fix(web): add IwoooS S4.9 request draft package

docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-REQUEST-DRAFT.md

@@ -0,0 +1,62 @@
+# Gitea 清冊負責人證明補件草稿
+
+| 項目 | 內容 |
+|------|------|
+| 日期 | 2026-06-01 |
+| 狀態 | 草稿已整理，尚未送出 |
+| 對應階段 | S4.9 |
+| 對應收件包 | `docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md` |
+| 快照 | `docs/security/gitea-inventory-owner-attestation-request-draft.snapshot.json` |
+| 模式 | `owner_request_draft_only` |
+| 執行面授權 | `false` |
+
+## 1. 草稿目的
+
+此草稿把 S4.9 需要負責人補齊的五項 Gitea 清冊證明整理成可交付內容。它只用於人工判讀與後續送件準備，不代表已送出請求、不代表已收到回覆，也不代表任何 Gitea / GitHub / refs / workflow / secret / Kali 執行授權。
+
+## 2. 五個補件題目
+
+| 順序 | Template | 負責人需要回覆 | 目前狀態 |
+|------|----------|----------------|----------|
+| 1 | `response-public-only-vs-local-gitea-gap` | `wooo/clawbot-v5`、`wooo/wooo-aiops` 是否屬本輪 inventory / migration scope | 草稿完成，未送出 |
+| 2 | `response-org-user-endpoint-identity` | `wooo` 在 Gitea 中應以 user、org 或兩者盤點 | 草稿完成，未送出 |
+| 3 | `response-internal-110-adjacent-scope` | `bitan-pharmacy`、`root/momo-pro-system`、`tsenyang-website`、`wooo/wooo-infra-config` 是否納入本輪 scope | 草稿完成，未送出 |
+| 4 | `response-repo-owner-canonical-scope` | in-scope repo 的 owner、canonical source、GitHub target candidate 與 visibility review owner | 草稿完成，未送出 |
+| 5 | `response-legacy-or-inaccessible-disposition` | legacy、inaccessible 或 external repo 的 disposition、理由與後續 owner | 草稿完成，未送出 |
+
+## 3. 回覆格式
+
+每一題都只接受下列欄位：
+
+- `owner_role_or_team`
+- `decision`
+- `decision_reason`
+- `affected_repos`、`affected_sources` 或 `canonical_namespace`
+- `evidence_refs`
+- `followup_owner`
+
+`evidence_refs` 只能指向 repo 內文件、snapshot 或負責人提供的脫敏 metadata。若資料可能包含 token、secret、private key、cookie、session、DB dump、git object pack 或 repo archive，必須改用 quarantine pointer，不得貼原文。
+
+## 4. 明確禁止
+
+- 不收 token、PAT、webhook secret、repository secret value、runner registration token 或 deploy key private key。
+- 不收 DB dump、repo archive、git object pack、裸 repo tarball 或可還原憑證的 artifact。
+- 不建立、不刪除、不封存、不修改 Gitea repo。
+- 不建立 GitHub repo、不改 visibility、不同步 refs、不刪 refs、不 force push。
+- 不切 GitHub primary、不停用 Gitea、不啟用 GitHub hosted runner。
+- 不啟動 Kali、SSH、掃描、主機更新、修復或部署。
+
+## 5. 目前狀態
+
+| 指標 | 值 |
+|------|----|
+| request draft package | ready |
+| request draft template count | 5 |
+| request sent | false |
+| request sent count | 0 |
+| recipients confirmed count | 0 |
+| owner response received count | 0 |
+| owner response accepted count | 0 |
+| runtime gate opened | false |
+| action buttons allowed | false |
+

docs/security/gitea-inventory-owner-attestation-request-draft.snapshot.json

@@ -0,0 +1,86 @@
+{
+  "schema_version": "gitea_inventory_owner_attestation_request_draft_v1",
+  "status": "request_draft_ready_not_sent",
+  "date": "2026-06-01",
+  "stage_id": "S4.9",
+  "mode": "owner_request_draft_only",
+  "runtime_execution_authorized": false,
+  "source_packet": "docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-RESPONSE.md",
+  "source_snapshot": "docs/security/gitea-inventory-owner-attestation-response.snapshot.json",
+  "summary": {
+    "request_draft_package_ready": true,
+    "request_draft_template_count": 5,
+    "request_sent": false,
+    "request_sent_count": 0,
+    "recipients_confirmed_count": 0,
+    "owner_response_received_count": 0,
+    "owner_response_accepted_count": 0,
+    "owner_response_rejected_count": 0,
+    "audit_events_emitted_count": 0,
+    "runtime_gate_opened": false,
+    "action_buttons_allowed": false,
+    "not_authorization": true
+  },
+  "request_draft_templates": [
+    {
+      "template_id": "response-public-only-vs-local-gitea-gap",
+      "display_order": 1,
+      "attestation_item_id": "public_only_vs_local_gitea_gap",
+      "draft_status": "ready_not_sent",
+      "owner_question": "判定 wooo/clawbot-v5 與 wooo/wooo-aiops 是否屬本輪 inventory / migration scope。",
+      "required_fields": ["owner_role_or_team", "decision", "decision_reason", "affected_repos", "evidence_refs", "followup_owner"]
+    },
+    {
+      "template_id": "response-org-user-endpoint-identity",
+      "display_order": 2,
+      "attestation_item_id": "org_user_endpoint_identity",
+      "draft_status": "ready_not_sent",
+      "owner_question": "說明 wooo 在 Gitea 中應以 user、org 或兩者盤點。",
+      "required_fields": ["owner_role_or_team", "decision", "decision_reason", "canonical_namespace", "evidence_refs", "followup_owner"]
+    },
+    {
+      "template_id": "response-internal-110-adjacent-scope",
+      "display_order": 3,
+      "attestation_item_id": "internal_110_adjacent_scope",
+      "draft_status": "ready_not_sent",
+      "owner_question": "逐項判定 bitan-pharmacy、root/momo-pro-system、tsenyang-website、wooo/wooo-infra-config 是否納入本輪 scope。",
+      "required_fields": ["owner_role_or_team", "decision", "decision_reason", "affected_sources", "evidence_refs", "followup_owner"]
+    },
+    {
+      "template_id": "response-repo-owner-canonical-scope",
+      "display_order": 4,
+      "attestation_item_id": "repo_owner_canonical_scope",
+      "draft_status": "ready_not_sent",
+      "owner_question": "為 in-scope repo 指定 owner、canonical source、GitHub target candidate 與 visibility review owner。",
+      "required_fields": ["owner_role_or_team", "decision", "decision_reason", "affected_repos", "evidence_refs", "followup_owner"]
+    },
+    {
+      "template_id": "response-legacy-or-inaccessible-disposition",
+      "display_order": 5,
+      "attestation_item_id": "legacy_or_inaccessible_repo_disposition",
+      "draft_status": "ready_not_sent",
+      "owner_question": "對 legacy、inaccessible 或 external repo 留下 disposition、理由與後續 owner。",
+      "required_fields": ["owner_role_or_team", "decision", "decision_reason", "affected_repos", "evidence_refs", "followup_owner"]
+    }
+  ],
+  "allowed_outputs": [
+    "owner role/team metadata",
+    "decision and decision reason",
+    "affected repo/source/namespace metadata",
+    "redacted evidence refs",
+    "followup owner"
+  ],
+  "forbidden_actions": [
+    "collect_secret_plaintext",
+    "collect_repo_archive",
+    "write_gitea",
+    "create_github_repo",
+    "change_repo_visibility",
+    "sync_or_delete_refs",
+    "force_push_refs",
+    "switch_github_primary",
+    "disable_gitea",
+    "open_runtime_gate"
+  ],
+  "not_authorization": true
+}

docs/security/iwooos-posture-projection.snapshot.json

@@ -10,6 +10,8 @@
     "docs/security/security-rollout-policy.snapshot.json",
     "docs/security/source-control-owner-response-validation-rollup.snapshot.json",
     "docs/security/source-control-primary-readiness-gate.snapshot.json",
+    "docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-REQUEST-DRAFT.md",
+    "docs/security/gitea-inventory-owner-attestation-request-draft.snapshot.json",
     "docs/security/kali-integration-status.snapshot.json",
     "apps/web/src/app/[locale]/iwooos/page.tsx",
     "apps/web/src/app/[locale]/security-compliance/page.tsx",
@@ -54,6 +56,8 @@
     "progress_evidence_rail_runtime_gate_count": 0,
     "evidence_unlock_queue_first_layer": true,
     "evidence_unlock_queue_item_count": 4,
+    "evidence_unlock_queue_s4_9_request_draft_template_count": 5,
+    "evidence_unlock_queue_s4_9_request_draft_ready_count": 1,
     "evidence_unlock_queue_request_sent_count": 0,
     "evidence_unlock_queue_received_count": 0,
     "evidence_unlock_queue_accepted_count": 0,
@@ -429,7 +433,10 @@
       "display_order": 1,
       "gate": "S4.9",
       "display_mode": "first_screen_evidence_unlock_queue",
-      "value": "0/5",
+      "value": "草稿 5",
+      "request_draft_package_ready": true,
+      "request_draft_template_count": 5,
+      "request_draft_ready_count": 1,
       "request_sent_count": 0,
       "received_count": 0,
       "accepted_count": 0,

docs/security/security-mirror-status-rollup.snapshot.json

@@ -2377,6 +2377,18 @@
       "runtime_delta": false,
       "execution_authorized": false,
       "not_authorization": true
+    },
+    {
+      "delta_id": "s2_159_iwooos_s49_request_draft_package",
+      "display_order": 188,
+      "completed_stage": "S2.159 IwoooS S4.9 負責人補件草稿包",
+      "progress_axis": "framework_detail",
+      "headline_percent_delta": 0,
+      "framework_delta_visible": true,
+      "why_headline_unchanged": "IwoooS 只把 S4.9 Gitea 清冊負責人證明的五個補件題目整理成可交付草稿包，並在首屏工作佇列顯示草稿 5；iwooos_evidence_unlock_queue_s4_9_request_draft_template_count=5、iwooos_evidence_unlock_queue_s4_9_request_draft_ready_count=1、iwooos_evidence_unlock_queue_request_sent_count=0、iwooos_evidence_unlock_queue_received_count=0、iwooos_evidence_unlock_queue_accepted_count=0、runtime_execution_authorized=false、active_runtime_gate_count=0、action_buttons_allowed=false，不把草稿包當請求送出、負責人回覆收到、審查接受、審批紀錄、掃描、修復、部署、主機更新、GitHub primary 切換或 Gitea 停用。",
+      "runtime_delta": false,
+      "execution_authorized": false,
+      "not_authorization": true
     }
   ],
   "next_safe_actions": [