{ "schema_version": "security_rollout_policy_v1", "status": "draft", "default_mode": "observe", "enforcement_level": "mirror_only", "non_blocking_escalation_lane_count": 7, "non_blocking_escalation_lanes": [ { "lane_id": "lane-low-medium-observation", "display_order": 1, "trigger": "LOW / MEDIUM finding 且不涉及不可逆變更、secret value、repo / refs / deploy / primary control plane。", "initial_mode": "warn", "allowed_action": "標記風險、建立 follow-up、補 evidence_ref 或準備草案。", "forbidden_escalation": "不得阻擋 deploy、不得自動 patch、不得自動 merge、不得建立 runtime blocker。", "owner_review_required_before_blocking": true, "runtime_blocking_allowed": false, "awooop_display_mode": "display_low_friction_non_blocking_lane_only", "not_authorization": true }, { "lane_id": "lane-owner-response-missing", "display_order": 2, "trigger": "S4.9 / S4.10 / S4.11 / S4.12 owner response 尚未收到或尚未 accepted。", "initial_mode": "observe", "allowed_action": "顯示 missing lane、next collection candidate、template status 與 request packet。", "forbidden_escalation": "不得把未回覆當成拒絕、不得停止產品流程、不得自動補 owner response。", "owner_review_required_before_blocking": true, "runtime_blocking_allowed": false, "awooop_display_mode": "display_low_friction_non_blocking_lane_only", "not_authorization": true }, { "lane_id": "lane-mirror-data-incomplete", "display_order": 3, "trigger": "mirror snapshot、redacted payload 或 contract coverage 不完整，但未涉及 raw secret / token / exploit payload。", "initial_mode": "warn", "allowed_action": "顯示 partial / quarantine reason、要求補 redacted snapshot、保留 retry gate。", "forbidden_escalation": "不得阻擋無關 runtime、不得把 partial mirror 當 production incident、不得吞入未脫敏 payload。", "owner_review_required_before_blocking": true, "runtime_blocking_allowed": false, "awooop_display_mode": "display_low_friction_non_blocking_lane_only", "not_authorization": true }, { "lane_id": "lane-source-control-drift-draft", "display_order": 4, "trigger": "GitHub / Gitea refs、target、visibility 或 canonical decision 存在差異，但尚未 owner approved。", "initial_mode": "warn", "allowed_action": "維持 draft reconcile plan、ADR、read-only diff 與 owner review lane。", "forbidden_escalation": "不得 sync refs、delete refs、force push、建立 repo、修改 visibility 或切 GitHub primary。", "owner_review_required_before_blocking": true, "runtime_blocking_allowed": false, "awooop_display_mode": "display_low_friction_non_blocking_lane_only", "not_authorization": true }, { "lane_id": "lane-kali-observe-finding", "display_order": 5, "trigger": "Kali finding 或 scan scope 仍在 observe / approval package 階段。", "initial_mode": "warn", "allowed_action": "只顯示 redacted finding summary、evidence_ref、scan scope approval candidate 與 block reason。", "forbidden_escalation": "不得自動啟動 active scan、不得呼叫 /execute、不得把 finding 直接變 deploy blocker。", "owner_review_required_before_blocking": true, "runtime_blocking_allowed": false, "awooop_display_mode": "display_low_friction_non_blocking_lane_only", "not_authorization": true }, { "lane_id": "lane-workflow-secret-name-gap", "display_order": 6, "trigger": "workflow、webhook、runner、deploy key、branch protection、CODEOWNERS 或 secret 名稱 parity 尚缺 redacted evidence。", "initial_mode": "warn", "allowed_action": "要求 redacted export、顯示 owner response template 與只讀 readiness blocker wording。", "forbidden_escalation": "不得收集 secret value、不得啟用 GitHub hosted runner、不得修改 workflow / webhook / repository secret。", "owner_review_required_before_blocking": true, "runtime_blocking_allowed": false, "awooop_display_mode": "display_low_friction_non_blocking_lane_only", "not_authorization": true }, { "lane_id": "lane-progress-display-holding", "display_order": 7, "trigger": "headline progress 維持 58%，但 framework detail ledger 持續增加。", "initial_mode": "observe", "allowed_action": "顯示 micro progress、latest delta、not_authorization 與下一個高層 gate。", "forbidden_escalation": "不得把 progress holding 解讀成卡住、不得把 micro progress 當 runtime approval。", "owner_review_required_before_blocking": true, "runtime_blocking_allowed": false, "awooop_display_mode": "display_low_friction_non_blocking_lane_only", "not_authorization": true } ], "allowed_awooop_outputs": [ "display_non_blocking_escalation_lanes", "create_followup_without_blocking", "show_owner_review_required_before_blocking", "keep_runtime_blocking_false" ], "policy_items": [ { "condition": "read_only_inventory_or_evidence_mirror", "mode": "observe", "allowed": [ "collect_metadata", "write_redacted_snapshot", "update_docs", "mirror_to_awooop_runtime_state" ], "forbidden": [ "change_runtime", "write_to_remote_system", "delete_or_archive_repo", "sync_refs" ], "reason": "初期先建立可見性與追溯性，不阻擋產品與架構推進。" }, { "condition": "low_or_medium_observation_without_irreversible_change", "mode": "warn", "allowed": [ "label_risk", "create_followup_item", "add_evidence_ref", "prepare_draft_plan" ], "forbidden": [ "block_deploy", "force_owner_decision", "auto_patch", "auto_merge" ], "reason": "LOW / MEDIUM observation 先累積 evidence，不把日常流程變成審批地獄。" }, { "condition": "uses_readonly_token_or_admin_export", "mode": "approve_required", "allowed": [ "request_human_approval", "run_once_after_approval", "store_token_present_boolean_only", "write_redacted_inventory" ], "forbidden": [ "store_token_value", "reuse_write_token", "write_to_gitea", "create_repo" ], "reason": "只讀 token 與管理匯出會碰敏感邊界，需 approval，但仍不授權任何同步或寫入。" }, { "condition": "repo_creation_visibility_change_or_refs_sync", "mode": "approve_required", "allowed": [ "create_approval_candidate", "prepare_migration_plan", "prepare_rollback_plan" ], "forbidden": [ "execute_without_owner_approval", "push_refs", "change_visibility", "switch_primary" ], "reason": "這些動作會改供應鏈控制面，必須逐 repo 核准。" }, { "condition": "secret_rbac_network_firewall_deploy_or_primary_switch", "mode": "approve_required", "allowed": [ "create_approval_required_event", "prepare_dry_run_plan", "define_rollback" ], "forbidden": [ "auto_execute", "store_secret_value", "skip_human_review" ], "reason": "這些動作有生產、權限或安全 blast radius，不進入初期自動化。" }, { "condition": "destructive_action_without_rollback_or_secret_value_storage", "mode": "block_candidate", "allowed": [ "record_block_reason", "request_manual_exception" ], "forbidden": [ "force_push", "delete_repo", "store_raw_secret", "disable_audit" ], "reason": "不可逆且無 rollback 的動作不屬於初期框架建置範圍。" } ] }