diff --git a/apps/web/messages/en.json b/apps/web/messages/en.json index b401af7a9..16af755f7 100644 --- a/apps/web/messages/en.json +++ b/apps/web/messages/en.json @@ -2342,6 +2342,54 @@ "guard": "active runtime gates=0; action buttons=false" } } + }, + "hostOwnerDecisionRecordHumanHandoffReadinessReview": { + "title": "Host Owner Decision Record Human Handoff Readiness Review Checklist", + "subtitle": "Human handoff readiness review checklist only displays read-only checks before handoff readiness packets can be reviewed by a future human record owner. It does not mark review passed, start handoff, mark handoff ready, create decision records, accept owner decisions, or open runtime gates.", + "checkLabel": "Handoff readiness check", + "guardLabel": "Guardrail", + "items": { + "identityTraceReadable": { + "title": "Identity trace readable", + "body": "Confirms candidate record id, version, source outcome lane, source queue review, and trace pointer are readable; gaps can only route back to identity trace refresh.", + "guard": "handoff started=0; ready=0" + }, + "ownerBoundaryReadable": { + "title": "Owner boundary readable", + "body": "Confirms future record owner, backup owner, contact point, and responsibility boundary are readable without sending notifications or collecting owner decisions.", + "guard": "owner decision received=0" + }, + "decisionSummaryReadable": { + "title": "Decision summary readable", + "body": "Confirms decision summary, candidate conclusion, and no-execution statement are readable so handoff readiness cannot be mistaken for approval.", + "guard": "decision record created=false" + }, + "scopeExpiryCurrent": { + "title": "Scope and expiry current", + "body": "Confirms host, network, service, exclusion, observation intent, and expiry are current and in scope; stale scope can only route back to scope refresh.", + "guard": "review passed=0" + }, + "scanLimitsNotAuthorization": { + "title": "Scan limits not authorization", + "body": "Confirms observe-only, future active scan, and credentialed scan limits remain constraint wording, not scan approval.", + "guard": "scan authorized=false" + }, + "credentialBoundaryMetadataOnly": { + "title": "Credential boundary metadata-only", + "body": "Confirms credential boundary only contains metadata, retention, and masking responsibility without plaintext, token values, or raw secrets.", + "guard": "secret collection=false" + }, + "maintenanceRollbackTraceable": { + "title": "Maintenance and rollback traceable", + "body": "Confirms maintenance window, constraints, rollback owner, recovery path, and human contact are traceable while still disallowing SSH, package updates, or host tuning.", + "guard": "host change=false" + }, + "runtimeGateSeparate": { + "title": "Runtime gate separate", + "body": "Confirms validation evidence and follow-up runtime gate remain independent and cannot open from readiness review.", + "guard": "active runtime gates=0; action buttons=false" + } + } } }, "tickets": { diff --git a/apps/web/messages/zh-TW.json b/apps/web/messages/zh-TW.json index 15e8a1c57..8c74a4f12 100644 --- a/apps/web/messages/zh-TW.json +++ b/apps/web/messages/zh-TW.json @@ -2343,6 +2343,54 @@ "guard": "active runtime gates=0；action buttons=false" } } + }, + "hostOwnerDecisionRecordHumanHandoffReadinessReview": { + "title": "主機 Owner Decision Record Human Handoff Readiness Review Checklist", + "subtitle": "Human handoff readiness review checklist 只顯示 handoff readiness packets 進人工 record owner 前的只讀核對條件。不代表 review passed、不開始 handoff、不標記 handoff ready、不建立 decision record、不接受 owner decision、不開 runtime gate。", + "checkLabel": "Handoff readiness check", + "guardLabel": "保護邊界", + "items": { + "identityTraceReadable": { + "title": "Identity trace readable", + "body": "確認 candidate record id、版本、來源 outcome lane、source queue review 與 trace pointer 可讀；缺漏時只能回補 identity trace。", + "guard": "handoff started=0；ready=0" + }, + "ownerBoundaryReadable": { + "title": "Owner boundary readable", + "body": "確認 future record owner、backup owner、聯絡窗口與責任邊界可讀；不能自動通知或收 owner decision。", + "guard": "owner decision received=0" + }, + "decisionSummaryReadable": { + "title": "Decision summary readable", + "body": "確認 decision summary、候選結論與 no-execution statement 可讀，避免 handoff readiness 被誤讀成批准。", + "guard": "decision record created=false" + }, + "scopeExpiryCurrent": { + "title": "Scope and expiry current", + "body": "確認 host、network、service、exclusion、觀察目的與 expiry 沒有過期或越界；過期時只能回補 scope。", + "guard": "review passed=0" + }, + "scanLimitsNotAuthorization": { + "title": "Scan limits not authorization", + "body": "確認 observe-only、future active scan 與 credentialed scan limits 仍只是限制文字，不是掃描批准。", + "guard": "scan authorized=false" + }, + "credentialBoundaryMetadataOnly": { + "title": "Credential boundary metadata-only", + "body": "確認 credential boundary 只含 metadata、retention 與 masking 責任；不得收 plaintext、token value 或 raw secret。", + "guard": "secret collection=false" + }, + "maintenanceRollbackTraceable": { + "title": "Maintenance and rollback traceable", + "body": "確認維護窗口、限制條件、rollback owner、復原路徑與人工聯絡點可追溯，但仍不能 SSH、更新套件或調校主機。", + "guard": "host change=false" + }, + "runtimeGateSeparate": { + "title": "Runtime gate separate", + "body": "確認 validation evidence 與 follow-up runtime gate 仍維持獨立，不由 readiness review 開啟。", + "guard": "active runtime gates=0；action buttons=false" + } + } } }, "tickets": { diff --git a/apps/web/src/app/[locale]/iwooos/page.tsx b/apps/web/src/app/[locale]/iwooos/page.tsx index 274cc47d3..6f87eac3d 100644 --- a/apps/web/src/app/[locale]/iwooos/page.tsx +++ b/apps/web/src/app/[locale]/iwooos/page.tsx @@ -250,6 +250,13 @@ type HostOwnerDecisionRecordHumanHandoffReadinessPacket = { tone: 'steady' | 'warn' | 'locked' } +type HostOwnerDecisionRecordHumanHandoffReadinessReviewItem = { + key: string + check: string + icon: typeof ShieldCheck + tone: 'steady' | 'warn' | 'locked' +} + const postureMetrics: PostureMetric[] = [ { key: 'overall', value: '58%', tone: 'warn' }, { key: 'framework', value: '80-85%', tone: 'steady' }, @@ -596,6 +603,17 @@ const hostOwnerDecisionRecordHumanHandoffReadinessPackets: HostOwnerDecisionReco { key: 'handoffRuntimeGate', packet: 'FHO8', icon: ShieldCheck, tone: 'locked' }, ] +const hostOwnerDecisionRecordHumanHandoffReadinessReviewItems: HostOwnerDecisionRecordHumanHandoffReadinessReviewItem[] = [ + { key: 'identityTraceReadable', check: 'FHC1', icon: FileText, tone: 'warn' }, + { key: 'ownerBoundaryReadable', check: 'FHC2', icon: Bell, tone: 'warn' }, + { key: 'decisionSummaryReadable', check: 'FHC3', icon: ClipboardCheck, tone: 'warn' }, + { key: 'scopeExpiryCurrent', check: 'FHC4', icon: Radar, tone: 'warn' }, + { key: 'scanLimitsNotAuthorization', check: 'FHC5', icon: Activity, tone: 'locked' }, + { key: 'credentialBoundaryMetadataOnly', check: 'FHC6', icon: Lock, tone: 'locked' }, + { key: 'maintenanceRollbackTraceable', check: 'FHC7', icon: Clock3, tone: 'warn' }, + { key: 'runtimeGateSeparate', check: 'FHC8', icon: ShieldCheck, tone: 'locked' }, +] + const evidenceItems = [ 'iwooos-posture-projection.snapshot.json', 'security-rollout-policy.snapshot.json', @@ -1578,6 +1596,38 @@ function HostOwnerDecisionRecordHumanHandoffReadinessCard({ ) } +function HostOwnerDecisionRecordHumanHandoffReadinessReviewCard({ + item, +}: { + item: HostOwnerDecisionRecordHumanHandoffReadinessReviewItem +}) { + const t = useTranslations('iwooos.hostOwnerDecisionRecordHumanHandoffReadinessReview') + const Icon = item.icon + return ( +
+
+
+ + {t('checkLabel')} +
+ {item.check} +
+

+ {t(`items.${item.key}.title` as never)} +

+

+ {t(`items.${item.key}.body` as never)} +

+
+
{t('guardLabel')}
+
+ {t(`items.${item.key}.guard` as never)} +
+
+
+ ) +} + export default function IwoooSPage({ params }: { params: { locale: string } }) { const t = useTranslations('iwooos') @@ -2150,6 +2200,26 @@ export default function IwoooSPage({ params }: { params: { locale: string } }) { +
+
+

{t('hostOwnerDecisionRecordHumanHandoffReadinessReview.title')}

+

+ {t('hostOwnerDecisionRecordHumanHandoffReadinessReview.subtitle')} +

+
+
+ {hostOwnerDecisionRecordHumanHandoffReadinessReviewItems.map(item => ( + + ))} +
+
+
None: "s2_36_iwooos_host_owner_decision_record_formal_record_queue_review_checklist", "s2_37_iwooos_host_owner_decision_record_formal_record_queue_review_outcome_lanes", "s2_38_iwooos_host_owner_decision_record_human_handoff_readiness_packets", + "s2_39_iwooos_host_owner_decision_record_human_handoff_readiness_review_checklist", ] assert_equal( "progress_delta_ledger.delta_ids", @@ -583,6 +584,16 @@ def validate(root: Path) -> None: "host_decision_record_handoff_readiness_maintenance_rollback_packet", "host_decision_record_handoff_readiness_runtime_gate_packet", ] + expected_iwooos_host_owner_decision_record_human_handoff_readiness_review_checklist_item_ids = [ + "host_decision_record_handoff_readiness_review_identity_trace_readable_check", + "host_decision_record_handoff_readiness_review_owner_boundary_readable_check", + "host_decision_record_handoff_readiness_review_decision_summary_readable_check", + "host_decision_record_handoff_readiness_review_scope_expiry_current_check", + "host_decision_record_handoff_readiness_review_scan_limits_not_authorization_check", + "host_decision_record_handoff_readiness_review_credential_boundary_metadata_only_check", + "host_decision_record_handoff_readiness_review_maintenance_rollback_traceable_check", + "host_decision_record_handoff_readiness_review_runtime_gate_separate_check", + ] assert_equal( "iwooos_projection.summary.frontend_surface_coverage_group_count", iwooos_projection["summary"]["frontend_surface_coverage_group_count"], @@ -728,6 +739,11 @@ def validate(root: Path) -> None: iwooos_projection["summary"]["host_owner_decision_record_human_handoff_readiness_packet_count"], len(expected_iwooos_host_owner_decision_record_human_handoff_readiness_packet_ids), ) + assert_equal( + "iwooos_projection.summary.host_owner_decision_record_human_handoff_readiness_review_checklist_item_count", + iwooos_projection["summary"]["host_owner_decision_record_human_handoff_readiness_review_checklist_item_count"], + len(expected_iwooos_host_owner_decision_record_human_handoff_readiness_review_checklist_item_ids), + ) iwooos_progress = iwooos_projection["progress"] assert_equal("iwooos_projection.progress.overall_percent", iwooos_progress["overall_percent"], progress["overall_percent"]) assert_equal( @@ -2780,6 +2796,115 @@ def validate(root: Path) -> None: f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.{item['packet_id']}.not_authorization", item["not_authorization"], ) + iwooos_host_owner_decision_record_human_handoff_readiness_review_checklist_items = iwooos_projection[ + "host_owner_decision_record_human_handoff_readiness_review_checklist_items" + ] + assert_equal( + "iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.ids", + [item["item_id"] for item in iwooos_host_owner_decision_record_human_handoff_readiness_review_checklist_items], + expected_iwooos_host_owner_decision_record_human_handoff_readiness_review_checklist_item_ids, + ) + assert_equal( + "iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.display_order", + [item["display_order"] for item in iwooos_host_owner_decision_record_human_handoff_readiness_review_checklist_items], + list( + range( + 1, + len(expected_iwooos_host_owner_decision_record_human_handoff_readiness_review_checklist_item_ids) + 1, + ) + ), + ) + expected_iwooos_host_owner_decision_record_human_handoff_readiness_review_conditions = [ + "identity_trace_readable", + "owner_boundary_readable", + "decision_summary_readable", + "scope_expiry_current", + "scan_limits_not_authorization", + "credential_boundary_metadata_only", + "maintenance_rollback_traceable", + "runtime_gate_separate", + ] + assert_equal( + "iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.review_conditions", + [ + item["review_condition"] + for item in iwooos_host_owner_decision_record_human_handoff_readiness_review_checklist_items + ], + expected_iwooos_host_owner_decision_record_human_handoff_readiness_review_conditions, + ) + for item in iwooos_host_owner_decision_record_human_handoff_readiness_review_checklist_items: + assert_equal( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.{item['item_id']}.display_mode", + item["display_mode"], + "owner_decision_record_human_handoff_readiness_review_checklist_only", + ) + assert_equal( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.{item['item_id']}.human_record_owner_handoff_review_passed_count", + item["human_record_owner_handoff_review_passed_count"], + 0, + ) + assert_equal( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.{item['item_id']}.human_record_owner_handoff_started_count", + item["human_record_owner_handoff_started_count"], + 0, + ) + assert_equal( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.{item['item_id']}.human_record_owner_handoff_ready_count", + item["human_record_owner_handoff_ready_count"], + 0, + ) + assert_equal( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.{item['item_id']}.formal_record_queue_review_passed_count", + item["formal_record_queue_review_passed_count"], + 0, + ) + assert_equal( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.{item['item_id']}.formal_record_queue_enqueued_count", + item["formal_record_queue_enqueued_count"], + 0, + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.{item['item_id']}.decision_record_created", + item["decision_record_created"], + ) + assert_equal( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.{item['item_id']}.owner_decision_received_count", + item["owner_decision_received_count"], + 0, + ) + assert_equal( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.{item['item_id']}.owner_decision_accepted_count", + item["owner_decision_accepted_count"], + 0, + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.{item['item_id']}.owner_approval_record_created", + item["owner_approval_record_created"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.{item['item_id']}.runtime_gate_opened", + item["runtime_gate_opened"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.{item['item_id']}.raw_payload_allowed", + item["raw_payload_allowed"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.{item['item_id']}.secret_value_collection_allowed", + item["secret_value_collection_allowed"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.{item['item_id']}.runtime_execution_authorized", + item["runtime_execution_authorized"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.{item['item_id']}.action_buttons_allowed", + item["action_buttons_allowed"], + ) + assert_true( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_review_checklist_items.{item['item_id']}.not_authorization", + item["not_authorization"], + ) assert_equal( "iwooos_projection.non_blocking_lane_ids", iwooos_projection["non_blocking_lane_ids"], @@ -2827,6 +2952,7 @@ def validate(root: Path) -> None: "display_host_owner_decision_record_formal_record_queue_review_checklist", "display_host_owner_decision_record_formal_record_queue_review_outcome_lanes", "display_host_owner_decision_record_human_handoff_readiness_packets", + "display_host_owner_decision_record_human_handoff_readiness_review_checklist", "display_evidence_refs", "display_forbidden_actions", ]: @@ -2937,6 +3063,11 @@ def validate(root: Path) -> None: "mark_human_record_owner_handoff_ready_from_frontend", "create_host_owner_decision_record_from_handoff_readiness", "open_runtime_gate_from_handoff_readiness", + "treat_host_owner_decision_record_handoff_readiness_review_as_approval", + "mark_human_record_owner_handoff_readiness_review_passed", + "start_human_record_owner_handoff_from_readiness_review", + "create_host_owner_decision_record_from_handoff_readiness_review", + "open_runtime_gate_from_handoff_readiness_review", "apply_runtime_blocking_control", "switch_github_primary", "production_deploy",