225 lines
8.8 KiB
JSON
225 lines
8.8 KiB
JSON
{
|
||
"schema_version": "gitea_authenticated_inventory_import_acceptance_v1",
|
||
"status": "draft_waiting_redacted_inventory_payload",
|
||
"date": "2026-05-13",
|
||
"mode": "redacted_payload_acceptance_only",
|
||
"runtime_execution_authorized": false,
|
||
"source_contract": "gitea_repo_inventory_v1",
|
||
"source_request_contract": "gitea_authenticated_inventory_export_request_v1",
|
||
"source_indexes": [
|
||
"docs/security/gitea-authenticated-inventory-export-request.snapshot.json",
|
||
"docs/security/gitea-repo-inventory.snapshot.json",
|
||
"docs/security/gitea-public-repo-search.snapshot.json",
|
||
"docs/security/gitea-org-repo-inventory-blocked.snapshot.json",
|
||
"docs/security/local-git-remote-inventory.snapshot.json",
|
||
"docs/security/security-mirror-quarantine.snapshot.json"
|
||
],
|
||
"summary": {
|
||
"target_contract": "gitea_repo_inventory_v1.status=ok",
|
||
"import_payload_status": "waiting_redacted_payload",
|
||
"accepted_visibility_scopes": ["authenticated", "admin_export"],
|
||
"minimum_repo_count": 2,
|
||
"local_gitea_unique_repo_count": 4,
|
||
"required_gap_explanation_count": 3,
|
||
"received_payload_count": 0,
|
||
"accepted_payload_count": 0,
|
||
"rejected_payload_count": 0,
|
||
"acceptance_check_count": 10,
|
||
"rejection_rule_count": 10,
|
||
"quarantine_required_for_sensitive_payload": true,
|
||
"token_value_collection_allowed": false,
|
||
"raw_secret_allowed": false,
|
||
"db_dump_allowed": false,
|
||
"git_object_import_allowed": false,
|
||
"repo_write_allowed": false,
|
||
"refs_sync_allowed": false,
|
||
"github_primary_switch_authorized": false,
|
||
"action_buttons_allowed": false
|
||
},
|
||
"payload_shape": {
|
||
"required_top_level_fields": [
|
||
"schema_version",
|
||
"base_url",
|
||
"org",
|
||
"visibility_scope",
|
||
"token_present",
|
||
"status",
|
||
"repo_count",
|
||
"repos",
|
||
"coverage_gap_explanation",
|
||
"redaction_attestation"
|
||
],
|
||
"required_repo_fields": [
|
||
"full_name",
|
||
"name",
|
||
"owner.login",
|
||
"private",
|
||
"archived",
|
||
"empty",
|
||
"default_branch",
|
||
"clone_url_redacted",
|
||
"ssh_url_redacted",
|
||
"github_repo_candidate"
|
||
],
|
||
"required_attestations": [
|
||
"no_token_value",
|
||
"no_write_token",
|
||
"no_webhook_secret",
|
||
"no_deploy_key_private_key",
|
||
"no_runner_registration_token",
|
||
"no_cookie_or_session",
|
||
"no_gitea_db_dump",
|
||
"no_git_object_pack"
|
||
],
|
||
"field_constraints": [
|
||
"`visibility_scope` 必須是 `authenticated` 或 `admin_export`",
|
||
"`status` 必須是 `ok`",
|
||
"`repo_count` 必須大於或等於 2，並且必須等於 `repos.length`",
|
||
"`coverage_gap_explanation` 必須解釋 public-only 2 repos、本機 Gitea 4 unique repos 與 internal 110 adjacent source 的差異",
|
||
"所有 URL 必須 redacted，且不得含 username、password、token 或 secret query string"
|
||
]
|
||
},
|
||
"acceptance_checks": [
|
||
{
|
||
"check_id": "schema_and_status_ok",
|
||
"title": "Schema 與狀態正確",
|
||
"required": true,
|
||
"pass_condition": "`schema_version=gitea_repo_inventory_v1` 且 `status=ok`",
|
||
"failure_lane": "reject_payload",
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"check_id": "visibility_scope_allowed",
|
||
"title": "可接受的可見範圍",
|
||
"required": true,
|
||
"pass_condition": "`visibility_scope` 為 `authenticated` 或 `admin_export`",
|
||
"failure_lane": "reject_payload",
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"check_id": "repo_count_consistent",
|
||
"title": "repo_count 與 repos 數量一致",
|
||
"required": true,
|
||
"pass_condition": "`repo_count >= 2` 且等於 `repos.length`",
|
||
"failure_lane": "request_more_evidence",
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"check_id": "local_gitea_gap_explained",
|
||
"title": "本機 Gitea 覆蓋缺口已說明",
|
||
"required": true,
|
||
"pass_condition": "payload 解釋 public-only 2 repos 與本機 4 unique Gitea repos 的差異",
|
||
"failure_lane": "request_more_evidence",
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"check_id": "internal_110_scope_explained",
|
||
"title": "110 內部相鄰來源已說明",
|
||
"required": true,
|
||
"pass_condition": "payload 說明 internal 110 repos 是否屬於本輪 GitHub migration scope",
|
||
"failure_lane": "request_owner_scope_decision",
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"check_id": "redaction_attestation_present",
|
||
"title": "脫敏聲明存在",
|
||
"required": true,
|
||
"pass_condition": "payload 明確聲明不含 token、secret、private key、cookie、session、DB dump 或 git object pack",
|
||
"failure_lane": "quarantine_sensitive_payload",
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"check_id": "urls_are_redacted",
|
||
"title": "URL 已脫敏",
|
||
"required": true,
|
||
"pass_condition": "clone / ssh URL 不含 username、password、token、cookie 或 secret query string",
|
||
"failure_lane": "quarantine_sensitive_payload",
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"check_id": "token_scope_readonly",
|
||
"title": "token scope 只讀或不保存",
|
||
"required": true,
|
||
"pass_condition": "只保存 `token_present=true|false`，且 owner 聲明沒有 write/admin/secret scope",
|
||
"failure_lane": "reject_payload",
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"check_id": "repo_identity_unique",
|
||
"title": "repo identity 可唯一判讀",
|
||
"required": true,
|
||
"pass_condition": "每筆 repo 都有 `full_name` 或 `owner.login + name`，且不得重複",
|
||
"failure_lane": "request_more_evidence",
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"check_id": "output_is_contract_update_only",
|
||
"title": "輸出只允許更新契約與證據",
|
||
"required": true,
|
||
"pass_condition": "只更新 `gitea_repo_inventory_v1` snapshot、migration matrix、decision table、readiness gate 與 LOGBOOK",
|
||
"failure_lane": "reject_runtime_or_source_control_action",
|
||
"execution_authorized": false
|
||
}
|
||
],
|
||
"rejection_rules": [
|
||
"payload 含 token value、PAT、cookie、session、CSRF token 或 partial token 時必須拒收。",
|
||
"payload 含 webhook secret、repository secret value、runner registration token 或 deploy key private key 時必須拒收。",
|
||
"payload 含 Gitea DB dump、完整 git object pack、裸 repo tarball 或可還原 credential 的 artifact 時必須拒收。",
|
||
"payload 要求使用 write-capable token、admin token 或 secret scope token 時必須拒收。",
|
||
"payload 要求建立、刪除、封存或修改 Gitea repo 時必須拒收。",
|
||
"payload 要求建立 GitHub repo、修改 visibility、sync refs、delete refs 或 force push 時必須拒收。",
|
||
"payload 未解釋 public-only 與本機 Gitea 覆蓋差異時不得標記 inventory complete。",
|
||
"payload 未說明 internal 110 adjacent source scope 時不得進 GitHub primary readiness。",
|
||
"payload 只提供截圖、文字描述或不完整 repo metadata 時必須要求補 evidence。",
|
||
"任何不確定是否含敏感值的 payload 必須先進 mirror quarantine，不得人工手改後直接入庫。"
|
||
],
|
||
"quarantine_mapping": [
|
||
{
|
||
"condition": "出現 token、password、cookie、session、private key、webhook secret 或 runner registration token",
|
||
"target_lane": "sensitive_value_payload_quarantine",
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"condition": "出現 Gitea DB dump、git object pack、裸 repo tarball 或完整 artifact",
|
||
"target_lane": "oversized_or_wrong_artifact_quarantine",
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"condition": "欄位不足、repo_count 不一致或 coverage gap 未解釋",
|
||
"target_lane": "schema_or_evidence_gap_quarantine",
|
||
"execution_authorized": false
|
||
},
|
||
{
|
||
"condition": "payload 夾帶 repo 建立、refs sync、primary switch 或 workflow/secret 修改要求",
|
||
"target_lane": "execution_request_quarantine",
|
||
"execution_authorized": false
|
||
}
|
||
],
|
||
"allowed_outputs": [
|
||
"產出或更新脫敏後的 `gitea_repo_inventory_v1.status=ok` snapshot",
|
||
"更新 `SOURCE-CONTROL-MIGRATION-MATRIX.md` 與 source-control decision table",
|
||
"更新 `source_control_primary_readiness_gate_v1` 的 Gitea inventory blocker 狀態",
|
||
"更新 `security_mirror_status_rollup_v1` 與 `docs/LOGBOOK.md`",
|
||
"對缺口建立人工 owner review lane，不建立 execution action"
|
||
],
|
||
"forbidden_actions": [
|
||
"store_token_value",
|
||
"store_raw_secret",
|
||
"store_cookie_or_session",
|
||
"import_gitea_db_dump",
|
||
"import_git_object_pack",
|
||
"use_write_capable_token",
|
||
"write_to_gitea",
|
||
"create_gitea_repo",
|
||
"delete_or_archive_gitea_repo",
|
||
"create_github_repo",
|
||
"change_repo_visibility",
|
||
"sync_git_refs",
|
||
"delete_git_refs",
|
||
"force_push",
|
||
"switch_github_primary",
|
||
"disable_gitea",
|
||
"add_action_button"
|
||
]
|
||
}
|