docs(security): add GitHub target owner handoff [skip ci]

docs/security/GITHUB-TARGET-OWNER-DECISION-RESPONSE.md

@@ -2,8 +2,8 @@
 
 | 項目 | 內容 |
 |------|------|
-| 日期 | 2026-05-17 |
-| 狀態 | 草案，等待 owner response |
+| 日期 | 2026-06-04 |
+| 狀態 | 草案與 P1-3 handoff 已整理，等待 owner response |
 | 資料契約 | `docs/schemas/github_target_owner_decision_response_v1.schema.json` |
 | 快照 | `docs/security/github-target-owner-decision-response.snapshot.json` |
 | 來源契約 | `github_target_decision_v1` |
@@ -44,6 +44,56 @@ S4.10 不是 repo creation approval、不是 visibility change approval、不是
 | 授權切換 GitHub primary | `false` |
 | 允許收集 secret value | `false` |
 | 允許 action button | `false` |
+| P1-3 handoff package | `ready` |
+| request dispatch authorized | `false` |
+| `not_found_or_private` 當不存在 | `false` |
+
+## 1.0 2026-06-04 P1-3 GitHub Target Owner Handoff
+
+本段把 S4.10 從「收件包已定義」推到「P1-3 可交接請 owner 逐項回覆」。這是 handoff readiness，不是 request sent、不是 owner response received、不是 repo 建立或 visibility 變更批准。S4.9 owner response gate 與 P1-2 Gitea authenticated inventory request handoff 仍是前置依賴；未通過前不得把 GitHub target decision 視為可執行。
+
+| 指標 | 值 |
+|------|----|
+| P1-3 handoff package | ready |
+| handoff completion | 100% |
+| request dispatch authorized | false |
+| target probe candidates | 8 |
+| approval-required targets | 7 |
+| external scope summary target | `nexu-io/open-design` |
+| `not_found_or_private` targets | 3 |
+| owner response received | 0 |
+| owner response accepted | 0 |
+| repo creation authorized | false |
+| visibility change authorized | false |
+
+### 1.0.1 送件前檢查
+
+| 順序 | 檢查項 | 完成條件 | 目前狀態 |
+|------|--------|----------|----------|
+| 1 | 基線同步 | 送件前確認 `gitea/main`、GitHub target probe、S4.9 / P1-2 最新狀態 | 已定義，未送件 |
+| 2 | 七個 target 範圍 | 只向 7 個 approval-required targets 收 owner / visibility / canonical 回覆 | 已定義，未送件 |
+| 3 | external scope 摘要 | `nexu-io/open-design` 只作 external scope evidence，不納入 AWOOOI target approval queue | 已定義，未送件 |
+| 4 | `not_found_or_private` 語意 | 只能表示 read-only probe 看不到；不得視為 repo 不存在或可直接建立 | 已定義，未送件 |
+| 5 | 回覆欄位 | 必須有 owner role/team、decision、reason、canonical source、target disposition、visibility review owner、redacted evidence refs | 已定義，未送件 |
+| 6 | 執行要求拒收 | repo creation、visibility change、refs sync、workflow / secret 修改、primary switch 全部 hard reject | 已定義，未送件 |
+
+### 1.0.2 交接封套欄位
+
+| 欄位 | 內容規則 |
+|------|----------|
+| `request_id` | `p1_3_github_target_owner_response_handoff` |
+| `stage_id` | `S4.10` |
+| `prerequisite_gates` | S4.9 owner response gate、P1-2 Gitea authenticated inventory request handoff |
+| `requested_templates` | 只引用本文件第 3 節七個 template id |
+| `target_probe_summary` | 8 個 candidates、5 個 exists、3 個 `not_found_or_private`、1 個 external scope summary |
+| `recipient_role_or_team` | 只填 role / team，不收個人敏感資料或 credential |
+| `required_response_fields` | owner role/team、decision、decision reason、canonical source、target disposition、visibility review owner、redacted evidence refs、followup owner |
+| `forbidden_inputs` | token、secret、private key、private clone URL credential、repo archive、git object pack、API request body |
+| `not_approval` | 必須為 `true` |
+
+### 1.0.3 送件後不變條件
+
+即使後續 owner 實際回覆，也只能先進 S4.10 intake preflight 與 reviewer validation。通過後可更新 read-only GitHub target decision table、approval package、approval board 與 readiness wording；不得直接建立 repo、修改 visibility、sync / delete refs、force push、改 workflow / secret、切 GitHub primary 或停用 Gitea。
 
 ## 1.1 Owner Response Request Packet
 

docs/security/github-target-owner-decision-response.snapshot.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "github_target_owner_decision_response_v1",
   "status": "draft_waiting_owner_response",
-  "date": "2026-05-17",
+  "date": "2026-06-04",
   "mode": "owner_decision_response_intake_only",
   "runtime_execution_authorized": false,
   "source_contract": "github_target_decision_v1",
@@ -37,8 +37,116 @@
     "refs_sync_authorized": false,
     "github_primary_switch_authorized": false,
     "secret_value_collection_allowed": false,
-    "action_buttons_allowed": false
+    "action_buttons_allowed": false,
+    "target_owner_handoff_package_ready": true,
+    "target_owner_handoff_completion_percent": 100,
+    "target_owner_handoff_check_count": 6,
+    "target_owner_handoff_packet_field_count": 9,
+    "target_owner_request_dispatch_authorized": false,
+    "not_found_or_private_as_absent_allowed": false,
+    "repo_creation_allowed_without_owner_response": false,
+    "visibility_change_allowed_without_owner_response": false,
+    "github_target_owner_response_handoff_not_approval": true
   },
+  "target_owner_handoff_preflight_checks": [
+    {
+      "check_id": "p1-3-baseline-sync",
+      "display_order": 1,
+      "check": "送件前確認 gitea/main、GitHub target probe、S4.9 / P1-2 最新狀態。",
+      "current_status": "defined_not_dispatched",
+      "execution_authorized": false
+    },
+    {
+      "check_id": "p1-3-seven-target-scope",
+      "display_order": 2,
+      "check": "只向 7 個 approval-required targets 收 owner / visibility / canonical 回覆。",
+      "current_status": "defined_not_dispatched",
+      "execution_authorized": false
+    },
+    {
+      "check_id": "p1-3-external-scope-summary",
+      "display_order": 3,
+      "check": "nexu-io/open-design 只作 external scope evidence，不納入 AWOOOI target approval queue。",
+      "current_status": "defined_not_dispatched",
+      "execution_authorized": false
+    },
+    {
+      "check_id": "p1-3-not-found-or-private-semantics",
+      "display_order": 4,
+      "check": "not_found_or_private 只能表示 read-only probe 看不到；不得視為 repo 不存在或可直接建立。",
+      "current_status": "defined_not_dispatched",
+      "execution_authorized": false
+    },
+    {
+      "check_id": "p1-3-required-owner-fields",
+      "display_order": 5,
+      "check": "必須有 owner role/team、decision、reason、canonical source、target disposition、visibility review owner、redacted evidence refs。",
+      "current_status": "defined_not_dispatched",
+      "execution_authorized": false
+    },
+    {
+      "check_id": "p1-3-execution-request-rejected",
+      "display_order": 6,
+      "check": "repo creation、visibility change、refs sync、workflow / secret 修改、primary switch 全部 hard reject。",
+      "current_status": "defined_not_dispatched",
+      "execution_authorized": false
+    }
+  ],
+  "target_owner_handoff_packet": {
+    "request_id": "p1_3_github_target_owner_response_handoff",
+    "stage_id": "S4.10",
+    "prerequisite_gates": [
+      "S4.9 owner response gate",
+      "P1-2 Gitea authenticated inventory request handoff"
+    ],
+    "requested_templates": [
+      "target-awoooi-refs-blocked",
+      "target-clawbot-v5-refs-blocked",
+      "target-wooo-aiops-refs-blocked",
+      "target-wooo-infra-config-internal-remote",
+      "target-ewoooc-private-or-new",
+      "target-bitan-pharmacy-private-or-new",
+      "target-tsenyang-website-private-or-new"
+    ],
+    "target_probe_summary": {
+      "candidate_count": 8,
+      "exists_count": 5,
+      "not_found_or_private_count": 3,
+      "external_scope_summary_repo": "nexu-io/open-design"
+    },
+    "recipient_role_or_team_required": true,
+    "required_response_fields": [
+      "owner_role_or_team",
+      "decision",
+      "decision_reason",
+      "canonical_source",
+      "github_target_disposition",
+      "visibility_review_owner",
+      "redacted_evidence_refs",
+      "followup_owner"
+    ],
+    "forbidden_inputs": [
+      "token_value",
+      "secret_value",
+      "private_key",
+      "private_clone_url_credential",
+      "repo_archive",
+      "git_object_pack",
+      "api_request_body",
+      "repo_creation_command",
+      "visibility_change_command",
+      "refs_sync_or_delete_request",
+      "github_primary_switch_request"
+    ],
+    "not_approval": true,
+    "execution_authorized": false
+  },
+  "post_dispatch_invariants": [
+    "Owner response 到來後仍需先進 S4.10 intake preflight 與 reviewer validation。",
+    "not_found_or_private 不得自動視為 repo 不存在或可建立。",
+    "通過後只可更新 read-only target decision table、approval package、approval board 與 readiness wording。",
+    "不得直接建立 repo、修改 visibility、sync/delete refs、force push、改 workflow / secret、切 GitHub primary 或停用 Gitea。"
+  ],
   "owner_response_request_packet": {
     "request_id": "s4_10_github_target_owner_decision_response_request",
     "display_status": "ready_to_request_owner_response",