feat(web): add IwoooS AwoooP landing readiness

apps/web/messages/en.json

@@ -2748,6 +2748,51 @@
         }
       }
     },
+    "awooopReadOnlyLandingReadiness": {
+      "title": "AwoooP Read-Only Landing Readiness",
+      "subtitle": "S2.51 turns the AwoooP main-line read-only consumption path for IwoooS / security mirror state into an intake readiness board. This is landing readiness, not production_landing_enabled, and it does not connect an execution router.",
+      "readinessLabel": "Read-only intake",
+      "requirementLabel": "Intake requirement",
+      "guardLabel": "Still locked",
+      "items": {
+        "rollupSnapshotReadable": {
+          "title": "Rollup snapshots are readable",
+          "body": "`security-mirror-status-rollup.snapshot.json` and `iwooos-posture-projection.snapshot.json` can serve as the main read-only sources for AwoooP.",
+          "requirement": "AwoooP consumes committed snapshots and guard output only, without calling Kali, Gitea, GitHub, or runtime APIs directly.",
+          "guard": "production_landing_enabled=false; execution router linked=false"
+        },
+        "evidenceRefsReadable": {
+          "title": "Evidence refs are traceable",
+          "body": "IwoooS already lists evidence refs for security rollout, owner response validation, Kali status, rollup, and projection state.",
+          "requirement": "AwoooP landing may show evidence refs and status summaries only; it must not store raw payloads, credential plaintext, or token values.",
+          "guard": "payloads_ingested=false; secret value collection=false"
+        },
+        "guardChecksKnown": {
+          "title": "Guard checks are known",
+          "body": "`security-mirror-progress-guard.py` and `source-control-owner-response-guard.py` are the required read-only preflight checks.",
+          "requirement": "AwoooP main-line intake must preserve progress, owner response, runtime flag, action button, and forbidden output checks.",
+          "guard": "Do not skip guards; do not treat guard pass as runtime approval."
+        },
+        "routeGroupsKnown": {
+          "title": "Mirror route groups are known",
+          "body": "`security_mirror_route_v1` already defines read-only destinations for Operator Console, runtime state, channel event, audit evidence, and approval queue.",
+          "requirement": "AwoooP may display and classify by route group only; it must not add scan, execute, repair, repo, refs, or deploy actions.",
+          "guard": "action_buttons_allowed=false; runtime_execution_authorized=false"
+        },
+        "forbiddenOutputsLocked": {
+          "title": "Forbidden outputs stay locked",
+          "body": "IwoooS / rollup explicitly forbids action buttons, runtime gates, GitHub primary switching, or production execution from landing readiness.",
+          "requirement": "AwoooP intake must preserve the forbidden output list and keep write, execution, switch, and secret-value collection paths closed.",
+          "guard": "Do not treat landing readiness as production consumption."
+        },
+        "productionHandoffPending": {
+          "title": "Production handoff is still pending",
+          "body": "This is only the AwoooP read-only landing intake preparation; it does not prove the AwoooP production main line consumes the state yet.",
+          "requirement": "A later PR / deployment evidence must prove AwoooP displays rollup, evidence refs, and guard results read-only.",
+          "guard": "progress_change_applied=false; headline percent delta=0"
+        }
+      }
+    },
     "progressAcceleration": {
       "title": "Progress Acceleration And Real Unlock Points",
       "subtitle": "Progress is moving, but the 58% headline only gets reassessed when owner responses, runtime gates, GitHub primary readiness, or AwoooP production landing produce real evidence. This board makes the next visible unlock points explicit.",

apps/web/messages/zh-TW.json

@@ -2749,6 +2749,51 @@
         }
       }
     },
+    "awooopReadOnlyLandingReadiness": {
+      "title": "AwoooP 只讀 Landing Readiness",
+      "subtitle": "S2.51 把 AwoooP 主線要如何只讀消費 IwoooS / security mirror 狀態整理成接入準備面板。這是 landing readiness，不是 production landing enabled，也不接 execution router。",
+      "readinessLabel": "只讀接入",
+      "requirementLabel": "接入要求",
+      "guardLabel": "仍鎖住",
+      "items": {
+        "rollupSnapshotReadable": {
+          "title": "Rollup snapshot 可讀",
+          "body": "`security-mirror-status-rollup.snapshot.json` 與 `iwooos-posture-projection.snapshot.json` 已可作為 AwoooP 只讀入口的主要來源。",
+          "requirement": "AwoooP 只讀消費 committed snapshot 與 guard output，不直接呼叫 Kali、Gitea、GitHub 或 runtime API。",
+          "guard": "production_landing_enabled=false；execution router linked=false"
+        },
+        "evidenceRefsReadable": {
+          "title": "Evidence refs 可追溯",
+          "body": "IwoooS 已列出 security rollout、owner response validation、Kali status、rollup 與 projection 的 evidence refs。",
+          "requirement": "AwoooP landing 只能顯示 evidence refs 與狀態摘要，不保存 raw payload、credential plaintext 或 token value。",
+          "guard": "payloads_ingested=false；secret value collection=false"
+        },
+        "guardChecksKnown": {
+          "title": "Guard checks 已知",
+          "body": "`security-mirror-progress-guard.py` 與 `source-control-owner-response-guard.py` 是接入前必跑的只讀檢查。",
+          "requirement": "AwoooP 主線接入前必須保留 progress、owner response、runtime flags、action button 與 forbidden output 檢查。",
+          "guard": "不跳過 guard；不把 guard pass 當 runtime approval"
+        },
+        "routeGroupsKnown": {
+          "title": "Mirror route groups 已知",
+          "body": "`security_mirror_route_v1` 已定義 Operator Console、runtime state、channel event、audit evidence、approval queue 的只讀目的地。",
+          "requirement": "AwoooP 只能依 route group 顯示與分類，不新增 scan、execute、repair、repo、refs 或 deploy action。",
+          "guard": "action_buttons_allowed=false；runtime_execution_authorized=false"
+        },
+        "forbiddenOutputsLocked": {
+          "title": "Forbidden outputs 鎖住",
+          "body": "IwoooS / rollup 已明確列出不得從 landing readiness 產生 action button、runtime gate、GitHub primary 或 production execution。",
+          "requirement": "AwoooP 接入時必須保留禁止輸出清單，並把所有寫入、執行、切換與收 secret value 的入口維持關閉。",
+          "guard": "不把 landing readiness 當 production consumption"
+        },
+        "productionHandoffPending": {
+          "title": "Production handoff 仍待接入",
+          "body": "目前只是 AwoooP 只讀 landing 的接入準備，尚未證明 AwoooP production 主線已消費這組狀態。",
+          "requirement": "需要後續 PR / deployment evidence 證明 AwoooP 主線只讀顯示 rollup、evidence refs 與 guard result。",
+          "guard": "progress_change_applied=false；headline percent delta=0"
+        }
+      }
+    },
     "progressAcceleration": {
       "title": "進度加速與真正解鎖點",
       "subtitle": "目前不是沒有推進，而是 58% headline 只在 owner response、runtime gate、GitHub primary readiness 或 AwoooP production landing 有實質 evidence 時才會重估。這裡把下一批有感推進點集中顯示。",

apps/web/src/app/[locale]/iwooos/page.tsx

@@ -45,6 +45,13 @@ type ProgressHoldMovementGate = {
   tone: 'steady' | 'warn' | 'locked'
 }
 
+type AwoooPReadOnlyLandingReadinessItem = {
+  key: string
+  item: string
+  icon: typeof ShieldCheck
+  tone: 'steady' | 'warn' | 'locked'
+}
+
 type OwnerResponseNextActionFocusItem = {
   key: string
   focus: string
@@ -359,6 +366,15 @@ const progressHoldMovementGates: ProgressHoldMovementGate[] = [
   { key: 'awooopReadOnlyLanding', gate: 'G5', icon: Radar, tone: 'steady' },
 ]
 
+const awooopReadOnlyLandingReadinessItems: AwoooPReadOnlyLandingReadinessItem[] = [
+  { key: 'rollupSnapshotReadable', item: 'L1', icon: FileText, tone: 'steady' },
+  { key: 'evidenceRefsReadable', item: 'L2', icon: SearchCheck, tone: 'steady' },
+  { key: 'guardChecksKnown', item: 'L3', icon: ShieldCheck, tone: 'steady' },
+  { key: 'routeGroupsKnown', item: 'L4', icon: Radar, tone: 'warn' },
+  { key: 'forbiddenOutputsLocked', item: 'L5', icon: Lock, tone: 'locked' },
+  { key: 'productionHandoffPending', item: 'L6', icon: Clock3, tone: 'locked' },
+]
+
 const ownerResponseNextActionFocusItems: OwnerResponseNextActionFocusItem[] = [
   { key: 'giteaOwnerAttestation', focus: 'S4.9', icon: ClipboardCheck, tone: 'warn' },
   { key: 'githubTargetOwnerDecision', focus: 'S4.10', icon: GitBranch, tone: 'warn' },
@@ -924,6 +940,39 @@ function ProgressHoldMovementGateCard({ item }: { item: ProgressHoldMovementGate
   )
 }
 
+function AwoooPReadOnlyLandingReadinessCard({ item }: { item: AwoooPReadOnlyLandingReadinessItem }) {
+  const t = useTranslations('iwooos.awooopReadOnlyLandingReadiness')
+  const Icon = item.icon
+  const textWrap = { overflowWrap: 'anywhere' as const, wordBreak: 'break-word' as const }
+  return (
+    <div style={{ ...band, minHeight: 190, padding: 16, ...textWrap }}>
+      <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: 12 }}>
+        <div style={{ display: 'flex', alignItems: 'center', gap: 9 }}>
+          <Icon size={18} color={toneColors[item.tone]} />
+          <span style={{ fontSize: 11, color: '#87867f' }}>{t('readinessLabel')}</span>
+        </div>
+        <span style={{ fontSize: 11, color: toneColors[item.tone] }}>{item.item}</span>
+      </div>
+      <h2 style={{ fontSize: 14, margin: '12px 0 6px', color: '#141413' }}>
+        {t(`items.${item.key}.title` as never)}
+      </h2>
+      <p style={{ fontSize: 12, lineHeight: 1.55, color: '#6f6d66', margin: 0, ...textWrap }}>
+        {t(`items.${item.key}.body` as never)}
+      </p>
+      <div style={{ marginTop: 10, display: 'grid', gap: 5 }}>
+        <div style={{ fontSize: 11, color: '#87867f' }}>{t('requirementLabel')}</div>
+        <div style={{ fontSize: 11, color: toneColors[item.tone], lineHeight: 1.45, ...textWrap }}>
+          {t(`items.${item.key}.requirement` as never)}
+        </div>
+        <div style={{ fontSize: 11, color: '#87867f', marginTop: 4 }}>{t('guardLabel')}</div>
+        <div style={{ fontSize: 11, color: '#6f6d66', lineHeight: 1.45, ...textWrap }}>
+          {t(`items.${item.key}.guard` as never)}
+        </div>
+      </div>
+    </div>
+  )
+}
+
 function OwnerResponseNextActionFocusCard({ item }: { item: OwnerResponseNextActionFocusItem }) {
   const t = useTranslations('iwooos.ownerResponseNextActionFocus')
   const Icon = item.icon
@@ -2227,6 +2276,26 @@ export default function IwoooSPage({ params }: { params: { locale: string } }) {
           </div>
         </section>
 
+        <section style={{ marginBottom: 14 }}>
+          <div style={{ marginBottom: 14 }}>
+            <h2 style={{ fontSize: 16, margin: 0 }}>{t('awooopReadOnlyLandingReadiness.title')}</h2>
+            <p style={{ fontSize: 12, color: '#6f6d66', margin: '6px 0 0', lineHeight: 1.55 }}>
+              {t('awooopReadOnlyLandingReadiness.subtitle')}
+            </p>
+          </div>
+          <div
+            style={{
+              display: 'grid',
+              gridTemplateColumns: 'repeat(auto-fit, minmax(220px, 1fr))',
+              gap: 12,
+            }}
+          >
+            {awooopReadOnlyLandingReadinessItems.map(item => (
+              <AwoooPReadOnlyLandingReadinessCard key={item.key} item={item} />
+            ))}
+          </div>
+        </section>
+
         <section style={{ marginBottom: 14 }}>
           <div style={{ marginBottom: 14 }}>
             <h2 style={{ fontSize: 16, margin: 0 }}>{t('progressAcceleration.title')}</h2>