docs(security): 補 S4.10 owner response canonical fields [skip ci]

docs/security/GITHUB-TARGET-OWNER-DECISION-RESPONSE.md

@@ -76,7 +76,21 @@ S4.10 template status ledger 只讓 AwoooP 逐項顯示 9 個 GitHub target temp
 
 ## 2. Owner Response 必填欄位
 
-每筆 response 至少要能回答 owner role/team、decision、decision reason、canonical source、GitHub target disposition、visibility review owner 與 redacted evidence refs；新納入的 `VibeWork` 必須補 product / surface owner，`agent-bounty-protocol` 必須補 external agent / treasury / runtime gate owner。
+每筆 response 至少要能回答下列 canonical 9 欄。這 9 欄只代表收件與 reviewer 可判讀，不代表 repo creation、visibility change、refs sync、GitHub primary 或 runtime execution 被批准。
+
+| 欄位 | 必填內容 | 缺漏時處理 |
+|------|----------|------------|
+| `owner_role_or_team` | 回覆責任角色或團隊，不收個人 credential 或敏感身份資料 | 補件 |
+| `decision` | 只能使用第 4 節可接受決策值 | 非允許值拒收 |
+| `decision_reason` | 決策理由摘要，不得貼 raw secret、token、cookie、未脫敏截圖或 API body | 補件或隔離 |
+| `affected_scope` | 影響範圍，例如 repo、canonical source、visibility、refs truth、workflow-secret parity、產品邊界或 agent runtime boundary | 補件 |
+| `redacted_evidence_refs` | 只引用 repo 內文件、snapshot 或已脫敏 metadata pointer | 疑似敏感 payload 進 quarantine |
+| `followup_owner` | 下一步補證或判定負責人 | 補件 |
+| `rollback_owner` | 若未來進入變更候選，誰負責 rollback 判定與回復計畫 | 補件 |
+| `maintenance_window` | 若未來進入變更候選，允許審查的維護窗口或明確標示 `not_authorized_yet` | 補件 |
+| `validation_plan` | 若未來進入變更候選，要如何驗證 read-only update、repo / refs / workflow 邊界與 post-check | 補件 |
+
+每個 template 仍可要求 target-specific 欄位，例如 `canonical_source`、`github_target_disposition`、`visibility_review_owner`、`refs_truth_review_owner`、`product_boundary_owner`、`external_agent_owner`、`treasury_owner` 或 `runtime_gate_owner`。新納入的 `VibeWork` 必須補 product / surface owner，`agent-bounty-protocol` 必須補 external agent / treasury / runtime gate owner。
 
 ## 3. 九個 Response Template
 
@@ -110,12 +124,12 @@ S4.10 template status ledger 只讓 AwoooP 逐項顯示 9 個 GitHub target temp
 
 1. `github_repo` 必須對應 github_target_decision_v1 的 9 個 approval-required targets 之一。
 2. `decision` 必須是該 target template 的 acceptable_decisions 之一。
-3. 每筆回覆必須有 owner role/team、visibility review owner 或明確 out-of-scope disposition。
+3. 每筆回覆必須填齊 canonical 9 欄，並依 template 補齊 visibility review owner、canonical source 或明確 out-of-scope disposition。
 4. in-scope 或 candidate target 必須標示 canonical source；未知時必須選 unknown_requires_more_evidence。
 5. 回覆不得把 refs truth、workflow-secret parity、Gitea inventory、rollback ADR 或 server-side diff 缺口視為已完成。
 6. 回覆只能批准候選方向或補證方向，不得包含立即建立 repo 或修改 visibility 的執行要求。
 7. 回覆不得要求 push、delete、force push、mirror sync、primary switch 或 disable Gitea。
-8. `evidence_refs` 只能指向 repo 內文件、snapshot 或已脫敏 owner metadata，不得含 token、credential、secret value、private key 或 deploy key value。
+8. `redacted_evidence_refs` 只能指向 repo 內文件、snapshot 或已脫敏 owner metadata，不得含 token、credential、secret value、private key 或 deploy key value。
 
 ## 6. 必須拒收
 
@@ -124,7 +138,7 @@ S4.10 template status ledger 只讓 AwoooP 逐項顯示 9 個 GitHub target temp
 3. 回覆含 visibility change command 或要求立即修改 public/private/internal visibility 時必須拒收。
 4. 回覆要求 push refs、delete refs、force push、mirror sync、tag rewrite 或 branch rewrite 時必須拒收。
 5. 回覆要求切 GitHub primary、停用 Gitea、刪除 Gitea、封存 Gitea 或移除 fallback 時必須拒收。
-6. 回覆缺 owner、visibility review owner、canonical source 或 out-of-scope disposition 時不得標記 accepted。
+6. 回覆缺 canonical 9 欄、visibility review owner、canonical source 或 out-of-scope disposition 時不得標記 accepted。
 7. 回覆把 `not_found_or_private` 自動解釋為 repo 不存在或可建立時必須拒收。
 8. 回覆要求自動合併 unrelated histories 或刪除 momo / ewoooc working tree 時必須拒收。
 9. 回覆把 owner decision response 當成 repo migration approval、refs sync approval 或 primary approval 時必須拒收。

docs/security/github-target-owner-decision-response.snapshot.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "github_target_owner_decision_response_v1",
   "status": "draft_waiting_owner_response",
-  "date": "2026-06-04",
+  "date": "2026-06-11",
   "mode": "owner_decision_response_intake_only",
   "runtime_execution_authorized": false,
   "source_contract": "github_target_decision_v1",
@@ -80,7 +80,7 @@
     {
       "check_id": "p1-3-required-owner-fields",
       "display_order": 5,
-      "check": "必須有 owner role/team、decision、reason、canonical source、target disposition、visibility review owner、redacted evidence refs。",
+      "check": "必須有 owner role/team、decision、decision reason、affected scope、redacted evidence refs、followup owner、rollback owner、maintenance window、validation plan。",
       "current_status": "defined_not_dispatched",
       "execution_authorized": false
     },
@@ -125,11 +125,12 @@
       "owner_role_or_team",
       "decision",
       "decision_reason",
-      "canonical_source",
-      "github_target_disposition",
-      "visibility_review_owner",
+      "affected_scope",
       "redacted_evidence_refs",
-      "followup_owner"
+      "followup_owner",
+      "rollback_owner",
+      "maintenance_window",
+      "validation_plan"
     ],
     "forbidden_inputs": [
       "token_value",
@@ -169,7 +170,7 @@
       "target-vibework-private-or-new",
       "target-agent-bounty-protocol-private-or-new"
     ],
-    "owner_instruction_summary": "請 owner 只依 S4.10 九個 templates 回覆 GitHub target 的 owner / visibility / canonical / target disposition，並只引用脫敏 evidence refs；不要貼 token、secret、private clone URL credential、repo archive、git object、API request body 或任何可執行 payload。",
+    "owner_instruction_summary": "請 owner 只依 S4.10 九個 templates 回覆 GitHub target 的 owner / visibility / canonical / target disposition，且每筆都要填齊 owner role/team、decision、decision reason、affected scope、redacted evidence refs、followup owner、rollback owner、maintenance window、validation plan；不要貼 token、secret、private clone URL credential、repo archive、git object、API request body 或任何可執行 payload。",
     "allowed_response_fields": [
       "owner_role_or_team",
       "decision",
@@ -190,7 +191,12 @@
       "surface_owner",
       "external_agent_owner",
       "treasury_owner",
-      "runtime_gate_owner"
+      "runtime_gate_owner",
+      "affected_scope",
+      "redacted_evidence_refs",
+      "rollback_owner",
+      "maintenance_window",
+      "validation_plan"
     ],
     "evidence_ref_rules": [
       "只允許 repo 內既有文件、snapshot 或已脫敏 owner metadata pointer",
@@ -805,7 +811,7 @@
       "display_order": 6,
       "title": "只記錄 GitHub target audit metadata",
       "required": true,
-      "pass_condition": "AwoooP 只能記錄 request shown、response received metadata、template id、github repo、owner role/team、redacted evidence refs 與 outcome lane；不得保存 token value、secret value、private clone URL credential、repo archive、git object pack 或可執行 payload。",
+      "pass_condition": "AwoooP 只能記錄 request shown、response received metadata、template id、github repo、owner role/team、affected scope、redacted evidence refs、followup owner、rollback owner、maintenance window、validation plan 與 outcome lane；不得保存 token value、secret value、private clone URL credential、repo archive、git object pack 或可執行 payload。",
       "failure_lane": "quarantine_sensitive_payload",
       "awooop_display": "display_audit_metadata_only",
       "execution_authorized": false,
@@ -828,7 +834,7 @@
       "display_order": 2,
       "title": "GitHub target 必填欄位完整",
       "required": true,
-      "pass_condition": "每筆 response 必須有 owner role/team、decision、decision_reason、canonical_source、target disposition 或 out-of-scope disposition、visibility review owner 與 evidence_refs。",
+      "pass_condition": "每筆 response 必須有 owner role/team、decision、decision_reason、affected_scope、redacted_evidence_refs、followup_owner、rollback_owner、maintenance_window 與 validation_plan；target-specific canonical source、target disposition、visibility review owner 或 out-of-scope disposition 仍需依 template 補齊。",
       "failure_lane": "request_more_evidence",
       "awooop_display": "request_more_evidence",
       "execution_authorized": false
@@ -886,6 +892,12 @@
         "owner_role_or_team",
         "decision",
         "decision_reason",
+        "affected_scope",
+        "redacted_evidence_refs",
+        "followup_owner",
+        "rollback_owner",
+        "maintenance_window",
+        "validation_plan",
         "canonical_source",
         "github_target_disposition",
         "visibility_review_owner",
@@ -906,12 +918,14 @@
       "acceptance_criteria": [
         "必須明確指定 `wooo/awoooi` 的 canonical source 與 owner review 責任人。",
         "必須承認 refs truth / workflow-secret parity / rollback ADR 未完成前不得推 refs 或切 primary。",
-        "若 decision 是 hold，必須說明下一個 evidence owner。"
+        "若 decision 是 hold，必須說明下一個 evidence owner。",
+        "必須填齊 S4.10 canonical 9 欄，包含 affected scope、redacted evidence refs、followup owner、rollback owner、maintenance window 與 validation plan。"
       ],
       "rejection_conditions": [
         "把既有 GitHub repo 視為可直接 primary。",
         "要求 push、delete、force push refs 或修改 visibility。",
-        "缺 canonical source、visibility review owner 或 refs truth review owner。"
+        "缺 canonical source、visibility review owner 或 refs truth review owner。",
+        "缺 rollback owner、maintenance window 或 validation plan。"
       ],
       "allowed_outputs": [
         "更新 GitHub target decision table 的 owner / canonical / visibility read-only 欄位。",
@@ -931,6 +945,12 @@
         "owner_role_or_team",
         "decision",
         "decision_reason",
+        "affected_scope",
+        "redacted_evidence_refs",
+        "followup_owner",
+        "rollback_owner",
+        "maintenance_window",
+        "validation_plan",
         "canonical_source",
         "tag_disposition_owner",
         "visibility_review_owner",
@@ -950,12 +970,14 @@
       "acceptance_criteria": [
         "必須說明 main SHA 與 tag 差異要由哪個 owner 判定。",
         "若仍 active，必須保留 refs review lane。",
-        "若排除 scope，必須附 owner 理由與後續 disposition。"
+        "若排除 scope，必須附 owner 理由與後續 disposition。",
+        "必須填齊 S4.10 canonical 9 欄，包含 affected scope、redacted evidence refs、followup owner、rollback owner、maintenance window 與 validation plan。"
       ],
       "rejection_conditions": [
         "用單一句話批准 refs sync。",
         "未處理 GitHub 缺 Gitea tag 的 disposition。",
-        "要求刪除任一端 repo 或 refs。"
+        "要求刪除任一端 repo 或 refs。",
+        "缺 rollback owner、maintenance window 或 validation plan。"
       ],
       "allowed_outputs": [
         "更新 refs truth review lane。",
@@ -975,6 +997,12 @@
         "owner_role_or_team",
         "decision",
         "decision_reason",
+        "affected_scope",
+        "redacted_evidence_refs",
+        "followup_owner",
+        "rollback_owner",
+        "maintenance_window",
+        "validation_plan",
         "canonical_source",
         "github_only_refs_owner",
         "visibility_review_owner",
@@ -994,12 +1022,14 @@
       "acceptance_criteria": [
         "必須指定 GitHub-only branch / tags 的 owner 或補證 owner。",
         "必須說明 main SHA truth source 尚未判定時要維持 blocked。",
-        "若標為 out_of_scope，必須說明與 AwoooP / AWOOOI scope 的關係。"
+        "若標為 out_of_scope，必須說明與 AwoooP / AWOOOI scope 的關係。",
+        "必須填齊 S4.10 canonical 9 欄，包含 affected scope、redacted evidence refs、followup owner、rollback owner、maintenance window 與 validation plan。"
       ],
       "rejection_conditions": [
         "要求刪除 GitHub-only refs。",
         "未指定 GitHub-only refs owner。",
-        "把 refs classification 當成已批准 sync。"
+        "把 refs classification 當成已批准 sync。",
+        "缺 rollback owner、maintenance window 或 validation plan。"
       ],
       "allowed_outputs": [
         "更新 refs truth classification 的 owner review 欄位。",
@@ -1019,6 +1049,12 @@
         "owner_role_or_team",
         "decision",
         "decision_reason",
+        "affected_scope",
+        "redacted_evidence_refs",
+        "followup_owner",
+        "rollback_owner",
+        "maintenance_window",
+        "validation_plan",
         "canonical_source",
         "internal_remote_disposition",
         "secret_name_inventory_owner",
@@ -1038,12 +1074,14 @@
       "acceptance_criteria": [
         "必須判定 110 internal remote 是 active source、mirror、legacy 或需要補證。",
         "必須指定 infra secret 名稱 inventory owner。",
-        "不得把 internal remote disposition 當成刪除 remote 的批准。"
+        "不得把 internal remote disposition 當成刪除 remote 的批准。",
+        "必須填齊 S4.10 canonical 9 欄，包含 affected scope、redacted evidence refs、followup owner、rollback owner、maintenance window 與 validation plan。"
       ],
       "rejection_conditions": [
         "要求直接刪除 remote 或改 remote URL。",
         "要求搬移或貼出 secret value。",
-        "未說明 110 internal remote 用途。"
+        "未說明 110 internal remote 用途。",
+        "缺 rollback owner、maintenance window 或 validation plan。"
       ],
       "allowed_outputs": [
         "更新 canonical decision table 的 remote disposition。",
@@ -1063,6 +1101,12 @@
         "owner_role_or_team",
         "decision",
         "decision_reason",
+        "affected_scope",
+        "redacted_evidence_refs",
+        "followup_owner",
+        "rollback_owner",
+        "maintenance_window",
+        "validation_plan",
         "canonical_source",
         "github_target_disposition",
         "visibility_review_owner",
@@ -1084,12 +1128,14 @@
       "acceptance_criteria": [
         "必須明確說明 `not_found_or_private` 不能自動視為不存在。",
         "必須指定 ewoooc / momo-pro-system canonical 判定 owner。",
-        "若只是批准候選新 repo，仍不得建立 repo，必須先產生 migration plan。"
+        "若只是批准候選新 repo，仍不得建立 repo，必須先產生 migration plan。",
+        "必須填齊 S4.10 canonical 9 欄，包含 affected scope、redacted evidence refs、followup owner、rollback owner、maintenance window 與 validation plan。"
       ],
       "rejection_conditions": [
         "把 `not_found_or_private` 當成建立 repo 的直接批准。",
         "自動合併 unrelated histories。",
-        "要求刪除任一 momo / ewoooc working tree。"
+        "要求刪除任一 momo / ewoooc working tree。",
+        "缺 rollback owner、maintenance window 或 validation plan。"
       ],
       "allowed_outputs": [
         "更新 target decision table 的 disposition。",
@@ -1109,6 +1155,12 @@
         "owner_role_or_team",
         "decision",
         "decision_reason",
+        "affected_scope",
+        "redacted_evidence_refs",
+        "followup_owner",
+        "rollback_owner",
+        "maintenance_window",
+        "validation_plan",
         "active_status",
         "canonical_source",
         "github_target_disposition",
@@ -1130,12 +1182,14 @@
       "acceptance_criteria": [
         "必須說明 repo 是否仍 active。",
         "必須指定 GitHub target 是既有 private、候選新 repo、out-of-scope 或需補證。",
-        "若 active，必須保留 workflow / secret name parity gate。"
+        "若 active，必須保留 workflow / secret name parity gate。",
+        "必須填齊 S4.10 canonical 9 欄，包含 affected scope、redacted evidence refs、followup owner、rollback owner、maintenance window 與 validation plan。"
       ],
       "rejection_conditions": [
         "把 target 看不到當成可直接建立 repo。",
         "沒有 active_status 或 visibility review owner。",
-        "要求自動 push refs 或刪除 110 remote。"
+        "要求自動 push refs 或刪除 110 remote。",
+        "缺 rollback owner、maintenance window 或 validation plan。"
       ],
       "allowed_outputs": [
         "更新 target decision table 的 active / disposition 欄位。",
@@ -1155,6 +1209,12 @@
         "owner_role_or_team",
         "decision",
         "decision_reason",
+        "affected_scope",
+        "redacted_evidence_refs",
+        "followup_owner",
+        "rollback_owner",
+        "maintenance_window",
+        "validation_plan",
         "active_status",
         "canonical_source",
         "github_target_disposition",
@@ -1176,12 +1236,14 @@
       "acceptance_criteria": [
         "必須說明 repo 是否仍 active。",
         "必須指定 GitHub target 是既有 private、候選新 repo、out-of-scope 或需補證。",
-        "若 active，必須保留 workflow / secret name parity gate。"
+        "若 active，必須保留 workflow / secret name parity gate。",
+        "必須填齊 S4.10 canonical 9 欄，包含 affected scope、redacted evidence refs、followup owner、rollback owner、maintenance window 與 validation plan。"
       ],
       "rejection_conditions": [
         "把 target 看不到當成可直接建立 repo。",
         "沒有 active_status 或 visibility review owner。",
-        "要求自動 push refs 或刪除 110 remote。"
+        "要求自動 push refs 或刪除 110 remote。",
+        "缺 rollback owner、maintenance window 或 validation plan。"
       ],
       "allowed_outputs": [
         "更新 target decision table 的 active / disposition 欄位。",
@@ -1201,6 +1263,12 @@
         "owner_role_or_team",
         "decision",
         "decision_reason",
+        "affected_scope",
+        "redacted_evidence_refs",
+        "followup_owner",
+        "rollback_owner",
+        "maintenance_window",
+        "validation_plan",
         "canonical_source",
         "github_target_disposition",
         "visibility_review_owner",
@@ -1223,12 +1291,14 @@
       "acceptance_criteria": [
         "必須說明 VibeWork 是否已有 private GitHub target 或只是新 target candidate。",
         "必須指定 product boundary owner、repo owner、surface owner 與 visibility review owner。",
-        "必須明確保留 VibeWork 獨立產品邊界，不得把 target decision 當成併入 AWOOOI 或 primary cutover approval。"
+        "必須明確保留 VibeWork 獨立產品邊界，不得把 target decision 當成併入 AWOOOI 或 primary cutover approval。",
+        "必須填齊 S4.10 canonical 9 欄，包含 affected scope、redacted evidence refs、followup owner、rollback owner、maintenance window 與 validation plan。"
       ],
       "rejection_conditions": [
         "把 not_found_or_private 視為可直接建立 repo。",
         "缺 product boundary owner、canonical source 或 visibility review owner。",
-        "要求修改 workflow、搬 secret value、push refs 或切 primary。"
+        "要求修改 workflow、搬 secret value、push refs 或切 primary。",
+        "缺 rollback owner、maintenance window 或 validation plan。"
       ],
       "allowed_outputs": [
         "更新 GitHub target decision table 的 VibeWork read-only disposition。",
@@ -1248,6 +1318,12 @@
         "owner_role_or_team",
         "decision",
         "decision_reason",
+        "affected_scope",
+        "redacted_evidence_refs",
+        "followup_owner",
+        "rollback_owner",
+        "maintenance_window",
+        "validation_plan",
         "canonical_source",
         "github_target_disposition",
         "visibility_review_owner",
@@ -1271,12 +1347,14 @@
       "acceptance_criteria": [
         "必須說明 agent-bounty-protocol 是否已有 private GitHub target 或只是新 target candidate。",
         "必須指定 repo、deployment、external agent、treasury 與 runtime gate owner。",
-        "必須確認 A2A / MCP / bounty / treasury / payout / withdrawal 不因 target response 而開啟 runtime。"
+        "必須確認 A2A / MCP / bounty / treasury / payout / withdrawal 不因 target response 而開啟 runtime。",
+        "必須填齊 S4.10 canonical 9 欄，包含 affected scope、redacted evidence refs、followup owner、rollback owner、maintenance window 與 validation plan。"
       ],
       "rejection_conditions": [
         "把 not_found_or_private 視為可直接建立 repo。",
         "缺 external agent owner、treasury owner、runtime gate owner 或 visibility review owner。",
-        "要求啟用 agent action、payout、withdrawal、workflow 修改、push refs 或切 primary。"
+        "要求啟用 agent action、payout、withdrawal、workflow 修改、push refs 或切 primary。",
+        "缺 rollback owner、maintenance window 或 validation plan。"
       ],
       "allowed_outputs": [
         "更新 GitHub target decision table 的 agent-bounty-protocol read-only disposition。",
@@ -1307,7 +1385,7 @@
       "check_id": "owner_and_visibility_present",
       "title": "owner 與 visibility review 責任存在",
       "required": true,
-      "pass_condition": "每筆回覆必須有 owner role/team、visibility review owner 或明確 out-of-scope disposition。",
+      "pass_condition": "每筆回覆必須有 canonical 9 欄，並依 template 補齊 visibility review owner、canonical source 或明確 out-of-scope disposition。",
       "failure_lane": "request_more_evidence",
       "execution_authorized": false
     },
@@ -1347,7 +1425,7 @@
       "check_id": "secret_values_absent",
       "title": "未包含 secret value",
       "required": true,
-      "pass_condition": "`evidence_refs` 只能指向 repo 內文件、snapshot 或已脫敏 owner metadata，不得含 token、credential、secret value、private key 或 deploy key value。",
+      "pass_condition": "`redacted_evidence_refs` 只能指向 repo 內文件、snapshot 或已脫敏 owner metadata，不得含 token、credential、secret value、private key 或 deploy key value。",
       "failure_lane": "quarantine_sensitive_payload",
       "execution_authorized": false
     }
@@ -1370,7 +1448,9 @@
     "更新 `source-control-primary-readiness-gate.snapshot.json` 的 blocker wording。",
     "更新 `source-control-approval-board.snapshot.json` 的 review lane。",
     "建立 request_more_evidence / quarantine lane。",
-    "維持 `github_primary_ready_count=0` 與所有 execution flags false。"
+    "維持 `github_primary_ready_count=0` 與所有 execution flags false。",
+    "建立 read-only owner response validation record candidate，不進 execution queue。",
+    "更新 S4.10 收件缺口矩陣的欄位完整度，不調高 owner response accepted count。"
   ],
   "forbidden_actions": [
     "建立 GitHub repo。",