{ "execution_boundaries": { "action_buttons_allowed": false, "active_scan_authorized": false, "audit_event_emitted": false, "dispatch_authorized": false, "dns_tls_change_authorized": false, "host_write_authorized": false, "nginx_reload_authorized": false, "not_authorization": true, "production_write_authorized": false, "recipient_confirmed": false, "request_sent": false, "reviewer_queue_write": false, "runtime_execution_authorized": false, "secret_value_collection_allowed": false, "workflow_modification_authorized": false }, "forbidden_payloads": [ "token", "secret", "private_key", "cookie", "session", "authorization_header", "runner_token", "webhook_secret", "db_dump", "repo_archive", "git_object_pack", "raw_sensitive_live_config" ], "generated_at": "2026-06-14T18:45:00+08:00", "git_commit": "ddd9e433", "handoff_envelope_fields": [ "request_id", "stage_id", "packet_id", "recipient_role_or_team", "sender_role_or_team", "requested_response_window", "allowed_response_format", "redacted_evidence_refs", "forbidden_payloads", "followup_owner", "not_approval" ], "not_approval_statement": "本草稿不是 request sent、不是 owner response received、不是 reviewer accepted、不是 Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate 授權。", "request_drafts": [ { "accepted_response": false, "action_buttons_allowed": false, "affected_files": [ "scripts/ops/188-registry-certbot-fix.sh", "scripts/ops/fix-188-registry-certbot-renewal.sh" ], "allowed_response_format": { "allowed_decisions": [ "confirm", "defer", "reject", "request_more_evidence" ], "fields": [ "owner_role_or_team", "decision", "decision_reason", "affected_scope", "redacted_evidence_refs", "followup_owner", "rollback_owner", "maintenance_window", "validation_plan" ], "redacted_evidence_refs_only": true }, "audit_event_emitted": false, "blocked_requests": [ "repo_create", "visibility_change", "refs_sync", "refs_delete", "force_push", "workflow_modify", "runner_enable", "secret_value_submit", "ssh_host_modify", "nginx_reload", "dns_tls_modify", "argocd_sync", "kubectl_apply", "active_scan", "agent_bounty_runtime_execute", "payout_or_withdrawal" ], "category_id": "dns_tls_certbot", "control_tier": "C0", "followup_owner": "pending_followup_owner", "forbidden_payloads": [ "token", "secret", "private_key", "cookie", "session", "authorization_header", "runner_token", "webhook_secret", "db_dump", "repo_archive", "git_object_pack", "raw_sensitive_live_config" ], "handoff_envelope_fields": [ "request_id", "stage_id", "packet_id", "recipient_role_or_team", "sender_role_or_team", "requested_response_window", "allowed_response_format", "redacted_evidence_refs", "forbidden_payloads", "followup_owner", "not_approval" ], "label": "DNS / TLS / certbot / certificate path", "not_approval": true, "not_approval_statement": "本草稿不是 request sent、不是 owner response received、不是 reviewer accepted、不是 Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate 授權。", "packet_id": "high_value_config_owner_packet:dns_tls_certbot", "priority": "P0", "production_write_authorized": false, "received_response": false, "recipient_confirmed": false, "recipient_role_or_team": "pending_owner_role_or_team", "redacted_evidence_refs": [ "docs/security/high-value-config-owner-packet.snapshot.json", "docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json" ], "rejected_response": false, "request_id": "high_value_config_owner_request:dns_tls_certbot", "request_sent": false, "requested_response_window": "not_scheduled", "required_gate": "domain_tls_owner_response_required", "required_validation": [ "domain_inventory", "certificate_path_check", "renewal_window", "acme_path_smoke", "public_https_smoke", "rollback_ref" ], "reviewer_queue_write": false, "runtime_gate": false, "secret_value_collection_allowed": false, "sender_role_or_team": "iwooos_security_reviewer", "stage_id": "P0-14", "status": "draft_not_dispatched" }, { "accepted_response": false, "action_buttons_allowed": false, "affected_files": [ "k8s/nginx/awoooi-prod.conf" ], "allowed_response_format": { "allowed_decisions": [ "confirm", "defer", "reject", "request_more_evidence" ], "fields": [ "owner_role_or_team", "decision", "decision_reason", "affected_scope", "redacted_evidence_refs", "followup_owner", "rollback_owner", "maintenance_window", "validation_plan" ], "redacted_evidence_refs_only": true }, "audit_event_emitted": false, "blocked_requests": [ "repo_create", "visibility_change", "refs_sync", "refs_delete", "force_push", "workflow_modify", "runner_enable", "secret_value_submit", "ssh_host_modify", "nginx_reload", "dns_tls_modify", "argocd_sync", "kubectl_apply", "active_scan", "agent_bounty_runtime_execute", "payout_or_withdrawal" ], "category_id": "nginx_public_gateway", "control_tier": "C0", "followup_owner": "pending_followup_owner", "forbidden_payloads": [ "token", "secret", "private_key", "cookie", "session", "authorization_header", "runner_token", "webhook_secret", "db_dump", "repo_archive", "git_object_pack", "raw_sensitive_live_config" ], "handoff_envelope_fields": [ "request_id", "stage_id", "packet_id", "recipient_role_or_team", "sender_role_or_team", "requested_response_window", "allowed_response_format", "redacted_evidence_refs", "forbidden_payloads", "followup_owner", "not_approval" ], "label": "Nginx / reverse proxy / public route", "not_approval": true, "not_approval_statement": "本草稿不是 request sent、不是 owner response received、不是 reviewer accepted、不是 Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate 授權。", "packet_id": "high_value_config_owner_packet:nginx_public_gateway", "priority": "P0", "production_write_authorized": false, "received_response": false, "recipient_confirmed": false, "recipient_role_or_team": "pending_owner_role_or_team", "redacted_evidence_refs": [ "docs/security/high-value-config-owner-packet.snapshot.json", "docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json" ], "rejected_response": false, "request_id": "high_value_config_owner_request:nginx_public_gateway", "request_sent": false, "requested_response_window": "not_scheduled", "required_gate": "public_gateway_owner_response_required", "required_validation": [ "rendered_diff", "nginx_t", "affected_route_smoke", "admin_route_smoke_if_affected", "acme_path_smoke_if_affected", "rollback_ref" ], "reviewer_queue_write": false, "runtime_gate": false, "secret_value_collection_allowed": false, "sender_role_or_team": "iwooos_security_reviewer", "stage_id": "P0-14", "status": "draft_not_dispatched" }, { "accepted_response": false, "action_buttons_allowed": false, "affected_files": [ "docs/security/HIGH-VALUE-CONFIG-CHANGE-GATE.md", "docs/security/high-value-config-change-gate.snapshot.json", "scripts/security/high-value-config-change-gate.py" ], "allowed_response_format": { "allowed_decisions": [ "confirm", "defer", "reject", "request_more_evidence" ], "fields": [ "owner_role_or_team", "decision", "decision_reason", "affected_scope", "redacted_evidence_refs", "followup_owner", "rollback_owner", "maintenance_window", "validation_plan" ], "redacted_evidence_refs_only": true }, "audit_event_emitted": false, "blocked_requests": [ "repo_create", "visibility_change", "refs_sync", "refs_delete", "force_push", "workflow_modify", "runner_enable", "secret_value_submit", "ssh_host_modify", "nginx_reload", "dns_tls_modify", "argocd_sync", "kubectl_apply", "active_scan", "agent_bounty_runtime_execute", "payout_or_withdrawal" ], "category_id": "security_evidence_tooling", "control_tier": "C3", "followup_owner": "pending_followup_owner", "forbidden_payloads": [ "token", "secret", "private_key", "cookie", "session", "authorization_header", "runner_token", "webhook_secret", "db_dump", "repo_archive", "git_object_pack", "raw_sensitive_live_config" ], "handoff_envelope_fields": [ "request_id", "stage_id", "packet_id", "recipient_role_or_team", "sender_role_or_team", "requested_response_window", "allowed_response_format", "redacted_evidence_refs", "forbidden_payloads", "followup_owner", "not_approval" ], "label": "Security evidence / snapshot / guard tooling", "not_approval": true, "not_approval_statement": "本草稿不是 request sent、不是 owner response received、不是 reviewer accepted、不是 Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate 授權。", "packet_id": "high_value_config_owner_packet:security_evidence_tooling", "priority": "P3", "production_write_authorized": false, "received_response": false, "recipient_confirmed": false, "recipient_role_or_team": "pending_owner_role_or_team", "redacted_evidence_refs": [ "docs/security/high-value-config-owner-packet.snapshot.json", "docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json" ], "rejected_response": false, "request_id": "high_value_config_owner_request:security_evidence_tooling", "request_sent": false, "requested_response_window": "not_scheduled", "required_gate": "security_evidence_owner_review_required", "required_validation": [ "snapshot_parse", "guard_smoke", "doc_secret_sanity", "no_runtime_gate_increase" ], "reviewer_queue_write": false, "runtime_gate": false, "secret_value_collection_allowed": false, "sender_role_or_team": "iwooos_security_reviewer", "stage_id": "P0-14", "status": "draft_not_dispatched" } ], "schema_version": "high_value_config_owner_request_draft_v1", "send_after_conditions": [ "必須先重新確認 gitea/main、P0 總帳與另一個 AwoooP Session 基線。", "只能送出脫敏欄位與禁止條款，不得附 secret value、raw payload 或執行命令。", "只有真實人工送件 metadata 存在時，才能另行記錄 request_sent_count。", "送件後不得同步拉高 received / accepted / rejected / reviewer queue / runtime gate。" ], "source_intake_preflight_schema_version": "high_value_config_owner_packet_intake_preflight_v1", "source_intake_preflight_status": "request_dispatch_preflight_ready", "status": "owner_request_draft_ready_not_dispatched", "summary": { "accepted_response_count": 0, "action_button_count": 0, "audit_event_emitted_count": 0, "blocked_request_count": 16, "c0_request_draft_count": 2, "c1_request_draft_count": 0, "dispatch_preflight_check_count": 9, "forbidden_payload_count": 12, "handoff_envelope_field_count": 11, "received_response_count": 0, "recipient_confirmed_count": 0, "rejected_response_count": 0, "request_draft_count": 3, "request_sent_count": 0, "required_owner_field_total": 27, "reviewer_intake_lane_count": 5, "reviewer_queue_write_count": 0, "runtime_gate_count": 0 } }