docs(security): add parallel session recovery checks

docs/security/SECURITY-MIRROR-STATUS-ROLLUP.md

@@ -28,11 +28,11 @@
 | Review packets | S3.2 已建立；8 packets、7 ready for human review、1 block candidate |
 | State transitions | S3.3 已建立；5 個 decision options 都有 next state，且都不授權執行 |
 | Follow-up runtime gate templates | S3.4 已建立；8 個 templates、0 個 active runtime gates |
-| GitHub primary readiness gate | S4.0 已建立；8 個 candidate repos、7 個 in-scope blocked、0 個 primary ready；S4.10 已補 GitHub target owner decision response request packet、7 個 template statuses、3 個 audit event templates、5 個 redaction examples、6 個 collection checks、6 個 intake preflight checks 與收件包，7 個 response templates、owner response 0 筆；S4.11 已補 refs truth owner response request packet、5 個 template statuses、3 個 audit event templates、5 個 redaction examples、6 個 collection checks、6 個 intake preflight checks 與收件包，5 個 response templates、owner response 0 筆、audit events emitted 0 筆；S4.12 已補 workflow / secret 名稱 owner response request packet、5 個 template statuses、3 個 audit event templates、5 個 redaction examples、6 個 collection checks、6 個 intake preflight checks 與收件包，5 個 response templates、owner response 0 筆、audit events emitted 0 筆；S4.13 已補四包 owner response validation rollup、6 條 evidence routing rules、8 個 display sections、7 條 state transition rules、9 個 reviewer checklist items、7 條 reviewer outcome lanes、4 個 reviewer audit event templates、5 個 reviewer audit display sections、6 個 reviewer audit collection checks、5 個 reviewer audit redaction examples、5 條 reviewer audit retention rules、6 個 reviewer audit retention checks、6 個 reviewer audit handoff packets、6 個 reviewer audit handoff checks、6 個 parallel session sync checks 與 6 條 parallel session conflict lanes，22 個 templates、received / accepted / rejected 皆為 0、reviewer audit emitted 仍為 0 |
+| GitHub primary readiness gate | S4.0 已建立；8 個 candidate repos、7 個 in-scope blocked、0 個 primary ready；S4.10 已補 GitHub target owner decision response request packet、7 個 template statuses、3 個 audit event templates、5 個 redaction examples、6 個 collection checks、6 個 intake preflight checks 與收件包，7 個 response templates、owner response 0 筆；S4.11 已補 refs truth owner response request packet、5 個 template statuses、3 個 audit event templates、5 個 redaction examples、6 個 collection checks、6 個 intake preflight checks 與收件包，5 個 response templates、owner response 0 筆、audit events emitted 0 筆；S4.12 已補 workflow / secret 名稱 owner response request packet、5 個 template statuses、3 個 audit event templates、5 個 redaction examples、6 個 collection checks、6 個 intake preflight checks 與收件包，5 個 response templates、owner response 0 筆、audit events emitted 0 筆；S4.13 已補四包 owner response validation rollup、6 條 evidence routing rules、8 個 display sections、7 條 state transition rules、9 個 reviewer checklist items、7 條 reviewer outcome lanes、4 個 reviewer audit event templates、5 個 reviewer audit display sections、6 個 reviewer audit collection checks、5 個 reviewer audit redaction examples、5 條 reviewer audit retention rules、6 個 reviewer audit retention checks、6 個 reviewer audit handoff packets、6 個 reviewer audit handoff checks、6 個 parallel session sync checks、6 條 parallel session conflict lanes 與 6 個 parallel session recovery checks，22 個 templates、received / accepted / rejected 皆為 0、reviewer audit emitted 仍為 0 |
 | GitHub primary rollback ADR | S4.4 已建立；7 個 in-scope rollback drafts、0 個 owner approved、0 個 dry-run completed、0 個 active cutover |
 | Gitea inventory | S4.5 已補認證清冊匯出請求；S4.6 已補匯入驗收契約；S4.7 已補 owner coverage attestation；S4.8 已把既有 Gitea queue/gate/review packet/follow-up gate 對齊 attestation 先行；S4.9 已補 owner response request packet、5 個 template statuses、3 個 audit event templates、5 個 redaction examples、8 個 display sections、6 個 collection checks、owner response 收件包、6 個 intake preflight checks 與 5 個 outcome lanes；目前 status=`partial_waiting_authenticated_inventory`、未認證公開範圍 repos 2 個、本機可見 Gitea unique repos 4 個、匯出來源選項 2 類、匯入驗收 payload 0 筆、owner attestation items 5 個、收到 attestation 0 筆、owner response 0 筆、audit events emitted 0 筆、敏感 payload 必須隔離、允許收集 token value=false |
 | Workflow / secret name inventory | S4.1 已建立；S4.2 補 4 個 repos、31 個 workflow files、43 個 referenced secret names 的 local evidence；S4.3 補 7 個 repos、5 類 lanes 的 redacted export request；S4.12 補 1 個 owner response request packet、5 個 template statuses、3 個 audit event templates、5 個 redaction examples、6 個 collection checks、6 個 intake preflight checks 與 5 個 owner response templates；0 個 inventory complete、audit events emitted 0 筆、禁止收集 secret value、禁止 write token |
-| Owner response validation | S4.13 已建立；四包 owner response 目前 received/accepted 皆為 0；4 條 missing response lanes、4 步 collection order、next collection candidate、6 條 evidence routing rules、8 個 display sections、7 條 state transition rules、9 個 reviewer checklist items、7 條 reviewer outcome lanes、4 個 reviewer audit event templates、5 個 reviewer audit display sections、6 個 reviewer audit collection checks、5 個 reviewer audit redaction examples、5 條 reviewer audit retention rules、6 個 reviewer audit retention checks、6 個 reviewer audit handoff packets、6 個 reviewer audit handoff checks、6 個 parallel session sync checks 與 6 條 parallel session conflict lanes 可供 AwoooP 直接顯示；下一個建議收件為 S4.9 Gitea owner attestation；latest local validation 為 `SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK`，reviewer audit emitted 仍為 0，不代表 owner response 已收到或任何執行授權 |
+| Owner response validation | S4.13 已建立；四包 owner response 目前 received/accepted 皆為 0；4 條 missing response lanes、4 步 collection order、next collection candidate、6 條 evidence routing rules、8 個 display sections、7 條 state transition rules、9 個 reviewer checklist items、7 條 reviewer outcome lanes、4 個 reviewer audit event templates、5 個 reviewer audit display sections、6 個 reviewer audit collection checks、5 個 reviewer audit redaction examples、5 條 reviewer audit retention rules、6 個 reviewer audit retention checks、6 個 reviewer audit handoff packets、6 個 reviewer audit handoff checks、6 個 parallel session sync checks、6 條 parallel session conflict lanes 與 6 個 parallel session recovery checks 可供 AwoooP 直接顯示；下一個建議收件為 S4.9 Gitea owner attestation；latest local validation 為 `SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK`，reviewer audit emitted 仍為 0，不代表 owner response 已收到或任何執行授權 |
 | Dry-run | `contract_defined_not_executed`；已納入 `CHECK_PROGRESS_GUARD` 與 `CHECK_OWNER_RESPONSE_GUARD`，latest local validation 為 `repo_snapshot_guard_pass`，仍不代表 production ingestion |
 | Runtime actions | `false` |
 | Payload ingestion | `false` |
@@ -85,6 +85,7 @@
 | S4.13 reviewer audit handoff checks | framework detail | 0 | 只確認 handoff packets 可見、counters 不變、source packets 必讀、安全顯示欄位、runtime 誤讀阻擋與 next focus 未被標記 received，不代表 owner response、production ingestion、approval、runtime gate 或 execution authorization |
 | S4.13 parallel session sync checks | framework detail | 0 | 只確認同一 PR 分支、latest delta 可見、counters 仍為 0、runtime flags 仍為 false、source-control mutation 阻擋與 next focus 維持 S4.9，不代表 owner response、production ingestion、approval、runtime gate 或 execution authorization |
 | S4.13 parallel session conflict lanes | framework detail | 0 | 只把 stale branch、stale delta、counter drift、runtime flag drift、source-control mutation request 與 next focus drift 分流到停下重讀或人工 review，不代表 owner response、production ingestion、approval、runtime gate 或 execution authorization |
+| S4.13 parallel session recovery checks | framework detail | 0 | 只確認 conflict lane 後要重抓遠端、重讀 latest ledger、重跑只讀 guards、review staged diff、確認 runtime false flags 與回到 S4.9 next focus，不代表 owner response、production ingestion、approval、runtime gate 或 execution authorization |
 
 headline 進度要再往上，至少需要下列任一高層 gate 有實質 evidence：
 
@@ -132,7 +133,7 @@ python3 scripts/security/security-mirror-progress-guard.py
 5. Kali `/execute` 維持 block candidate。
 6. Refs truth owner response：先依 S4.11 request packet、template status ledger、audit event templates、redaction examples、collection checks 與 intake preflight checks 顯示 main/dev truth、deprecated drift、release tag、GitHub-only refs 的 5 個 response templates；received / accepted response 目前皆為 0，audit events emitted 仍為 0，不得把 request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 或 response packet 當成 refs sync、delete、force push 或 primary approval。
 7. Workflow / secret 名稱 owner response：先依 S4.12 request packet、template status ledger、audit event templates、redaction examples、collection checks 與 intake preflight checks 顯示 webhook、runner、deploy key、branch protection / CODEOWNERS、repository secret name parity 的 5 個 response templates；received / accepted response 目前皆為 0，audit events emitted 仍為 0，不得把 request packet、template status ledger、audit event templates、redaction examples、collection checks、intake preflight checks 或 response packet 當成 secret value 收集、workflow 修改、GitHub hosted runner 啟用或 primary approval。
-8. Owner response validation rollup：先依 S4.13 顯示 S4.9/S4.10/S4.11/S4.12 四包 response packets、22 個 templates、10 個 cross-packet checks、6 條 evidence routing rules、8 個 display sections、7 條 state transition rules、9 個 reviewer checklist items、7 條 reviewer outcome lanes、4 個 reviewer audit event templates、5 個 reviewer audit display sections、6 個 reviewer audit collection checks、5 個 reviewer audit redaction examples、5 條 reviewer audit retention rules、6 個 reviewer audit retention checks、6 個 reviewer audit handoff packets、6 個 reviewer audit handoff checks、6 個 parallel session sync checks、6 條 parallel session conflict lanes 與 quarantine rules；不得把 rollup、routing、display sections、state transition rules、reviewer checklist、reviewer outcome lanes、reviewer audit templates、reviewer audit display sections、reviewer audit collection checks、reviewer audit redaction examples、reviewer audit retention rules、reviewer audit retention checks、reviewer audit handoff packets / checks、parallel session sync checks 或 parallel session conflict lanes 當成 approval、runtime gate、production ingestion 或 execution authorization。
+8. Owner response validation rollup：先依 S4.13 顯示 S4.9/S4.10/S4.11/S4.12 四包 response packets、22 個 templates、10 個 cross-packet checks、6 條 evidence routing rules、8 個 display sections、7 條 state transition rules、9 個 reviewer checklist items、7 條 reviewer outcome lanes、4 個 reviewer audit event templates、5 個 reviewer audit display sections、6 個 reviewer audit collection checks、5 個 reviewer audit redaction examples、5 條 reviewer audit retention rules、6 個 reviewer audit retention checks、6 個 reviewer audit handoff packets、6 個 reviewer audit handoff checks、6 個 parallel session sync checks、6 條 parallel session conflict lanes、6 個 parallel session recovery checks 與 quarantine rules；不得把 rollup、routing、display sections、state transition rules、reviewer checklist、reviewer outcome lanes、reviewer audit templates、reviewer audit display sections、reviewer audit collection checks、reviewer audit redaction examples、reviewer audit retention rules、reviewer audit retention checks、reviewer audit handoff packets / checks、parallel session sync checks、parallel session conflict lanes 或 parallel session recovery checks 當成 approval、runtime gate、production ingestion 或 execution authorization。
 9. GitHub primary readiness blockers 與 rollback ADR 缺口。
 10. S4.4 GitHub primary rollback ADR 草案：先顯示 7 個 repo 的 rollback owner、validation window 與 triggers，owner approval 前不可執行。
 11. workflow / webhook / runner / deploy key / branch protection / CODEOWNERS / secret 名稱 inventory 缺口，先看 S4.2 local evidence，再依 S4.3 redacted export request 與 S4.12 owner response request packet / template status ledger / audit event templates / redaction examples / collection checks / intake preflight checks / 收件包補 webhook / runner / deploy key / branch protection / repository secret parity；只保存名稱與 owner，不保存 value，不使用 write token。