Merge remote-tracking branch 'gitea-ssh/main' into codex/github-redacted-evidence-validator-20260627

# Conflicts:
#	docs/LOGBOOK.md

apps/api/src/services/awoooi_status_cleanup_dashboard.py

@@ -1,10 +1,10 @@
 """
 AWOOOI Status Cleanup dashboard snapshot.
 
-Loads the read-only dashboard that combines status cleanup preflight, owner
-review, owner response preflight, dry-run execution plan, apply gate, and
-artifact sync readback. This module never writes memory, syncs raw Codex app
-data, fetches repos, modifies workflows, queries Wazuh live APIs, or authorizes
+Loads the dashboard that combines status cleanup preflight, controlled owner
+acknowledgements, dry-run package readiness, apply boundaries, and artifact
+sync readback. This module never writes memory, syncs raw Codex app data,
+fetches repos, modifies workflows, queries Wazuh live APIs, or authorizes
 runtime writes.
 """
 
@@ -19,6 +19,7 @@ from src.services.snapshot_paths import default_operations_dir
 _DEFAULT_OPERATIONS_DIR = default_operations_dir(Path(__file__))
 _SNAPSHOT_PATTERN = "awoooi-status-cleanup-dashboard.snapshot.json"
 _SCHEMA_VERSION = "awoooi_status_cleanup_dashboard_v1"
+_CONTROLLED_STATUS = "controlled_status_cleanup_package_ready"
 
 
 def load_latest_awoooi_status_cleanup_dashboard(
@@ -80,8 +81,10 @@ def _require_summary(payload: dict[str, Any], label: str) -> None:
     actions = payload.get("next_actions") or []
     if payload.get("target_route") != "/workspace/status-cleanup":
         raise ValueError(f"{label}: target_route must remain /workspace/status-cleanup")
-    if summary.get("dashboard_status") != "blocked_status_cleanup_apply_not_authorized":
-        raise ValueError(f"{label}: dashboard_status must remain blocked")
+    if summary.get("dashboard_status") != _CONTROLLED_STATUS:
+        raise ValueError(
+            f"{label}: dashboard_status must remain {_CONTROLLED_STATUS}"
+        )
     if summary.get("gate_count") != len(gates):
         raise ValueError(f"{label}: gate_count mismatch")
     if summary.get("blocked_gate_count") != sum(1 for item in gates if item.get("blocked") is True):
@@ -101,6 +104,31 @@ def _require_summary(payload: dict[str, Any], label: str) -> None:
             raise ValueError(f"{label}: summary.{flag} must remain false")
     if summary.get("gate_count") != 5:
         raise ValueError(f"{label}: dashboard must contain five status cleanup gates")
+    if summary.get("blocked_gate_count") != 0:
+        raise ValueError(f"{label}: controlled dashboard gates must be unblocked")
+    controlled_counts = {
+        "accepted_owner_flag_count": "required_owner_flag_count",
+        "approved_update_section_count": "required_update_section_count",
+        "approved_target_path_count": "target_path_count",
+        "boundary_ack_count": "required_boundary_ack_count",
+    }
+    mismatched_counts = sorted(
+        key
+        for key, required_key in controlled_counts.items()
+        if summary.get(key) != summary.get(required_key)
+    )
+    if mismatched_counts:
+        raise ValueError(
+            f"{label}: controlled acknowledgements incomplete: {mismatched_counts}"
+        )
+    for flag in (
+        "controlled_status_cleanup_package_ready",
+        "controlled_owner_acknowledgements_ready",
+        "controlled_dry_run_package_ready",
+        "controlled_post_apply_verifier_required",
+    ):
+        if summary.get(flag) is not True:
+            raise ValueError(f"{label}: summary.{flag} must remain true")
     if summary.get("wazuh_handoff_status") != "blocked_not_released":
         raise ValueError(f"{label}: Wazuh handoff status must remain blocked")
     if summary.get("wazuh_handoff_base_commit") != "b540fc0c":