awoooi/docs/security/high-value-config-owner-packet.snapshot.json

{
  "allowed_decisions": [
    "confirm",
    "defer",
    "reject",
    "request_more_evidence"
  ],
  "canonical_owner_fields": [
    "owner_role_or_team",
    "decision",
    "decision_reason",
    "affected_scope",
    "redacted_evidence_refs",
    "followup_owner",
    "rollback_owner",
    "maintenance_window",
    "validation_plan"
  ],
  "control_category_inventory": [
    {
      "category_id": "nginx_public_gateway",
      "control_tier": "C0",
      "label": "Nginx / reverse proxy / public route",
      "path_patterns": [
        "infra/ansible/roles/nginx/templates/*.j2",
        "infra/ansible/playbooks/nginx-sync.yml",
        "ops/nginx/**",
        "docs/runbooks/disaster-recovery/DR-Nginx.md"
      ],
      "priority": "P0",
      "required_gate": "public_gateway_owner_response_required",
      "required_owner_fields": [
        "owner_role_or_team",
        "decision",
        "decision_reason",
        "affected_scope",
        "redacted_evidence_refs",
        "followup_owner",
        "rollback_owner",
        "maintenance_window",
        "validation_plan"
      ],
      "required_validation": [
        "rendered_diff",
        "nginx_t",
        "affected_route_smoke",
        "admin_route_smoke_if_affected",
        "acme_path_smoke_if_affected",
        "rollback_ref"
      ]
    },
    {
      "category_id": "dns_tls_certbot",
      "control_tier": "C0",
      "label": "DNS / TLS / certbot / certificate path",
      "path_patterns": [
        "docs/runbooks/REGISTRY-CERTBOT-188.md",
        "docs/runbooks/**/*CERTBOT*.md",
        "docs/runbooks/**/*TLS*.md",
        "ops/**/*cert*",
        "ops/**/*tls*",
        "infra/**/*cert*",
        "infra/**/*tls*",
        "k8s/**/*tls*"
      ],
      "priority": "P0",
      "required_gate": "domain_tls_owner_response_required",
      "required_owner_fields": [
        "owner_role_or_team",
        "decision",
        "decision_reason",
        "affected_scope",
        "redacted_evidence_refs",
        "followup_owner",
        "rollback_owner",
        "maintenance_window",
        "validation_plan"
      ],
      "required_validation": [
        "domain_inventory",
        "certificate_path_check",
        "renewal_window",
        "acme_path_smoke",
        "public_https_smoke",
        "rollback_ref"
      ]
    },
    {
      "category_id": "k8s_production_gitops",
      "control_tier": "C0",
      "label": "K8s / ArgoCD / production manifests",
      "path_patterns": [
        "k8s/awoooi-prod/**",
        "k8s/argocd/**",
        "k8s/velero/**",
        "k8s/monitoring/**"
      ],
      "priority": "P0",
      "required_gate": "gitops_owner_response_required",
      "required_owner_fields": [
        "owner_role_or_team",
        "decision",
        "decision_reason",
        "affected_scope",
        "redacted_evidence_refs",
        "followup_owner",
        "rollback_owner",
        "maintenance_window",
        "validation_plan"
      ],
      "required_validation": [
        "gitops_diff",
        "argocd_health_readback",
        "sync_authorization_check",
        "rollback_revision",
        "post_deploy_health_if_executed"
      ]
    },
    {
      "category_id": "secret_metadata",
      "control_tier": "C0",
      "label": "Secret metadata / injection / redaction",
      "path_patterns": [
        "k8s/**/*secret*",
        "k8s/**/*Secret*",
        ".gitea/workflows/*.yml",
        ".gitea/workflows/*.yaml",
        ".github/workflows/*.yml",
        ".github/workflows/*.yaml",
        "docs/runbooks/SECRETS-MANAGEMENT.md",
        "docs/security/SECRETS_REFERENCE.md"
      ],
      "priority": "P0",
      "required_gate": "secret_metadata_owner_response_required",
      "required_owner_fields": [
        "owner_role_or_team",
        "decision",
        "decision_reason",
        "affected_scope",
        "redacted_evidence_refs",
        "followup_owner",
        "rollback_owner",
        "maintenance_window",
        "validation_plan"
      ],
      "required_validation": [
        "secret_name_parity",
        "metadata_only_check",
        "no_secret_value_check",
        "rotation_owner",
        "injection_readback_if_deployed"
      ]
    },
    {
      "category_id": "gitea_workflow_runner_source_control",
      "control_tier": "C0",
      "label": "Gitea workflow / runner / deploy key / webhook / branch protection",
      "path_patterns": [
        ".gitea/workflows/**",
        ".github/workflows/**",
        "ops/runner/**",
        "scripts/setup-runner*.sh",
        "scripts/**/*runner*",
        "docs/security/SOURCE-CONTROL-*",
        "docs/security/GITEA-*",
        "docs/security/GITHUB-*"
      ],
      "priority": "P0",
      "required_gate": "workflow_source_control_owner_response_required",
      "required_owner_fields": [
        "owner_role_or_team",
        "decision",
        "decision_reason",
        "affected_scope",
        "redacted_evidence_refs",
        "followup_owner",
        "rollback_owner",
        "maintenance_window",
        "validation_plan"
      ],
      "required_validation": [
        "workflow_diff",
        "runner_label_owner",
        "deploy_key_metadata_only",
        "webhook_metadata_only",
        "branch_protection_metadata",
        "no_token_value_check"
      ]
    },
    {
      "category_id": "public_admin_api_runtime_config",
      "control_tier": "C0",
      "label": "Public / admin / API / frontend runtime config",
      "path_patterns": [
        "apps/web/next.config.*",
        "apps/web/src/lib/config.*",
        "apps/api/src/core/config.py",
        "apps/api/src/api/v1/monitoring.py",
        "apps/api/src/middleware/**",
        "apps/web/src/middleware.*"
      ],
      "priority": "P0",
      "required_gate": "public_runtime_config_owner_response_required",
      "required_owner_fields": [
        "owner_role_or_team",
        "decision",
        "decision_reason",
        "affected_scope",
        "redacted_evidence_refs",
        "followup_owner",
        "rollback_owner",
        "maintenance_window",
        "validation_plan"
      ],
      "required_validation": [
        "public_url_check",
        "frontend_internal_ip_ban",
        "cors_boundary_check",
        "admin_auth_boundary_check",
        "desktop_mobile_smoke_if_frontend"
      ]
    },
    {
      "category_id": "backup_restore_credential",
      "control_tier": "C0",
      "label": "Backup / restore / escrow / retention",
      "path_patterns": [
        "scripts/backup/**",
        "k8s/velero/**",
        "docs/runbooks/disaster-recovery/**",
        "docs/runbooks/**/*RESTORE*.md",
        "docs/runbooks/**/*BACKUP*.md"
      ],
      "priority": "P0",
      "required_gate": "backup_restore_owner_response_required",
      "required_owner_fields": [
        "owner_role_or_team",
        "decision",
        "decision_reason",
        "affected_scope",
        "redacted_evidence_refs",
        "followup_owner",
        "rollback_owner",
        "maintenance_window",
        "validation_plan"
      ],
      "required_validation": [
        "credential_absence_check",
        "restore_drill_gate",
        "retention_policy",
        "escrow_owner",
        "rollback_ref"
      ]
    },
    {
      "category_id": "agent_bounty_protocol_runtime",
      "control_tier": "C0",
      "label": "agent-bounty-protocol runtime / MCP / A2A / treasury boundary",
      "path_patterns": [
        "docs/security/AGENT-BOUNTY-IWOOOS-ONBOARDING-HANDOFF.md",
        "docs/security/agent-bounty-iwooos-onboarding-handoff.snapshot.json",
        "docs/schemas/agent_bounty_iwooos_onboarding_handoff_v1.schema.json",
        "agent-bounty-protocol/**"
      ],
      "priority": "P0",
      "required_gate": "agent_bounty_owner_response_required",
      "required_owner_fields": [
        "owner_role_or_team",
        "decision",
        "decision_reason",
        "affected_scope",
        "redacted_evidence_refs",
        "followup_owner",
        "rollback_owner",
        "maintenance_window",
        "validation_plan"
      ],
      "required_validation": [
        "repo_owner_scope",
        "runtime_gate_false",
        "no_payout_or_treasury_execution",
        "no_mcp_a2a_runtime_execution",
        "redacted_evidence_refs_only"
      ]
    },
    {
      "category_id": "monitoring_alerting_observability",
      "control_tier": "C1",
      "label": "Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse",
      "path_patterns": [
        "ops/monitoring/**",
        "ops/alertmanager/**",
        "ops/grafana/**",
        "ops/signoz/**",
        "ops/sentry-self-hosted/**",
        "infra/langfuse/**",
        "k8s/monitoring/**"
      ],
      "priority": "P1",
      "required_gate": "monitoring_observability_owner_response_required",
      "required_owner_fields": [
        "owner_role_or_team",
        "decision",
        "decision_reason",
        "affected_scope",
        "redacted_evidence_refs",
        "followup_owner",
        "rollback_owner",
        "maintenance_window",
        "validation_plan"
      ],
      "required_validation": [
        "rule_diff",
        "receiver_diff",
        "reload_gate",
        "failure_notification_policy",
        "public_route_smoke_if_affected"
      ]
    },
    {
      "category_id": "docker_compose_systemd_host_config",
      "control_tier": "C1",
      "label": "Docker Compose / systemd / host service config",
      "path_patterns": [
        "docker-compose*.yml",
        "docker-compose*.yaml",
        "ops/**/docker-compose*.yml",
        "ops/**/docker-compose*.yaml",
        "scripts/reboot-recovery/**",
        "scripts/**/*.service",
        "ops/**/*.service"
      ],
      "priority": "P1",
      "required_gate": "host_service_owner_response_required",
      "required_owner_fields": [
        "owner_role_or_team",
        "decision",
        "decision_reason",
        "affected_scope",
        "redacted_evidence_refs",
        "followup_owner",
        "rollback_owner",
        "maintenance_window",
        "validation_plan"
      ],
      "required_validation": [
        "port_conflict_check",
        "volume_diff",
        "env_name_diff",
        "restart_window",
        "rollback_owner"
      ]
    },
    {
      "category_id": "ssh_firewall_network_access",
      "control_tier": "C1",
      "label": "SSH / sudoers / known_hosts / firewall / WireGuard / NodePort",
      "path_patterns": [
        "infra/ansible/inventory/**",
        "infra/ansible/**/*known_hosts*",
        "infra/ansible/**/*ssh*",
        "scripts/**/*ssh*",
        "scripts/**/*known_hosts*",
        "ops/**/*wireguard*",
        "ops/**/*firewall*",
        "k8s/**/*network*",
        "k8s/**/*Network*"
      ],
      "priority": "P1",
      "required_gate": "network_access_owner_response_required",
      "required_owner_fields": [
        "owner_role_or_team",
        "decision",
        "decision_reason",
        "affected_scope",
        "redacted_evidence_refs",
        "followup_owner",
        "rollback_owner",
        "maintenance_window",
        "validation_plan"
      ],
      "required_validation": [
        "target_whitelist",
        "host_key_policy",
        "ingress_egress_matrix",
        "rollback_owner",
        "maintenance_window"
      ]
    },
    {
      "category_id": "ai_provider_model_routing",
      "control_tier": "C1",
      "label": "AI provider / model routing / Ollama proxy / cost and privacy",
      "path_patterns": [
        "apps/api/src/services/ai_providers/**",
        "apps/api/src/services/**/*model*",
        "apps/api/src/services/**/*provider*",
        "infra/ansible/roles/nginx/templates/110-ollama-proxy.conf.j2",
        "docs/ai/**",
        "docs/**/*Ollama*"
      ],
      "priority": "P1",
      "required_gate": "ai_provider_owner_response_required",
      "required_owner_fields": [
        "owner_role_or_team",
        "decision",
        "decision_reason",
        "affected_scope",
        "redacted_evidence_refs",
        "followup_owner",
        "rollback_owner",
        "maintenance_window",
        "validation_plan"
      ],
      "required_validation": [
        "dry_run",
        "benchmark",
        "cost_review",
        "privacy_review",
        "fallback_order_check"
      ]
    },
    {
      "category_id": "product_surface_runtime_routes",
      "control_tier": "C2",
      "label": "AWOOOI / AwoooP / IwoooS / VibeWork / other product runtime routes",
      "path_patterns": [
        "apps/web/src/app/**",
        "apps/web/messages/*.json",
        "docs/security/VIBEWORK-IWOOOS-ONBOARDING-HANDOFF.md",
        "docs/security/vibework-iwooos-onboarding-handoff.snapshot.json"
      ],
      "priority": "P2",
      "required_gate": "product_surface_owner_response_required",
      "required_owner_fields": [
        "owner_role_or_team",
        "decision",
        "decision_reason",
        "affected_scope",
        "redacted_evidence_refs",
        "followup_owner",
        "rollback_owner",
        "maintenance_window",
        "validation_plan"
      ],
      "required_validation": [
        "product_boundary_check",
        "i18n_traditional_chinese_check",
        "no_internal_transcript_check",
        "desktop_mobile_smoke_if_frontend"
      ]
    },
    {
      "category_id": "security_evidence_tooling",
      "control_tier": "C3",
      "label": "Security evidence / snapshot / guard tooling",
      "path_patterns": [
        "docs/security/**",
        "docs/schemas/**",
        "scripts/security/**",
        "docs/LOGBOOK.md"
      ],
      "priority": "P3",
      "required_gate": "security_evidence_owner_review_required",
      "required_owner_fields": [
        "owner_role_or_team",
        "decision",
        "decision_reason",
        "affected_scope",
        "redacted_evidence_refs",
        "followup_owner",
        "rollback_owner",
        "maintenance_window",
        "validation_plan"
      ],
      "required_validation": [
        "snapshot_parse",
        "guard_smoke",
        "doc_secret_sanity",
        "no_runtime_gate_increase"
      ]
    }
  ],
  "execution_boundaries": {
    "action_buttons_allowed": false,
    "host_write_authorized": false,
    "request_sent": false,
    "response_accepted": false,
    "response_received": false,
    "runtime_execution_authorized": false,
    "secret_value_collected": false
  },
  "generated_at": "2026-06-11T13:00:00+08:00",
  "git_commit": "ccf87213",
  "next_steps": [
    "若 packet_count > 0，將 packet 交給 owner 補 canonical 欄位；不得把草案視為已送件。",
    "若 owner 回覆含 secret 或執行要求，先 quarantine 或 reject_execution_request。",
    "只有 reviewer checklist 完成後才可進 accepted；accepted 仍不開 runtime gate。"
  ],
  "packets": [
    {
      "affected_files": [
        "docs/LOGBOOK.md",
        "docs/security/HIGH-VALUE-CONFIG-CHANGE-GATE.md",
        "docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET.md",
        "docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md",
        "docs/security/high-value-config-change-gate.snapshot.json",
        "docs/security/high-value-config-owner-packet.snapshot.json",
        "scripts/security/high-value-config-change-gate.py",
        "scripts/security/high-value-config-owner-packet.py"
      ],
      "allowed_decisions": [
        "confirm",
        "defer",
        "reject",
        "request_more_evidence"
      ],
      "blocked_requests": [
        "repo_create",
        "visibility_change",
        "refs_sync",
        "refs_delete",
        "force_push",
        "workflow_modify",
        "runner_enable",
        "secret_value_submit",
        "ssh_host_modify",
        "nginx_reload",
        "dns_tls_modify",
        "argocd_sync",
        "kubectl_apply",
        "active_scan",
        "agent_bounty_runtime_execute",
        "payout_or_withdrawal"
      ],
      "category_id": "security_evidence_tooling",
      "control_tier": "C3",
      "false_flags": {
        "action_buttons_allowed": false,
        "active_scan_authorized": false,
        "dns_tls_change_authorized": false,
        "force_push_authorized": false,
        "host_write_authorized": false,
        "nginx_reload_authorized": false,
        "refs_sync_authorized": false,
        "request_sent": false,
        "response_accepted": false,
        "response_received": false,
        "runner_change_authorized": false,
        "runtime_execution_authorized": false,
        "secret_value_collection_allowed": false,
        "workflow_modification_authorized": false
      },
      "field_templates": [
        {
          "field": "owner_role_or_team",
          "instruction": "填角色或團隊，不填私人帳號、密碼、token 或私人聯絡資訊。",
          "required": true
        },
        {
          "field": "decision",
          "instruction": "只能填 confirm、defer、reject、request_more_evidence；不得附帶 runtime 執行批准。",
          "required": true
        },
        {
          "field": "decision_reason",
          "instruction": "填脫敏短理由；不可貼 raw log、raw API body、未脫敏截圖或內部對話。",
          "required": true
        },
        {
          "field": "affected_scope",
          "instruction": "填受影響 repo、host、domain、namespace、route、service、secret name 或產品邊界。",
          "required": true
        },
        {
          "field": "redacted_evidence_refs",
          "instruction": "只填文件路徑、snapshot id、ticket id、commit、hash 或脫敏 metadata pointer。",
          "required": true
        },
        {
          "field": "followup_owner",
          "instruction": "填後續補證、審查或決策負責角色 / 團隊。",
          "required": true
        },
        {
          "field": "rollback_owner",
          "instruction": "填回滾負責角色 / 團隊；不是直接執行授權。",
          "required": true
        },
        {
          "field": "maintenance_window",
          "instruction": "填維護窗口或明確寫 deferred / not scheduled；不得用口頭同意代替。",
          "required": true
        },
        {
          "field": "validation_plan",
          "instruction": "填 preflight、post-check、rollback check；若只讀文件變更，寫 guard / json / doc secret sanity。",
          "required": true
        }
      ],
      "label": "Security evidence / snapshot / guard tooling",
      "outcome_lanes": [
        "keep_waiting_owner_response",
        "request_more_evidence",
        "quarantine_sensitive_payload",
        "reject_execution_request",
        "ready_for_reviewer_validation"
      ],
      "packet_id": "high_value_config_owner_packet:security_evidence_tooling",
      "priority": "P3",
      "redaction_rules": [
        "只收 redacted evidence refs，不收 secret value。",
        "疑似 token、cookie、authorization header、private key、runner token 或 webhook secret 一律 quarantine。",
        "內部工作視窗對話、抱怨、口頭同意不得進產品文案或 LOGBOOK raw text。"
      ],
      "required_gate": "security_evidence_owner_review_required",
      "required_validation": [
        "snapshot_parse",
        "guard_smoke",
        "doc_secret_sanity",
        "no_runtime_gate_increase"
      ],
      "reviewer_checklist": [
        "canonical owner fields 全部存在。",
        "decision 只使用允許值。",
        "affected scope 可映射到 repo / host / domain / route / service / secret name。",
        "redacted evidence refs 不含 raw payload。",
        "沒有夾帶執行要求。",
        "C0 / C1 若要進 runtime，需獨立人工批准與維護窗口。"
      ],
      "status": "draft_waiting_owner_response"
    }
  ],
  "schema_version": "high_value_config_owner_packet_v1",
  "source_gate_schema_version": "high_value_config_change_gate_v1",
  "source_gate_summary": {
    "changed_file_count": 8,
    "impacted_c0_category_count": 0,
    "impacted_c1_category_count": 0,
    "impacted_category_count": 1,
    "matched_high_value_file_count": 8,
    "owner_evidence_complete": false,
    "owner_evidence_provided": false,
    "runtime_execution_authorized": false,
    "strongest_priority": "P3",
    "strongest_tier": "C3"
  },
  "status": "draft_waiting_owner_response",
  "summary": {
    "accepted_response_count": 0,
    "c0_packet_count": 0,
    "c1_packet_count": 0,
    "packet_count": 1,
    "received_response_count": 0,
    "request_sent_count": 0,
    "runtime_gate_count": 0
  },
  "universal_owner_response_template": {
    "allowed_decisions": [
      "confirm",
      "defer",
      "reject",
      "request_more_evidence"
    ],
    "false_flags": {
      "action_buttons_allowed": false,
      "active_scan_authorized": false,
      "dns_tls_change_authorized": false,
      "force_push_authorized": false,
      "host_write_authorized": false,
      "nginx_reload_authorized": false,
      "refs_sync_authorized": false,
      "request_sent": false,
      "response_accepted": false,
      "response_received": false,
      "runner_change_authorized": false,
      "runtime_execution_authorized": false,
      "secret_value_collection_allowed": false,
      "workflow_modification_authorized": false
    },
    "field_templates": [
      {
        "field": "owner_role_or_team",
        "instruction": "填角色或團隊，不填私人帳號、密碼、token 或私人聯絡資訊。",
        "required": true
      },
      {
        "field": "decision",
        "instruction": "只能填 confirm、defer、reject、request_more_evidence；不得附帶 runtime 執行批准。",
        "required": true
      },
      {
        "field": "decision_reason",
        "instruction": "填脫敏短理由；不可貼 raw log、raw API body、未脫敏截圖或內部對話。",
        "required": true
      },
      {
        "field": "affected_scope",
        "instruction": "填受影響 repo、host、domain、namespace、route、service、secret name 或產品邊界。",
        "required": true
      },
      {
        "field": "redacted_evidence_refs",
        "instruction": "只填文件路徑、snapshot id、ticket id、commit、hash 或脫敏 metadata pointer。",
        "required": true
      },
      {
        "field": "followup_owner",
        "instruction": "填後續補證、審查或決策負責角色 / 團隊。",
        "required": true
      },
      {
        "field": "rollback_owner",
        "instruction": "填回滾負責角色 / 團隊；不是直接執行授權。",
        "required": true
      },
      {
        "field": "maintenance_window",
        "instruction": "填維護窗口或明確寫 deferred / not scheduled；不得用口頭同意代替。",
        "required": true
      },
      {
        "field": "validation_plan",
        "instruction": "填 preflight、post-check、rollback check；若只讀文件變更，寫 guard / json / doc secret sanity。",
        "required": true
      }
    ]
  }
}