OK`。
- `python3 scripts/security/source-control-owner-response-guard.py --root .` → `SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK`。
- `python3 scripts/security/iwooos-config-control-guard.py --root .` → `IWOOOS_CONFIG_CONTROL_GUARD_OK`。
- `python3 scripts/security/iwooos-owner-gate-guard.py --root .` → `IWOOOS_OWNER_GATE_GUARD_OK`。
- `python3 scripts/ops/doc-secrets-sanity-check.py docs .gitea` → `DOC_SECRET_SANITY_OK scanned_files=865`。
- `git diff --check` 通過。
**Git / Gitea**：
- Feature commit：`c35f064d test(iwooos): 新增供應鏈 owner policy gate [skip ci]`。
- 本輪為 repo-only 文件 / snapshot / guard 更新，`[skip ci]`，不觸發正式部署。
**完成度與邊界**：
- Package / Docker supply-chain owner policy gate：`0% -> 100%`。
- Node lockfile owner policy：`80%`，已有 `pnpm-lock.yaml` 與 owner policy request；尚未收到 owner response。
- Python lock policy：`30% -> 45%`，已建立 owner policy request；尚未決定工具與 lockfile 策略。
- requirements pinning policy：`20% -> 35%`，已建立 26 條未 pin entry 的 owner policy request；尚未批准 pinning 或相容性窗口。
- Docker / compose image policy：`35% -> 45%`，已建立 C0 digest pinning owner policy request；尚未批准 registry owner、digest 來源、rollback owner 或 post-check。
- CVE / license / SBOM 驗證：`0% -> 15%`，已建立 owner policy request；尚未批准外部掃描窗口或工具。
- IwoooS headline 維持 `64%`；active runtime gate 維持 `0`。
- owner response sent / received / accepted、runtime execution、action buttons、package install / upgrade、lockfile write、requirements pin、CVE / license lookup、SBOM generation、docker pull / build / push、registry login、workflow modification、secret collection、production deploy 全部維持 `0 / false`。
- 本輪未 SSH、未改主機、未重啟 Docker / Nginx、未修改 firewall / iptables、未收 secrets 明文、未 active scan、未切 GitHub primary、未 force push，也沒有把工作視窗溝通內容放到前端頁面。
## 2026-06-15｜Tenants 前台敏感識別二次遮罩與 Owner Gate Guard 正式部署完成
**背景**：使用者指出 `/zh-TW/awooop/tenants` 曾把個人 owner namespace、完整 repository slug、英文專案名稱、內部阻塞狀態與預算資訊直接放到前台。這不符合 IwoooS 現階段「只讀證據、低摩擦流程、公開面不暴露內部識別」原則；前台必須只顯示繁中公開名稱、公開代號與人讀狀態，raw id 只能留在後端、snapshot、guard 或只讀驗收脈絡。