docs(security): 新增高價值配置 owner request 草稿包 [skip ci]

docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET-INTAKE-PREFLIGHT.md

@@ -15,6 +15,12 @@
 
 本階段仍不是 request sent、不是 owner response received、不是 accepted record、不是 reviewer queue write，也不是 Nginx reload、DNS / TLS 變更、workflow 修改、host write、active scan、agent-bounty runtime、payout / withdrawal 或 production write 授權。
 
+## 1.1 2026-06-14 Request Draft
+
+已新增 `docs/security/HIGH-VALUE-CONFIG-OWNER-REQUEST-DRAFT.md` 與 `docs/security/high-value-config-owner-request-draft.snapshot.json`，將三包預檢結果轉成人工送件前可核對的 request draft 與 handoff envelope。
+
+目前固定為 `request_draft_count=3`、`c0_request_draft_count=2`、`handoff_envelope_field_count=11`、`required_owner_field_total=27`、`forbidden_payload_count=12`。此 artifact 只表示草稿包已準備，不代表 request sent、recipient confirmed、audit event emitted、owner response received、reviewer accepted、queue write、runtime execution、Nginx reload、DNS / TLS 變更、workflow 修改、host write、active scan 或 production write。
+
 ## 2. 目前摘要
 
 | 指標 | 值 | 說明 |

docs/security/HIGH-VALUE-CONFIG-OWNER-PACKET.md

@@ -33,6 +33,12 @@ P0.2 已能將變更分類成 C0 / C1 / C2 / C3。本文件與工具負責下一
 
 目前固定為 `dispatch_preflight_check_count=9`、`reviewer_intake_lane_count=5`、`required_owner_field_total=27`、`blocked_request_count=16`。此 artifact 只表示收件框架已準備，不代表 request sent、owner response received、reviewer accepted、queue write、runtime execution、Nginx reload、DNS / TLS 變更、workflow 修改、host write、active scan 或 production write。
 
+## 1.3 2026-06-14 Request draft
+
+已新增 `docs/security/HIGH-VALUE-CONFIG-OWNER-REQUEST-DRAFT.md` 與 `docs/security/high-value-config-owner-request-draft.snapshot.json`，將三包收件預檢轉成人工送件前可核對的 request draft。
+
+目前固定為 `request_draft_count=3`、`c0_request_draft_count=2`、`handoff_envelope_field_count=11`、`required_owner_field_total=27`、`forbidden_payload_count=12`。此 artifact 只表示草稿包已準備，不代表 request sent、recipient confirmed、audit event emitted、owner response received、reviewer accepted、queue write、runtime execution、Nginx reload、DNS / TLS 變更、workflow 修改、host write、active scan 或 production write。
+
 ## 2. Canonical 欄位
 
 高價值配置 packet 對齊 S4.9 canonical owner response envelope，使用以下欄位：

docs/security/HIGH-VALUE-CONFIG-OWNER-REQUEST-DRAFT.md

@@ -0,0 +1,98 @@
+# IwoooS 高價值配置 Owner Request 草稿包
+
+| 項目 | 內容 |
+|------|------|
+| 日期 | 2026-06-14 |
+| 狀態 | `owner_request_draft_ready_not_dispatched` |
+| 工具 | `scripts/security/high-value-config-owner-request-draft.py` |
+| 輸入 | `docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json` |
+| Snapshot | `docs/security/high-value-config-owner-request-draft.snapshot.json` |
+| runtime gate | `0` |
+
+## 1. 目的
+
+本文件承接高價值配置 Owner Packet 收件預檢，將三包 owner packet 轉成可人工核對的 request draft 與 handoff envelope。它只負責固定未來送件前的內容格式、禁止 payload 與送後不變條件。
+
+本階段仍不是 request sent、不是 recipient confirmed、不是 owner response received、不是 reviewer accepted、不是 audit event emitted，也不是 Nginx reload、DNS / TLS 變更、workflow 修改、host write、active scan、agent-bounty runtime、payout / withdrawal 或 production write 授權。
+
+## 2. 草稿摘要
+
+| 指標 | 值 | 說明 |
+|------|----|------|
+| request draft count | `3` | DNS / TLS / certbot、Nginx public gateway、security evidence tooling |
+| C0 request draft count | `2` | DNS / TLS / certbot 與 Nginx public gateway |
+| handoff envelope field count | `11` | 送件前交接封套欄位 |
+| required owner field total | `27` | 三包各九欄 |
+| forbidden payload count | `12` | token、secret、private key、cookie、session、raw sensitive live config 等 |
+| blocked request count | `16` | repo / refs / workflow / runner / host / scan / runtime / payout 等要求全部拒收 |
+| request sent | `0` | 尚未送 request |
+| recipient confirmed | `0` | 尚未確認收件角色 |
+| audit event emitted | `0` | 尚未建立送件稽核事件 |
+| received / accepted / rejected | `0 / 0 / 0` | 尚未收到或驗收任何 owner response |
+| runtime gate | `0` | 未開啟 |
+
+## 3. Handoff Envelope
+
+| 欄位 | 內容規則 |
+|------|----------|
+| `request_id` | 固定對應高價值配置 owner request，不建立 runtime action id |
+| `stage_id` | 固定 `P0-14` |
+| `packet_id` | 對應來源 owner packet |
+| `recipient_role_or_team` | 只填 role / team；不得填 token、cookie、session 或私人聯絡資訊 |
+| `sender_role_or_team` | 只填送件操作角色；不得把 AwoooP approval 視為資安批准 |
+| `requested_response_window` | 可填人工約定窗口；空值不得阻擋 `0 / false` gate |
+| `allowed_response_format` | 只接受九個 canonical owner 欄位與允許 decision |
+| `redacted_evidence_refs` | 僅指向既有文件、snapshot、ticket id、hash 或 quarantine pointer |
+| `forbidden_payloads` | secret、repo archive、DB dump、runner token、raw sensitive live config 等全部拒收 |
+| `followup_owner` | 只記後續補證 role / team |
+| `not_approval` | 必須為 `true` |
+
+## 4. 三包草稿
+
+| Request | Priority | Control tier | 邊界 |
+|---------|----------|--------------|------|
+| `high_value_config_owner_request:dns_tls_certbot` | `P0` | `C0` | 只要求 domain / TLS / certbot owner 補件，不代表 certbot renew、DNS 變更或 public HTTPS route change |
+| `high_value_config_owner_request:nginx_public_gateway` | `P0` | `C0` | 只要求 Nginx public gateway owner 補件，不代表 live conf 讀取、`nginx -t`、reload 或 route change |
+| `high_value_config_owner_request:security_evidence_tooling` | `P3` | `C3` | 只要求文件 / snapshot / guard 類證據補件，不代表 runtime gate 提升 |
+
+## 5. 送後不變條件
+
+即使未來真的由人工送出 request，也只能在有可稽核送件 metadata 後，另行記錄真實 `request_sent_count`。不得因草稿、送件、AwoooP approval、UI 可見或 CD success 同步拉高 received / accepted / rejected、reviewer queue、runtime gate 或 action button。
+
+送件後仍需經過：
+
+1. owner response 收件預檢。
+2. 敏感 payload 隔離。
+3. 執行要求拒收。
+4. 跨包一致性檢查。
+5. reviewer validation。
+6. security acceptance record。
+7. 獨立人工 runtime approval、維護窗口、rollback 與 post-check。
+
+## 6. 指令
+
+產生 committed snapshot：
+
+```bash
+python3 scripts/security/high-value-config-owner-request-draft.py \
+  --root . \
+  --intake-preflight-report docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json \
+  --output docs/security/high-value-config-owner-request-draft.snapshot.json \
+  --generated-at 2026-06-14T18:45:00+08:00
+```
+
+驗證 guard：
+
+```bash
+python3 scripts/security/security-mirror-progress-guard.py --root .
+```
+
+## 7. 完成度
+
+| 工作 | 完成度 | 說明 |
+|------|--------|------|
+| request draft artifact | `100%` | 產生器、snapshot 與文件已固定 |
+| request dispatch | `0%` | 尚未送 owner request |
+| owner response received | `0%` | 尚未收到正式回覆 |
+| reviewer accepted | `0%` | 尚未建立 security acceptance record |
+| runtime gate | `0%` | 未授權且未開啟 |

docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md

@@ -7,7 +7,7 @@
 | 本階段完成 | 資安供應鏈 contract manifest + Source Control Approval Board + Draft Reconcile Plan + Ref Detail Diff + Ref Truth Classification + Source Control Ref Truth Owner Response 收件包 + GitHub Primary Readiness Gate + GitHub Primary Rollback ADR + GitHub Target Owner Decision Response 收件包 + Gitea 認證清冊匯出請求 + Gitea 認證清冊匯入驗收契約 + Gitea 清冊覆蓋 Owner Attestation + Gitea Owner Attestation Approval Lane 對齊 + Gitea Owner Attestation Response 收件包 + Workflow / Secret Name Inventory + Workflow / Secret Name Local Evidence + Workflow / Secret Name Redacted Export Request + Workflow / Secret Name Owner Response 收件包 + Source Control Owner Response Validation Rollup + Kali 112 live integration status + Security Finding contract + Kali scan scope approval package + Security Approval Queue + S3 人工批准 Gate + S3 人工決策紀錄 + S3 人工審查封包 + S3 人工決策狀態轉移 + S3 後續 runtime gate 準備契約 + 鏡像 readiness index + 鏡像接收計畫 + 鏡像事件信封 + 鏡像路由矩陣 + 鏡像驗收契約 + 鏡像隔離契約 + 鏡像 dry-run 報告契約 + 鏡像狀態彙整契約 + IwoooS 前端態勢入口 + IwoooS posture projection contract + IwoooS 既有前端資安頁面整合 + IwoooS 覆蓋與邊界矩陣 + IwoooS 只讀資安處理旅程 + IwoooS owner evidence readiness board + IwoooS host coverage view + IwoooS host action gate matrix + IwoooS host evidence readiness board + IwoooS host evidence collection order + IwoooS host evidence intake preflight + IwoooS host evidence review outcome lanes + IwoooS host evidence review handoff packets + IwoooS host evidence reviewer checklist + IwoooS host evidence reviewer outcome lanes + IwoooS host owner decision candidate packets + IwoooS host owner decision review checklist + IwoooS host owner decision review outcome lanes + IwoooS host owner decision record draft packets + IwoooS host owner decision record draft review checklist + IwoooS host owner decision record draft review outcome lanes + IwoooS host owner decision record write-up packets + IwoooS host owner decision record write-up review checklist + IwoooS host owner decision record write-up review outcome lanes + IwoooS host owner decision record formal candidate packets + IwoooS host owner decision record formal candidate review checklist + IwoooS host owner decision record formal candidate review outcome lanes + IwoooS host owner decision record formal record queue packets + IwoooS host owner decision record formal record queue review checklist + IwoooS host owner decision record formal record queue review outcome lanes + IwoooS host owner decision record human handoff readiness packets + IwoooS host owner decision record human handoff readiness review checklist + IwoooS host owner decision record human handoff readiness review outcome lanes + IwoooS host owner decision record human record owner review candidate packets + IwoooS host owner decision record human record owner review candidate checklist + IwoooS host owner decision record human record owner review candidate outcome lanes + IwoooS host owner decision record human record owner review preparation packets + IwoooS host owner decision record human record owner review preparation checklist + IwoooS progress acceleration lanes + IwoooS owner response next-action focus + IwoooS S4.9 owner response preflight + IwoooS S4.9 owner response request templates + IwoooS progress hold movement gates + IwoooS AwoooP read-only landing readiness + IwoooS AwoooP cross-session handoff packets + AwoooP 首頁 IwoooS 資安鏡像候選 + AwoooP 工作鏈路 IwoooS 資安鏡像候選 + AwoooP 審批佇列 IwoooS owner response 只讀焦點 |
 | 本階段追加 | AwoooP 合約儀表板 IwoooS 資安契約只讀候選 + AwoooP 租戶管理 IwoooS 資安租戶範圍只讀候選 + AwoooP 執行監控 IwoooS 執行狀態只讀候選 + 既有安全 / 合規頁面 IwoooS 只讀反向橋接 + 告警 / 錯誤 / 授權 / 治理頁面 IwoooS 只讀反向橋接 + 稽核 / 工程審查頁面 IwoooS 深色只讀反向橋接 + IwoooS 前端資安頁面連接狀態板 + IwoooS GitHub 主要來源就緒度只讀狀態板 + AwoooP 工作鏈路 GitHub 主要來源就緒度只讀工作項 + AwoooP 合約儀表板 GitHub 主要來源就緒度合約只讀候選 + AwoooP 審批佇列 GitHub 主要來源就緒度審批邊界 + AwoooP 首頁 GitHub 主要來源就緒度只讀摘要 + AwoooP 租戶管理 GitHub 主要來源就緒度租戶範圍 + AwoooP 執行監控 GitHub 主要來源就緒度執行邊界 + IwoooS / AwoooP 資安可視區塊繁體中文呈現防護檢查 + AwoooP 執行詳情 / 審批詳情繁體中文呈現防護檢查 + AwoooP 首頁負責人回覆驗收總覽 + AwoooP 工作鏈路負責人回覆驗收只讀工作項 + AwoooP 合約儀表板負責人回覆驗收契約只讀候選 + AwoooP 審批佇列負責人回覆驗收只讀審查邊界 + AwoooP 租戶管理負責人回覆驗收租戶範圍 + AwoooP 執行監控負責人回覆驗收執行邊界 + AwoooP 執行詳情負責人回覆驗收詳情邊界 + AwoooP 審批決策負責人回覆驗收審批邊界 + IwoooS AwoooP 資安入口覆蓋狀態板 + IwoooS 階段式資安收斂節奏圖 + IwoooS 下一步人工收件作戰板 + IwoooS 人工回覆安全驗收閘道 + IwoooS 人工回覆審查結果分流 + IwoooS 人工決策準備佇列 + IwoooS 人工決策紀錄草稿防誤用 + IwoooS 人工決策正式紀錄負責人指派確認準備包 + IwoooS 人工決策正式紀錄負責人指派確認清單 + IwoooS 人工決策正式紀錄負責人指派確認結果分流 + IwoooS 人工決策正式紀錄負責人指派決策準備包 + IwoooS 人工決策正式紀錄負責人指派決策檢查清單 + IwoooS S4.9 負責人回覆封套欄位 + IwoooS S4.9 負責人回覆封套送件前檢查 + IwoooS S4.9 負責人回覆封套送件前結果分流 + IwoooS S4.9 負責人回覆送件請求草稿 + IwoooS S4.9 負責人回覆送件鏈路摘要 + IwoooS 低摩擦分階段收斂主控 + IwoooS 低摩擦下一步行動邊界 + IwoooS 64% 進度移動訊號驗收條 + IwoooS 第一個進度解鎖路徑 + IwoooS 第一解鎖證據包 + IwoooS 第一解鎖證據包預檢分流 + IwoooS 第一解鎖證據包補件路徑 + IwoooS 第一解鎖證據包補件送審前檢查 + IwoooS 第一解鎖證據包補件送審結果分流 + IwoooS 第一解鎖證據包 reviewer 指派準備包 + IwoooS 第一解鎖證據包 reviewer 指派前檢查 + IwoooS 第一解鎖證據包 reviewer 指派前檢查結果分流 + IwoooS 正式只讀 landing 與 Kali 112 只讀證據進度重估 |
 | 本階段追加補充 | IwoooS 目前具體工作地圖 + IwoooS 目前具體交付清單 + IwoooS 目前阻塞與解除條件 + IwoooS 三軸進度與全產品套用範圍 + IwoooS 全產品分階段套用台帳 + IwoooS 全產品 rollout 波次驗收門檻 + IwoooS 全產品 rollout 驗收結果分流 + IwoooS 全產品證據接線地圖 + IwoooS 全產品證據接線預檢 + IwoooS 全產品證據接線預檢結果分流 + IwoooS 全產品預檢補件回收台帳 + IwoooS 全產品補件重試門檻 + IwoooS 全產品重試結果分流 + IwoooS 全產品人工審查候選準備 + IwoooS 全產品人工審查候選預檢 + IwoooS 全產品人工審查候選預檢結果分流 + IwoooS 全產品人工審查候選預檢補件回收台帳 + IwoooS 全產品人工審查候選預檢補件重試門檻 + IwoooS 全產品只讀套用快照 + P2-145 owner response acceptance gate 正式驗證完成 |
-| P0 追加 | IwoooS P0 配置控管優先序前台正式驗證完成；Nginx public gateway、DNS / TLS / certbot、K8s / ArgoCD / production manifests、Workflow / runner / secret metadata、Public / admin / API runtime config、agent-bounty runtime / treasury 六類先列為即時風險配置；高價值配置 Gate 已補上 `k8s/nginx/**`、`scripts/ops/**/*cert*`、`scripts/ops/**/*tls*`，sample 從 `matched=0 / C0=0` 收斂到 `matched=3 / C0=2`；Gate 預設工作樹 preflight 已可讀取 staged / unstaged / untracked，本地 smoke 對臨時 `k8s/nginx/*` 檔命中 C0；Owner Packet snapshot 已同步為 `packets=3 / c0=2`，Coverage snapshot 已同步最新 patterns；IwoooS / AwoooP 前台 Owner Packet 摘要已正式驗證 `packet=3 / c0=2`，feature commit `e999c16b`、deploy marker `16c6b983`、Gitea code-review `2973` / CD `2972` success；IwoooS posture projection snapshot / schema / guard 已同步 `packet=3 / c0=2`，不再保留舊 `1 / 0` 口徑；高價值配置 Owner Packet 收件預檢已新增 `checks=9 / lanes=5 / required_fields=27 / blocked_requests=16`；owner response / live evidence / runtime gate / action buttons 仍全部為 0 |
+| P0 追加 | IwoooS P0 配置控管優先序前台正式驗證完成；Nginx public gateway、DNS / TLS / certbot、K8s / ArgoCD / production manifests、Workflow / runner / secret metadata、Public / admin / API runtime config、agent-bounty runtime / treasury 六類先列為即時風險配置；高價值配置 Gate 已補上 `k8s/nginx/**`、`scripts/ops/**/*cert*`、`scripts/ops/**/*tls*`，sample 從 `matched=0 / C0=0` 收斂到 `matched=3 / C0=2`；Gate 預設工作樹 preflight 已可讀取 staged / unstaged / untracked，本地 smoke 對臨時 `k8s/nginx/*` 檔命中 C0；Owner Packet snapshot 已同步為 `packets=3 / c0=2`，Coverage snapshot 已同步最新 patterns；IwoooS / AwoooP 前台 Owner Packet 摘要已正式驗證 `packet=3 / c0=2`，feature commit `e999c16b`、deploy marker `16c6b983`、Gitea code-review `2973` / CD `2972` success；IwoooS posture projection snapshot / schema / guard 已同步 `packet=3 / c0=2`，不再保留舊 `1 / 0` 口徑；高價值配置 Owner Packet 收件預檢已新增 `checks=9 / lanes=5 / required_fields=27 / blocked_requests=16`；高價值配置 Owner Request 草稿包已新增 `drafts=3 / handoff_fields=11 / forbidden_payloads=12 / sent=0`；owner response / live evidence / runtime gate / action buttons 仍全部為 0 |
 | 原則 | 低摩擦分階段；文件、schema、read-only evidence 優先；不做 runtime enforcement、不切 primary |
 | P0 主控板 | `docs/workplans/2026-06-04-iwooos-security-governance-p0.md` |
 
@@ -388,6 +388,7 @@ headline 要再往上，需要 S4.9 / S4.10 / S4.11 / S4.12 任一 owner respons
 | 高價值配置 Owner Packet 前台同步 | 正式驗證完成 | `/iwooos` 與 `/awooop` 已同步 owner packet snapshot，顯示 `packet=3 / c0=2`、Nginx public gateway、DNS / TLS / certbot 與 security tooling 影響範圍；feature commit `e999c16b`、deploy marker `16c6b983`、Gitea code-review `2973` / CD `2972` success；本地與正式 desktop / mobile / in-app browser smoke 已確認必要文字與 boundary keys 可見、水平溢位 `0`、卡片內操作控制 `0`、危險連結 `0`、工作溝通片語命中 `0` | 這是前台 read-only projection 對齊，不是 owner request sent、owner response received / accepted、Nginx reload、certbot renew、DNS / TLS probe、workflow 修改、secret rotation、agent-bounty runtime、host write、active scan、production write 或 runtime gate；headline 仍不提高 |
 | IwoooS posture projection Owner Packet 數字同步 | 本地完成 | `iwooos-posture-projection.snapshot.json`、`iwooos_posture_projection_v1.schema.json` 與 `security-mirror-progress-guard.py` 已同步 `high_value_config_owner_packet_count=3`、`high_value_config_owner_packet_c0_packet_count=2` | 這是 committed evidence / schema / guard drift closure，不是前端 bundle、CD、runtime gate、owner request sent、owner response received / accepted 或 production write；不需要 production browser smoke |
 | 高價值配置 Owner Packet 收件預檢 | 本地完成 | `high-value-config-owner-packet-intake-preflight.snapshot.json` 已固定 `packet_count=3`、`c0_packet_count=2`、`dispatch_preflight_check_count=9`、`reviewer_intake_lane_count=5`、`required_owner_field_total=27`、`blocked_request_count=16`，並由 `security-mirror-progress-guard.py` 鎖住 packet ids、check ids、lane ids 與 false flags | 這是 request dispatch 前的只讀預檢與 reviewer intake lanes，不是 request sent、owner response received / accepted、reviewer queue write、Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate；不需要 production browser smoke |
+| 高價值配置 Owner Request 草稿包 | 本地完成 | `high-value-config-owner-request-draft.snapshot.json` 已固定 `request_draft_count=3`、`c0_request_draft_count=2`、`handoff_envelope_field_count=11`、`required_owner_field_total=27`、`forbidden_payload_count=12`、`request_sent_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 request ids、handoff fields 與 false flags | 這是人工送件前草稿與 handoff envelope，不是 request sent、recipient confirmed、audit event emitted、owner response received / accepted、reviewer queue write、Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate；不需要 production browser smoke |
 | S3 approval gate | 進行中 | `security_approval_gate_v1` 已建立 8 個人工 gate items：7 pending、1 block candidate、0 approved | 不得繞過人工批准；批准後仍需 follow-up runtime gate |
 | S3.0 人工批准 Gate 契約 | 完成草案 | 定義批准範圍、決策選項、required reviewers、still forbidden 與 follow-up runtime gate | AwoooP 可記錄決策，不可執行 gate item |
 | S3.1 人工決策紀錄契約 | 完成草案 | `security_approval_decision_record_v1` 已建立；目前 0 筆 decision records、0 個 runtime action 授權 | AwoooP 可稽核決策，不可把決策當執行 |

docs/security/high-value-config-owner-request-draft.snapshot.json

@@ -0,0 +1,406 @@
+{
+  "execution_boundaries": {
+    "action_buttons_allowed": false,
+    "active_scan_authorized": false,
+    "audit_event_emitted": false,
+    "dispatch_authorized": false,
+    "dns_tls_change_authorized": false,
+    "host_write_authorized": false,
+    "nginx_reload_authorized": false,
+    "not_authorization": true,
+    "production_write_authorized": false,
+    "recipient_confirmed": false,
+    "request_sent": false,
+    "reviewer_queue_write": false,
+    "runtime_execution_authorized": false,
+    "secret_value_collection_allowed": false,
+    "workflow_modification_authorized": false
+  },
+  "forbidden_payloads": [
+    "token",
+    "secret",
+    "private_key",
+    "cookie",
+    "session",
+    "authorization_header",
+    "runner_token",
+    "webhook_secret",
+    "db_dump",
+    "repo_archive",
+    "git_object_pack",
+    "raw_sensitive_live_config"
+  ],
+  "generated_at": "2026-06-14T18:45:00+08:00",
+  "git_commit": "ddd9e433",
+  "handoff_envelope_fields": [
+    "request_id",
+    "stage_id",
+    "packet_id",
+    "recipient_role_or_team",
+    "sender_role_or_team",
+    "requested_response_window",
+    "allowed_response_format",
+    "redacted_evidence_refs",
+    "forbidden_payloads",
+    "followup_owner",
+    "not_approval"
+  ],
+  "not_approval_statement": "本草稿不是 request sent、不是 owner response received、不是 reviewer accepted、不是 Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate 授權。",
+  "request_drafts": [
+    {
+      "accepted_response": false,
+      "action_buttons_allowed": false,
+      "affected_files": [
+        "scripts/ops/188-registry-certbot-fix.sh",
+        "scripts/ops/fix-188-registry-certbot-renewal.sh"
+      ],
+      "allowed_response_format": {
+        "allowed_decisions": [
+          "confirm",
+          "defer",
+          "reject",
+          "request_more_evidence"
+        ],
+        "fields": [
+          "owner_role_or_team",
+          "decision",
+          "decision_reason",
+          "affected_scope",
+          "redacted_evidence_refs",
+          "followup_owner",
+          "rollback_owner",
+          "maintenance_window",
+          "validation_plan"
+        ],
+        "redacted_evidence_refs_only": true
+      },
+      "audit_event_emitted": false,
+      "blocked_requests": [
+        "repo_create",
+        "visibility_change",
+        "refs_sync",
+        "refs_delete",
+        "force_push",
+        "workflow_modify",
+        "runner_enable",
+        "secret_value_submit",
+        "ssh_host_modify",
+        "nginx_reload",
+        "dns_tls_modify",
+        "argocd_sync",
+        "kubectl_apply",
+        "active_scan",
+        "agent_bounty_runtime_execute",
+        "payout_or_withdrawal"
+      ],
+      "category_id": "dns_tls_certbot",
+      "control_tier": "C0",
+      "followup_owner": "pending_followup_owner",
+      "forbidden_payloads": [
+        "token",
+        "secret",
+        "private_key",
+        "cookie",
+        "session",
+        "authorization_header",
+        "runner_token",
+        "webhook_secret",
+        "db_dump",
+        "repo_archive",
+        "git_object_pack",
+        "raw_sensitive_live_config"
+      ],
+      "handoff_envelope_fields": [
+        "request_id",
+        "stage_id",
+        "packet_id",
+        "recipient_role_or_team",
+        "sender_role_or_team",
+        "requested_response_window",
+        "allowed_response_format",
+        "redacted_evidence_refs",
+        "forbidden_payloads",
+        "followup_owner",
+        "not_approval"
+      ],
+      "label": "DNS / TLS / certbot / certificate path",
+      "not_approval": true,
+      "not_approval_statement": "本草稿不是 request sent、不是 owner response received、不是 reviewer accepted、不是 Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate 授權。",
+      "packet_id": "high_value_config_owner_packet:dns_tls_certbot",
+      "priority": "P0",
+      "production_write_authorized": false,
+      "received_response": false,
+      "recipient_confirmed": false,
+      "recipient_role_or_team": "pending_owner_role_or_team",
+      "redacted_evidence_refs": [
+        "docs/security/high-value-config-owner-packet.snapshot.json",
+        "docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json"
+      ],
+      "rejected_response": false,
+      "request_id": "high_value_config_owner_request:dns_tls_certbot",
+      "request_sent": false,
+      "requested_response_window": "not_scheduled",
+      "required_gate": "domain_tls_owner_response_required",
+      "required_validation": [
+        "domain_inventory",
+        "certificate_path_check",
+        "renewal_window",
+        "acme_path_smoke",
+        "public_https_smoke",
+        "rollback_ref"
+      ],
+      "reviewer_queue_write": false,
+      "runtime_gate": false,
+      "secret_value_collection_allowed": false,
+      "sender_role_or_team": "iwooos_security_reviewer",
+      "stage_id": "P0-14",
+      "status": "draft_not_dispatched"
+    },
+    {
+      "accepted_response": false,
+      "action_buttons_allowed": false,
+      "affected_files": [
+        "k8s/nginx/awoooi-prod.conf"
+      ],
+      "allowed_response_format": {
+        "allowed_decisions": [
+          "confirm",
+          "defer",
+          "reject",
+          "request_more_evidence"
+        ],
+        "fields": [
+          "owner_role_or_team",
+          "decision",
+          "decision_reason",
+          "affected_scope",
+          "redacted_evidence_refs",
+          "followup_owner",
+          "rollback_owner",
+          "maintenance_window",
+          "validation_plan"
+        ],
+        "redacted_evidence_refs_only": true
+      },
+      "audit_event_emitted": false,
+      "blocked_requests": [
+        "repo_create",
+        "visibility_change",
+        "refs_sync",
+        "refs_delete",
+        "force_push",
+        "workflow_modify",
+        "runner_enable",
+        "secret_value_submit",
+        "ssh_host_modify",
+        "nginx_reload",
+        "dns_tls_modify",
+        "argocd_sync",
+        "kubectl_apply",
+        "active_scan",
+        "agent_bounty_runtime_execute",
+        "payout_or_withdrawal"
+      ],
+      "category_id": "nginx_public_gateway",
+      "control_tier": "C0",
+      "followup_owner": "pending_followup_owner",
+      "forbidden_payloads": [
+        "token",
+        "secret",
+        "private_key",
+        "cookie",
+        "session",
+        "authorization_header",
+        "runner_token",
+        "webhook_secret",
+        "db_dump",
+        "repo_archive",
+        "git_object_pack",
+        "raw_sensitive_live_config"
+      ],
+      "handoff_envelope_fields": [
+        "request_id",
+        "stage_id",
+        "packet_id",
+        "recipient_role_or_team",
+        "sender_role_or_team",
+        "requested_response_window",
+        "allowed_response_format",
+        "redacted_evidence_refs",
+        "forbidden_payloads",
+        "followup_owner",
+        "not_approval"
+      ],
+      "label": "Nginx / reverse proxy / public route",
+      "not_approval": true,
+      "not_approval_statement": "本草稿不是 request sent、不是 owner response received、不是 reviewer accepted、不是 Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate 授權。",
+      "packet_id": "high_value_config_owner_packet:nginx_public_gateway",
+      "priority": "P0",
+      "production_write_authorized": false,
+      "received_response": false,
+      "recipient_confirmed": false,
+      "recipient_role_or_team": "pending_owner_role_or_team",
+      "redacted_evidence_refs": [
+        "docs/security/high-value-config-owner-packet.snapshot.json",
+        "docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json"
+      ],
+      "rejected_response": false,
+      "request_id": "high_value_config_owner_request:nginx_public_gateway",
+      "request_sent": false,
+      "requested_response_window": "not_scheduled",
+      "required_gate": "public_gateway_owner_response_required",
+      "required_validation": [
+        "rendered_diff",
+        "nginx_t",
+        "affected_route_smoke",
+        "admin_route_smoke_if_affected",
+        "acme_path_smoke_if_affected",
+        "rollback_ref"
+      ],
+      "reviewer_queue_write": false,
+      "runtime_gate": false,
+      "secret_value_collection_allowed": false,
+      "sender_role_or_team": "iwooos_security_reviewer",
+      "stage_id": "P0-14",
+      "status": "draft_not_dispatched"
+    },
+    {
+      "accepted_response": false,
+      "action_buttons_allowed": false,
+      "affected_files": [
+        "docs/security/HIGH-VALUE-CONFIG-CHANGE-GATE.md",
+        "docs/security/high-value-config-change-gate.snapshot.json",
+        "scripts/security/high-value-config-change-gate.py"
+      ],
+      "allowed_response_format": {
+        "allowed_decisions": [
+          "confirm",
+          "defer",
+          "reject",
+          "request_more_evidence"
+        ],
+        "fields": [
+          "owner_role_or_team",
+          "decision",
+          "decision_reason",
+          "affected_scope",
+          "redacted_evidence_refs",
+          "followup_owner",
+          "rollback_owner",
+          "maintenance_window",
+          "validation_plan"
+        ],
+        "redacted_evidence_refs_only": true
+      },
+      "audit_event_emitted": false,
+      "blocked_requests": [
+        "repo_create",
+        "visibility_change",
+        "refs_sync",
+        "refs_delete",
+        "force_push",
+        "workflow_modify",
+        "runner_enable",
+        "secret_value_submit",
+        "ssh_host_modify",
+        "nginx_reload",
+        "dns_tls_modify",
+        "argocd_sync",
+        "kubectl_apply",
+        "active_scan",
+        "agent_bounty_runtime_execute",
+        "payout_or_withdrawal"
+      ],
+      "category_id": "security_evidence_tooling",
+      "control_tier": "C3",
+      "followup_owner": "pending_followup_owner",
+      "forbidden_payloads": [
+        "token",
+        "secret",
+        "private_key",
+        "cookie",
+        "session",
+        "authorization_header",
+        "runner_token",
+        "webhook_secret",
+        "db_dump",
+        "repo_archive",
+        "git_object_pack",
+        "raw_sensitive_live_config"
+      ],
+      "handoff_envelope_fields": [
+        "request_id",
+        "stage_id",
+        "packet_id",
+        "recipient_role_or_team",
+        "sender_role_or_team",
+        "requested_response_window",
+        "allowed_response_format",
+        "redacted_evidence_refs",
+        "forbidden_payloads",
+        "followup_owner",
+        "not_approval"
+      ],
+      "label": "Security evidence / snapshot / guard tooling",
+      "not_approval": true,
+      "not_approval_statement": "本草稿不是 request sent、不是 owner response received、不是 reviewer accepted、不是 Nginx reload、DNS / TLS change、workflow 修改、host write、active scan、production write 或 runtime gate 授權。",
+      "packet_id": "high_value_config_owner_packet:security_evidence_tooling",
+      "priority": "P3",
+      "production_write_authorized": false,
+      "received_response": false,
+      "recipient_confirmed": false,
+      "recipient_role_or_team": "pending_owner_role_or_team",
+      "redacted_evidence_refs": [
+        "docs/security/high-value-config-owner-packet.snapshot.json",
+        "docs/security/high-value-config-owner-packet-intake-preflight.snapshot.json"
+      ],
+      "rejected_response": false,
+      "request_id": "high_value_config_owner_request:security_evidence_tooling",
+      "request_sent": false,
+      "requested_response_window": "not_scheduled",
+      "required_gate": "security_evidence_owner_review_required",
+      "required_validation": [
+        "snapshot_parse",
+        "guard_smoke",
+        "doc_secret_sanity",
+        "no_runtime_gate_increase"
+      ],
+      "reviewer_queue_write": false,
+      "runtime_gate": false,
+      "secret_value_collection_allowed": false,
+      "sender_role_or_team": "iwooos_security_reviewer",
+      "stage_id": "P0-14",
+      "status": "draft_not_dispatched"
+    }
+  ],
+  "schema_version": "high_value_config_owner_request_draft_v1",
+  "send_after_conditions": [
+    "必須先重新確認 gitea/main、P0 總帳與另一個 AwoooP Session 基線。",
+    "只能送出脫敏欄位與禁止條款，不得附 secret value、raw payload 或執行命令。",
+    "只有真實人工送件 metadata 存在時，才能另行記錄 request_sent_count。",
+    "送件後不得同步拉高 received / accepted / rejected / reviewer queue / runtime gate。"
+  ],
+  "source_intake_preflight_schema_version": "high_value_config_owner_packet_intake_preflight_v1",
+  "source_intake_preflight_status": "request_dispatch_preflight_ready",
+  "status": "owner_request_draft_ready_not_dispatched",
+  "summary": {
+    "accepted_response_count": 0,
+    "action_button_count": 0,
+    "audit_event_emitted_count": 0,
+    "blocked_request_count": 16,
+    "c0_request_draft_count": 2,
+    "c1_request_draft_count": 0,
+    "dispatch_preflight_check_count": 9,
+    "forbidden_payload_count": 12,
+    "handoff_envelope_field_count": 11,
+    "received_response_count": 0,
+    "recipient_confirmed_count": 0,
+    "rejected_response_count": 0,
+    "request_draft_count": 3,
+    "request_sent_count": 0,
+    "required_owner_field_total": 27,
+    "reviewer_intake_lane_count": 5,
+    "reviewer_queue_write_count": 0,
+    "runtime_gate_count": 0
+  }
+}