docs(zh-TW): bring the Traditional Chinese README up to date - #36
Conversation
The English README was corrected in #34; this closes the same gaps on the zh-TW side, and folds in the posture/provenance rows drafted in the still-open PR #29 (whose README.md half is now redundant). - OWASP Agentic coverage 4/10 -> 8/10, verified against `agentsec coverage` - Bundled scenarios: four -> eight, naming the AGT-CONFIG-* attack shapes; scenarios/ is eight worked examples - Two capability rows that had no zh-TW equivalent: static posture ingestion and run provenance - Two trust-posture bullets: a scanner's score is never a verdict, and a verdict states how it was proven - Architecture tree gains `inspect/` and `posture/` - Detection rule ids gain 100901-100904; CLI table gains `get-run` and `mcp-contract` The resource counts and the scan section were already current from #33, so they are untouched. Both READMEs now state the same facts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MhAYvfhZE3xs6KX5vWyukX
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d01d985b83
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | **發布邊界** | 唯讀的報表 gateway 只提供投影過的子集 —— 對話輪次轉為摘要值、主體轉為代號，不提供證據與稽核 URI —— 讓儀表板不會把它要回報的那次外洩再洩一次 | | ||
| | **Finding 工作流程** | `new → reproduced → fixing → regression_added → detection_added → verified → closed`，狀態轉移由程式強制 | | ||
| | **靜態態勢（posture）匯入** | 將靜態掃描工具的報告（AgentShield JSON 或 SARIF）與已探索到的表面、以及實際執行過的判定互相比對 —— 分數永遠不是判定，未能對應到任何情境的發現預設為 `not_tested` | | ||
| | **執行來源（provenance）** | 每個判定都會標示 `recorded` / `live` / `mixed`，由實際使用的執行器與證據後端推導而來 —— 用 fixture 產生的 `secure` 絕不會被誤讀成對真實 agent 驗證出來的結果 | |
There was a problem hiding this comment.
When a user follows the newly documented agentsec get-run RUN_ID path (or calls agentsec_get_run), this guarantee does not hold: those interfaces serialize the raw value from HarnessService.get_run(), and the Run model has no provenance field; provenance is only derived by the normalized report, dashboard, and JUnit paths. Consequently, a fixture-derived secure result from the single-run interface remains unlabeled and can still be mistaken for a live result, precisely contrary to this claim. Either expose provenance on the single-run paths or scope the statement to normalized reports.
Useful? React with 👍 / 👎.
| schemas/ scenario / target / evidence、專案宣告檔與發布用儀表板的 | ||
| JSON Schema —— 可攜的核心資產 | ||
| scenarios/ 情境目錄（四個完整範例） | ||
| scenarios/ 情境目錄（八個完整範例） |
There was a problem hiding this comment.
For users expecting these examples to work with the repository's offline quick start, only four are currently complete: AGT-CONFIG-001–004 explicitly exclude the shipped local fixture target, and docs/roadmap.md records their fixture recordings as still pending. Calling all eight “完整範例” obscures that half the catalogue requires a separately configured real CI/staging target; describe this as eight contracts with four runnable fixture examples, or add the missing recordings.
Useful? React with 👍 / 👎.
2 participants
What changed
Both READMEs now state the same facts. #34 corrected the English side and left
README.zh-TW.mdas the only file still carrying pre-#28 numbers; this closes that gap, and folds in the two content rows drafted in the still-open #29 — whoseREADME.mdhalf is now redundant, so #29 can be closed in favour of this.AAI001–AAI004,AAI006–AAI009)AGT-CONFIG-*attack shapes namedscenarios/inspect/, noposture/100501…100810100901–100904;get-run,mcp-contractThe resource counts (10 total / 7 published) and the whole
agentsec scansection were already brought current in #33, so they are untouched here — this is only the residue.Type
Purple coverage
Checks
agentsec coverage, not copied from the English prose4/10,四個內建,四個完整,八個資源,九個資源— zero hitsNotes for the reviewer
Two things worth a look:
README.mdhalf is what has gone stale, not this.inspect/andposture/tree descriptions are mine. I describedposture/as 靜態態勢匯入，以及哪些 finding 有情境涵蓋 — that isadapter.py+coverage.py, all the package exports.skill_assurancelives inproject/discovery.py, so I deliberately kept it out of that line.Unrelated but still open, since this PR does not address it: v0.2.0 is merged but not tagged. The tag push returns HTTP 403 from this session's proxy (ref-scope policy — branch pushes work, tag refs do not), so
git push origin v0.2.0still needs to be run from outside this session for the release workflow to fire.Generated by Claude Code