feat(web): add IwoooS record candidates

docs/security/IWOOOS-POSTURE-PROJECTION.md

@@ -59,6 +59,7 @@ IwoooS 首版只讀取或對齊以下已提交 evidence：
 27. 7 個 host owner decision record write-up packets，顯示正式 decision record 撰寫欄位，但不建立 record、不標記 completed / accepted、不開 runtime gate。
 28. 7 個 host owner decision record write-up review checklist items，顯示正式撰寫欄位進入決策紀錄前仍需只讀核對的條件。
 29. 7 個 host owner decision record write-up review outcome lanes，顯示 write-up review 後的只讀結果分流與下一步。
+30. 7 個 host owner decision record formal candidate packets，顯示 formal record candidate 需要的候選欄位，但不建立 decision record、不標記 finalized / accepted、不開 runtime gate。
 
 ## 3.1 既有前端資安頁面整合
 
@@ -442,6 +443,24 @@ S2.31 將 write-up review checklist 後的可能結果拆成七個只讀 outcome
 
 這個 outcome board 不代表 write-up review 已通過、formal decision record 已完成、decision record 已建立、owner decision 已接受、資安批准已完成或 runtime gate 已開啟。它只讓 IwoooS 把 write-up review 後的補件、候選或 runtime gate 分離狀態顯示清楚。
 
+## 3.23 Host Owner Decision Record Formal Candidate Packets
+
+S2.32 將 ready for formal record candidate 後的候選正式紀錄欄位拆成七個只讀 packets。這一層只回答「若未來真的要建立正式 decision record，candidate 需要有哪些可讀欄位」，不標記 finalized、不建立 decision record、不標記 accepted、不建立 approval record、不開 runtime gate。
+
+| 順序 | Candidate packet | 來源 lane | 候選欄位 |
+|------|------------------|-----------|----------|
+| 1 | Record identity candidate | ready for formal record candidate | record id、version、owner、review scope、trace source |
+| 2 | Decision summary candidate | ready for formal record candidate | human decision summary、risk acceptance boundary、no-execution statement |
+| 3 | Approved scope candidate | ready for formal record candidate | host / network / service / exclusion / observation intent / expiry |
+| 4 | Scan mode limits candidate | ready for formal record candidate | observe-only、future active scan、credentialed scan limits |
+| 5 | Credential boundary candidate | ready for formal record candidate | metadata-only credential owner、retention、masking、forbidden collection |
+| 6 | Maintenance and rollback candidate | ready for formal record candidate | maintenance window、constraints、rollback owner、recovery path、human contact |
+| 7 | Validation and runtime gate candidate | ready for formal record candidate | validation evidence、post-check metrics、baseline pointer、separate runtime gate requirement |
+
+每個 candidate packet 都固定 `display_mode=owner_decision_record_formal_candidate_only`、`formal_record_candidate_finalized_count=0`、`decision_record_created=false`、`owner_decision_received_count=0`、`owner_decision_accepted_count=0`、`owner_approval_record_created=false`、`runtime_gate_opened=false`、`raw_payload_allowed=false`、`secret_value_collection_allowed=false`、`runtime_execution_authorized=false`、`action_buttons_allowed=false`、`not_authorization=true`。
+
+這個 candidate board 不代表 formal decision record 已 finalized、decision record 已建立、owner decision 已接受、資安批准已完成或 runtime gate 已開啟。它只讓 IwoooS 先把正式紀錄候選欄位呈現清楚，讓後續人工 owner decision 與 runtime gate 繼續保持分離。
+
 ## 4. 仍禁止
 
 IwoooS 不得提供下列輸出：
@@ -470,7 +489,8 @@ IwoooS 不得提供下列輸出：
 22. 從 owner decision record write-up 建立 decision record、標記 write-up completed、標記 decision record accepted，或從 write-up 開 runtime gate。
 23. 把 owner decision record write-up review 當成 approval、標記 write-up review passed / completed、從 write-up review 建立 decision record，或從 write-up review 開 runtime gate。
 24. 把 owner decision record write-up review outcome 當成 approval、標記 write-up review outcome passed / completed、從 write-up review outcome 建立 decision record，或從 write-up review outcome 開 runtime gate。
-25. 把 58% progress、contract count、mirror readiness 或前端可見狀態當成授權。
+25. 把 owner decision record formal candidate 當成 approval、標記 formal candidate finalized、從 formal candidate 建立或接受 decision record，或從 formal candidate 開 runtime gate。
+26. 把 58% progress、contract count、mirror readiness 或前端可見狀態當成授權。
 
 ## 5. 驗證
 

docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md

@@ -35,7 +35,7 @@
 | Owner response validation | S4.13 已建立；四包 owner response 目前 received/accepted 皆為 0；4 條 missing response lanes、4 步 collection order、next collection candidate、6 條 evidence routing rules、8 個 display sections、7 條 state transition rules、9 個 reviewer checklist items、7 條 reviewer outcome lanes、4 個 reviewer audit event templates、5 個 reviewer audit display sections、6 個 reviewer audit collection checks、5 個 reviewer audit redaction examples、5 條 reviewer audit retention rules、6 個 reviewer audit retention checks、6 個 reviewer audit handoff packets、6 個 reviewer audit handoff checks、6 個 parallel session sync checks、6 條 parallel session conflict lanes、6 個 parallel session recovery checks 與 7 條 parallel session recovery outcome lanes 可供 AwoooP 直接顯示；下一個建議收件為 S4.9 Gitea owner attestation；latest local validation 為 `SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK`，reviewer audit emitted 仍為 0，不代表 owner response 已收到或任何執行授權 |
 | Low-friction rollout policy | S1.3 已補 7 條 non-blocking escalation lanes；LOW / MEDIUM、缺 owner response、partial mirror、source-control drift、Kali observe finding、workflow / secret name gap 與 headline holding 初期只能 observe / warn；`owner_review_required_before_blocking=true`、`runtime_blocking_allowed=false` |
 | IwoooS frontend posture | S2.8 已新增 `/iwooos` read-only Information Security 入口；顯示 Security Posture / Exposure、source-control supply chain、Kali 112 Mesh、approval boundary、non-blocking lanes 與 evidence refs；不新增執行按鈕 |
-| IwoooS posture projection | S2.9 已新增 `iwooos_posture_projection_v1`；S2.10 已把 10 個既有前端資安相關頁面納入 projection；S2.11 已補 4 個 coverage groups 與 5 個 conflict controls；S2.12 已補 6 個只讀 operator journey steps；S2.13 已補 7 個 owner evidence readiness items；S2.14 已補 3 個 host coverage items：Kali 112、開發主機 168、開發主機 111；S2.15 已補 6 個 host action gate items；S2.16 已補 7 個 host evidence readiness items；S2.17 已補 7 個 host evidence collection order steps；S2.18 已補 7 個 host evidence intake preflight checks；S2.19 已補 7 個 host evidence review outcome lanes；S2.20 已補 7 個 host evidence review handoff packets；S2.21 已補 7 個 host evidence reviewer checklist items；S2.22 已補 7 個 host evidence reviewer outcome lanes；S2.23 已補 7 個 host owner decision candidate packets；S2.24 已補 7 個 host owner decision review checklist items；S2.25 已補 7 個 host owner decision review outcome lanes；S2.26 已補 7 個 host owner decision record draft packets；S2.27 已補 7 個 host owner decision record draft review checklist items；S2.28 已補 7 個 host owner decision record draft review outcome lanes；S2.29 已補 7 個 host owner decision record write-up packets；S2.30 已補 7 個 host owner decision record write-up review checklist items；S2.31 已補 7 個 host owner decision record write-up review outcome lanes；仍不新增 action button |
+| IwoooS posture projection | S2.9 已新增 `iwooos_posture_projection_v1`；S2.10 已把 10 個既有前端資安相關頁面納入 projection；S2.11 已補 4 個 coverage groups 與 5 個 conflict controls；S2.12 已補 6 個只讀 operator journey steps；S2.13 已補 7 個 owner evidence readiness items；S2.14 已補 3 個 host coverage items：Kali 112、開發主機 168、開發主機 111；S2.15 已補 6 個 host action gate items；S2.16 已補 7 個 host evidence readiness items；S2.17 已補 7 個 host evidence collection order steps；S2.18 已補 7 個 host evidence intake preflight checks；S2.19 已補 7 個 host evidence review outcome lanes；S2.20 已補 7 個 host evidence review handoff packets；S2.21 已補 7 個 host evidence reviewer checklist items；S2.22 已補 7 個 host evidence reviewer outcome lanes；S2.23 已補 7 個 host owner decision candidate packets；S2.24 已補 7 個 host owner decision review checklist items；S2.25 已補 7 個 host owner decision review outcome lanes；S2.26 已補 7 個 host owner decision record draft packets；S2.27 已補 7 個 host owner decision record draft review checklist items；S2.28 已補 7 個 host owner decision record draft review outcome lanes；S2.29 已補 7 個 host owner decision record write-up packets；S2.30 已補 7 個 host owner decision record write-up review checklist items；S2.31 已補 7 個 host owner decision record write-up review outcome lanes；S2.32 已補 7 個 host owner decision record formal candidate packets；仍不新增 action button |
 | Dry-run | `contract_defined_not_executed`；已納入 `CHECK_PROGRESS_GUARD` 與 `CHECK_OWNER_RESPONSE_GUARD`，latest local validation 為 `repo_snapshot_guard_pass`，仍不代表 production ingestion |
 | Runtime actions | `false` |
 | Payload ingestion | `false` |
@@ -115,6 +115,7 @@
 | S2.29 IwoooS host owner decision record write-up packets | framework detail | 0 | 只顯示 formal decision record 需要的七個撰寫欄位；write-up completed、decision record created、accepted count、approval record、runtime gate、raw payload、secret value、runtime execution 與 action button 仍全部鎖住 |
 | S2.30 IwoooS host owner decision record write-up review checklist | framework detail | 0 | 只顯示 formal decision record 撰寫欄位進人審前的七個只讀核對項；review passed、write-up completed、decision record created、accepted count、approval record、runtime gate、raw payload、secret value、runtime execution 與 action button 仍全部鎖住 |
 | S2.31 IwoooS host owner decision record write-up review outcome lanes | framework detail | 0 | 只顯示 write-up review checklist 後的七個只讀結果分流；review passed、write-up completed、decision record created、accepted count、approval record、runtime gate、raw payload、secret value、runtime execution 與 action button 仍全部鎖住 |
+| S2.32 IwoooS host owner decision record formal candidate packets | framework detail | 0 | 只顯示 formal decision record candidate 需要的七個候選欄位；finalized count、decision record created、accepted count、approval record、runtime gate、raw payload、secret value、runtime execution 與 action button 仍全部鎖住 |
 
 headline 進度要再往上，至少需要下列任一高層 gate 有實質 evidence：
 

docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md

@@ -4,7 +4,7 @@
 |------|------|
 | 日期 | 2026-05-17 |
 | 狀態 | S0/S1 read-only evidence 建置中 |
-| 本階段完成 | 資安供應鏈 contract manifest + Source Control Approval Board + Draft Reconcile Plan + Ref Detail Diff + Ref Truth Classification + Source Control Ref Truth Owner Response 收件包 + GitHub Primary Readiness Gate + GitHub Primary Rollback ADR + GitHub Target Owner Decision Response 收件包 + Gitea 認證清冊匯出請求 + Gitea 認證清冊匯入驗收契約 + Gitea 清冊覆蓋 Owner Attestation + Gitea Owner Attestation Approval Lane 對齊 + Gitea Owner Attestation Response 收件包 + Workflow / Secret Name Inventory + Workflow / Secret Name Local Evidence + Workflow / Secret Name Redacted Export Request + Workflow / Secret Name Owner Response 收件包 + Source Control Owner Response Validation Rollup + Kali 112 live integration status + Security Finding contract + Kali scan scope approval package + Security Approval Queue + S3 人工批准 Gate + S3 人工決策紀錄 + S3 人工審查封包 + S3 人工決策狀態轉移 + S3 後續 runtime gate 準備契約 + 鏡像 readiness index + 鏡像接收計畫 + 鏡像事件信封 + 鏡像路由矩陣 + 鏡像驗收契約 + 鏡像隔離契約 + 鏡像 dry-run 報告契約 + 鏡像狀態彙整契約 + IwoooS 前端態勢入口 + IwoooS posture projection contract + IwoooS 既有前端資安頁面整合 + IwoooS 覆蓋與邊界矩陣 + IwoooS 只讀資安處理旅程 + IwoooS owner evidence readiness board + IwoooS host coverage view + IwoooS host action gate matrix + IwoooS host evidence readiness board + IwoooS host evidence collection order + IwoooS host evidence intake preflight + IwoooS host evidence review outcome lanes + IwoooS host evidence review handoff packets + IwoooS host evidence reviewer checklist + IwoooS host evidence reviewer outcome lanes + IwoooS host owner decision candidate packets + IwoooS host owner decision review checklist + IwoooS host owner decision review outcome lanes + IwoooS host owner decision record draft packets + IwoooS host owner decision record draft review checklist + IwoooS host owner decision record draft review outcome lanes + IwoooS host owner decision record write-up packets + IwoooS host owner decision record write-up review checklist + IwoooS host owner decision record write-up review outcome lanes |
+| 本階段完成 | 資安供應鏈 contract manifest + Source Control Approval Board + Draft Reconcile Plan + Ref Detail Diff + Ref Truth Classification + Source Control Ref Truth Owner Response 收件包 + GitHub Primary Readiness Gate + GitHub Primary Rollback ADR + GitHub Target Owner Decision Response 收件包 + Gitea 認證清冊匯出請求 + Gitea 認證清冊匯入驗收契約 + Gitea 清冊覆蓋 Owner Attestation + Gitea Owner Attestation Approval Lane 對齊 + Gitea Owner Attestation Response 收件包 + Workflow / Secret Name Inventory + Workflow / Secret Name Local Evidence + Workflow / Secret Name Redacted Export Request + Workflow / Secret Name Owner Response 收件包 + Source Control Owner Response Validation Rollup + Kali 112 live integration status + Security Finding contract + Kali scan scope approval package + Security Approval Queue + S3 人工批准 Gate + S3 人工決策紀錄 + S3 人工審查封包 + S3 人工決策狀態轉移 + S3 後續 runtime gate 準備契約 + 鏡像 readiness index + 鏡像接收計畫 + 鏡像事件信封 + 鏡像路由矩陣 + 鏡像驗收契約 + 鏡像隔離契約 + 鏡像 dry-run 報告契約 + 鏡像狀態彙整契約 + IwoooS 前端態勢入口 + IwoooS posture projection contract + IwoooS 既有前端資安頁面整合 + IwoooS 覆蓋與邊界矩陣 + IwoooS 只讀資安處理旅程 + IwoooS owner evidence readiness board + IwoooS host coverage view + IwoooS host action gate matrix + IwoooS host evidence readiness board + IwoooS host evidence collection order + IwoooS host evidence intake preflight + IwoooS host evidence review outcome lanes + IwoooS host evidence review handoff packets + IwoooS host evidence reviewer checklist + IwoooS host evidence reviewer outcome lanes + IwoooS host owner decision candidate packets + IwoooS host owner decision review checklist + IwoooS host owner decision review outcome lanes + IwoooS host owner decision record draft packets + IwoooS host owner decision record draft review checklist + IwoooS host owner decision record draft review outcome lanes + IwoooS host owner decision record write-up packets + IwoooS host owner decision record write-up review checklist + IwoooS host owner decision record write-up review outcome lanes + IwoooS host owner decision record formal candidate packets |
 | 原則 | 低摩擦分階段；文件、schema、read-only evidence 優先；不做 runtime enforcement、不切 primary |
 
 ## 0. 本階段完成後整體進度
@@ -27,7 +27,7 @@ python3 scripts/security/security-mirror-progress-guard.py
 
 ### 0.2 Headline 58% 不代表停滯
 
-近期 S4.10 request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks、S4.11 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks、S4.12 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks、S4.13 evidence routing rules / display sections / state transition rules / reviewer checklist / reviewer outcome lanes / reviewer audit event templates / reviewer audit display sections / reviewer audit collection checks / reviewer audit redaction examples / reviewer audit retention rules / reviewer audit retention checks / reviewer audit handoff packets / reviewer audit handoff checks / parallel session sync checks / parallel session conflict lanes / parallel session recovery checks / recovery outcome lanes、S1.3 non-blocking escalation lanes、S2.8 IwoooS frontend posture entry，以及 S2.9-S2.31 IwoooS posture projection contract 都是有效進展，但它們是 framework detail，不是 owner response、runtime gate、production ingestion 或 GitHub primary readiness。因此 headline 仍維持 58%，避免把只讀框架誤算成已落地執行。
+近期 S4.10 request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks、S4.11 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks、S4.12 request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks、S4.13 evidence routing rules / display sections / state transition rules / reviewer checklist / reviewer outcome lanes / reviewer audit event templates / reviewer audit display sections / reviewer audit collection checks / reviewer audit redaction examples / reviewer audit retention rules / reviewer audit retention checks / reviewer audit handoff packets / reviewer audit handoff checks / parallel session sync checks / parallel session conflict lanes / parallel session recovery checks / recovery outcome lanes、S1.3 non-blocking escalation lanes、S2.8 IwoooS frontend posture entry，以及 S2.9-S2.32 IwoooS posture projection contract 都是有效進展，但它們是 framework detail，不是 owner response、runtime gate、production ingestion 或 GitHub primary readiness。因此 headline 仍維持 58%，避免把只讀框架誤算成已落地執行。
 
 | 最近完成 | 目前狀態 | headline delta |
 |----------|----------|----------------|
@@ -91,6 +91,7 @@ python3 scripts/security/security-mirror-progress-guard.py
 | S2.29 IwoooS host owner decision record write-up packets | 已完成草案，將 decision summary、approved scope、scan mode limits、credential boundary、maintenance / rollback、validation evidence 與 runtime gate pointer 顯示成七個只讀正式撰寫欄位 | 0 |
 | S2.30 IwoooS host owner decision record write-up review checklist | 已完成草案，將 decision summary readable、scope / expiry complete、scan mode limits explicit、credential metadata-only、maintenance / rollback linked、validation evidence linked 與 runtime gate separate 顯示成七個只讀核對項 | 0 |
 | S2.31 IwoooS host owner decision record write-up review outcome lanes | 已完成草案，將 ready for formal record candidate、decision summary needs clarification、scope / expiry needs refresh、scan mode limits ambiguous、credential boundary failed、maintenance / rollback incomplete 與 runtime gate still required 顯示成七個只讀結果分流 | 0 |
+| S2.32 IwoooS host owner decision record formal candidate packets | 已完成草案，將 record identity、decision summary、approved scope、scan mode limits、credential boundary、maintenance / rollback、validation / runtime gate 顯示成七個只讀 formal candidate 欄位 | 0 |
 
 headline 要再往上，需要 S4.9 / S4.10 / S4.11 / S4.12 任一 owner response 收到並通過脫敏驗收，或人工批准後出現 active runtime gate、redacted payload ingestion、GitHub primary readiness 這類落地 evidence。
 
@@ -141,6 +142,7 @@ headline 要再往上，需要 S4.9 / S4.10 / S4.11 / S4.12 任一 owner respons
 | S2.29 IwoooS Host Owner Decision Record Write-Up Packets | 完成草案 | `/iwooos` 新增主機 owner decision record write-up packets，顯示 decision summary、approved scope、scan mode limits、credential boundary、maintenance / rollback、validation evidence、runtime gate pointer 七個正式撰寫欄位 | 使用者能理解 ready for write-up 仍只是欄位整理；仍不標記 write-up completed、不建立 decision record、不標記 accepted、不開 runtime gate、不執行主機動作 |
 | S2.30 IwoooS Host Owner Decision Record Write-Up Review Checklist | 完成草案 | `/iwooos` 新增主機 owner decision record write-up review checklist，顯示 decision summary readable、scope / expiry complete、scan mode limits explicit、credential metadata-only、maintenance / rollback linked、validation evidence linked、runtime gate separate 七個核對項 | 使用者能理解 write-up packets 後仍需只讀核對；仍不標記 review passed、不標記 write-up completed、不建立 decision record、不標記 accepted、不開 runtime gate、不執行主機動作 |
 | S2.31 IwoooS Host Owner Decision Record Write-Up Review Outcome Lanes | 完成草案 | `/iwooos` 新增主機 owner decision record write-up review outcome lanes，顯示 ready for formal record candidate、decision summary needs clarification、scope / expiry needs refresh、scan mode limits ambiguous、credential boundary failed、maintenance / rollback incomplete、runtime gate still required 七個分流 | 使用者能理解 write-up review 後仍只是只讀結果分流；仍不標記 review passed、不標記 write-up completed、不建立 decision record、不標記 accepted、不開 runtime gate、不執行主機動作 |
+| S2.32 IwoooS Host Owner Decision Record Formal Candidate Packets | 完成草案 | `/iwooos` 新增主機 owner decision record formal candidate packets，顯示 record identity、decision summary、approved scope、scan mode limits、credential boundary、maintenance / rollback、validation / runtime gate 七個候選欄位 | 使用者能理解 formal candidate 仍不是正式紀錄；仍不標記 finalized、不建立 decision record、不標記 accepted、不開 runtime gate、不執行主機動作 |
 | S3 approval gate | 進行中 | `security_approval_gate_v1` 已建立 8 個人工 gate items：7 pending、1 block candidate、0 approved | 不得繞過人工批准；批准後仍需 follow-up runtime gate |
 | S3.0 人工批准 Gate 契約 | 完成草案 | 定義批准範圍、決策選項、required reviewers、still forbidden 與 follow-up runtime gate | AwoooP 可記錄決策，不可執行 gate item |
 | S3.1 人工決策紀錄契約 | 完成草案 | `security_approval_decision_record_v1` 已建立；目前 0 筆 decision records、0 個 runtime action 授權 | AwoooP 可稽核決策，不可把決策當執行 |

docs/security/iwooos-posture-projection.snapshot.json

@@ -57,7 +57,8 @@
     "host_owner_decision_record_draft_review_outcome_lane_count": 7,
     "host_owner_decision_record_writeup_packet_count": 7,
     "host_owner_decision_record_writeup_review_checklist_item_count": 7,
-    "host_owner_decision_record_writeup_review_outcome_lane_count": 7
+    "host_owner_decision_record_writeup_review_outcome_lane_count": 7,
+    "host_owner_decision_record_formal_candidate_packet_count": 7
   },
   "progress": {
     "overall_percent": 58,
@@ -151,7 +152,8 @@
     "display_host_owner_decision_record_draft_review_outcome_lanes",
     "display_host_owner_decision_record_writeup_packets",
     "display_host_owner_decision_record_writeup_review_checklist",
-    "display_host_owner_decision_record_writeup_review_outcome_lanes"
+    "display_host_owner_decision_record_writeup_review_outcome_lanes",
+    "display_host_owner_decision_record_formal_candidate_packets"
   ],
   "forbidden_frontend_outputs": [
     "add_scan_button",
@@ -228,7 +230,12 @@
     "mark_host_owner_decision_record_writeup_review_outcome_passed",
     "mark_host_owner_decision_record_writeup_review_outcome_completed",
     "create_host_owner_decision_record_from_writeup_review_outcome",
-    "open_runtime_gate_from_owner_decision_record_writeup_review_outcome"
+    "open_runtime_gate_from_owner_decision_record_writeup_review_outcome",
+    "treat_host_owner_decision_record_formal_candidate_as_approval",
+    "mark_host_owner_decision_record_formal_candidate_finalized",
+    "create_host_owner_decision_record_from_formal_candidate",
+    "accept_host_owner_decision_record_from_formal_candidate",
+    "open_runtime_gate_from_owner_decision_record_formal_candidate"
   ],
   "runtime_execution_authorized": false,
   "action_buttons_allowed": false,
@@ -3029,5 +3036,140 @@
       "action_buttons_allowed": false,
       "not_authorization": true
     }
+  ],
+  "host_owner_decision_record_formal_candidate_packets": [
+    {
+      "packet_id": "host_decision_record_formal_candidate_identity_packet",
+      "display_order": 1,
+      "source_lane_id": "host_decision_record_writeup_review_ready_for_formal_record_outcome_lane",
+      "candidate_field": "record_identity_and_version",
+      "required_metadata": "record_id_candidate_version_owner_review_scope_and_trace_source",
+      "display_mode": "owner_decision_record_formal_candidate_only",
+      "formal_record_candidate_finalized_count": 0,
+      "decision_record_created": false,
+      "owner_decision_received_count": 0,
+      "owner_decision_accepted_count": 0,
+      "owner_approval_record_created": false,
+      "runtime_gate_opened": false,
+      "raw_payload_allowed": false,
+      "secret_value_collection_allowed": false,
+      "runtime_execution_authorized": false,
+      "action_buttons_allowed": false,
+      "not_authorization": true
+    },
+    {
+      "packet_id": "host_decision_record_formal_candidate_decision_summary_packet",
+      "display_order": 2,
+      "source_lane_id": "host_decision_record_writeup_review_ready_for_formal_record_outcome_lane",
+      "candidate_field": "decision_summary",
+      "required_metadata": "human_decision_summary_risk_acceptance_boundary_and_no_execution_statement",
+      "display_mode": "owner_decision_record_formal_candidate_only",
+      "formal_record_candidate_finalized_count": 0,
+      "decision_record_created": false,
+      "owner_decision_received_count": 0,
+      "owner_decision_accepted_count": 0,
+      "owner_approval_record_created": false,
+      "runtime_gate_opened": false,
+      "raw_payload_allowed": false,
+      "secret_value_collection_allowed": false,
+      "runtime_execution_authorized": false,
+      "action_buttons_allowed": false,
+      "not_authorization": true
+    },
+    {
+      "packet_id": "host_decision_record_formal_candidate_approved_scope_packet",
+      "display_order": 3,
+      "source_lane_id": "host_decision_record_writeup_review_ready_for_formal_record_outcome_lane",
+      "candidate_field": "approved_scope_statement",
+      "required_metadata": "host_network_service_exclusion_observation_intent_and_expiry",
+      "display_mode": "owner_decision_record_formal_candidate_only",
+      "formal_record_candidate_finalized_count": 0,
+      "decision_record_created": false,
+      "owner_decision_received_count": 0,
+      "owner_decision_accepted_count": 0,
+      "owner_approval_record_created": false,
+      "runtime_gate_opened": false,
+      "raw_payload_allowed": false,
+      "secret_value_collection_allowed": false,
+      "runtime_execution_authorized": false,
+      "action_buttons_allowed": false,
+      "not_authorization": true
+    },
+    {
+      "packet_id": "host_decision_record_formal_candidate_scan_mode_limits_packet",
+      "display_order": 4,
+      "source_lane_id": "host_decision_record_writeup_review_ready_for_formal_record_outcome_lane",
+      "candidate_field": "scan_mode_limits_statement",
+      "required_metadata": "observe_only_future_active_scan_and_credentialed_scan_limits",
+      "display_mode": "owner_decision_record_formal_candidate_only",
+      "formal_record_candidate_finalized_count": 0,
+      "decision_record_created": false,
+      "owner_decision_received_count": 0,
+      "owner_decision_accepted_count": 0,
+      "owner_approval_record_created": false,
+      "runtime_gate_opened": false,
+      "raw_payload_allowed": false,
+      "secret_value_collection_allowed": false,
+      "runtime_execution_authorized": false,
+      "action_buttons_allowed": false,
+      "not_authorization": true
+    },
+    {
+      "packet_id": "host_decision_record_formal_candidate_credential_boundary_packet",
+      "display_order": 5,
+      "source_lane_id": "host_decision_record_writeup_review_ready_for_formal_record_outcome_lane",
+      "candidate_field": "credential_boundary_statement",
+      "required_metadata": "metadata_only_credential_owner_retention_masking_and_forbidden_collection",
+      "display_mode": "owner_decision_record_formal_candidate_only",
+      "formal_record_candidate_finalized_count": 0,
+      "decision_record_created": false,
+      "owner_decision_received_count": 0,
+      "owner_decision_accepted_count": 0,
+      "owner_approval_record_created": false,
+      "runtime_gate_opened": false,
+      "raw_payload_allowed": false,
+      "secret_value_collection_allowed": false,
+      "runtime_execution_authorized": false,
+      "action_buttons_allowed": false,
+      "not_authorization": true
+    },
+    {
+      "packet_id": "host_decision_record_formal_candidate_maintenance_rollback_packet",
+      "display_order": 6,
+      "source_lane_id": "host_decision_record_writeup_review_ready_for_formal_record_outcome_lane",
+      "candidate_field": "maintenance_and_rollback_statement",
+      "required_metadata": "maintenance_window_constraints_rollback_owner_recovery_path_and_human_contact",
+      "display_mode": "owner_decision_record_formal_candidate_only",
+      "formal_record_candidate_finalized_count": 0,
+      "decision_record_created": false,
+      "owner_decision_received_count": 0,
+      "owner_decision_accepted_count": 0,
+      "owner_approval_record_created": false,
+      "runtime_gate_opened": false,
+      "raw_payload_allowed": false,
+      "secret_value_collection_allowed": false,
+      "runtime_execution_authorized": false,
+      "action_buttons_allowed": false,
+      "not_authorization": true
+    },
+    {
+      "packet_id": "host_decision_record_formal_candidate_validation_runtime_gate_packet",
+      "display_order": 7,
+      "source_lane_id": "host_decision_record_writeup_review_ready_for_formal_record_outcome_lane",
+      "candidate_field": "validation_and_runtime_gate_statement",
+      "required_metadata": "validation_evidence_post_check_metrics_baseline_pointer_and_separate_runtime_gate_requirement",
+      "display_mode": "owner_decision_record_formal_candidate_only",
+      "formal_record_candidate_finalized_count": 0,
+      "decision_record_created": false,
+      "owner_decision_received_count": 0,
+      "owner_decision_accepted_count": 0,
+      "owner_approval_record_created": false,
+      "runtime_gate_opened": false,
+      "raw_payload_allowed": false,
+      "secret_value_collection_allowed": false,
+      "runtime_execution_authorized": false,
+      "action_buttons_allowed": false,
+      "not_authorization": true
+    }
   ]
 }

docs/security/security-mirror-status-rollup.snapshot.json

@@ -870,6 +870,16 @@
       "runtime_delta": false,
       "execution_authorized": false,
       "not_authorization": true
+    },
+    {
+      "delta_id": "s2_32_iwooos_host_owner_decision_record_formal_candidate_packets",
+      "display_order": 61,
+      "progress_axis": "framework_detail",
+      "headline_percent_delta": 0,
+      "framework_delta_visible": true,
+      "runtime_delta": false,
+      "execution_authorized": false,
+      "not_authorization": true
     }
   ],
   "next_safe_actions": [
@@ -1250,7 +1260,8 @@
     "S1.3 只新增 7 條 low-friction non-blocking escalation lanes；non_blocking_escalation_lane_count=7、owner_review_required_before_blocking=true、runtime_blocking_allowed=false，不把 LOW / MEDIUM、缺 owner response、partial mirror、source-control drift、Kali observe finding、workflow / secret name gap 或 headline holding 直接變 blocking gate、runtime enforcement 或 action button。",
     "S2.29 只新增 IwoooS host owner decision record write-up packets；host_owner_decision_record_writeup_packet_count=7、decision_record_writeup_completed_count=0、decision_record_created=false、owner_decision_received_count=0、owner_decision_accepted_count=0、owner_approval_record_created=false、runtime_gate_opened=false，不把 write-up packet 當正式決策紀錄、完成、接受、批准或 runtime gate。",
     "S2.30 只新增 IwoooS host owner decision record write-up review checklist；host_owner_decision_record_writeup_review_checklist_item_count=7、decision_record_writeup_review_passed_count=0、decision_record_writeup_completed_count=0、decision_record_created=false、owner_decision_received_count=0、owner_decision_accepted_count=0、owner_approval_record_created=false、runtime_gate_opened=false，不把 write-up review 當正式決策紀錄、完成、接受、批准或 runtime gate。",
-    "S2.31 只新增 IwoooS host owner decision record write-up review outcome lanes；host_owner_decision_record_writeup_review_outcome_lane_count=7、decision_record_writeup_review_passed_count=0、decision_record_writeup_completed_count=0、decision_record_created=false、owner_decision_received_count=0、owner_decision_accepted_count=0、owner_approval_record_created=false、runtime_gate_opened=false，不把 write-up review outcome 當正式決策紀錄、完成、接受、批准或 runtime gate。"
+    "S2.31 只新增 IwoooS host owner decision record write-up review outcome lanes；host_owner_decision_record_writeup_review_outcome_lane_count=7、decision_record_writeup_review_passed_count=0、decision_record_writeup_completed_count=0、decision_record_created=false、owner_decision_received_count=0、owner_decision_accepted_count=0、owner_approval_record_created=false、runtime_gate_opened=false，不把 write-up review outcome 當正式決策紀錄、完成、接受、批准或 runtime gate。",
+    "S2.32 只新增 IwoooS host owner decision record formal candidate packets；host_owner_decision_record_formal_candidate_packet_count=7、formal_record_candidate_finalized_count=0、decision_record_created=false、owner_decision_received_count=0、owner_decision_accepted_count=0、owner_approval_record_created=false、runtime_gate_opened=false，不把 formal candidate packet 當正式決策紀錄、完成、接受、批准或 runtime gate。"
   ],
   "forbidden_actions": [
     "start_kali_scan",