{ "schema_version": "source_control_workflow_secret_name_owner_response_v1", "status": "draft_waiting_owner_response", "date": "2026-06-11", "mode": "owner_workflow_secret_name_response_intake_only", "runtime_execution_authorized": false, "source_contract": "source_control_workflow_secret_name_inventory_v1", "target_contract": "source_control_workflow_secret_name_export_request_v1", "source_indexes": [ "docs/security/source-control-workflow-secret-name-inventory.snapshot.json", "docs/security/source-control-workflow-secret-name-local-evidence.snapshot.json", "docs/security/source-control-workflow-secret-name-export-request.snapshot.json", "docs/security/SOURCE-CONTROL-WORKFLOW-SECRET-NAME-INVENTORY.md", "docs/security/SOURCE-CONTROL-WORKFLOW-SECRET-NAME-LOCAL-EVIDENCE.md", "docs/security/SOURCE-CONTROL-WORKFLOW-SECRET-NAME-EXPORT-REQUEST.md", "docs/security/source-control-primary-readiness-gate.snapshot.json", "docs/security/security-approval-review-packet.snapshot.json", "docs/security/security-followup-runtime-gate.snapshot.json" ], "summary": { "owner_response_status": "waiting_owner_response", "candidate_repo_count": 10, "in_scope_repo_count": 9, "export_request_count": 9, "export_lane_count": 5, "local_evidence_repo_count": 5, "local_workflow_file_count": 33, "local_referenced_secret_name_count": 42, "owner_response_request_packet_count": 1, "owner_response_template_status_count": 5, "owner_response_audit_event_template_count": 3, "owner_response_redaction_example_count": 5, "response_template_count": 5, "received_response_count": 0, "accepted_response_count": 0, "rejected_response_count": 0, "acceptance_check_count": 8, "rejection_rule_count": 10, "secret_value_collection_allowed": false, "write_token_allowed": false, "workflow_modification_authorized": false, "webhook_modification_authorized": false, "runner_change_authorized": false, "deploy_key_change_authorized": false, "branch_protection_change_authorized": false, "repo_secret_change_authorized": false, "github_hosted_runner_enable_authorized": false, "refs_sync_authorized": false, "github_primary_switch_authorized": false, "action_buttons_allowed": false, "owner_response_collection_check_count": 6, "intake_preflight_check_count": 6, "workflow_secret_owner_handoff_package_ready": true, "workflow_secret_owner_handoff_completion_percent": 100, "workflow_secret_owner_handoff_check_count": 6, "workflow_secret_owner_handoff_packet_field_count": 9, "workflow_secret_owner_request_dispatch_authorized": false, "secret_name_parity_complete": false, "secret_value_or_hash_collection_allowed": false, "workflow_secret_owner_response_handoff_not_approval": true }, "workflow_secret_owner_handoff_preflight_checks": [ { "check_id": "p1-4-baseline-sync", "display_order": 1, "check": "送件前確認 gitea/main、local evidence、S4.9-S4.12 source packets 最新狀態。", "current_status": "defined_not_dispatched", "execution_authorized": false }, { "check_id": "p1-4-local-evidence-freshness", "display_order": 2, "check": "以 2026-06-04 local evidence 的 31 個 workflow files、42 個 unique secret names、5 個 runner labels 為基準。", "current_status": "defined_not_dispatched", "execution_authorized": false }, { "check_id": "p1-4-five-response-lanes", "display_order": 3, "check": "webhook、runner、deploy key、branch protection / CODEOWNERS、repository secret name parity 逐項追蹤。", "current_status": "defined_not_dispatched", "execution_authorized": false }, { "check_id": "p1-4-metadata-only", "display_order": 4, "check": "只收 redacted host、runner label、key name、ruleset / CODEOWNERS metadata、secret name / scope / present-absent。", "current_status": "defined_not_dispatched", "execution_authorized": false }, { "check_id": "p1-4-secret-material-rejected", "display_order": 5, "check": "secret value、hash、masked token、partial token、private key、runner token、webhook secret 全部拒收或隔離。", "current_status": "defined_not_dispatched", "execution_authorized": false }, { "check_id": "p1-4-execution-request-rejected", "display_order": 6, "check": "workflow / webhook / runner / deploy key / branch protection / repository secret 修改、hosted runner enable、refs sync、primary switch 全部 hard reject。", "current_status": "defined_not_dispatched", "execution_authorized": false } ], "workflow_secret_owner_handoff_packet": { "request_id": "p1_4_workflow_secret_owner_response_handoff", "stage_id": "S4.12", "source_evidence_summary": { "local_evidence_repo_count": 5, "local_workflow_file_count": 33, "local_referenced_secret_name_count": 42, "runner_label_count": 5 }, "requested_templates": [ "response-webhook-redacted-export", "response-runner-label-owner", "response-deploy-key-redacted-export", "response-branch-protection-codeowners", "response-repository-secret-name-parity" ], "recipient_role_or_team_required": true, "required_response_fields": [ "owner_role_or_team", "decision", "repo", "provider", "lane", "lane_specific_owner", "lane_specific_metadata", "redacted_evidence_refs", "followup_owner" ], "allowed_metadata": [ "redacted_host", "event_types", "runner_label", "key_name", "required_checks", "codeowners_path", "secret_name", "scope", "present_absent" ], "forbidden_inputs": [ "secret_value", "secret_hash", "masked_token", "partial_token", "token_value", "runner_registration_token", "webhook_secret", "private_key", "deploy_key_private_key", "authorization_header", "workflow_modification_request", "runner_enablement_request", "github_hosted_runner_enable_request", "repository_secret_change_request", "github_primary_switch_request" ], "not_approval": true, "execution_authorized": false }, "post_dispatch_invariants": [ "Owner response 到來後仍需先進 S4.12 intake preflight 與 reviewer validation。", "通過後只可更新 read-only workflow / secret name inventory、export request、primary readiness blocker wording 與 status rollup。", "不得建立、複製、rotate、修改或刪除 secret。", "不得改 workflow / webhook / runner / deploy key / branch protection / CODEOWNERS，不得啟用 GitHub hosted runner。", "不得 sync refs、切 GitHub primary 或停用 Gitea。" ], "owner_response_request_packet": { "request_id": "s4_12_workflow_secret_name_owner_response_request", "display_status": "ready_to_request_owner_response", "requested_packet": "docs/security/SOURCE-CONTROL-WORKFLOW-SECRET-NAME-OWNER-RESPONSE.md", "required_response_item_count": 5, "requested_template_ids": [ "response-webhook-redacted-export", "response-runner-label-owner", "response-deploy-key-redacted-export", "response-branch-protection-codeowners", "response-repository-secret-name-parity" ], "owner_instruction_summary": "請 owner 只依 S4.12 五個 templates 回覆 webhook、runner、deploy key、branch protection / CODEOWNERS 與 repository secret name parity 的脫敏 metadata；不要貼 secret value、token、runner token、webhook secret、private key、deploy key value、完整 URL credential、request body、header、未脫敏截圖或任何 workflow / secret / runner 執行要求。", "allowed_response_fields": [ "owner_role_or_team", "decision", "decision_reason", "repo", "provider", "lane", "webhook_name_or_none", "destination_host_redacted", "event_types", "active_enabled_flag", "webhook_owner", "runner_label_or_none", "runner_scope", "executor_type", "hosted_or_self_hosted", "runner_owner", "github_hosted_minutes_risk", "maintenance_window", "key_name_or_none", "read_only_flag", "repo_scope", "key_owner", "rotation_owner", "protected_branch_name_or_none", "required_review_count", "required_status_check_names", "codeowners_path_or_none", "owner_team_names", "ruleset_owner", "secret_name_list_or_none", "secret_scope", "owning_team", "used_by_workflow_name", "present_in_gitea", "present_in_github", "evidence_refs", "followup_owner" ], "evidence_ref_rules": [ "只允許 repo 內既有文件、snapshot、workflow 檔名、job 名稱、secret 名稱、runner label、redacted host 或已脫敏 owner metadata pointer。", "secret parity 只能保存 secret name / scope / present-absent metadata / owner，不得保存 value、hash、masked token 或 partial token。", "runner 回覆只能標示 self-hosted / hosted 風險 review candidate，不得視為 GitHub hosted runner 啟用批准。", "webhook 回覆只能保存 redacted host、event types、enabled flag 與 owner，不得保存 webhook secret、tokenized URL、header 或 payload body。", "deploy key 回覆只能保存 key 名稱、read-only flag、repo scope 與 owner，不得保存 private key、完整 public key 或 credential material。", "不確定是否含敏感值時先走 mirror quarantine，不得直接貼入 response。" ], "forbidden_payloads": [ "secret_value", "token_value", "private_key", "deploy_key_value", "runner_registration_token", "runner_admin_token", "webhook_secret", "cookie_or_session", "authorization_header", "private_clone_url_credential", "complete_webhook_payload_url", "query_token", "request_body", "response_body", "secret_hash", "masked_token", "partial_credential", "workflow_modification_request", "webhook_modification_request", "runner_enablement_request", "deploy_key_rotation_request", "branch_protection_change_request", "repository_secret_change_request", "github_hosted_runner_enable_request", "refs_sync_request", "github_primary_switch_request", "execution_request_payload" ], "allowed_submission_modes": [ "markdown_table_redacted_metadata", "json_redacted_metadata_pointer", "existing_repo_doc_reference", "awooop_manual_review_note" ], "awooop_display_mode": "display_owner_response_request_only", "execution_authorized": false, "not_approval": true, "still_forbidden": [ "不收集或保存 secret value、token value、runner token、webhook secret、private key、deploy key value、cookie 或 session", "不使用 write token 或 write API", "不修改 workflow、webhook、runner、deploy key、branch protection、CODEOWNERS 或 repository secret", "不 rotate、建立、複製或刪除 secret", "不啟用 GitHub hosted runner 或消耗 GitHub Actions 額度", "不 sync refs、不建立 repo、不修改 visibility、不切 GitHub primary", "不停用、刪除、封存或降級 Gitea repo", "不新增 AwoooP execution action button" ] }, "owner_response_template_statuses": [ { "template_id": "response-webhook-redacted-export", "lane": "webhook_redacted_export_request", "display_order": 1, "collection_status": "waiting_owner_response", "request_status": "request_ready_not_sent", "received_response_count": 0, "accepted_response_count": 0, "rejected_response_count": 0, "latest_outcome_lane": "keep_waiting_owner_response", "next_owner_action": "Owner 需回覆 webhook 名稱、redacted host、event types、enabled flag 與 webhook owner；不得貼 webhook secret、tokenized URL、header、cookie 或 payload body。", "awooop_display_mode": "display_template_status_only", "execution_authorized": false, "not_approval": true, "still_forbidden": [ "不建立、修改、停用或刪除 webhook", "不保存 webhook secret、完整 payload URL、query token、header、cookie 或 request body", "不把 request_ready_not_sent 當成 webhook inventory complete" ] }, { "template_id": "response-runner-label-owner", "lane": "runner_label_owner_export_request", "display_order": 2, "collection_status": "waiting_owner_response", "request_status": "request_ready_not_sent", "received_response_count": 0, "accepted_response_count": 0, "rejected_response_count": 0, "latest_outcome_lane": "keep_waiting_owner_response", "next_owner_action": "Owner 需回覆 runner label、executor type、self-hosted / hosted、runner owner、GitHub hosted minutes 風險與 maintenance window；不得貼 runner token、host password、SSH key 或 admin token。", "awooop_display_mode": "display_template_status_only", "execution_authorized": false, "not_approval": true, "still_forbidden": [ "不新增、啟用、停用或改 runner label", "不啟用 GitHub hosted runner 或消耗 GitHub Actions 額度", "不保存 runner registration token、admin token、SSH private key 或 host password" ] }, { "template_id": "response-deploy-key-redacted-export", "lane": "deploy_key_redacted_export_request", "display_order": 3, "collection_status": "waiting_owner_response", "request_status": "request_ready_not_sent", "received_response_count": 0, "accepted_response_count": 0, "rejected_response_count": 0, "latest_outcome_lane": "keep_waiting_owner_response", "next_owner_action": "Owner 需回覆 deploy key / machine key 名稱、read-only flag、repo scope、key owner 與 rotation owner；不得貼 private key、完整 public key、token value 或 password。", "awooop_display_mode": "display_template_status_only", "execution_authorized": false, "not_approval": true, "still_forbidden": [ "不新增、刪除、rotate 或修改 deploy key", "不保存 private key、完整 public key、token value、password 或 credential value", "不把 write-capable key 風險 candidate 當成 rotation approval" ] }, { "template_id": "response-branch-protection-codeowners", "lane": "branch_protection_codeowners_export_request", "display_order": 4, "collection_status": "waiting_owner_response", "request_status": "request_ready_not_sent", "received_response_count": 0, "accepted_response_count": 0, "rejected_response_count": 0, "latest_outcome_lane": "keep_waiting_owner_response", "next_owner_action": "Owner 需回覆 protected branch、required checks、required review count、CODEOWNERS path、owner teams 與 ruleset owner；不得要求立即修改 branch protection、ruleset 或 CODEOWNERS。", "awooop_display_mode": "display_template_status_only", "execution_authorized": false, "not_approval": true, "still_forbidden": [ "不修改 branch protection、ruleset、required checks 或 CODEOWNERS", "不保存 PAT、admin override token、team secret、session cookie 或未脫敏截圖", "不把 branch protection response 當成 primary readiness complete" ] }, { "template_id": "response-repository-secret-name-parity", "lane": "repository_secret_name_parity_export_request", "display_order": 5, "collection_status": "waiting_owner_response", "request_status": "request_ready_not_sent", "received_response_count": 0, "accepted_response_count": 0, "rejected_response_count": 0, "latest_outcome_lane": "keep_waiting_owner_response", "next_owner_action": "Owner 需回覆 repository secret 名稱、scope、owning team、used-by workflow、present_in_gitea / present_in_github 與 rotation owner；不得貼 value、hash、masked token、partial token 或任何可還原片段。", "awooop_display_mode": "display_template_status_only", "execution_authorized": false, "not_approval": true, "still_forbidden": [ "不建立、複製、rotate、修改或刪除 repository secret", "不保存 secret value、hash、masked token、partial token、private key 或 credential value", "不把 secret name parity response 當成 workflow ready 或 primary ready" ] } ], "owner_response_audit_event_templates": [ { "event_template_id": "audit-workflow-secret-response-request-shown", "display_order": 1, "event_status": "template_only_not_emitted", "trigger": "AwoooP 顯示 S4.12 workflow / secret name owner response request packet 時。", "purpose": "只記錄 request packet 顯示 metadata；不代表 request 已送出、owner response 已收到、secret value collection、workflow / webhook / runner / deploy key / branch protection / repository secret 修改或 GitHub primary 授權。", "allowed_metadata_fields": [ "event_id", "event_time_taipei", "event_template_id", "source_contract", "target_contract", "request_id", "requested_template_ids", "displayed_by_role", "displayed_to_owner_role_or_team", "repo_count", "lane_count", "source_document_ref", "redaction_status" ], "forbidden_payloads": [ "secret_value", "token_value", "private_key", "deploy_key_value", "runner_registration_token", "runner_admin_token", "webhook_secret", "cookie_or_session", "authorization_header", "complete_webhook_payload_url", "query_token", "request_body", "response_body", "secret_hash", "masked_token", "partial_credential", "workflow_modification_request", "webhook_modification_request", "runner_enablement_request", "deploy_key_rotation_request", "branch_protection_change_request", "repository_secret_change_request", "github_hosted_runner_enable_request", "refs_sync_request", "github_primary_switch_request", "execution_request_payload", "unredacted_screenshot" ], "emitted_event_count": 0, "stored_raw_payload_allowed": false, "awooop_display_mode": "display_audit_template_only", "execution_authorized": false, "not_approval": true }, { "event_template_id": "audit-workflow-secret-response-received-metadata", "display_order": 2, "event_status": "template_only_not_emitted", "trigger": "Owner 提供 S4.12 workflow / secret name response metadata pointer 時。", "purpose": "只記錄已收到脫敏 metadata pointer；不得保存 owner response raw body、secret value、token、runner token、webhook secret、private key、deploy key value、完整 URL credential、request body、response body 或未脫敏截圖。", "allowed_metadata_fields": [ "event_id", "event_time_taipei", "event_template_id", "source_contract", "request_id", "template_id", "lane", "repo", "provider", "owner_role_or_team", "decision", "decision_reason_summary", "evidence_refs", "redaction_status", "quarantine_lane", "next_owner_action" ], "forbidden_payloads": [ "secret_value", "token_value", "private_key", "deploy_key_value", "runner_registration_token", "runner_admin_token", "webhook_secret", "cookie_or_session", "authorization_header", "complete_webhook_payload_url", "query_token", "request_body", "response_body", "secret_hash", "masked_token", "partial_credential", "workflow_modification_request", "webhook_modification_request", "runner_enablement_request", "deploy_key_rotation_request", "branch_protection_change_request", "repository_secret_change_request", "github_hosted_runner_enable_request", "refs_sync_request", "github_primary_switch_request", "execution_request_payload", "unredacted_screenshot" ], "emitted_event_count": 0, "stored_raw_payload_allowed": false, "awooop_display_mode": "display_audit_template_only", "execution_authorized": false, "not_approval": true }, { "event_template_id": "audit-workflow-secret-response-outcome-classified", "display_order": 3, "event_status": "template_only_not_emitted", "trigger": "AwoooP 依 S4.12 acceptance checks 與 rejection rules 分類 workflow / secret name owner response 時。", "purpose": "只記錄分類結果、reviewer role 與下一步 owner action；不得把 outcome、owner wording 或單項 response 當成 secret value collection、workflow 修改、webhook 修改、runner 啟用、deploy key rotation、branch protection change、repository secret change、refs sync 或 GitHub primary 授權。", "allowed_metadata_fields": [ "event_id", "event_time_taipei", "event_template_id", "source_contract", "request_id", "template_id", "lane", "repo", "provider", "owner_role_or_team", "decision", "decision_reason_summary", "latest_outcome_lane", "evidence_refs", "redaction_status", "quarantine_lane", "next_owner_action", "reviewer_role" ], "forbidden_payloads": [ "secret_value", "token_value", "private_key", "deploy_key_value", "runner_registration_token", "runner_admin_token", "webhook_secret", "cookie_or_session", "authorization_header", "complete_webhook_payload_url", "query_token", "request_body", "response_body", "secret_hash", "masked_token", "partial_credential", "workflow_modification_request", "webhook_modification_request", "runner_enablement_request", "deploy_key_rotation_request", "branch_protection_change_request", "repository_secret_change_request", "github_hosted_runner_enable_request", "refs_sync_request", "github_primary_switch_request", "execution_request_payload", "unredacted_screenshot" ], "emitted_event_count": 0, "stored_raw_payload_allowed": false, "awooop_display_mode": "display_audit_template_only", "execution_authorized": false, "not_approval": true } ], "owner_response_redaction_examples": [ { "example_id": "redaction-webhook-redacted-host-metadata", "display_order": 1, "example_status": "template_example_only", "category": "webhook_redacted_host_metadata", "safe_response_shape": [ "template_id=response-webhook-redacted-export", "repo=owenhytsai/awoooi", "webhook_name_or_none=deployment-status-webhook", "destination_host_redacted=hooks.example.internal", "event_types=[push, pull_request]", "active_enabled_flag=true", "webhook_owner=platform-ops" ], "required_redactions": [ "只保留 host 或 domain 類 metadata，不保留完整 payload URL、query string、header、cookie 或 body", "webhook secret 必須以 absent / managed_by_owner / rotate_required_candidate 類 metadata 表示，不得保存值", "enabled flag 只代表 inventory metadata，不代表可建立、停用或修改 webhook" ], "forbidden_raw_values": [ "webhook_secret", "complete_webhook_payload_url", "query_token", "authorization_header", "request_body", "response_body", "cookie_or_session" ], "stored_raw_payload_allowed": false, "awooop_display_mode": "display_redaction_example_only", "execution_authorized": false, "not_approval": true }, { "example_id": "redaction-runner-label-owner-metadata", "display_order": 2, "example_status": "template_example_only", "category": "runner_label_owner_metadata", "safe_response_shape": [ "template_id=response-runner-label-owner", "repo=owenhytsai/wooo-aiops", "runner_label_or_none=self-hosted-linux-110", "executor_type=self_hosted", "hosted_or_self_hosted=self_hosted", "runner_owner=platform-ops", "github_hosted_minutes_risk=not_enabled" ], "required_redactions": [ "runner label 只能保存名稱、scope、executor type、owner 與額度風險 metadata", "hosted runner 只能標成 risk review candidate，不得視為啟用或消耗 GitHub Actions 額度批准", "不得貼 runner registration token、admin token、host password、SSH private key 或 machine credential" ], "forbidden_raw_values": [ "runner_registration_token", "runner_admin_token", "host_password", "ssh_private_key", "machine_credential", "github_hosted_runner_enable_request" ], "stored_raw_payload_allowed": false, "awooop_display_mode": "display_redaction_example_only", "execution_authorized": false, "not_approval": true }, { "example_id": "redaction-deploy-key-name-scope-metadata", "display_order": 3, "example_status": "template_example_only", "category": "deploy_key_name_scope_metadata", "safe_response_shape": [ "template_id=response-deploy-key-redacted-export", "repo=owenhytsai/wooo-infra-config", "key_name_or_none=infra-readonly-deploy-key", "read_only_flag=true", "repo_scope=single_repo", "key_owner=platform-ops", "rotation_owner=security-commander" ], "required_redactions": [ "deploy key 只能保存 key name、read-only flag、repo scope、owner 與 rotation owner metadata", "public key 若需要補證，必須改成既有文件引用或 owner metadata pointer，不保存完整 key material", "rotation owner 只代表後續責任人，不代表本階段可 rotate、建立、刪除或修改 key" ], "forbidden_raw_values": [ "private_key", "deploy_key_value", "complete_public_key", "token_value", "credential_value", "deploy_key_rotation_request" ], "stored_raw_payload_allowed": false, "awooop_display_mode": "display_redaction_example_only", "execution_authorized": false, "not_approval": true }, { "example_id": "redaction-branch-protection-codeowners-metadata", "display_order": 4, "example_status": "template_example_only", "category": "branch_protection_codeowners_metadata", "safe_response_shape": [ "template_id=response-branch-protection-codeowners", "repo=owenhytsai/awoooi", "protected_branch_name_or_none=main", "required_review_count=1", "required_status_check_names=[lint, test]", "codeowners_path_or_none=.github/CODEOWNERS", "ruleset_owner=source-control-owner" ], "required_redactions": [ "只保存 branch/ruleset/CODEOWNERS metadata 與 required check names，不保存 admin override token 或 session", "若引用 UI screenshot，必須先脫敏 owner、token、cookie、email、完整 URL credential 與個資", "不得把 required check 或 reviewer wording 當成可立即修改 branch protection / ruleset / CODEOWNERS 的授權" ], "forbidden_raw_values": [ "admin_override_token", "session_cookie", "authorization_header", "unredacted_screenshot", "branch_protection_change_request", "codeowners_write_request" ], "stored_raw_payload_allowed": false, "awooop_display_mode": "display_redaction_example_only", "execution_authorized": false, "not_approval": true }, { "example_id": "redaction-secret-name-parity-quarantine-pointer", "display_order": 5, "example_status": "template_example_only", "category": "repository_secret_name_parity_or_quarantine", "safe_response_shape": [ "template_id=response-repository-secret-name-parity", "repo=owenhytsai/awoooi", "secret_name_list_or_none=[DATABASE_URL, OPENAI_API_KEY]", "present_in_gitea=unknown_requires_more_evidence", "present_in_github=unknown_requires_more_evidence", "owning_team=platform-ops", "collection_status=quarantine_sensitive_payload_if_value_seen" ], "required_redactions": [ "secret parity 只能保存 secret name、scope、present / absent / unknown metadata、owner 與 evidence refs", "任何 value、hash、masked token、partial token、可還原片段或未脫敏截圖都必須改走 quarantine pointer", "secret name parity 通過也只更新 read-only wording，不代表可建立、複製、rotate、修改或刪除 secret" ], "forbidden_raw_values": [ "secret_value", "secret_hash", "masked_token", "partial_credential", "repository_secret_change_request", "execution_request_payload", "owner_response_raw_body" ], "stored_raw_payload_allowed": false, "awooop_display_mode": "display_redaction_example_only", "execution_authorized": false, "not_approval": true } ], "owner_response_collection_checks": [ { "check_id": "collection-workflow-secret-request-packet-displayed", "display_order": 1, "title": "已顯示 workflow / secret 名稱 owner response request packet", "required": true, "pass_condition": "AwoooP 必須只顯示 owner_response_request_packet 的 5 個 workflow / secret 名稱 templates、允許欄位、脫敏 evidence 規則與禁止 payload，不得附加 secret value collection、workflow/webhook/runner/deploy key/branch protection/secret 修改、refs sync 或 primary switch 要求。", "failure_lane": "keep_waiting_owner_response", "awooop_display": "display_request_packet_only", "execution_authorized": false, "not_approval": true }, { "check_id": "collection-workflow-secret-read-only-submission-mode", "display_order": 2, "title": "workflow / secret 名稱收件模式維持 read-only", "required": true, "pass_condition": "owner 只能用 read-only markdown response、redacted metadata pointer、existing repo doc reference 或 AwoooP manual review note；不得提交 secret value、webhook secret、runner token、deploy key material、private key、authorization header、未脫敏截圖或 execution request。", "failure_lane": "quarantine_sensitive_payload", "awooop_display": "display_read_only_submission_only", "execution_authorized": false, "not_approval": true }, { "check_id": "collection-five-workflow-secret-template-tracking", "display_order": 3, "title": "五個 workflow / secret templates 分開追蹤", "required": true, "pass_condition": "S4.12 五個 requested_template_ids 必須逐 lane 追蹤 received / accepted / rejected 狀態；不可用單一整體同意取代 webhook、runner、deploy key、branch protection / CODEOWNERS 或 repository secret name parity 的個別判定。", "failure_lane": "request_more_evidence", "awooop_display": "display_per_workflow_secret_lane_tracking", "execution_authorized": false, "not_approval": true }, { "check_id": "collection-workflow-secret-redacted-evidence-only", "display_order": 4, "title": "只收 workflow / secret 名稱脫敏 evidence refs", "required": true, "pass_condition": "收件內容只能包含 repo 內路徑、snapshot path、secret name metadata、redacted host、runner label、key name、ruleset/CODEOWNERS metadata 或已脫敏 evidence refs；任何不確定是否含 secret value、token、private key、deploy key material、完整 URL credential、request body、header 或未脫敏截圖的資料都先進 quarantine。", "failure_lane": "quarantine_sensitive_payload", "awooop_display": "display_redacted_evidence_only", "execution_authorized": false, "not_approval": true }, { "check_id": "collection-workflow-secret-no-approval-language", "display_order": 5, "title": "不得把 workflow / secret 回覆語意升級成批准", "required": true, "pass_condition": "即使 owner response 文字包含同意、OK、可進行或批准，也只能視為 workflow / secret 名稱 inventory disposition；不得視為 secret 建立、複製、rotate、workflow 修改、runner 啟用、deploy key rotation、branch protection change、refs sync 或 GitHub primary approval。", "failure_lane": "reject_execution_request", "awooop_display": "display_scope_response_only", "execution_authorized": false, "not_approval": true }, { "check_id": "collection-workflow-secret-audit-metadata-only", "display_order": 6, "title": "只記錄 workflow / secret audit metadata", "required": true, "pass_condition": "AwoooP 只能記錄 request shown、response received metadata、template id、lane、repo、owner role/team、redacted host、runner label、key name、secret name metadata、evidence refs 與 outcome lane；不得保存 secret value、hash、masked token、partial credential、webhook secret、runner token、private key、authorization header 或可執行 payload。", "failure_lane": "quarantine_sensitive_payload", "awooop_display": "display_audit_metadata_only", "execution_authorized": false, "not_approval": true } ], "intake_preflight_checks": [ { "check_id": "preflight-known-workflow-secret-lane", "display_order": 1, "title": "回覆必須對應已知 workflow / secret 名稱 lane", "required": true, "pass_condition": "`template_id` 或 `lane` 必須對應 S4.12 五個 workflow / secret name templates 之一，不得新增未盤點 repo、未請求 workflow / secret 類別，或把 out-of-scope repo 自動視為可補 secret / workflow。", "failure_lane": "request_owner_correction", "awooop_display": "request_more_evidence", "execution_authorized": false }, { "check_id": "preflight-required-workflow-secret-owner-fields", "display_order": 2, "title": "workflow / secret 名稱必填欄位完整", "required": true, "pass_condition": "每筆 response 必須有 owner role/team、decision、decision_reason、repo、provider、lane、lane-specific owner、必要的 redacted metadata 與 evidence_refs；secret name parity 批次回覆必須有可重現 repo list 與 scope。", "failure_lane": "request_more_evidence", "awooop_display": "request_more_evidence", "execution_authorized": false }, { "check_id": "preflight-allowed-workflow-secret-decision", "display_order": 3, "title": "workflow / secret decision 在模板允許值內", "required": true, "pass_condition": "`decision` 必須落在對應 response template 的 acceptable_decisions；口頭同意、整體 OK、可進行、請幫我建立 secret 或未列出的執行語句都不得進入 accepted。", "failure_lane": "request_owner_correction", "awooop_display": "request_more_evidence", "execution_authorized": false }, { "check_id": "preflight-workflow-secret-redacted-evidence-only", "display_order": 4, "title": "只接受 workflow / secret 名稱脫敏 evidence refs", "required": true, "pass_condition": "`evidence_refs` 只能指向 repo 內文件、snapshot、redacted metadata pointer、secret name list、redacted host、runner label、key name、ruleset / CODEOWNERS metadata；不得含 secret value、hash、masked token、partial credential、webhook secret、runner token、private key、deploy key value、authorization header、cookie、session、request body 或未脫敏截圖。", "failure_lane": "quarantine_sensitive_payload", "awooop_display": "quarantine_sensitive_payload", "execution_authorized": false }, { "check_id": "preflight-no-workflow-secret-execution-request", "display_order": 5, "title": "不得夾帶 workflow / secret 執行要求", "required": true, "pass_condition": "response 不得要求建立 / 複製 / rotate secret、修改 workflow/webhook/runner/deploy key/branch protection/CODEOWNERS、啟用 GitHub hosted runner、使用 write token、建立 repo、sync refs、GitHub primary switch、Kali scan 或任何 runtime action。", "failure_lane": "reject_execution_request", "awooop_display": "reject_execution_request", "execution_authorized": false }, { "check_id": "preflight-all-five-workflow-secret-lanes-before-accepted", "display_order": 6, "title": "接受前需覆蓋五個 workflow / secret templates", "required": true, "pass_condition": "S4.12 要被標示 accepted 前，五個 response templates 都必須收到可驗收的 owner response；部分回覆只能維持 waiting、ready_for_owner_review、request_more_evidence 或 quarantine。", "failure_lane": "keep_waiting_owner_response", "awooop_display": "ready_for_owner_review", "execution_authorized": false } ], "response_templates": [ { "template_id": "response-webhook-redacted-export", "lane": "webhook_redacted_export_request", "affected_repos": [ "owenhytsai/awoooi", "owenhytsai/wooo-aiops" ], "risk": "MEDIUM", "covered_repo_count": 2, "requested_owner_decision": "回覆 webhook 名稱、redacted host、事件類型、enabled flag 與 owner；不得包含 webhook secret、token URL、header、cookie 或 payload body。", "required_owner_fields": [ "owner_role_or_team", "decision", "decision_reason", "repo", "provider", "webhook_name_or_none", "destination_host_redacted", "event_types", "active_enabled_flag", "webhook_owner", "evidence_refs" ], "acceptable_decisions": [ "provide_redacted_webhook_inventory_candidate", "mark_no_webhook_candidate", "hold_pending_webhook_owner", "unknown_requires_more_evidence" ], "minimum_evidence_refs": [ "docs/security/source-control-workflow-secret-name-export-request.snapshot.json", "docs/security/source-control-primary-readiness-gate.snapshot.json", "docs/security/security-mirror-quarantine.snapshot.json" ], "acceptance_criteria": [ "只允許保存 redacted host、event types、enabled flag 與 owner。", "必須標示 primary cutover 後哪一端負責發 webhook，或明確要求補證。", "必須承認 response 通過後只更新 read-only inventory / readiness wording，不修改 webhook。" ], "rejection_conditions": [ "含 webhook secret、完整 payload URL、query token、header、cookie 或 request body。", "要求立即建立、停用或修改 webhook。", "缺 repo、provider、webhook owner 或 no-webhook disposition。" ], "allowed_outputs": [ "更新 `source-control-workflow-secret-name-export-request.snapshot.json` 的 webhook read-only owner response 欄位。", "更新 `source-control-primary-readiness-gate.snapshot.json` 的 workflow/webhook blocker wording。", "建立 request_more_evidence / quarantine lane。" ], "execution_authorized": false }, { "template_id": "response-runner-label-owner", "lane": "runner_label_owner_export_request", "affected_repos": [ "owenhytsai/awoooi", "owenhytsai/wooo-aiops", "owenhytsai/wooo-infra-config", "owenhytsai/ewoooc" ], "risk": "HIGH", "covered_repo_count": 4, "requested_owner_decision": "回覆 runner label、executor type、hosted/self-hosted、owner 與 GitHub hosted minutes 風險；不得包含 runner registration token、admin token、SSH key 或 host password。", "required_owner_fields": [ "owner_role_or_team", "decision", "decision_reason", "repo", "provider", "runner_label_or_none", "runner_scope", "executor_type", "hosted_or_self_hosted", "runner_owner", "github_hosted_minutes_risk", "maintenance_window", "evidence_refs" ], "acceptable_decisions": [ "keep_self_hosted_runner_candidate", "approve_hosted_runner_risk_review_candidate", "mark_no_runner_candidate", "hold_pending_runner_owner", "unknown_requires_more_evidence" ], "minimum_evidence_refs": [ "docs/security/source-control-workflow-secret-name-local-evidence.snapshot.json", "docs/security/source-control-workflow-secret-name-export-request.snapshot.json", "docs/security/source-control-primary-readiness-gate.snapshot.json" ], "acceptance_criteria": [ "必須標示 runner 是 self-hosted 或 hosted；若 hosted，必須列入額度風險 review，而不是啟用批准。", "必須指定 runner owner 與維護窗口，或明確要求補證。", "必須承認 response 不授權新增 runner、不授權改 workflow、不授權消耗 GitHub hosted minutes。" ], "rejection_conditions": [ "含 runner registration token、admin token、SSH private key、host password 或 API token。", "要求立即啟用 GitHub hosted runner 或改 runner label。", "把 hosted runner risk review candidate 當成使用 GitHub Actions 額度的批准。" ], "allowed_outputs": [ "更新 runner label owner review lane。", "更新 GitHub hosted runner 額度風險 wording。", "維持 workflow / runner execution disabled。" ], "execution_authorized": false }, { "template_id": "response-deploy-key-redacted-export", "lane": "deploy_key_redacted_export_request", "affected_repos": [ "owenhytsai/wooo-infra-config" ], "risk": "HIGH", "covered_repo_count": 1, "requested_owner_decision": "回覆 deploy key / machine key 名稱、read-only flag、repo scope 與 owner；不得包含 private key、完整 public key、token value 或 password。", "required_owner_fields": [ "owner_role_or_team", "decision", "decision_reason", "repo", "provider", "key_name_or_none", "read_only_flag", "repo_scope", "key_owner", "rotation_owner", "evidence_refs" ], "acceptable_decisions": [ "provide_deploy_key_name_scope_candidate", "mark_no_deploy_key_candidate", "mark_write_capable_key_risk_candidate", "hold_pending_key_owner", "unknown_requires_more_evidence" ], "minimum_evidence_refs": [ "docs/security/source-control-workflow-secret-name-export-request.snapshot.json", "docs/security/GIT-REMOTE-REFS-WOOO-INFRA-CONFIG-SNAPSHOT.md", "docs/security/security-mirror-quarantine.snapshot.json" ], "acceptance_criteria": [ "只允許 key 名稱、read-only flag、repo scope、owner 與 rotation owner。", "write-capable key 只能列為風險 candidate，不得自動 rotate 或刪除。", "必須承認 response 不授權搬移 key、不授權貼 private key、不授權修改 deploy key。" ], "rejection_conditions": [ "含 private key、完整 public key、token value、password 或 credential value。", "要求立即 rotate、刪除或新增 deploy key。", "缺 key owner / rotation owner 或 no-key disposition。" ], "allowed_outputs": [ "更新 deploy key read-only risk lane。", "更新 primary readiness key blocker wording。", "建立 key_owner request_more_evidence lane。" ], "execution_authorized": false }, { "template_id": "response-branch-protection-codeowners", "lane": "branch_protection_codeowners_export_request", "affected_repos": [ "owenhytsai/awoooi", "owenhytsai/clawbot-v5", "owenhytsai/wooo-infra-config", "owenhytsai/ewoooc" ], "risk": "MEDIUM", "covered_repo_count": 4, "requested_owner_decision": "回覆 protected branch、required checks、required review count、CODEOWNERS path 與 owner teams；不得包含 team secret、PAT、admin override token 或 session cookie。", "required_owner_fields": [ "owner_role_or_team", "decision", "decision_reason", "repo", "provider", "protected_branch_name_or_none", "required_review_count", "required_status_check_names", "codeowners_path_or_none", "owner_team_names", "ruleset_owner", "evidence_refs" ], "acceptable_decisions": [ "provide_branch_protection_codeowners_candidate", "mark_no_branch_protection_candidate", "hold_pending_ruleset_owner", "unknown_requires_more_evidence" ], "minimum_evidence_refs": [ "docs/security/source-control-workflow-secret-name-local-evidence.snapshot.json", "docs/security/source-control-workflow-secret-name-export-request.snapshot.json", "docs/security/source-control-primary-readiness-gate.snapshot.json" ], "acceptance_criteria": [ "必須列出 required status check names，並標示與 workflow / runner label 對應狀態。", "缺 CODEOWNERS 或 branch protection 只能形成 readiness gap，不代表可修改規則。", "必須指定 ruleset owner 或 request_more_evidence owner。" ], "rejection_conditions": [ "含 PAT、admin override token、session cookie、team secret 或未脫敏截圖。", "要求立即修改 branch protection、ruleset、required checks 或 CODEOWNERS。", "把 branch protection response 當成 primary readiness complete。" ], "allowed_outputs": [ "更新 branch protection / CODEOWNERS owner review lane。", "更新 required status check parity wording。", "維持 primary_ready_count=0。" ], "execution_authorized": false }, { "template_id": "response-repository-secret-name-parity", "lane": "repository_secret_name_parity_export_request", "affected_repos": [ "owenhytsai/awoooi", "owenhytsai/clawbot-v5", "owenhytsai/wooo-aiops", "owenhytsai/wooo-infra-config", "owenhytsai/ewoooc", "owenhytsai/bitan-pharmacy", "owenhytsai/tsenyang-website" ], "risk": "HIGH", "covered_repo_count": 7, "requested_owner_decision": "回覆 repository secret 名稱 parity、scope、owning team、used-by workflow 與 present_in_gitea / present_in_github metadata；不得包含 value、hash、partial token 或可還原片段。", "required_owner_fields": [ "owner_role_or_team", "decision", "decision_reason", "repo", "provider", "secret_name_list_or_none", "secret_scope", "owning_team", "used_by_workflow_name", "rotation_owner", "present_in_gitea", "present_in_github", "evidence_refs" ], "acceptable_decisions": [ "provide_secret_name_presence_map_candidate", "mark_no_repository_secret_candidate", "hold_pending_secret_owner", "unknown_requires_more_evidence" ], "minimum_evidence_refs": [ "docs/security/source-control-workflow-secret-name-local-evidence.snapshot.json", "docs/security/source-control-workflow-secret-name-export-request.snapshot.json", "docs/security/security-mirror-quarantine.snapshot.json" ], "acceptance_criteria": [ "只允許保存 secret name、scope、owner、used-by workflow、present/absent metadata。", "不得保存 value、hash、partial token、masked token 或任何可還原片段。", "缺漏 secret 只建立 owner review lane，不自動建立、複製、rotate 或刪除 secret。" ], "rejection_conditions": [ "含 secret value、plaintext、hash、partial token、private key、credential value 或未脫敏截圖。", "要求立即建立、複製、修改、rotate 或刪除 repository secret。", "把 secret name parity response 當成 workflow 已可執行或 primary ready。" ], "allowed_outputs": [ "更新 repository secret name parity owner review lane。", "更新 workflow / secret name inventory gap wording。", "維持 inventory_complete_count=0 與 primary_ready_count=0。" ], "execution_authorized": false } ], "acceptance_checks": [ { "check_id": "maps_to_known_export_lane", "title": "回覆對應既有 export lane", "required": true, "pass_condition": "`lane` 必須對應 S4.3 既有 export lanes：webhook、runner、deploy key、branch protection / CODEOWNERS 或 repository secret name parity。", "failure_lane": "reject_unknown_export_lane", "execution_authorized": false }, { "check_id": "decision_value_allowed", "title": "決策值在允許範圍內", "required": true, "pass_condition": "`decision` 必須是該 response template 的 acceptable_decisions 之一。", "failure_lane": "request_owner_correction", "execution_authorized": false }, { "check_id": "repo_scope_present", "title": "repo scope 已標示", "required": true, "pass_condition": "每筆回覆必須有 repo、provider 與 lane；批次 secret name parity 必須有可重現 repo list。", "failure_lane": "request_more_evidence", "execution_authorized": false }, { "check_id": "owner_present", "title": "owner 或補證 owner 已標示", "required": true, "pass_condition": "每筆回覆必須有 owner role/team，且 lane-specific owner 不得空白；未知時必須選 hold/unknown。", "failure_lane": "request_owner_assignment", "execution_authorized": false }, { "check_id": "allowed_fields_only", "title": "只含允許欄位", "required": true, "pass_condition": "回覆只能包含 lane allowed_fields 與 owner/evidence metadata，不得加入 request body、header、credential 或 raw config。", "failure_lane": "quarantine_unexpected_payload", "execution_authorized": false }, { "check_id": "secret_values_absent", "title": "未包含 secret value", "required": true, "pass_condition": "不得包含 secret/token/cookie/private key/deploy key/runner token/webhook secret/password、hash、masked token 或 partial credential。", "failure_lane": "quarantine_sensitive_payload", "execution_authorized": false }, { "check_id": "no_write_or_rotation_requested", "title": "不含 write 或 rotation 要求", "required": true, "pass_condition": "回覆不得要求 write API、rotate secret、修改 workflow、修改 webhook、修改 runner、修改 deploy key 或修改 branch protection。", "failure_lane": "reject_runtime_change_request", "execution_authorized": false }, { "check_id": "no_primary_or_refs_action_requested", "title": "不含 primary 或 refs action", "required": true, "pass_condition": "回覆不得要求建立 repo、sync refs、切 GitHub primary、停用 Gitea 或把 inventory 視為 primary ready。", "failure_lane": "reject_primary_or_refs_action", "execution_authorized": false } ], "rejection_rules": [ "回覆含 secret value、PAT、cookie、session、CSRF token、private key、deploy key value、runner token、webhook secret 或 partial credential 時必須拒收。", "回覆含完整 webhook payload URL、query token、authorization header、request body 或未脫敏截圖時必須拒收。", "回覆含 runner registration token、runner admin token、SSH private key、host password 或 API token 時必須拒收。", "回覆含 deploy key private material、完整 public key、token value、password 或 credential value 時必須拒收。", "回覆含 secret value、secret hash、partial token、masked token 或任何可還原片段時必須拒收。", "回覆要求 write API、修改 workflow/webhook/runner/deploy key/branch protection/CODEOWNERS 或 rotate secret 時必須拒收。", "回覆要求建立 repo、sync refs、切 GitHub primary、停用或封存 Gitea 時必須拒收。", "回覆缺 repo、provider、lane owner 或 no-data disposition 時不得標記 accepted。", "回覆把 owner response 當成 inventory complete、workflow ready、secret parity complete 或 GitHub primary ready 時必須拒收。", "任何不確定是否含敏感值、私有 URL 憑證、完整 key material 或未脫敏截圖的回覆必須先進 mirror quarantine。" ], "allowed_outputs": [ "更新 `source-control-workflow-secret-name-inventory.snapshot.json` 的 read-only owner response 欄位。", "更新 `source-control-workflow-secret-name-export-request.snapshot.json` 的 response status wording。", "更新 `source-control-primary-readiness-gate.snapshot.json` 的 workflow / webhook / runner / secret name blocker wording。", "更新 `security-mirror-status-rollup.snapshot.json` 的 workflow_secret owner response summary。", "建立 request_more_evidence / quarantine lane。", "維持 `inventory_complete_count=0`、`github_primary_ready_count=0` 與所有 workflow / secret / repo / refs / primary execution flags false。" ], "forbidden_actions": [ "收集或保存 secret value、token value、cookie、session、private key、deploy key value、runner token 或 webhook secret。", "使用 write token 或 write API。", "修改 workflow、webhook、runner、deploy key、branch protection、CODEOWNERS 或 repository secret。", "rotate secret、建立 secret、複製 secret 或刪除 secret。", "啟用 GitHub hosted runner 或消耗 GitHub Actions 額度。", "建立 GitHub repo 或修改 visibility。", "sync refs、push refs、delete refs 或 force push。", "切 GitHub primary。", "停用、刪除、封存或降級 Gitea repo。", "新增 AwoooP execution action button。" ] }