docs(security): add GitHub target owner handoff [skip ci]

docs/workplans/2026-06-04-iwooos-security-governance-p0.md

@@ -23,7 +23,7 @@
 | runtime landing | 40-45% | 否 | production 只讀頁存在，不等於 runtime ingestion 或 execution router |
 | active runtime gate | 0 | 否 | 必須維持 0，直到獨立人工批准、rollback、post-check 與 guard 成立 |
 | S4.9 owner response gate | 0% | 可在收到合格回覆後調整 | 目前只定義欄位、預檢、收件與驗收，不標記 received / accepted |
-| GitHub primary readiness | 0 | 否 | primary gate 仍為 0；P1 只讀重盤工作本身目前約 64%，不代表可切 primary |
+| GitHub primary readiness | 0 | 否 | primary gate 仍為 0；P1 只讀重盤工作本身目前約 66%，不代表可切 primary |
 | Kali 112 維護準備 | 只讀證據已納管，維護尚未開始 | 否 | 不更新套件、不重啟、不 hardening、不 active scan |
 | 111 / 168 開發主機納管 | observe-only mapping 已有，維護包需補強 | 可補文件，不調 runtime | 仍不 credentialed scan、不讀未授權資料、不自動修復 |
 | VibeWork 納入 IwoooS | 前端態勢已有 onboarding 欄位，產品邊界需補規範 | 可補文件 | 保留 VibeWork 獨立產品邊界 |
@@ -147,16 +147,17 @@ S4.9 是目前 IwoooS 64% 能往前的第一優先 gate。驗收前所有 count
 |------|--------|-----------------|--------|
 | `awoooi` Gitea / GitHub refs refresh | 100% | Gitea heads `170`、GitHub heads `2`、Gitea tags `2`、GitHub tags `0`、main SHA 不一致 | 已重產 ref detail diff / ref truth classification；下一步收 S4.11 owner response |
 | Gitea public repo inventory refresh | 100% | user endpoint public-only 仍只見 `wooo/awoooi`、`wooo/ewoooc`；org endpoint 仍 blocked / 404 | 取得只讀 token 或 redacted admin export 批准 |
-| GitHub target probe refresh | 100% | 8 個候選中 5 個可讀、3 個 `not_found_or_private`；`open-design` heads `644` 只作 external scope evidence | owner / visibility / canonical response 仍待收 |
+| GitHub target probe refresh | 100% | 8 個候選中 5 個可讀、3 個 `not_found_or_private`；`open-design` heads `644` 只作 external scope evidence | P1-3 handoff 已補；owner / visibility / canonical response 仍待收 |
 | Workflow / secret 名稱本機 evidence refresh | 100% | 31 個 workflow files、42 個 unique referenced secret names、`secret_value_detected=false` | 補 webhook、runner owner、deploy key、branch protection、secret name parity |
 | Primary readiness gate 文件更新 | 90% | 已寫入 2026-06-04 refs truth 重產結果與禁止誤讀規則 | 跑 guard 後以 LOGBOOK 封存 |
 | Gitea authenticated inventory request handoff | 100% | S4.5 請求已對齊 S4.9 owner response gate，補 5 項 request dispatch preflight、8 欄 handoff packet 與送後不變條件 | 仍未收 token value、未收 payload、未 import inventory；S4.6/S4.9 驗收前不得標記 status=ok |
+| GitHub target owner response handoff | 100% | S4.10 已對齊 2026-06-04 target probe，補 6 項 target owner handoff preflight、9 欄 handoff packet 與送後不變條件 | `not_found_or_private` 不得視為不存在；received / accepted 仍 0，不建 repo、不改 visibility |
 | 全量 Gitea 專案版本盤點 | 25% | 目前仍是 public-only + 本機輔助 evidence | 需只讀 token / admin export；不使用 write credential |
 | 逐 repo refs truth queue | 100% | S4.11 current queue 已重產為 `194` refs review items：真相來源 `4`、deprecated / archive 候選 `142`、release tag `3`、GitHub-only `20` | 送 owner response；received / accepted 仍維持 0 |
 | Workflow / runner / secret parity owner response | 15% | 有 local evidence 與 template，但 received / accepted 皆 0 | 只收 redacted metadata，不收 value |
 | GitHub primary cutover readiness | 0% | `primary_ready_count=0`、`github_primary_switch_authorized=false` | 需 owner、parity、rollback ADR、人工批准全部成立 |
 
-P1 只讀重盤階段整體完成度：`64%`。它代表 freshness / inventory / handoff 工作進度，不代表 GitHub primary gate、authenticated inventory gate 或 runtime gate 提升。
+P1 只讀重盤階段整體完成度：`66%`。它代表 freshness / inventory / handoff 工作進度，不代表 GitHub primary gate、authenticated inventory gate、owner response accepted 或 runtime gate 提升。
 
 ## 6.2 規範分析：已不符合、需新增、需調整
 
@@ -179,7 +180,7 @@ P1 只讀重盤階段整體完成度：`64%`。它代表 freshness / inventory /
 |------|------|------|----------|
 | P1-1 | Source-control refs truth 重產 | 以 2026-06-04 `awoooi` refs refresh 重產 detail diff / truth classification | 新 queue 已改為 `194` items，不再引用舊 `141` 為 current |
 | P1-2 | Gitea authenticated inventory request | 已補 2026-06-04 request handoff package；S4.9 owner response gate 作先行條件，只讀 token API / redacted admin export 二選一 | 只收 metadata，不保存 token value；received / accepted / imported 全部仍為 0 |
-| P1-3 | GitHub target owner response | 對 7 個 in-scope targets 收 owner / visibility / canonical 決策 | received / accepted 前仍全部 0 |
+| P1-3 | GitHub target owner response | 已補 2026-06-04 target owner handoff package；對 7 個 in-scope targets 收 owner / visibility / canonical 決策 | received / accepted 前仍全部 0；`not_found_or_private` 不代表不存在或可建立 |
 | P1-4 | Workflow / runner / secret parity evidence | webhook、runner owner、deploy key、branch protection、CODEOWNERS、secret name parity | redacted evidence refs 完整，secret value 仍拒收 |
 | P1-5 | Primary rollback ADR 補強 | 逐 repo rollback owner、trigger、validation window、fallback role | ADR approved 前不切 primary |
 | P1-6 | AwoooP Session 同步 | 同步 commits、runs、production sanity、P1 refresh counts、gate 0 / false | 另一 Session 不再使用舊 refs count |
@@ -207,6 +208,8 @@ P1 只讀重盤階段整體完成度：`64%`。它代表 freshness / inventory /
 | P1 workflow / secret 名稱 refresh | 31 個 workflow files、42 個 unique referenced secret names、`secret_value_detected=false` |
 | P1-2 Gitea authenticated inventory request handoff | S4.5 request 日期更新為 2026-06-04；補 5 項 dispatch preflight、8 欄 request handoff packet、送後不變條件；payload received / accepted / imported 仍 0 |
 | P1-2 JSON parse / structure check | `gitea-authenticated-inventory-export-request.snapshot.json` 與 schema JSON parse 通過；本段自訂結構檢查 `GITEA_AUTHENTICATED_INVENTORY_HANDOFF_STRUCTURE_OK`；本地無 `jsonschema` / AJV，未跑完整 schema validator |
+| P1-3 GitHub target owner response handoff | S4.10 日期更新為 2026-06-04；補 6 項 target owner handoff preflight、9 欄 handoff packet、送後不變條件；received / accepted / rejected 仍 0 |
+| P1-3 JSON parse / structure check | `github-target-owner-decision-response.snapshot.json` 與 schema JSON parse 通過；本段自訂結構檢查 `GITHUB_TARGET_OWNER_HANDOFF_STRUCTURE_OK`；本地無 `jsonschema` / AJV，未跑完整 schema validator |
 | P1 JSON parse | `gitea-github-awoooi-inventory`、`github-target-probe`、`source-control-primary-readiness-gate`、`source-control-workflow-secret-name-local-evidence`、Gitea repo / search / org blocked snapshots 皆通過 |
 | P1 production 頁面檢查 | 本輪未改前端、未改 production 文案、未新增 deploy；不宣稱新的 production 狀態，沿用 P0 live sanity 作為基準 |