feat(web): show owner response validation contracts

apps/web/messages/en.json

@@ -4198,6 +4198,35 @@
           "workflowInventory": "Workflow, runner, deploy-key, branch-protection, CODEOWNERS, and secret-name inventory; names only, never values.",
           "postureProjection": "The IwoooS frontend projection for the GitHub readiness board and forbidden actions."
         }
+      },
+      "ownerResponseValidationCandidate": {
+        "title": "Owner Response Validation Contract Read-only Candidate",
+        "subtitle": "The contract dashboard mirrors the S4.13 owner response validation rollup and four source intake packets. This is not received owner response, an approval record, repo / refs / workflow action, or runtime authorization.",
+        "badge": "Validation candidate",
+        "contractRefsTitle": "Owner response validation contract refs",
+        "boundaryLabel": "Validation Boundary",
+        "boundaryTitle": "No validation result is publishable or executable here",
+        "boundaryDetail": "This panel only displays the four packets, 22 response templates, received / accepted / rejected counters at 0, and AwoooP display sections. It does not create approval records, create repos, mutate refs, modify workflows / secrets, collect secret values, switch primary, or open runtime gates.",
+        "openIwooos": "Open IwoooS",
+        "metrics": {
+          "packets": "Packets",
+          "packetsDetail": "The S4.9-S4.12 packets are still waiting for owner response.",
+          "templates": "Templates",
+          "templatesDetail": "22 templates only define intake shape; they are not sent or accepted responses.",
+          "received": "Received",
+          "receivedDetail": "Still 0; visible work items or contracts must not rewrite intake state.",
+          "accepted": "Accepted",
+          "acceptedDetail": "Still 0; only redacted evidence that passes validation can change this.",
+          "displaySections": "Display sections",
+          "displaySectionsDetail": "8 AwoooP display sections explain validation flow and boundaries only."
+        },
+        "contractRefs": {
+          "validationRollup": "The S4.13 four-packet validation rollup that keeps received / accepted / rejected and reviewer checks separate.",
+          "giteaAttestation": "The S4.9 Gitea inventory owner attestation packet; five templates are still not received.",
+          "githubTarget": "The S4.10 GitHub target owner decision packet; seven templates are still not accepted.",
+          "refsTruth": "The S4.11 refs truth owner response packet; classification must not become refs action authorization.",
+          "workflowSecret": "The S4.12 workflow / secret-name owner response packet; names and redacted evidence only, never secret values."
+        }
       }
     },
     "approvals": {

apps/web/messages/zh-TW.json

@@ -4147,58 +4147,87 @@
     "contracts": {
       "securityContractCandidate": {
         "title": "IwoooS 資安契約只讀候選",
-        "subtitle": "合約儀表板只顯示 IwoooS / 資安鏡像目前依賴的 schema、snapshot 與 guard 口徑；這不是合約發布，也不會觸發 runtime gate。",
+        "subtitle": "合約儀表板只顯示 IwoooS / 資安鏡像目前依賴的結構定義、快照與防護檢查口徑；這不是合約發布，也不會觸發執行期閘門。",
         "badge": "契約候選",
         "contractRefsTitle": "只讀合約參照",
         "boundaryLabel": "合約邊界",
         "boundaryTitle": "目前沒有可發布的資安合約",
-        "boundaryDetail": "這個面板不發布合約版次、不改合約生命週期、不寫入平台合約 API、不呼叫 GitHub / Gitea / Kali，也不新增掃描、執行、部署、主要來源切換或 refs 動作。",
+        "boundaryDetail": "這個面板不發布合約版次、不改合約生命週期、不寫入平台合約 API、不呼叫 GitHub / Gitea / Kali，也不新增掃描、執行、部署、主要來源切換或分支 / 標籤參照動作。",
         "openIwooos": "開啟 IwoooS",
         "metrics": {
           "totalContracts": "合約總數",
           "totalContractsDetail": "資安鏡像目前彙整 36 個主要合約。",
           "readyForMirror": "鏡像就緒",
-          "readyForMirrorDetail": "33 個 ready、2 個 partial、1 個 contract-only、0 blocked。",
+          "readyForMirrorDetail": "33 個已就緒、2 個部分就緒、1 個僅契約、0 個阻擋。",
           "partialReady": "部分就緒",
-          "partialReadyDetail": "缺口仍集中在負責人回覆、payload ingestion 與原始碼管控負責人 evidence。",
+          "partialReadyDetail": "缺口仍集中在負責人回覆、資料匯入與原始碼管控負責人證據。",
           "activeRuntimeGates": "主動執行閘門",
-          "activeRuntimeGatesDetail": "仍為 0；合約可見性不等於 runtime enforcement。"
+          "activeRuntimeGatesDetail": "仍為 0；合約可見性不等於執行期強制控管。"
         },
         "contractRefs": {
-          "statusRollup": "AwoooP / Security Session 的共同狀態入口，只彙整進度與安全 gate。",
+          "statusRollup": "AwoooP / 資安工作階段的共同狀態入口，只彙整進度與安全閘門。",
           "postureProjection": "IwoooS 前端態勢、主機覆蓋、負責人回覆焦點與禁止動作的投影契約。",
-          "ownerValidation": "S4.9-S4.12 負責人回覆 received / accepted 分離與 reviewer 檢查口徑。",
-          "rolloutPolicy": "低摩擦、先觀測、封鎖前先由負責人審查的 rollout policy。"
+          "ownerValidation": "S4.9-S4.12 負責人回覆已收到 / 已接受分離與審查者檢查口徑。",
+          "rolloutPolicy": "低摩擦、先觀測、封鎖前先由負責人審查的推出政策。"
         }
       },
       "githubPrimaryReadinessCandidate": {
         "title": "GitHub 主要來源就緒度合約只讀候選",
-        "subtitle": "合約儀表板同步顯示 Gitea 轉 GitHub 的就緒度合約參照、負責人回覆缺口與不可執行邊界；這不是 repo 建立、refs 變更、secret 收集或主要來源切換授權。",
+        "subtitle": "合約儀表板同步顯示 Gitea 轉 GitHub 的就緒度合約參照、負責人回覆缺口與不可執行邊界；這不是專案庫建立、分支 / 標籤參照變更、機密收集或主要來源切換授權。",
         "badge": "GitHub 就緒度",
         "contractRefsTitle": "主要來源就緒度合約參照",
         "boundaryLabel": "原始碼管控邊界",
         "boundaryTitle": "目前沒有可切換的 GitHub 主要來源",
-        "boundaryDetail": "這個面板只顯示候選 repo、範圍內 repo、主要來源就緒數、負責人回覆與 workflow / secret 名稱清冊缺口；不建立 GitHub repo、不改可見性、不 sync / delete / force push refs、不收 secret value、不切主要來源、不停用 Gitea，也不觸發 runtime gate。",
+        "boundaryDetail": "這個面板只顯示候選專案庫、範圍內專案庫、主要來源就緒數、負責人回覆與工作流程 / 機密名稱清冊缺口；不建立 GitHub 專案庫、不改可見性、不同步 / 刪除 / 強制推送分支或標籤參照、不收機密明文值、不切主要來源、不停用 Gitea，也不觸發執行期閘門。",
         "openIwooos": "開啟 IwoooS",
         "metrics": {
-          "candidateRepos": "候選 repo",
+          "candidateRepos": "候選專案庫",
           "candidateReposDetail": "S4.0 目前追蹤 8 個 GitHub 主要來源就緒度候選。",
-          "inScopeRepos": "範圍內 repo",
-          "inScopeReposDetail": "7 個仍需負責人 / 可見性 / canonical / rollback evidence。",
+          "inScopeRepos": "範圍內專案庫",
+          "inScopeReposDetail": "7 個仍需負責人、可見性、主來源與回復證據。",
           "primaryReady": "主要來源就緒數",
           "primaryReadyDetail": "仍為 0；就緒度可見不等於已可切主要來源。",
           "ownerResponses": "負責人回覆",
-          "ownerResponsesDetail": "S4.9-S4.12 共 22 個回覆範本仍為 0 received / accepted。",
+          "ownerResponsesDetail": "S4.9-S4.12 共 22 個回覆範本仍為 0 已收到 / 0 已接受。",
           "workflowInventory": "工作流程清冊",
-          "workflowInventoryDetail": "7 個範圍內 repo 的 workflow / secret 名稱清冊仍未 complete。"
+          "workflowInventoryDetail": "7 個範圍內專案庫的工作流程 / 機密名稱清冊仍未完成。"
         },
         "contractRefs": {
-          "primaryReadiness": "GitHub 主要來源 parity、owner、refs、workflow 與 rollback 前置缺口的主就緒度閘門。",
-          "ownerValidation": "四包負責人回覆的 received / accepted / rejected 分離與 reviewer 檢查口徑。",
-          "rollbackAdr": "7 個 in-scope repos 的 rollback ADR 草案、owner review 與 validation window。",
-          "workflowInventory": "workflow、runner、deploy key、branch protection、CODEOWNERS 與 secret 名稱清冊；只收名稱不收 value。",
+          "primaryReadiness": "GitHub 主要來源一致性、負責人、分支 / 標籤參照、工作流程與回復前置缺口的主就緒度閘門。",
+          "ownerValidation": "四包負責人回覆的已收到 / 已接受 / 已拒收分離與審查者檢查口徑。",
+          "rollbackAdr": "7 個範圍內專案庫的回復 ADR 草案、負責人審查與驗證窗口。",
+          "workflowInventory": "工作流程、執行器、部署金鑰、分支保護、CODEOWNERS 與機密名稱清冊；只收名稱不收明文值。",
           "postureProjection": "IwoooS 用來呈現 GitHub 就緒度狀態板與禁止動作的前端投影。"
         }
+      },
+      "ownerResponseValidationCandidate": {
+        "title": "負責人回覆驗收契約只讀候選",
+        "subtitle": "合約儀表板同步顯示 S4.13 負責人回覆驗收彙整與四個來源收件包；這不是負責人回覆已收到、審批紀錄、專案庫 / 分支與標籤參照 / 工作流程動作或執行期授權。",
+        "badge": "驗收候選",
+        "contractRefsTitle": "負責人回覆驗收合約參照",
+        "boundaryLabel": "驗收邊界",
+        "boundaryTitle": "目前沒有可發布或可執行的驗收結果",
+        "boundaryDetail": "這個面板只顯示四包、22 個回覆範本、收件 / 接受 / 拒收仍為 0，以及 AwoooP 可顯示的驗收區塊；不建立審批紀錄、不建立專案庫、不改分支 / 標籤參照、不改工作流程 / 機密設定、不收機密明文值、不切主要來源，也不開執行期閘門。",
+        "openIwooos": "開啟 IwoooS",
+        "metrics": {
+          "packets": "回覆包",
+          "packetsDetail": "S4.9-S4.12 四包都仍在等待負責人回覆。",
+          "templates": "回覆範本",
+          "templatesDetail": "22 個範本只代表可收件格式，不代表已送出或已接受。",
+          "received": "已收到",
+          "receivedDetail": "目前仍為 0；工作項或合約可見性不得改寫收件狀態。",
+          "accepted": "已接受",
+          "acceptedDetail": "目前仍為 0；只有脫敏 evidence 通過驗收後才能改變。",
+          "displaySections": "顯示區塊",
+          "displaySectionsDetail": "8 個 AwoooP 顯示區塊只用於說明驗收流程與邊界。"
+        },
+        "contractRefs": {
+          "validationRollup": "S4.13 的四包驗收總覽，固定已收到 / 已接受 / 已拒收分離與審查者檢查口徑。",
+          "giteaAttestation": "S4.9 Gitea 清冊負責人證明收件包；目前 5 個範本仍未收到。",
+          "githubTarget": "S4.10 GitHub 目標負責人決策收件包；目前 7 個範本仍未接受。",
+          "refsTruth": "S4.11 分支 / 標籤真相負責人回覆收件包；不得把分類視為分支 / 標籤參照動作授權。",
+          "workflowSecret": "S4.12 工作流程 / 機密名稱負責人回覆收件包；只允許名稱與脫敏證據，不允許機密明文值。"
+        }
       }
     },
     "approvals": {

apps/web/src/app/[locale]/awooop/contracts/page.tsx

@@ -15,6 +15,7 @@ import {
   AlertCircle,
   Filter,
   ChevronDown,
+  ClipboardCheck,
   ShieldCheck,
   GitBranch,
 } from "lucide-react";
@@ -365,6 +366,127 @@ function GitHubPrimaryReadinessContractCandidatePanel() {
   );
 }
 
+function OwnerResponseValidationContractCandidatePanel() {
+  const t = useTranslations("awooop.contracts.ownerResponseValidationCandidate");
+  const metrics = [
+    {
+      label: t("metrics.packets"),
+      value: "4",
+      detail: t("metrics.packetsDetail"),
+    },
+    {
+      label: t("metrics.templates"),
+      value: "22",
+      detail: t("metrics.templatesDetail"),
+    },
+    {
+      label: t("metrics.received"),
+      value: "0",
+      detail: t("metrics.receivedDetail"),
+    },
+    {
+      label: t("metrics.accepted"),
+      value: "0",
+      detail: t("metrics.acceptedDetail"),
+    },
+    {
+      label: t("metrics.displaySections"),
+      value: "8",
+      detail: t("metrics.displaySectionsDetail"),
+    },
+  ];
+  const contracts = [
+    {
+      name: "source_control_owner_response_validation_rollup_v1",
+      detail: t("contractRefs.validationRollup"),
+    },
+    {
+      name: "gitea_inventory_owner_attestation_response_v1",
+      detail: t("contractRefs.giteaAttestation"),
+    },
+    {
+      name: "github_target_owner_decision_response_v1",
+      detail: t("contractRefs.githubTarget"),
+    },
+    {
+      name: "source_control_ref_truth_owner_response_v1",
+      detail: t("contractRefs.refsTruth"),
+    },
+    {
+      name: "source_control_workflow_secret_name_owner_response_v1",
+      detail: t("contractRefs.workflowSecret"),
+    },
+  ];
+
+  return (
+    <section className="overflow-hidden border border-[#ded8e8] bg-white">
+      <div className="flex flex-wrap items-start justify-between gap-3 border-b border-[#ded8e8] bg-[#fbf8ff] px-4 py-3">
+        <div className="flex items-start gap-2">
+          <ClipboardCheck className="mt-0.5 h-4 w-4 text-[#7561a8]" aria-hidden="true" />
+          <div>
+            <h3 className="text-sm font-semibold text-[#141413]">{t("title")}</h3>
+            <p className="mt-1 max-w-3xl text-xs leading-5 text-[#665f73]">{t("subtitle")}</p>
+          </div>
+        </div>
+        <span className="inline-flex border border-[#b7aad6] bg-white px-2 py-0.5 text-xs font-semibold text-[#5e4b93]">
+          {t("badge")}
+        </span>
+      </div>
+
+      <div className="grid gap-px bg-[#ded8e8] md:grid-cols-2 xl:grid-cols-5">
+        {metrics.map((item) => (
+          <div key={item.label} className="bg-white px-4 py-3">
+            <p className="text-xs font-semibold text-[#665f73]">{item.label}</p>
+            <p className="mt-2 font-mono text-2xl font-semibold text-[#141413]">{item.value}</p>
+            <p className="mt-2 text-xs leading-5 text-[#585260]">{item.detail}</p>
+          </div>
+        ))}
+      </div>
+
+      <div className="grid min-w-0 gap-4 p-4 xl:grid-cols-[1.1fr_0.9fr]">
+        <div className="min-w-0 border border-[#ded8e8] bg-white">
+          <div className="border-b border-[#ded8e8] bg-[#fbf8ff] px-4 py-3 text-xs font-semibold text-[#141413]">
+            {t("contractRefsTitle")}
+          </div>
+          <div className="divide-y divide-[#ece7f3]">
+            {contracts.map((item) => (
+              <div key={item.name} className="px-4 py-3">
+                <p className="break-all font-mono text-xs font-semibold text-[#141413]">{item.name}</p>
+                <p className="mt-1 text-xs leading-5 text-[#585260]">{item.detail}</p>
+              </div>
+            ))}
+          </div>
+        </div>
+
+        <div className="min-w-0 border border-[#ded8e8] bg-[#fbf8ff] px-4 py-3">
+          <p className="text-xs font-semibold text-[#665f73]">{t("boundaryLabel")}</p>
+          <p className="mt-2 text-sm font-semibold text-[#141413]">{t("boundaryTitle")}</p>
+          <p className="mt-2 text-xs leading-5 text-[#585260]">{t("boundaryDetail")}</p>
+          <div className="mt-4 grid gap-2 break-all font-mono text-xs text-[#141413]">
+            <span>owner_response_validation_received_count=0</span>
+            <span>owner_response_validation_accepted_count=0</span>
+            <span>approval_record_created=false</span>
+            <span>repo_creation_authorized=false</span>
+            <span>refs_sync_authorized=false</span>
+            <span>workflow_modification_authorized=false</span>
+            <span>secret_value_collection_allowed=false</span>
+            <span>github_primary_switch_authorized=false</span>
+            <span>runtime_execution_authorized=false</span>
+            <span>action_buttons_allowed=false</span>
+          </div>
+          <Link
+            href="/iwooos"
+            className="mt-4 inline-flex items-center gap-2 border border-[#b7aad6] bg-white px-3 py-1.5 text-xs font-semibold text-[#141413] hover:border-[#7561a8]"
+          >
+            {t("openIwooos")}
+            <ArrowRight className="h-3.5 w-3.5 text-[#665f73]" aria-hidden="true" />
+          </Link>
+        </div>
+      </div>
+    </section>
+  );
+}
+
 // =============================================================================
 // Main Component
 // =============================================================================
@@ -437,6 +559,7 @@ export default function ContractsPage() {
 
       <SecurityContractCandidatePanel />
       <GitHubPrimaryReadinessContractCandidatePanel />
+      <OwnerResponseValidationContractCandidatePanel />
 
       {/* Filters */}
       <div className="flex items-center gap-3 border border-[#e0ddd4] bg-white p-4">
@@ -481,13 +604,13 @@ export default function ContractsPage() {
                   合約類型
                 </th>
                 <th className="text-left px-4 py-3 text-xs font-medium text-muted-foreground uppercase tracking-wider">
-                  Project ID
+                  專案 ID
                 </th>
                 <th className="text-left px-4 py-3 text-xs font-medium text-muted-foreground uppercase tracking-wider">
                   狀態
                 </th>
                 <th className="text-left px-4 py-3 text-xs font-medium text-muted-foreground uppercase tracking-wider">
-                  Hash
+                  雜湊
                 </th>
                 <th className="text-left px-4 py-3 text-xs font-medium text-muted-foreground uppercase tracking-wider">
                   建立時間