release: enforce single named reviewer workflow
This commit is contained in:
+10
-7
@@ -18,6 +18,8 @@
|
||||
|
||||
代码门禁通过不等于真实放行证据已经形成。当前工作树尚未冻结为新的唯一 commit/tag/source manifest，也未重建当前字节对应的镜像、SBOM、安全扫描和安装包。
|
||||
|
||||
> 2026-09-27 更新：单审核人、RC-06 批次签名和恢复/回退契约修改已经使本文 2026-09-21 记录的“最终文件 SHA-256”失效。旧 hash 与 Linux 结果仅作历史追溯，不代表当前工作树；在新的唯一提交冻结前不生成替代正式 hash、镜像或放行证据。
|
||||
|
||||
## 2. RC-05 真实模型评测门禁
|
||||
|
||||
### 已完成
|
||||
@@ -59,13 +61,13 @@
|
||||
|
||||
### 已完成
|
||||
|
||||
- RC-06 manifest schema v2 强制消费当前 RC-05 完整终态、账本身份、campaign 身份和逐场景 operation coverage。
|
||||
- RC-06 manifest schema v3 强制消费当前 RC-05 完整终态、账本身份、campaign 身份和逐场景 operation coverage。
|
||||
- 所有计数必须为非 bool、非负、不超预算，并在 case、operation、ledger、combined、historical 之间总和一致；耗时 observed 也必须一致。
|
||||
- 144 个场景必须逐项验证 declared、mandatory、actual、call count、missing、extra 和 repair pair；coverage SHA 纳入终态身份。
|
||||
- 每场景三个自动质量字段必须显式为 true，human/legal 字段必须明确保持未完成，`not_legal_approval=true`。
|
||||
- 历史 `release_eligible` 仅接受 provider succeeded、非 timeout、business succeeded/resolved。
|
||||
- 冻结源码和数据传递闭包先以安全文件描述符固定到私有临时树，再从固定字节加载执行；不再执行校验后的可变工作树模块。
|
||||
- 旧的批次级 approval/apply 收据验证器保持硬拒绝；真实 60 资产和 14 Prompt 必须逐项签名批准、应用和在线快照。
|
||||
- v3 只接受陈钰麒对绑定真实 60 资产、14 Prompt、31 项处置及候选/RC-05 身份的一个批次作一次 Ed25519 签名批准；审批 keyring 必须由冻结 pin 对应的离线根密钥签发，发布执行过程须由冻结 pin 对应的服务密钥签名 74 项 apply result 和在线 hash。验证器逐项核验，旧 schema、无根信任、无服务签名或其他审核人均硬拒绝。
|
||||
|
||||
### 验证
|
||||
|
||||
@@ -78,7 +80,8 @@
|
||||
### 未完成
|
||||
|
||||
- RC-05 正式真实矩阵终态不存在。
|
||||
- 60 资产＋14 Prompt 的逐项签名批准、apply receipt 和在线 hash 快照不存在。
|
||||
- 陈钰麒对 60 资产＋14 Prompt 精确 hash 的一次批次签名批准尚不存在，系统据此生成的 74 项 apply receipt 和在线 hash 快照也不存在。
|
||||
- RC-06 离线根公钥、当前审批 keyring payload 和 apply 服务公钥的冻结 pin 尚未配置；在新候选冻结前验证器会保持 fail-closed。
|
||||
- 1 个起草 Prompt＋8 个复核 Prompt 的真实运行时可执行快照不存在。
|
||||
- 管理员＋2 名普通成员、2 个工作区的完整 API/UI UAT 未执行。
|
||||
|
||||
@@ -86,7 +89,7 @@
|
||||
|
||||
### 已完成
|
||||
|
||||
- keyring/evidence/plan schema v2；当前 keyring payload pin 和最小 epoch 未配置时严格拒绝，旧 keyring 在后续吊销状态发布后不能重放。
|
||||
- 单审核人恢复契约已版本化：首发 evidence/keyring/approval/plan/readiness 为 v2；前序版本回退 evidence/plan 为 v4、keyring 为 v3、approval 为 v2。当前 keyring payload pin 和最小 epoch 未配置时严格拒绝，旧 keyring 在后续吊销状态发布后不能重放。
|
||||
- 审批签名时间不得早于备份完成、恢复测试和兼容性评估。
|
||||
- 当前和前序包、镜像、环境、三份 Compose 实际 SHA、源码闭包、环境/主机/Docker daemon/cluster/source DB/restore DB/Compose project 均进入签名绑定。
|
||||
- 备份 artifact 的路径、digest、size 按实际字节验证；恢复证据必须绑定相同目标、manifest、artifact 和 schema。
|
||||
@@ -96,7 +99,7 @@
|
||||
### 未完成
|
||||
|
||||
- 组织根公钥、当前 keyring pin 和 epoch 仍故意为空，真实使用会安全拒绝。
|
||||
- 真实 UAT target、备份 artifact、恢复、兼容性、双人独立签名和现场复探未完成。
|
||||
- 真实 UAT target、备份 artifact、恢复、兼容性、陈钰麒（总经理）的单一具名签名和现场复探未完成。
|
||||
- rollback/forward、RPO/RTO 和数据库记录/hash 核验未执行。
|
||||
|
||||
## 5. RC-08 公众生产门禁
|
||||
@@ -145,8 +148,8 @@
|
||||
2. 基于新 commit 重建 source manifest、Linux 镜像、SBOM、安全扫描和安装/回退包；旧 `cac183b2` 候选不能继续代表当前字节。
|
||||
3. 从新不可变候选重新生成正式 RC-05 计划；初始化唯一 campaign 根并绑定历史回执 v3。
|
||||
4. 先执行矩阵内代表场景；若同类失败立即停组修根因。稳定后最多 2 并发完成 144 场景，所有失败、取消、未知、降级和人工接管进入分母，不自动重试、不启用 fallback。
|
||||
5. 仅在 RC-05 终态全绿后，准备 RC-06 的 74 项逐项签名批准/应用证据并进行管理员＋2 普通成员、2 工作区 UAT。
|
||||
6. 用同一候选和真实备份完成 RC-07 恢复、rollback/forward、RPO/RTO、双签和内部 Go/No-Go。
|
||||
5. 仅在 RC-05 终态全绿后，由陈钰麒对绑定 60 资产＋14 Prompt 精确 hash 的一个批次作一次具名批准，系统自动生成和逐项核验 74 项应用证据；随后进行管理员＋2 普通成员、2 工作区 UAT。两个普通成员账号是隔离测试身份，不是审核人。
|
||||
6. 用同一候选和真实备份完成 RC-07 恢复、rollback/forward、RPO/RTO、唯一审核人签名和内部 Go/No-Go；其余技术检查全部自动执行。
|
||||
7. 最后补齐 RC-08 外部材料与生产现场验证；blocker 为 0 且发布负责人明确授权后才允许公众切流。
|
||||
|
||||
在上述第 4～7 步完成前，不得将本地门禁测试描述为真实模型质量证明、法律批准、第三方存证、司法效力、真实恢复演练或公众生产放行。
|
||||
|
||||
@@ -20,6 +20,30 @@
|
||||
"RC-08 external production prerequisites are incomplete"
|
||||
]
|
||||
},
|
||||
"human_release_review_policy": {
|
||||
"observed_at": "2026-09-27T06:47:12+08:00",
|
||||
"mode": "single_named_reviewer",
|
||||
"approver_id": "chen-yuqi",
|
||||
"name": "陈钰麒",
|
||||
"title": "总经理",
|
||||
"approval_role": "release_owner",
|
||||
"approvals_per_recovery_or_rollback": 1,
|
||||
"rc06_asset_prompt_approval": "one_signed_batch_for_60_assets_and_14_prompt_modules",
|
||||
"provider_approval": "one_signed_batch_for_exact_provider_and_product_evidence",
|
||||
"public_policy_reviewer": "same_named_reviewer_with_separate_purpose_keys",
|
||||
"technical_gate_execution": "automated_fail_closed",
|
||||
"key_separation": {
|
||||
"offline_root_key": "keyring_issue_rotation_and_revocation_only",
|
||||
"operational_approval_key": "exact_release_recovery_or_rollback_evidence_only",
|
||||
"rc06_apply_service_key": "system_generated_74_item_apply_and_online_snapshot_receipts_only",
|
||||
"same_public_key_across_purposes_allowed": false
|
||||
},
|
||||
"additional_human_release_reviewers_required": false,
|
||||
"uat_member_accounts_are_reviewers": false,
|
||||
"changes_tenant_business_approval_controls": false,
|
||||
"formal_signature_or_release_authorization_recorded": false,
|
||||
"release_decision_unchanged": "NO_GO"
|
||||
},
|
||||
"source_state": {
|
||||
"observed_at": "2026-09-20T05:54:57+08:00",
|
||||
"git_head": "af091cdc4ff1751038b845bb0f3277b6d645f8f3",
|
||||
@@ -301,7 +325,7 @@
|
||||
"title": "Deploy, explicitly publish and complete two-workspace member UAT",
|
||||
"status": "waiting_for_rc04_rc05_and_external_uat_inputs",
|
||||
"dependencies": ["RC-04", "RC-05"],
|
||||
"exit": "Back up the target before migration; record both database heads; deploy exact RC image digests; explicitly approve, preview, apply and verify the 60-asset and 14-Prompt hashes; each of the 31 Golden assets has either named legal approval or a named, scoped, expiring internal-pilot risk acceptance with compensating controls and use limits, and unresolved assets cannot enter the RC-07 internal Go decision; admin plus two ordinary members in two workspaces cover each asset's applicable normal API flow and the eight core UI flows, tenant isolation, cancellation, idempotency, page continuation, worker restart, handoff and original-version preservation."
|
||||
"exit": "Back up the target before migration; record both database heads; deploy exact RC image digests; the sole named reviewer makes one batch decision bound to the exact 60-asset and 14-Prompt hashes, while the system previews, applies and verifies every item; that batch records for each of the 31 Golden assets either legal approval or a scoped, expiring internal-pilot risk acceptance with compensating controls and use limits, and unresolved assets cannot enter the RC-07 internal Go decision; admin plus two ordinary member test accounts in two workspaces cover each asset's applicable normal API flow and the eight core UI flows, tenant isolation, cancellation, idempotency, page continuation, worker restart, handoff and original-version preservation."
|
||||
},
|
||||
{
|
||||
"id": "RC-07",
|
||||
@@ -309,7 +333,7 @@
|
||||
"title": "Rehearse recovery and issue the internal release decision",
|
||||
"status": "waiting_for_rc06",
|
||||
"dependencies": ["RC-06"],
|
||||
"exit": "Restore the exact candidate into an isolated namespace; measure RPO and RTO; verify version, hashes and critical records; complete rollback and forward recovery; deliver install, upgrade, operations, rollback, release, known-limit and evidence-index documents; issue an independent internal controlled-use Go/No-Go."
|
||||
"exit": "Restore the exact candidate into an isolated namespace; measure RPO and RTO; verify version, hashes and critical records; complete rollback and forward recovery; deliver install, upgrade, operations, rollback, release, known-limit and evidence-index documents; sole named release reviewer Chen Yuqi (陈钰麒, General Manager/总经理) issues the internal controlled-use Go/No-Go after automated gates pass."
|
||||
},
|
||||
{
|
||||
"id": "RC-08",
|
||||
@@ -318,7 +342,7 @@
|
||||
"title": "Satisfy external production-release prerequisites",
|
||||
"status": "waiting_external_materials_and_production_validation",
|
||||
"dependencies": ["RC-07"],
|
||||
"exit": "Named owners approve and activate policies and consent; make an applicability decision for AI filing and labels and provide real effective identifiers where applicable; accept the production Provider and exact release; pass production preflight, TLS, secrets, monitoring, alerts, anti-abuse and fresh-backup checks; public blockers equal zero; the release owner authorizes traffic change."
|
||||
"exit": "Sole named reviewer Chen Yuqi (陈钰麒, General Manager/总经理) approves the exact policy and Provider batches; the system verifies signatures, hashes and activation evidence; make an applicability decision for AI filing and labels and provide real effective identifiers where applicable; pass production preflight, TLS, secrets, monitoring, alerts, anti-abuse and fresh-backup checks; public blockers equal zero; the same release owner separately authorizes traffic change."
|
||||
}
|
||||
],
|
||||
"execution_order": ["RC-01", "RC-02", "RC-03", "RC-04", "RC-05", "RC-06", "RC-07", "RC-08"],
|
||||
|
||||
Reference in New Issue
Block a user