feat(security): 綁定 S4.9 owner handoff queue

docs/schemas/gitea_inventory_owner_attestation_response_v1.schema.json

@@ -15,6 +15,7 @@
     "source_indexes",
     "summary",
     "response_templates",
+    "owner_response_intake_handoff_queue",
     "acceptance_checks",
     "rejection_rules",
     "allowed_outputs",
@@ -67,6 +68,13 @@
         "owner_response_display_section_count",
         "owner_response_request_packet_count",
         "owner_response_collection_check_count",
+        "owner_response_intake_handoff_queue_count",
+        "owner_response_intake_handoff_queue_ready_count",
+        "owner_response_intake_handoff_queue_received_count",
+        "owner_response_intake_handoff_queue_accepted_count",
+        "owner_response_intake_handoff_queue_runtime_gate_count",
+        "owner_response_intake_handoff_queue_raw_payload_allowed",
+        "owner_response_intake_handoff_queue_action_buttons_allowed",
         "intake_preflight_check_count",
         "intake_outcome_lane_count",
         "acceptance_check_count",
@@ -94,6 +102,19 @@
         "owner_response_display_section_count": {"type": "integer", "minimum": 0},
         "owner_response_request_packet_count": {"type": "integer", "minimum": 0},
         "owner_response_collection_check_count": {"type": "integer", "minimum": 0},
+        "owner_response_intake_handoff_queue_count": {"type": "integer", "minimum": 0},
+        "owner_response_intake_handoff_queue_ready_count": {"type": "integer", "minimum": 0},
+        "owner_response_intake_handoff_queue_received_count": {"type": "integer", "minimum": 0},
+        "owner_response_intake_handoff_queue_accepted_count": {"type": "integer", "minimum": 0},
+        "owner_response_intake_handoff_queue_runtime_gate_count": {"type": "integer", "minimum": 0},
+        "owner_response_intake_handoff_queue_raw_payload_allowed": {
+          "type": "boolean",
+          "const": false
+        },
+        "owner_response_intake_handoff_queue_action_buttons_allowed": {
+          "type": "boolean",
+          "const": false
+        },
         "intake_preflight_check_count": {"type": "integer", "minimum": 0},
         "intake_outcome_lane_count": {"type": "integer", "minimum": 0},
         "acceptance_check_count": {"type": "integer", "minimum": 0},
@@ -355,6 +376,55 @@
       },
       "minItems": 1
     },
+    "owner_response_intake_handoff_queue": {
+      "type": "array",
+      "description": "S4.9 owner response 收件前 handoff queue；只供 AwoooP / IwoooS 顯示下一個 owner 要補的脫敏中繼資料，不代表 request sent、received、accepted 或 runtime gate。",
+      "items": {
+        "type": "object",
+        "required": [
+          "handoff_lane_id",
+          "display_order",
+          "source_template_id",
+          "template_label",
+          "handoff_status",
+          "required_owner_field_count",
+          "required_owner_fields",
+          "current_blocker",
+          "next_safe_step",
+          "received_response_count",
+          "accepted_response_count",
+          "runtime_gate_count",
+          "raw_payload_allowed",
+          "secret_plaintext_allowed",
+          "action_buttons_allowed",
+          "execution_authorized",
+          "not_approval",
+          "still_forbidden"
+        ],
+        "properties": {
+          "handoff_lane_id": {"type": "string"},
+          "display_order": {"type": "integer", "minimum": 1},
+          "source_template_id": {"type": "string"},
+          "template_label": {"type": "string"},
+          "handoff_status": {"type": "string", "enum": ["waiting_owner_response_metadata"]},
+          "required_owner_field_count": {"type": "integer", "minimum": 1},
+          "required_owner_fields": {"type": "array", "items": {"type": "string"}, "minItems": 1},
+          "current_blocker": {"type": "string"},
+          "next_safe_step": {"type": "string"},
+          "received_response_count": {"type": "integer", "const": 0},
+          "accepted_response_count": {"type": "integer", "const": 0},
+          "runtime_gate_count": {"type": "integer", "const": 0},
+          "raw_payload_allowed": {"type": "boolean", "const": false},
+          "secret_plaintext_allowed": {"type": "boolean", "const": false},
+          "action_buttons_allowed": {"type": "boolean", "const": false},
+          "execution_authorized": {"type": "boolean", "const": false},
+          "not_approval": {"type": "boolean", "const": true},
+          "still_forbidden": {"type": "array", "items": {"type": "string"}, "minItems": 1}
+        },
+        "additionalProperties": false
+      },
+      "minItems": 1
+    },
     "owner_response_request_packet": {
       "type": "object",
       "description": "AwoooP 可直接顯示給 owner 的 S4.9 回覆請求；只說明要填什麼與不得貼什麼，不授權任何執行。",

docs/schemas/iwooos_posture_projection_v1.schema.json

@@ -182,7 +182,15 @@
         "action_buttons_allowed",
         "owner_response_next_action_focus_item_count",
         "s4_9_owner_response_preflight_check_count",
-        "s4_9_owner_response_request_template_count"
+        "s4_9_owner_response_request_template_count",
+        "s4_9_owner_response_intake_source_bound",
+        "s4_9_owner_response_intake_handoff_queue_count",
+        "s4_9_owner_response_intake_handoff_queue_ready_count",
+        "s4_9_owner_response_intake_handoff_queue_received_count",
+        "s4_9_owner_response_intake_handoff_queue_accepted_count",
+        "s4_9_owner_response_intake_handoff_queue_runtime_gate_count",
+        "s4_9_owner_response_intake_handoff_queue_raw_payload_allowed",
+        "s4_9_owner_response_intake_handoff_queue_action_buttons_allowed"
       ],
       "properties": {
         "route_path": {
@@ -499,6 +507,38 @@
         "s4_9_owner_response_request_template_count": {
           "type": "integer",
           "const": 5
+        },
+        "s4_9_owner_response_intake_source_bound": {
+          "type": "boolean",
+          "const": true
+        },
+        "s4_9_owner_response_intake_handoff_queue_count": {
+          "type": "integer",
+          "const": 5
+        },
+        "s4_9_owner_response_intake_handoff_queue_ready_count": {
+          "type": "integer",
+          "const": 0
+        },
+        "s4_9_owner_response_intake_handoff_queue_received_count": {
+          "type": "integer",
+          "const": 0
+        },
+        "s4_9_owner_response_intake_handoff_queue_accepted_count": {
+          "type": "integer",
+          "const": 0
+        },
+        "s4_9_owner_response_intake_handoff_queue_runtime_gate_count": {
+          "type": "integer",
+          "const": 0
+        },
+        "s4_9_owner_response_intake_handoff_queue_raw_payload_allowed": {
+          "type": "boolean",
+          "const": false
+        },
+        "s4_9_owner_response_intake_handoff_queue_action_buttons_allowed": {
+          "type": "boolean",
+          "const": false
         }
       },
       "additionalProperties": false

docs/security/gitea-inventory-owner-attestation-response.snapshot.json

@@ -28,6 +28,13 @@
     "owner_response_display_section_count": 8,
     "owner_response_request_packet_count": 1,
     "owner_response_collection_check_count": 6,
+    "owner_response_intake_handoff_queue_count": 5,
+    "owner_response_intake_handoff_queue_ready_count": 0,
+    "owner_response_intake_handoff_queue_received_count": 0,
+    "owner_response_intake_handoff_queue_accepted_count": 0,
+    "owner_response_intake_handoff_queue_runtime_gate_count": 0,
+    "owner_response_intake_handoff_queue_raw_payload_allowed": false,
+    "owner_response_intake_handoff_queue_action_buttons_allowed": false,
     "intake_preflight_check_count": 6,
     "intake_outcome_lane_count": 5,
     "acceptance_check_count": 8,
@@ -363,6 +370,181 @@
       ]
     }
   ],
+  "owner_response_intake_handoff_queue": [
+    {
+      "handoff_lane_id": "publicGap",
+      "display_order": 1,
+      "source_template_id": "response-public-only-vs-local-gitea-gap",
+      "template_label": "D1",
+      "handoff_status": "waiting_owner_response_metadata",
+      "required_owner_field_count": 6,
+      "required_owner_fields": [
+        "owner_role_or_team",
+        "decision",
+        "decision_reason",
+        "affected_repos",
+        "evidence_refs",
+        "followup_owner"
+      ],
+      "current_blocker": "缺少 public-only / local gap 的逐 repo owner 判定。",
+      "next_safe_step": "只等待負責人提供脫敏 metadata pointer；不得收 raw response 或啟動 repo / refs 動作。",
+      "received_response_count": 0,
+      "accepted_response_count": 0,
+      "runtime_gate_count": 0,
+      "raw_payload_allowed": false,
+      "secret_plaintext_allowed": false,
+      "action_buttons_allowed": false,
+      "execution_authorized": false,
+      "not_approval": true,
+      "still_forbidden": [
+        "mark_received_from_handoff_queue",
+        "mark_accepted_from_handoff_queue",
+        "store_owner_response_raw_body",
+        "create_github_repo",
+        "sync_refs",
+        "switch_github_primary"
+      ]
+    },
+    {
+      "handoff_lane_id": "namespaceIdentity",
+      "display_order": 2,
+      "source_template_id": "response-org-user-endpoint-identity",
+      "template_label": "D2",
+      "handoff_status": "waiting_owner_response_metadata",
+      "required_owner_field_count": 6,
+      "required_owner_fields": [
+        "owner_role_or_team",
+        "decision",
+        "decision_reason",
+        "canonical_namespace",
+        "evidence_refs",
+        "followup_owner"
+      ],
+      "current_blocker": "缺少 Gitea `wooo` user / org canonical namespace 判定。",
+      "next_safe_step": "只等待負責人提供 canonical namespace 與脫敏 evidence ref；不得使用 write/admin token。",
+      "received_response_count": 0,
+      "accepted_response_count": 0,
+      "runtime_gate_count": 0,
+      "raw_payload_allowed": false,
+      "secret_plaintext_allowed": false,
+      "action_buttons_allowed": false,
+      "execution_authorized": false,
+      "not_approval": true,
+      "still_forbidden": [
+        "mark_received_from_handoff_queue",
+        "mark_accepted_from_handoff_queue",
+        "store_owner_response_raw_body",
+        "store_token_value",
+        "write_gitea_repo",
+        "switch_github_primary"
+      ]
+    },
+    {
+      "handoff_lane_id": "adjacentScope",
+      "display_order": 3,
+      "source_template_id": "response-internal-110-adjacent-scope",
+      "template_label": "D3",
+      "handoff_status": "waiting_owner_response_metadata",
+      "required_owner_field_count": 6,
+      "required_owner_fields": [
+        "owner_role_or_team",
+        "decision",
+        "decision_reason",
+        "affected_sources",
+        "evidence_refs",
+        "followup_owner"
+      ],
+      "current_blocker": "缺少 110 相鄰來源逐項 scope 判定。",
+      "next_safe_step": "只等待 owner 標示來源是否 in-scope、legacy、external 或需補證；不得 fetch、push 或刪 refs。",
+      "received_response_count": 0,
+      "accepted_response_count": 0,
+      "runtime_gate_count": 0,
+      "raw_payload_allowed": false,
+      "secret_plaintext_allowed": false,
+      "action_buttons_allowed": false,
+      "execution_authorized": false,
+      "not_approval": true,
+      "still_forbidden": [
+        "mark_received_from_handoff_queue",
+        "mark_accepted_from_handoff_queue",
+        "store_owner_response_raw_body",
+        "fetch_refs",
+        "delete_refs",
+        "switch_github_primary"
+      ]
+    },
+    {
+      "handoff_lane_id": "canonicalOwner",
+      "display_order": 4,
+      "source_template_id": "response-repo-owner-canonical-scope",
+      "template_label": "D4",
+      "handoff_status": "waiting_owner_response_metadata",
+      "required_owner_field_count": 8,
+      "required_owner_fields": [
+        "owner_role_or_team",
+        "decision",
+        "decision_reason",
+        "repo_owner",
+        "canonical_source",
+        "github_target_candidate",
+        "visibility_review_owner",
+        "evidence_refs"
+      ],
+      "current_blocker": "缺少 repo owner、canonical source、GitHub target candidate 與 visibility review owner。",
+      "next_safe_step": "只等待負責人補齊 owner / canonical / visibility metadata；不得建立 GitHub repo 或改 visibility。",
+      "received_response_count": 0,
+      "accepted_response_count": 0,
+      "runtime_gate_count": 0,
+      "raw_payload_allowed": false,
+      "secret_plaintext_allowed": false,
+      "action_buttons_allowed": false,
+      "execution_authorized": false,
+      "not_approval": true,
+      "still_forbidden": [
+        "mark_received_from_handoff_queue",
+        "mark_accepted_from_handoff_queue",
+        "store_owner_response_raw_body",
+        "create_github_repo",
+        "change_repo_visibility",
+        "switch_github_primary"
+      ]
+    },
+    {
+      "handoff_lane_id": "legacyDisposition",
+      "display_order": 5,
+      "source_template_id": "response-legacy-or-inaccessible-disposition",
+      "template_label": "D5",
+      "handoff_status": "waiting_owner_response_metadata",
+      "required_owner_field_count": 7,
+      "required_owner_fields": [
+        "owner_role_or_team",
+        "decision",
+        "decision_reason",
+        "affected_repos_or_sources",
+        "disposition",
+        "evidence_refs",
+        "followup_owner"
+      ],
+      "current_blocker": "缺少 legacy、inaccessible 或 external repo disposition 與後續 owner。",
+      "next_safe_step": "只等待負責人補 disposition metadata；不得 archive、delete 或停用 Gitea repo。",
+      "received_response_count": 0,
+      "accepted_response_count": 0,
+      "runtime_gate_count": 0,
+      "raw_payload_allowed": false,
+      "secret_plaintext_allowed": false,
+      "action_buttons_allowed": false,
+      "execution_authorized": false,
+      "not_approval": true,
+      "still_forbidden": [
+        "mark_received_from_handoff_queue",
+        "mark_accepted_from_handoff_queue",
+        "store_owner_response_raw_body",
+        "archive_repo",
+        "delete_repo",
+        "disable_gitea_repo"
+      ]
+    }
+  ],
   "owner_response_audit_event_templates": [
     {
       "event_template_id": "audit-owner-response-request-shown",

docs/security/iwooos-posture-projection.snapshot.json

@@ -9,6 +9,8 @@
     "docs/security/security-mirror-status-rollup.snapshot.json",
     "docs/security/security-rollout-policy.snapshot.json",
     "docs/security/source-control-owner-response-validation-rollup.snapshot.json",
+    "docs/security/gitea-inventory-owner-attestation-response.snapshot.json",
+    "docs/schemas/gitea_inventory_owner_attestation_response_v1.schema.json",
     "docs/security/source-control-primary-readiness-gate.snapshot.json",
     "docs/security/GITEA-INVENTORY-OWNER-ATTESTATION-REQUEST-DRAFT.md",
     "docs/security/gitea-inventory-owner-attestation-request-draft.snapshot.json",
@@ -111,6 +113,14 @@
     "s4_9_owner_response_intake_accepted_count": 0,
     "s4_9_owner_response_intake_rejected_count": 0,
     "s4_9_owner_response_intake_runtime_gate_count": 0,
+    "s4_9_owner_response_intake_source_bound": true,
+    "s4_9_owner_response_intake_handoff_queue_count": 5,
+    "s4_9_owner_response_intake_handoff_queue_ready_count": 0,
+    "s4_9_owner_response_intake_handoff_queue_received_count": 0,
+    "s4_9_owner_response_intake_handoff_queue_accepted_count": 0,
+    "s4_9_owner_response_intake_handoff_queue_runtime_gate_count": 0,
+    "s4_9_owner_response_intake_handoff_queue_raw_payload_allowed": false,
+    "s4_9_owner_response_intake_handoff_queue_action_buttons_allowed": false,
     "visual_command_dashboard_widget_count": 14,
     "visual_command_dashboard_first_layer": true,
     "visual_command_dashboard_default_visible": false,