636 lines
26 KiB
JSON
636 lines
26 KiB
JSON
{
|
||
"coverage_categories": [
|
||
{
|
||
"action_buttons_allowed": false,
|
||
"category_id": "nginx_public_gateway",
|
||
"control_tier": "C0",
|
||
"coverage_percent": 84,
|
||
"coverage_status": "repo_only_preflight_contract_ready_needs_owner_live_diff",
|
||
"current_gap": "已固定 12 個 public gateway preflight gate；owner response、live conf、rendered diff、nginx -t、route smoke、maintenance window 與 rollback owner 仍全部為 0。",
|
||
"evidence_refs": [
|
||
"docs/security/NGINX-CONFIG-DRIFT-DETECTOR.md",
|
||
"docs/security/nginx-config-drift-repo.snapshot.json",
|
||
"docs/security/DOMAIN-TLS-CERTBOT-INVENTORY.md",
|
||
"docs/security/PUBLIC-GATEWAY-PREFLIGHT-INVENTORY.md",
|
||
"docs/security/public-gateway-preflight-inventory.snapshot.json",
|
||
"docs/schemas/public_gateway_preflight_inventory_v1.schema.json"
|
||
],
|
||
"label": "Nginx / reverse proxy / public route",
|
||
"next_owner_action": "補 public gateway owner、owner-provided live conf、source-to-live rendered diff、nginx -t evidence、route smoke、maintenance window 與 rollback owner。",
|
||
"owner_response_accepted": false,
|
||
"owner_response_received": false,
|
||
"owner_response_required": true,
|
||
"patterns": [
|
||
"infra/ansible/roles/nginx/templates/*.j2",
|
||
"infra/ansible/playbooks/nginx-sync.yml",
|
||
"ops/nginx/**",
|
||
"docs/runbooks/disaster-recovery/DR-Nginx.md"
|
||
],
|
||
"priority": "P0",
|
||
"required_gate": "public_gateway_owner_response_required",
|
||
"required_validation": [
|
||
"rendered_diff",
|
||
"nginx_t",
|
||
"affected_route_smoke",
|
||
"admin_route_smoke_if_affected",
|
||
"acme_path_smoke_if_affected",
|
||
"rollback_ref"
|
||
],
|
||
"runtime_gate_open": false
|
||
},
|
||
{
|
||
"action_buttons_allowed": false,
|
||
"category_id": "dns_tls_certbot",
|
||
"control_tier": "C0",
|
||
"coverage_percent": 74,
|
||
"coverage_status": "repo_only_inventory_ready",
|
||
"current_gap": "4 個 certificate path 關係需 owner 確認；live DNS / TLS probe 未執行。",
|
||
"evidence_refs": [
|
||
"docs/security/DOMAIN-TLS-CERTBOT-INVENTORY.md",
|
||
"docs/security/domain-tls-certbot-inventory.snapshot.json"
|
||
],
|
||
"label": "DNS / TLS / certbot / certificate path",
|
||
"next_owner_action": "確認 SAN / 共用憑證關係、renewal owner、ACME smoke 與 rollback owner。",
|
||
"owner_response_accepted": false,
|
||
"owner_response_received": false,
|
||
"owner_response_required": true,
|
||
"patterns": [
|
||
"docs/runbooks/REGISTRY-CERTBOT-188.md",
|
||
"docs/runbooks/**/*CERTBOT*.md",
|
||
"docs/runbooks/**/*TLS*.md",
|
||
"ops/**/*cert*",
|
||
"ops/**/*tls*",
|
||
"infra/**/*cert*",
|
||
"infra/**/*tls*",
|
||
"k8s/**/*tls*"
|
||
],
|
||
"priority": "P0",
|
||
"required_gate": "domain_tls_owner_response_required",
|
||
"required_validation": [
|
||
"domain_inventory",
|
||
"certificate_path_check",
|
||
"renewal_window",
|
||
"acme_path_smoke",
|
||
"public_https_smoke",
|
||
"rollback_ref"
|
||
],
|
||
"runtime_gate_open": false
|
||
},
|
||
{
|
||
"action_buttons_allowed": false,
|
||
"category_id": "k8s_production_gitops",
|
||
"control_tier": "C0",
|
||
"coverage_percent": 58,
|
||
"coverage_status": "gate_defined_needs_runtime_evidence",
|
||
"current_gap": "尚未把 ArgoCD health / sync readback 與 rollback revision 收成 owner packet。",
|
||
"evidence_refs": [
|
||
"docs/security/HIGH-VALUE-CONFIG-CHANGE-GATE.md",
|
||
"k8s/awoooi-prod",
|
||
"k8s/argocd"
|
||
],
|
||
"label": "K8s / ArgoCD / production manifests",
|
||
"next_owner_action": "補 GitOps owner、rollback revision、health readback 與 post-deploy validation plan。",
|
||
"owner_response_accepted": false,
|
||
"owner_response_received": false,
|
||
"owner_response_required": true,
|
||
"patterns": [
|
||
"k8s/awoooi-prod/**",
|
||
"k8s/argocd/**",
|
||
"k8s/velero/**",
|
||
"k8s/monitoring/**"
|
||
],
|
||
"priority": "P0",
|
||
"required_gate": "gitops_owner_response_required",
|
||
"required_validation": [
|
||
"gitops_diff",
|
||
"argocd_health_readback",
|
||
"sync_authorization_check",
|
||
"rollback_revision",
|
||
"post_deploy_health_if_executed"
|
||
],
|
||
"runtime_gate_open": false
|
||
},
|
||
{
|
||
"action_buttons_allowed": false,
|
||
"category_id": "secret_metadata",
|
||
"control_tier": "C0",
|
||
"coverage_percent": 66,
|
||
"coverage_status": "metadata_policy_ready",
|
||
"current_gap": "只允許 secret name / metadata；仍缺 owner response 與 parity acceptance。",
|
||
"evidence_refs": [
|
||
"docs/security/SOURCE-CONTROL-WORKFLOW-SECRET-NAME-INVENTORY.md",
|
||
"docs/security/source-control-workflow-secret-name-inventory.snapshot.json",
|
||
"docs/security/SECRETS_REFERENCE.md"
|
||
],
|
||
"label": "Secret metadata / injection / redaction",
|
||
"next_owner_action": "只回覆 secret name owner、rotation owner、injection owner 與 redacted evidence refs。",
|
||
"owner_response_accepted": false,
|
||
"owner_response_received": false,
|
||
"owner_response_required": true,
|
||
"patterns": [
|
||
"k8s/**/*secret*",
|
||
"k8s/**/*Secret*",
|
||
".gitea/workflows/*.yml",
|
||
".gitea/workflows/*.yaml",
|
||
".github/workflows/*.yml",
|
||
".github/workflows/*.yaml",
|
||
"docs/runbooks/SECRETS-MANAGEMENT.md",
|
||
"docs/security/SECRETS_REFERENCE.md"
|
||
],
|
||
"priority": "P0",
|
||
"required_gate": "secret_metadata_owner_response_required",
|
||
"required_validation": [
|
||
"secret_name_parity",
|
||
"metadata_only_check",
|
||
"no_secret_value_check",
|
||
"rotation_owner",
|
||
"injection_readback_if_deployed"
|
||
],
|
||
"runtime_gate_open": false
|
||
},
|
||
{
|
||
"action_buttons_allowed": false,
|
||
"category_id": "gitea_workflow_runner_source_control",
|
||
"control_tier": "C0",
|
||
"coverage_percent": 70,
|
||
"coverage_status": "metadata_inventory_ready",
|
||
"current_gap": "workflow / runner / deploy key / webhook / branch protection 仍待 owner response；不得改 workflow。",
|
||
"evidence_refs": [
|
||
"docs/security/SOURCE-CONTROL-WORKFLOW-SECRET-NAME-INVENTORY.md",
|
||
"docs/security/SOURCE-CONTROL-WORKFLOW-SECRET-NAME-OWNER-RESPONSE.md",
|
||
"docs/security/SOURCE-CONTROL-PRIMARY-READINESS-GATE.md"
|
||
],
|
||
"label": "Gitea workflow / runner / deploy key / webhook / branch protection",
|
||
"next_owner_action": "補 runner label、webhook、deploy key、branch protection 與 workflow parity owner metadata。",
|
||
"owner_response_accepted": false,
|
||
"owner_response_received": false,
|
||
"owner_response_required": true,
|
||
"patterns": [
|
||
".gitea/workflows/**",
|
||
".github/workflows/**",
|
||
"ops/runner/**",
|
||
"scripts/setup-runner*.sh",
|
||
"scripts/**/*runner*",
|
||
"docs/security/SOURCE-CONTROL-*",
|
||
"docs/security/GITEA-*",
|
||
"docs/security/GITHUB-*"
|
||
],
|
||
"priority": "P0",
|
||
"required_gate": "workflow_source_control_owner_response_required",
|
||
"required_validation": [
|
||
"workflow_diff",
|
||
"runner_label_owner",
|
||
"deploy_key_metadata_only",
|
||
"webhook_metadata_only",
|
||
"branch_protection_metadata",
|
||
"no_token_value_check"
|
||
],
|
||
"runtime_gate_open": false
|
||
},
|
||
{
|
||
"action_buttons_allowed": false,
|
||
"category_id": "public_admin_api_runtime_config",
|
||
"control_tier": "C0",
|
||
"coverage_percent": 62,
|
||
"coverage_status": "policy_ready_needs_change_scoped_smoke",
|
||
"current_gap": "每次產品 route / admin / API / frontend config 變更仍需逐次 smoke 與 owner gate。",
|
||
"evidence_refs": [
|
||
"docs/HARD_RULES.md",
|
||
"docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md"
|
||
],
|
||
"label": "Public / admin / API / frontend runtime config",
|
||
"next_owner_action": "補 affected route、admin/auth boundary、CORS/public URL 與 desktop/mobile smoke plan。",
|
||
"owner_response_accepted": false,
|
||
"owner_response_received": false,
|
||
"owner_response_required": true,
|
||
"patterns": [
|
||
"apps/web/next.config.*",
|
||
"apps/web/src/lib/config.*",
|
||
"apps/api/src/core/config.py",
|
||
"apps/api/src/api/v1/monitoring.py",
|
||
"apps/api/src/middleware/**",
|
||
"apps/web/src/middleware.*"
|
||
],
|
||
"priority": "P0",
|
||
"required_gate": "public_runtime_config_owner_response_required",
|
||
"required_validation": [
|
||
"public_url_check",
|
||
"frontend_internal_ip_ban",
|
||
"cors_boundary_check",
|
||
"admin_auth_boundary_check",
|
||
"desktop_mobile_smoke_if_frontend"
|
||
],
|
||
"runtime_gate_open": false
|
||
},
|
||
{
|
||
"action_buttons_allowed": false,
|
||
"category_id": "backup_restore_credential",
|
||
"control_tier": "C0",
|
||
"coverage_percent": 58,
|
||
"coverage_status": "repo_only_inventory_ready_needs_restore_drill_owner",
|
||
"current_gap": "repo-only 清冊已納入 38 個 backup / restore / escrow / retention surface；restore drill、offsite sync、credential escrow、retention change、live evidence 與 owner response 仍全部為 0。",
|
||
"evidence_refs": [
|
||
"docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md",
|
||
"docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md",
|
||
"docs/security/backup-restore-escrow-inventory.snapshot.json",
|
||
"docs/schemas/backup_restore_escrow_inventory_v1.schema.json"
|
||
],
|
||
"label": "Backup / restore / escrow / retention",
|
||
"next_owner_action": "補 restore drill approval package、offsite owner、escrow owner、retention owner、rollback owner 與 no-secret-value evidence。",
|
||
"owner_response_accepted": false,
|
||
"owner_response_received": false,
|
||
"owner_response_required": true,
|
||
"patterns": [
|
||
"scripts/backup/**",
|
||
"k8s/velero/**",
|
||
"docs/runbooks/disaster-recovery/**",
|
||
"docs/runbooks/**/*RESTORE*.md",
|
||
"docs/runbooks/**/*BACKUP*.md"
|
||
],
|
||
"priority": "P0",
|
||
"required_gate": "backup_restore_owner_response_required",
|
||
"required_validation": [
|
||
"credential_absence_check",
|
||
"restore_drill_gate",
|
||
"retention_policy",
|
||
"escrow_owner",
|
||
"rollback_ref"
|
||
],
|
||
"runtime_gate_open": false
|
||
},
|
||
{
|
||
"action_buttons_allowed": false,
|
||
"category_id": "agent_bounty_protocol_runtime",
|
||
"control_tier": "C0",
|
||
"coverage_percent": 68,
|
||
"coverage_status": "onboarding_handoff_ready_needs_runtime_owner",
|
||
"current_gap": "尚未收到 runtime / MCP / A2A / treasury / payout owner response；runtime gate 必須維持 0。",
|
||
"evidence_refs": [
|
||
"docs/security/AGENT-BOUNTY-IWOOOS-ONBOARDING-HANDOFF.md",
|
||
"docs/security/agent-bounty-iwooos-onboarding-handoff.snapshot.json",
|
||
"docs/security/GITHUB-TARGET-OWNER-DECISION-RESPONSE.md"
|
||
],
|
||
"label": "agent-bounty-protocol runtime / MCP / A2A / treasury boundary",
|
||
"next_owner_action": "補 repo owner、external agent owner、treasury owner、runtime gate owner 與 validation plan。",
|
||
"owner_response_accepted": false,
|
||
"owner_response_received": false,
|
||
"owner_response_required": true,
|
||
"patterns": [
|
||
"docs/security/AGENT-BOUNTY-IWOOOS-ONBOARDING-HANDOFF.md",
|
||
"docs/security/agent-bounty-iwooos-onboarding-handoff.snapshot.json",
|
||
"docs/schemas/agent_bounty_iwooos_onboarding_handoff_v1.schema.json",
|
||
"agent-bounty-protocol/**"
|
||
],
|
||
"priority": "P0",
|
||
"required_gate": "agent_bounty_owner_response_required",
|
||
"required_validation": [
|
||
"repo_owner_scope",
|
||
"runtime_gate_false",
|
||
"no_payout_or_treasury_execution",
|
||
"no_mcp_a2a_runtime_execution",
|
||
"redacted_evidence_refs_only"
|
||
],
|
||
"runtime_gate_open": false
|
||
},
|
||
{
|
||
"action_buttons_allowed": false,
|
||
"category_id": "monitoring_alerting_observability",
|
||
"control_tier": "C1",
|
||
"coverage_percent": 62,
|
||
"coverage_status": "repo_only_inventory_ready_needs_live_route_evidence",
|
||
"current_gap": "repo-only 清冊已納入 60 個 monitoring / alerting / observability surface；仍缺 live config hash、rule diff、receiver diff、reload owner、route smoke、receipt proof 與 owner response。",
|
||
"evidence_refs": [
|
||
"docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md",
|
||
"docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md",
|
||
"docs/security/monitoring-alerting-observability-inventory.snapshot.json",
|
||
"docs/schemas/monitoring_alerting_observability_inventory_v1.schema.json"
|
||
],
|
||
"label": "Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse",
|
||
"next_owner_action": "補 Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse / Telegram owner、live drift evidence、reload window、receiver owner、rollback owner 與 no-secret-value evidence。",
|
||
"owner_response_accepted": false,
|
||
"owner_response_received": false,
|
||
"owner_response_required": true,
|
||
"patterns": [
|
||
"ops/monitoring/**",
|
||
"ops/alertmanager/**",
|
||
"ops/grafana/**",
|
||
"ops/signoz/**",
|
||
"ops/sentry-self-hosted/**",
|
||
"infra/langfuse/**",
|
||
"k8s/monitoring/**"
|
||
],
|
||
"priority": "P1",
|
||
"required_gate": "monitoring_observability_owner_response_required",
|
||
"required_validation": [
|
||
"rule_diff",
|
||
"receiver_diff",
|
||
"reload_gate",
|
||
"failure_notification_policy",
|
||
"public_route_smoke_if_affected"
|
||
],
|
||
"runtime_gate_open": false
|
||
},
|
||
{
|
||
"action_buttons_allowed": false,
|
||
"category_id": "docker_compose_systemd_host_config",
|
||
"control_tier": "C1",
|
||
"coverage_percent": 50,
|
||
"coverage_status": "repo_only_inventory_ready_needs_live_owner_evidence",
|
||
"current_gap": "repo-only 清冊已納入 9 個 surface；仍缺 110 / 188 live hash、restart window、rollback owner 與 post-check 指標。",
|
||
"evidence_refs": [
|
||
"docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md",
|
||
"docs/security/HOST-SERVICE-CONFIG-INVENTORY.md",
|
||
"docs/security/host-service-config-inventory.snapshot.json",
|
||
"docs/security/DEV-HOSTS-112-111-168-OBSERVE-ONLY-MAPPING.md"
|
||
],
|
||
"label": "Docker Compose / systemd / host service config",
|
||
"next_owner_action": "補 owner-provided live hash / disposition、compose / systemd owner、restart window、rollback owner 與 post-check 指標。",
|
||
"owner_response_accepted": false,
|
||
"owner_response_received": false,
|
||
"owner_response_required": true,
|
||
"patterns": [
|
||
"docker-compose*.yml",
|
||
"docker-compose*.yaml",
|
||
"ops/**/docker-compose*.yml",
|
||
"ops/**/docker-compose*.yaml",
|
||
"scripts/reboot-recovery/**",
|
||
"scripts/**/*.service",
|
||
"ops/**/*.service"
|
||
],
|
||
"priority": "P1",
|
||
"required_gate": "host_service_owner_response_required",
|
||
"required_validation": [
|
||
"port_conflict_check",
|
||
"volume_diff",
|
||
"env_name_diff",
|
||
"restart_window",
|
||
"rollback_owner"
|
||
],
|
||
"runtime_gate_open": false
|
||
},
|
||
{
|
||
"action_buttons_allowed": false,
|
||
"category_id": "ssh_firewall_network_access",
|
||
"control_tier": "C1",
|
||
"coverage_percent": 54,
|
||
"coverage_status": "repo_only_inventory_ready_needs_live_owner_evidence",
|
||
"current_gap": "repo-only 清冊已納入 16 個 SSH / network access surface；仍缺 live firewall / sudoers / known_hosts / NetworkPolicy / NodePort / WireGuard evidence、network owner 與 rollback owner。",
|
||
"evidence_refs": [
|
||
"docs/HARD_RULES.md",
|
||
"docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md",
|
||
"docs/security/SSH-NETWORK-ACCESS-INVENTORY.md",
|
||
"docs/security/ssh-network-access-inventory.snapshot.json"
|
||
],
|
||
"label": "SSH / sudoers / known_hosts / firewall / WireGuard / NodePort",
|
||
"next_owner_action": "補 owner-provided live hash / disposition、host key pinning、firewall owner、NetworkPolicy / NodePort owner、WireGuard owner、maintenance window、rollback owner 與 post-check 指標。",
|
||
"owner_response_accepted": false,
|
||
"owner_response_received": false,
|
||
"owner_response_required": true,
|
||
"patterns": [
|
||
"infra/ansible/inventory/**",
|
||
"infra/ansible/**/*known_hosts*",
|
||
"infra/ansible/**/*ssh*",
|
||
"scripts/**/*ssh*",
|
||
"scripts/**/*known_hosts*",
|
||
"ops/**/*wireguard*",
|
||
"ops/**/*firewall*",
|
||
"k8s/**/*network*",
|
||
"k8s/**/*Network*"
|
||
],
|
||
"priority": "P1",
|
||
"required_gate": "network_access_owner_response_required",
|
||
"required_validation": [
|
||
"target_whitelist",
|
||
"host_key_policy",
|
||
"ingress_egress_matrix",
|
||
"rollback_owner",
|
||
"maintenance_window"
|
||
],
|
||
"runtime_gate_open": false
|
||
},
|
||
{
|
||
"action_buttons_allowed": false,
|
||
"category_id": "ai_provider_model_routing",
|
||
"control_tier": "C1",
|
||
"coverage_percent": 60,
|
||
"coverage_status": "policy_ready_needs_dry_run_pack",
|
||
"current_gap": "模型 / provider / Ollama proxy 切換需 dry-run、benchmark、成本與 privacy review；目前不切 production。",
|
||
"evidence_refs": [
|
||
"docs/HARD_RULES.md",
|
||
"docs/ai"
|
||
],
|
||
"label": "AI provider / model routing / Ollama proxy / cost and privacy",
|
||
"next_owner_action": "補 provider owner、fallback order、cost review、privacy review、benchmark 與 rollback owner。",
|
||
"owner_response_accepted": false,
|
||
"owner_response_received": false,
|
||
"owner_response_required": true,
|
||
"patterns": [
|
||
"apps/api/src/services/ai_providers/**",
|
||
"apps/api/src/services/**/*model*",
|
||
"apps/api/src/services/**/*provider*",
|
||
"infra/ansible/roles/nginx/templates/110-ollama-proxy.conf.j2",
|
||
"docs/ai/**",
|
||
"docs/**/*Ollama*"
|
||
],
|
||
"priority": "P1",
|
||
"required_gate": "ai_provider_owner_response_required",
|
||
"required_validation": [
|
||
"dry_run",
|
||
"benchmark",
|
||
"cost_review",
|
||
"privacy_review",
|
||
"fallback_order_check"
|
||
],
|
||
"runtime_gate_open": false
|
||
},
|
||
{
|
||
"action_buttons_allowed": false,
|
||
"category_id": "product_surface_runtime_routes",
|
||
"control_tier": "C2",
|
||
"coverage_percent": 72,
|
||
"coverage_status": "scope_inventory_ready",
|
||
"current_gap": "跨產品 owner response 尚未 accepted；產品 route / admin / webhook 仍需逐產品補證。",
|
||
"evidence_refs": [
|
||
"docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md",
|
||
"docs/security/VIBEWORK-IWOOOS-ONBOARDING-HANDOFF.md",
|
||
"docs/security/AGENT-BOUNTY-IWOOOS-ONBOARDING-HANDOFF.md"
|
||
],
|
||
"label": "AWOOOI / AwoooP / IwoooS / VibeWork / other product runtime routes",
|
||
"next_owner_action": "補 AWOOOI、AwoooP、IwoooS、VibeWork、agent-bounty-protocol 與公開網站 owner response。",
|
||
"owner_response_accepted": false,
|
||
"owner_response_received": false,
|
||
"owner_response_required": true,
|
||
"patterns": [
|
||
"apps/web/src/app/**",
|
||
"apps/web/messages/*.json",
|
||
"docs/security/VIBEWORK-IWOOOS-ONBOARDING-HANDOFF.md",
|
||
"docs/security/vibework-iwooos-onboarding-handoff.snapshot.json"
|
||
],
|
||
"priority": "P2",
|
||
"required_gate": "product_surface_owner_response_required",
|
||
"required_validation": [
|
||
"product_boundary_check",
|
||
"i18n_traditional_chinese_check",
|
||
"no_internal_transcript_check",
|
||
"desktop_mobile_smoke_if_frontend"
|
||
],
|
||
"runtime_gate_open": false
|
||
},
|
||
{
|
||
"action_buttons_allowed": false,
|
||
"category_id": "security_evidence_tooling",
|
||
"control_tier": "C3",
|
||
"coverage_percent": 86,
|
||
"coverage_status": "guard_ready",
|
||
"current_gap": "guard 已可重跑，但尚未接 blocking CI；本階段刻意維持低摩擦。",
|
||
"evidence_refs": [
|
||
"scripts/security/security-mirror-progress-guard.py",
|
||
"scripts/security/high-value-config-change-gate.py",
|
||
"scripts/security/high-value-config-owner-packet.py",
|
||
"docs/security/high-value-config-change-gate.snapshot.json"
|
||
],
|
||
"label": "Security evidence / snapshot / guard tooling",
|
||
"next_owner_action": "維持 guard / doc secret sanity；若要 CI blocking 需另開人工批准與 rollout plan。",
|
||
"owner_response_accepted": false,
|
||
"owner_response_received": false,
|
||
"owner_response_required": true,
|
||
"patterns": [
|
||
"docs/security/**",
|
||
"docs/schemas/**",
|
||
"scripts/security/**",
|
||
"docs/LOGBOOK.md"
|
||
],
|
||
"priority": "P3",
|
||
"required_gate": "security_evidence_owner_review_required",
|
||
"required_validation": [
|
||
"snapshot_parse",
|
||
"guard_smoke",
|
||
"doc_secret_sanity",
|
||
"no_runtime_gate_increase"
|
||
],
|
||
"runtime_gate_open": false
|
||
}
|
||
],
|
||
"execution_boundaries": {
|
||
"acme_challenge_change_authorized": false,
|
||
"action_buttons_allowed": false,
|
||
"active_scan_authorized": false,
|
||
"admin_route_change_authorized": false,
|
||
"agent_bounty_runtime_authorized": false,
|
||
"alert_chain_smoke_authorized": false,
|
||
"alertmanager_reload_authorized": false,
|
||
"argocd_sync_authorized": false,
|
||
"backup_run_authorized": false,
|
||
"certbot_renew_authorized": false,
|
||
"credential_escrow_marker_write_authorized": false,
|
||
"dns_tls_change_authorized": false,
|
||
"exporter_deploy_authorized": false,
|
||
"force_push_authorized": false,
|
||
"grafana_dashboard_apply_authorized": false,
|
||
"host_live_conf_read_authorized": false,
|
||
"host_write_authorized": false,
|
||
"kubectl_action_authorized": false,
|
||
"langfuse_config_change_authorized": false,
|
||
"live_alert_fire_authorized": false,
|
||
"nginx_reload_authorized": false,
|
||
"nginx_test_authorized": false,
|
||
"notification_route_change_authorized": false,
|
||
"offsite_remote_delete_authorized": false,
|
||
"offsite_sync_authorized": false,
|
||
"otel_collector_reload_authorized": false,
|
||
"payout_or_withdrawal_authorized": false,
|
||
"prometheus_reload_authorized": false,
|
||
"public_gateway_reload_authorized": false,
|
||
"public_route_change_authorized": false,
|
||
"rclone_config_authorized": false,
|
||
"receiver_route_change_authorized": false,
|
||
"refs_sync_authorized": false,
|
||
"remote_write_change_authorized": false,
|
||
"restic_prune_authorized": false,
|
||
"restore_drill_authorized": false,
|
||
"restore_run_authorized": false,
|
||
"retention_change_authorized": false,
|
||
"rollback_executed": false,
|
||
"route_smoke_authorized": false,
|
||
"runner_change_authorized": false,
|
||
"runtime_execution_authorized": false,
|
||
"secret_value_collection_allowed": false,
|
||
"sentry_deploy_authorized": false,
|
||
"signoz_rule_apply_authorized": false,
|
||
"silence_policy_change_authorized": false,
|
||
"telegram_send_authorized": false,
|
||
"velero_restore_authorized": false,
|
||
"webhook_receiver_change_authorized": false,
|
||
"websocket_route_change_authorized": false,
|
||
"workflow_modification_authorized": false
|
||
},
|
||
"generated_at": "2026-06-12T10:35:00+08:00",
|
||
"git_commit": "e4747722",
|
||
"lowest_coverage_categories": [
|
||
{
|
||
"category_id": "docker_compose_systemd_host_config",
|
||
"coverage_percent": 50,
|
||
"current_gap": "repo-only 清冊已納入 9 個 surface；仍缺 110 / 188 live hash、restart window、rollback owner 與 post-check 指標。",
|
||
"label": "Docker Compose / systemd / host service config",
|
||
"next_owner_action": "補 owner-provided live hash / disposition、compose / systemd owner、restart window、rollback owner 與 post-check 指標。"
|
||
},
|
||
{
|
||
"category_id": "ssh_firewall_network_access",
|
||
"coverage_percent": 54,
|
||
"current_gap": "repo-only 清冊已納入 16 個 SSH / network access surface；仍缺 live firewall / sudoers / known_hosts / NetworkPolicy / NodePort / WireGuard evidence、network owner 與 rollback owner。",
|
||
"label": "SSH / sudoers / known_hosts / firewall / WireGuard / NodePort",
|
||
"next_owner_action": "補 owner-provided live hash / disposition、host key pinning、firewall owner、NetworkPolicy / NodePort owner、WireGuard owner、maintenance window、rollback owner 與 post-check 指標。"
|
||
},
|
||
{
|
||
"category_id": "k8s_production_gitops",
|
||
"coverage_percent": 58,
|
||
"current_gap": "尚未把 ArgoCD health / sync readback 與 rollback revision 收成 owner packet。",
|
||
"label": "K8s / ArgoCD / production manifests",
|
||
"next_owner_action": "補 GitOps owner、rollback revision、health readback 與 post-deploy validation plan。"
|
||
},
|
||
{
|
||
"category_id": "backup_restore_credential",
|
||
"coverage_percent": 58,
|
||
"current_gap": "repo-only 清冊已納入 38 個 backup / restore / escrow / retention surface；restore drill、offsite sync、credential escrow、retention change、live evidence 與 owner response 仍全部為 0。",
|
||
"label": "Backup / restore / escrow / retention",
|
||
"next_owner_action": "補 restore drill approval package、offsite owner、escrow owner、retention owner、rollback owner 與 no-secret-value evidence。"
|
||
}
|
||
],
|
||
"next_collection_order": [
|
||
"nginx_public_gateway",
|
||
"dns_tls_certbot",
|
||
"secret_metadata",
|
||
"gitea_workflow_runner_source_control",
|
||
"agent_bounty_protocol_runtime",
|
||
"docker_compose_systemd_host_config",
|
||
"monitoring_alerting_observability",
|
||
"ssh_firewall_network_access",
|
||
"backup_restore_credential"
|
||
],
|
||
"operator_interpretation": [
|
||
"這是全域配置控管覆蓋矩陣，不是單次 git diff 變更分類。",
|
||
"所有 category 都已有高價值配置 Gate 註冊與 owner response 欄位，但 owner response received / accepted 仍為 0。",
|
||
"C0 / C1 coverage percent 只代表只讀框架成熟度，不代表 runtime 可執行。",
|
||
"缺 live evidence 的項目只能收 owner-provided redacted evidence，不得主動 SSH、reload、scan 或讀 secret value。"
|
||
],
|
||
"schema_version": "high_value_config_control_coverage_v1",
|
||
"source_category_definition": "scripts/security/high-value-config-change-gate.py",
|
||
"status": "coverage_matrix_ready",
|
||
"summary": {
|
||
"action_button_count": 0,
|
||
"average_coverage_percent": 66,
|
||
"c0_category_count": 8,
|
||
"c1_category_count": 4,
|
||
"c2_category_count": 1,
|
||
"c3_category_count": 1,
|
||
"category_count": 14,
|
||
"lowest_coverage_category_count": 4,
|
||
"needs_live_evidence_count": 7,
|
||
"owner_response_accepted_count": 0,
|
||
"owner_response_received_count": 0,
|
||
"owner_response_required_count": 14,
|
||
"registered_control_count": 14,
|
||
"runtime_gate_count": 0
|
||
}
|
||
}
|