diff --git a/apps/web/messages/en.json b/apps/web/messages/en.json
index 3a2e0a316..e2f93938a 100644
--- a/apps/web/messages/en.json
+++ b/apps/web/messages/en.json
@@ -2549,6 +2549,59 @@
"guard": "not_authorization=true; approval record=false"
}
}
+ },
+ "hostOwnerDecisionRecordHumanRecordOwnerReviewCandidateOutcomes": {
+ "title": "Host Owner Decision Record Human Record Owner Review Candidate Outcome Lanes",
+ "subtitle": "Human record owner review candidate outcome lanes only display next-step routing after candidate checklist. They do not mark checklist passed, start review, mark review ready, collect owner decisions, create decision records, create approval records, or open runtime gates.",
+ "laneLabel": "Review candidate outcome",
+ "nextLabel": "Next step",
+ "items": {
+ "readyForHumanRecordOwnerReviewPreparation": {
+ "title": "Ready for human record owner review preparation candidate",
+ "body": "All candidate checklist read-only conditions can be prepared for a future human record owner review surface, but this remains a preparation candidate.",
+ "next": "display only; review started=0"
+ },
+ "identityTraceNeedsRefresh": {
+ "title": "Identity trace needs refresh",
+ "body": "Candidate identity, source outcome, version, trace pointer, or queue review link needs refresh before the next layer.",
+ "next": "refresh identity trace; check passed=0"
+ },
+ "ownerBoundaryNeedsClarification": {
+ "title": "Owner boundary needs clarification",
+ "body": "Human record owner, backup owner, contact channel, or responsibility boundary still needs clarification and cannot count as owner engagement.",
+ "next": "clarify owner boundary; decision received=0"
+ },
+ "decisionSummaryNeedsClarification": {
+ "title": "Decision summary needs clarification",
+ "body": "Candidate decision summary, risk acceptance boundary, or no-execution statement is still unclear and cannot create a formal record.",
+ "next": "clarify summary; record created=false"
+ },
+ "scopeExpiryNeedsRefresh": {
+ "title": "Scope and expiry need refresh",
+ "body": "Host, network, service, exclusion, observation intent, or expiry needs refresh before moving into the next human preparation layer.",
+ "next": "refresh scope; review ready=0"
+ },
+ "scanLimitsRemainAmbiguous": {
+ "title": "Scan limits remain ambiguous",
+ "body": "Observe-only, future active scan, or credentialed scan limits may still be mistaken for authorization and must remain routed to clarification.",
+ "next": "clarify limits; scan authorized=false"
+ },
+ "credentialBoundaryFailed": {
+ "title": "Credential boundary failed",
+ "body": "Credential owner, retention, masking, or forbidden collection failed the metadata-only boundary and must be quarantined.",
+ "next": "quarantine credential boundary; secret collection=false"
+ },
+ "maintenanceRollbackIncomplete": {
+ "title": "Maintenance and rollback incomplete",
+ "body": "Maintenance window, constraints, rollback owner, recovery path, or human contact is incomplete and cannot lead to host change.",
+ "next": "complete maintenance data; host change=false"
+ },
+ "runtimeGateStillRequired": {
+ "title": "Runtime gate still required",
+ "body": "Validation evidence, post-check metrics, or follow-up runtime gate pointer still requires an independent gate and cannot open from candidate outcome.",
+ "next": "active runtime gates=0; action buttons=false"
+ }
+ }
}
},
"tickets": {
diff --git a/apps/web/messages/zh-TW.json b/apps/web/messages/zh-TW.json
index 9f0054e00..33a0de3f9 100644
--- a/apps/web/messages/zh-TW.json
+++ b/apps/web/messages/zh-TW.json
@@ -2550,6 +2550,59 @@
"guard": "not_authorization=true;approval record=false"
}
}
+ },
+ "hostOwnerDecisionRecordHumanRecordOwnerReviewCandidateOutcomes": {
+ "title": "主機 Owner Decision Record Human Record Owner Review Candidate Outcome Lanes",
+ "subtitle": "Human record owner review candidate outcome lanes 只顯示 candidate checklist 後下一步分流。不代表 checklist passed、不開始 review、不標記 review ready、不收 owner decision、不建立 decision record、不建立 approval record、不開 runtime gate。",
+ "laneLabel": "Review candidate outcome",
+ "nextLabel": "下一步",
+ "items": {
+ "readyForHumanRecordOwnerReviewPreparation": {
+ "title": "Ready for human record owner review preparation candidate",
+ "body": "所有 candidate checklist 只讀條件都可被準備成未來人工 record owner review 畫面,但目前仍只是 preparation candidate。",
+ "next": "display only;review started=0"
+ },
+ "identityTraceNeedsRefresh": {
+ "title": "Identity trace needs refresh",
+ "body": "candidate identity、source outcome、version、trace pointer 或 queue review link 需要補齊或刷新。",
+ "next": "refresh identity trace;check passed=0"
+ },
+ "ownerBoundaryNeedsClarification": {
+ "title": "Owner boundary needs clarification",
+ "body": "human record owner、backup owner、contact channel 或責任邊界仍需釐清,不能視為 owner 已接案。",
+ "next": "clarify owner boundary;decision received=0"
+ },
+ "decisionSummaryNeedsClarification": {
+ "title": "Decision summary needs clarification",
+ "body": "候選決策摘要、風險接受邊界或 no-execution statement 仍不夠清楚,不能建立正式紀錄。",
+ "next": "clarify summary;record created=false"
+ },
+ "scopeExpiryNeedsRefresh": {
+ "title": "Scope and expiry need refresh",
+ "body": "host、network、service、exclusion、observation intent 或 expiry 需要刷新後才能進下一層人工準備。",
+ "next": "refresh scope;review ready=0"
+ },
+ "scanLimitsRemainAmbiguous": {
+ "title": "Scan limits remain ambiguous",
+ "body": "observe-only、future active scan 或 credentialed scan limits 仍可能被誤讀成授權,需要保留為阻擋分流。",
+ "next": "clarify limits;scan authorized=false"
+ },
+ "credentialBoundaryFailed": {
+ "title": "Credential boundary failed",
+ "body": "credential owner、retention、masking 或 forbidden collection 沒有維持 metadata-only 時必須隔離。",
+ "next": "quarantine credential boundary;secret collection=false"
+ },
+ "maintenanceRollbackIncomplete": {
+ "title": "Maintenance and rollback incomplete",
+ "body": "maintenance window、constraints、rollback owner、recovery path 或人工聯絡點仍缺漏,不能導向主機變更。",
+ "next": "complete maintenance data;host change=false"
+ },
+ "runtimeGateStillRequired": {
+ "title": "Runtime gate still required",
+ "body": "validation evidence、post-check metrics 或 follow-up runtime gate pointer 仍需獨立 gate,不可由 candidate outcome 開啟。",
+ "next": "active runtime gates=0;action buttons=false"
+ }
+ }
}
},
"tickets": {
diff --git a/apps/web/src/app/[locale]/iwooos/page.tsx b/apps/web/src/app/[locale]/iwooos/page.tsx
index 43bf49606..ecb34387e 100644
--- a/apps/web/src/app/[locale]/iwooos/page.tsx
+++ b/apps/web/src/app/[locale]/iwooos/page.tsx
@@ -278,6 +278,13 @@ type HostOwnerDecisionRecordHumanRecordOwnerReviewCandidateChecklistItem = {
tone: 'steady' | 'warn' | 'locked'
}
+type HostOwnerDecisionRecordHumanRecordOwnerReviewCandidateOutcomeLane = {
+ key: string
+ lane: string
+ icon: typeof ShieldCheck
+ tone: 'steady' | 'warn' | 'locked'
+}
+
const postureMetrics: PostureMetric[] = [
{ key: 'overall', value: '58%', tone: 'warn' },
{ key: 'framework', value: '80-85%', tone: 'steady' },
@@ -671,6 +678,18 @@ const hostOwnerDecisionRecordHumanRecordOwnerReviewCandidateChecklistItems: Host
{ key: 'candidateNoExecutionAttestationPresent', check: 'FRC9', icon: ListChecks, tone: 'locked' },
]
+const hostOwnerDecisionRecordHumanRecordOwnerReviewCandidateOutcomeLanes: HostOwnerDecisionRecordHumanRecordOwnerReviewCandidateOutcomeLane[] = [
+ { key: 'readyForHumanRecordOwnerReviewPreparation', lane: 'FRV1', icon: CheckCircle2, tone: 'steady' },
+ { key: 'identityTraceNeedsRefresh', lane: 'FRV2', icon: FileText, tone: 'warn' },
+ { key: 'ownerBoundaryNeedsClarification', lane: 'FRV3', icon: Bell, tone: 'warn' },
+ { key: 'decisionSummaryNeedsClarification', lane: 'FRV4', icon: ClipboardCheck, tone: 'warn' },
+ { key: 'scopeExpiryNeedsRefresh', lane: 'FRV5', icon: Radar, tone: 'warn' },
+ { key: 'scanLimitsRemainAmbiguous', lane: 'FRV6', icon: Activity, tone: 'locked' },
+ { key: 'credentialBoundaryFailed', lane: 'FRV7', icon: Lock, tone: 'locked' },
+ { key: 'maintenanceRollbackIncomplete', lane: 'FRV8', icon: Clock3, tone: 'warn' },
+ { key: 'runtimeGateStillRequired', lane: 'FRV9', icon: ShieldCheck, tone: 'locked' },
+]
+
const evidenceItems = [
'iwooos-posture-projection.snapshot.json',
'security-rollout-policy.snapshot.json',
@@ -1781,6 +1800,38 @@ function HostOwnerDecisionRecordHumanRecordOwnerReviewCandidateChecklistCard({
)
}
+function HostOwnerDecisionRecordHumanRecordOwnerReviewCandidateOutcomeCard({
+ item,
+}: {
+ item: HostOwnerDecisionRecordHumanRecordOwnerReviewCandidateOutcomeLane
+}) {
+ const t = useTranslations('iwooos.hostOwnerDecisionRecordHumanRecordOwnerReviewCandidateOutcomes')
+ const Icon = item.icon
+ return (
+
+
+
+
+ {t('laneLabel')}
+
+
{item.lane}
+
+
+ {t(`items.${item.key}.title` as never)}
+
+
+ {t(`items.${item.key}.body` as never)}
+
+
+
{t('nextLabel')}
+
+ {t(`items.${item.key}.next` as never)}
+
+
+
+ )
+}
+
export default function IwoooSPage({ params }: { params: { locale: string } }) {
const t = useTranslations('iwooos')
@@ -2439,6 +2490,28 @@ export default function IwoooSPage({ params }: { params: { locale: string } }) {
+
+
+
+ {t('hostOwnerDecisionRecordHumanRecordOwnerReviewCandidateOutcomes.title')}
+
+
+ {t('hostOwnerDecisionRecordHumanRecordOwnerReviewCandidateOutcomes.subtitle')}
+
+
+
+ {hostOwnerDecisionRecordHumanRecordOwnerReviewCandidateOutcomeLanes.map(item => (
+
+ ))}
+
+
+
None:
"s2_40_iwooos_host_owner_decision_record_human_handoff_readiness_review_outcome_lanes",
"s2_41_iwooos_host_owner_decision_record_human_record_owner_review_candidate_packets",
"s2_42_iwooos_host_owner_decision_record_human_record_owner_review_candidate_checklist",
+ "s2_43_iwooos_host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes",
]
assert_equal(
"progress_delta_ledger.delta_ids",
@@ -630,6 +631,17 @@ def validate(root: Path) -> None:
"host_decision_record_human_record_owner_review_candidate_validation_runtime_gate_separate_check",
"host_decision_record_human_record_owner_review_candidate_no_execution_attestation_present_check",
]
+ expected_iwooos_host_owner_decision_record_human_record_owner_review_candidate_outcome_lane_ids = [
+ "host_decision_record_human_record_owner_review_candidate_ready_for_human_record_owner_review_preparation_outcome_lane",
+ "host_decision_record_human_record_owner_review_candidate_identity_trace_needs_refresh_outcome_lane",
+ "host_decision_record_human_record_owner_review_candidate_owner_boundary_needs_clarification_outcome_lane",
+ "host_decision_record_human_record_owner_review_candidate_decision_summary_needs_clarification_outcome_lane",
+ "host_decision_record_human_record_owner_review_candidate_scope_expiry_needs_refresh_outcome_lane",
+ "host_decision_record_human_record_owner_review_candidate_scan_limits_ambiguous_outcome_lane",
+ "host_decision_record_human_record_owner_review_candidate_credential_boundary_failed_outcome_lane",
+ "host_decision_record_human_record_owner_review_candidate_maintenance_rollback_incomplete_outcome_lane",
+ "host_decision_record_human_record_owner_review_candidate_runtime_gate_required_outcome_lane",
+ ]
assert_equal(
"iwooos_projection.summary.frontend_surface_coverage_group_count",
iwooos_projection["summary"]["frontend_surface_coverage_group_count"],
@@ -797,6 +809,13 @@ def validate(root: Path) -> None:
],
len(expected_iwooos_host_owner_decision_record_human_record_owner_review_candidate_checklist_item_ids),
)
+ assert_equal(
+ "iwooos_projection.summary.host_owner_decision_record_human_record_owner_review_candidate_outcome_lane_count",
+ iwooos_projection["summary"][
+ "host_owner_decision_record_human_record_owner_review_candidate_outcome_lane_count"
+ ],
+ len(expected_iwooos_host_owner_decision_record_human_record_owner_review_candidate_outcome_lane_ids),
+ )
iwooos_progress = iwooos_projection["progress"]
assert_equal("iwooos_projection.progress.overall_percent", iwooos_progress["overall_percent"], progress["overall_percent"])
assert_equal(
@@ -3322,6 +3341,138 @@ def validate(root: Path) -> None:
f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_checklist_items.{item['item_id']}.not_authorization",
item["not_authorization"],
)
+ iwooos_host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes = iwooos_projection[
+ "host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes"
+ ]
+ assert_equal(
+ "iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.ids",
+ [
+ item["lane_id"]
+ for item in iwooos_host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes
+ ],
+ expected_iwooos_host_owner_decision_record_human_record_owner_review_candidate_outcome_lane_ids,
+ )
+ assert_equal(
+ "iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.display_order",
+ [
+ item["display_order"]
+ for item in iwooos_host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes
+ ],
+ list(
+ range(
+ 1,
+ len(expected_iwooos_host_owner_decision_record_human_record_owner_review_candidate_outcome_lane_ids)
+ + 1,
+ )
+ ),
+ )
+ expected_iwooos_host_owner_decision_record_human_record_owner_review_candidate_outcome_states = [
+ "ready_for_human_record_owner_review_preparation_candidate",
+ "identity_trace_needs_refresh",
+ "owner_boundary_needs_clarification",
+ "decision_summary_needs_clarification",
+ "scope_expiry_needs_refresh",
+ "scan_limits_remain_ambiguous",
+ "credential_boundary_failed",
+ "maintenance_rollback_incomplete",
+ "runtime_gate_still_required",
+ ]
+ assert_equal(
+ "iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.outcome_states",
+ [
+ item["outcome_state"]
+ for item in iwooos_host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes
+ ],
+ expected_iwooos_host_owner_decision_record_human_record_owner_review_candidate_outcome_states,
+ )
+ for item in iwooos_host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes:
+ assert_equal(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.display_mode",
+ item["display_mode"],
+ "owner_decision_record_human_record_owner_review_candidate_outcome_only",
+ )
+ assert_equal(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.human_record_owner_review_check_passed_count",
+ item["human_record_owner_review_check_passed_count"],
+ 0,
+ )
+ assert_equal(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.human_record_owner_review_started_count",
+ item["human_record_owner_review_started_count"],
+ 0,
+ )
+ assert_equal(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.human_record_owner_review_ready_count",
+ item["human_record_owner_review_ready_count"],
+ 0,
+ )
+ assert_equal(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.human_record_owner_handoff_review_passed_count",
+ item["human_record_owner_handoff_review_passed_count"],
+ 0,
+ )
+ assert_equal(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.human_record_owner_handoff_started_count",
+ item["human_record_owner_handoff_started_count"],
+ 0,
+ )
+ assert_equal(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.human_record_owner_handoff_ready_count",
+ item["human_record_owner_handoff_ready_count"],
+ 0,
+ )
+ assert_equal(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.formal_record_queue_review_passed_count",
+ item["formal_record_queue_review_passed_count"],
+ 0,
+ )
+ assert_equal(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.formal_record_queue_enqueued_count",
+ item["formal_record_queue_enqueued_count"],
+ 0,
+ )
+ assert_false(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.decision_record_created",
+ item["decision_record_created"],
+ )
+ assert_equal(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.owner_decision_received_count",
+ item["owner_decision_received_count"],
+ 0,
+ )
+ assert_equal(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.owner_decision_accepted_count",
+ item["owner_decision_accepted_count"],
+ 0,
+ )
+ assert_false(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.owner_approval_record_created",
+ item["owner_approval_record_created"],
+ )
+ assert_false(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.runtime_gate_opened",
+ item["runtime_gate_opened"],
+ )
+ assert_false(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.raw_payload_allowed",
+ item["raw_payload_allowed"],
+ )
+ assert_false(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.secret_value_collection_allowed",
+ item["secret_value_collection_allowed"],
+ )
+ assert_false(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.runtime_execution_authorized",
+ item["runtime_execution_authorized"],
+ )
+ assert_false(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.action_buttons_allowed",
+ item["action_buttons_allowed"],
+ )
+ assert_true(
+ f"iwooos_projection.host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes.{item['lane_id']}.not_authorization",
+ item["not_authorization"],
+ )
assert_equal(
"iwooos_projection.non_blocking_lane_ids",
iwooos_projection["non_blocking_lane_ids"],
@@ -3373,6 +3524,7 @@ def validate(root: Path) -> None:
"display_host_owner_decision_record_human_handoff_readiness_review_outcome_lanes",
"display_host_owner_decision_record_human_record_owner_review_candidate_packets",
"display_host_owner_decision_record_human_record_owner_review_candidate_checklist",
+ "display_host_owner_decision_record_human_record_owner_review_candidate_outcome_lanes",
"display_evidence_refs",
"display_forbidden_actions",
]:
@@ -3506,6 +3658,13 @@ def validate(root: Path) -> None:
"collect_owner_decision_from_human_record_owner_review_candidate_checklist",
"create_host_owner_decision_record_from_human_record_owner_review_candidate_checklist",
"open_runtime_gate_from_human_record_owner_review_candidate_checklist",
+ "treat_host_owner_decision_record_human_record_owner_review_candidate_outcome_as_approval",
+ "mark_human_record_owner_review_candidate_outcome_passed",
+ "start_human_record_owner_review_from_candidate_outcome",
+ "mark_human_record_owner_review_ready_from_candidate_outcome",
+ "collect_owner_decision_from_human_record_owner_review_candidate_outcome",
+ "create_host_owner_decision_record_from_human_record_owner_review_candidate_outcome",
+ "open_runtime_gate_from_human_record_owner_review_candidate_outcome",
"apply_runtime_blocking_control",
"switch_github_primary",
"production_deploy",