fix(awooop): clarify controlled automation boundaries

apps/web/src/lib/__tests__/public-security-redaction.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'vitest'
+
+import { publicBoundaryText } from '../public-security-redaction'
+
+describe('publicBoundaryText controlled automation wording', () => {
+  it('renders runtime false as controlled automation boundary evidence', () => {
+    const text = publicBoundaryText('runtime_execution_authorized=false')
+
+    expect(text).toContain('AI controlled apply')
+    expect(text).toContain('critical / break-glass')
+    expect(text).not.toContain('執行期操作未授權')
+  })
+
+  it('keeps action button false from becoming a manual stop state', () => {
+    const text = publicBoundaryText('action_buttons_allowed=false')
+
+    expect(text).toContain('AI controlled work item')
+    expect(text).toContain('check-mode')
+    expect(text).toContain('verifier')
+  })
+
+  it('treats owner response zero as evidence instead of an apply blocker', () => {
+    const text = publicBoundaryText('owner_response_accepted_count=0')
+
+    expect(text).toContain('evidence')
+    expect(text).toContain('不阻擋 controlled apply')
+  })
+})

apps/web/src/lib/public-security-redaction.ts

@@ -27,11 +27,19 @@ export function publicBoundaryText(value: string): string {
     "security_compliance_rollout_enforcement_enabled=false": "強制執行尚未開放。",
   };
   if (labels[redacted]) return labels[redacted];
-  if (redacted.includes("runtime_execution_authorized=false")) return "執行期操作未授權。";
-  if (redacted.includes("action_buttons_allowed=false")) return "此頁不提供可執行操作按鈕。";
+  if (redacted.includes("runtime_execution_authorized=false")) {
+    return "低 / 中 / 高風險已走 AI controlled apply；此 false 僅標示 critical / break-glass 或外部來源切換未開放。";
+  }
+  if (redacted.includes("action_buttons_allowed=false")) {
+    return "此頁不放直接危險按鈕；AI controlled work item 仍由 check-mode、rollback 與 verifier 推進。";
+  }
   if (redacted.includes("active_runtime_gate_count=0")) return "執行期閘門維持關閉。";
-  if (redacted.includes("owner_response_validation_received_count=0")) return "負責人回覆尚未收到。";
-  if (redacted.includes("owner_response_validation_accepted_count=0")) return "負責人回覆尚未接受。";
+  if (redacted.includes("owner_response_validation_received_count=0")) {
+    return "負責人回覆尚未收到；僅作 evidence，不阻擋低 / 中 / 高風險 AI controlled apply。";
+  }
+  if (redacted.includes("owner_response_validation_accepted_count=0")) {
+    return "負責人回覆尚未接受；僅作 evidence，不作為 controlled automation 終局。";
+  }
   if (redacted.includes("owner_response_validation_rejected_count=0")) return "目前沒有正式拒收紀錄。";
   if (redacted.includes("repo_creation_authorized=false")) return "未核准建立專案庫或修改可見性。";
   if (redacted.includes("refs_mutation_authorized=false") || redacted.includes("refs_sync_authorized=false")) {
@@ -43,7 +51,9 @@ export function publicBoundaryText(value: string): string {
   if (redacted.includes("secret_value_collection_allowed=false")) return "不得收集或顯示任何機密明文值。";
   if (redacted.includes("github_primary_switch_authorized=false")) return "GitHub primary 尚未核准切換。";
   if (redacted.includes("gitea_disablement_authorized=false")) return "Gitea 不得停用，仍是目前 CI/CD 來源。";
-  if (redacted.includes("execution_router_linked=false")) return "尚未連接執行路由。";
+  if (redacted.includes("execution_router_linked=false")) {
+    return "此只讀面板不直連執行路由；可回滾變更由 AI controlled queue 與 verifier 接手。";
+  }
   if (redacted.includes("security_run_created=false") || redacted.includes("github_primary_run_created=false")) {
     return "目前沒有建立資安執行 run。";
   }
@@ -60,7 +70,9 @@ export function publicBoundaryText(value: string): string {
   if (redacted.includes("nginx_reload_authorized=false")) return "未核准 Nginx reload 或公開入口變更。";
   if (redacted.includes("agent_bounty_runtime_authorized=false")) return "agent-bounty-protocol 執行期維持關閉。";
   if (redacted.includes("github_primary_approval_granted=false")) return "GitHub primary 尚未獲得審批。";
-  if (redacted.includes("owner_response_accepted_count=0")) return "負責人回覆接受數仍為 0。";
+  if (redacted.includes("owner_response_accepted_count=0")) {
+    return "負責人回覆接受數仍為 0；這是歷史/evidence 欄位，不阻擋 controlled apply。";
+  }
   if (redacted.includes("_count=0")) return "目前計數仍為 0，僅供只讀觀測。";
   if (redacted.includes("=false")) return "目前狀態為未授權，僅供只讀觀測。";
   return redacted;