docs(security): 新增 Backup Restore owner request draft [skip ci]

docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md

@@ -16,6 +16,10 @@ Backup / restore / escrow / retention 已從抽象待辦推進成可重跑的 re
 
 此清冊仍不是 live backup truth。它只證明 repo 裡有哪些備份、還原、離機同步、credential escrow、Velero、alert 與 DR 文件需要被控管；不代表備份已成功、restore drill 已執行、offsite sync 已授權、escrow marker 可寫入或 retention policy 可變更。
 
+2026-06-14 已新增 `docs/security/BACKUP-RESTORE-OWNER-REQUEST-DRAFT.md` 與 `docs/security/backup-restore-owner-request-draft.snapshot.json`，將 38 個 backup / restore / escrow surface 轉成 owner request draft。固定 `request_draft_count=38`、`write_capable_request_draft_count=27`、`live_evidence_required_request_count=38`、`required_owner_field_count=14`、`blocked_action_count=18`、`request_sent_count=0`、`owner_response_received_count=0`、`runtime_gate_count=0`。
+
+此 artifact 只表示 owner request 的 required shape，不代表 request sent、recipient confirmed、owner response received / accepted、live backup evidence、backup run、restore run、offsite sync、remote delete、credential escrow marker write、retention change、restic prune、rclone config、Velero restore / backup、kubectl action、SSH、secret collection、host write、production write 或 runtime gate。
+
 ## 2. 覆蓋摘要
 
 | 指標 | 目前值 | 邊界 |
@@ -126,6 +130,7 @@ python3 scripts/security/backup-restore-escrow-inventory.py \
 | owner response 收件 / 接受 | `0%` | 尚未送件、收件或接受 |
 | live evidence collection | `0%` | 未 SSH、未 rclone、未 kubectl、未 restore |
 | restore / offsite / escrow / retention gate | `0%` | 全部仍為 `0 / false` |
+| owner request draft | `100%` | 已新增 38 份 request draft、snapshot、文件與 guard；request sent / received / accepted 仍為 0 |
 
 ## 9. 邊界
 

docs/security/BACKUP-RESTORE-OWNER-REQUEST-DRAFT.md

@@ -0,0 +1,111 @@
+# IwoooS Backup / Restore / Escrow Owner Request Draft
+
+| 項目 | 內容 |
+|------|------|
+| 日期 | 2026-06-14 |
+| 狀態 | `owner_request_draft_ready_not_dispatched` |
+| 工具 | `scripts/security/backup-restore-owner-request-draft.py` |
+| Snapshot | `docs/security/backup-restore-owner-request-draft.snapshot.json` |
+| Source inventory | `docs/security/backup-restore-escrow-inventory.snapshot.json` |
+| runtime gate | `0` |
+
+## 1. 目的
+
+本文件承接 Backup / Restore / Escrow / Retention repo-only 清冊，把 38 個 surface 轉成人工送件前 request draft。它讓備份總控、服務備份、Restic retention、offsite sync、credential escrow、Velero、restore drill、alert / health 與 DR 文件有一致的 owner 回覆欄位。
+
+這不是 live backup truth、不是備份成功證明、不是 restore drill 授權、不是 offsite sync 授權、不是 credential escrow marker 可寫入，也不是 retention policy 可變更。
+
+## 2. 摘要
+
+| 指標 | 目前值 | 說明 |
+|------|--------|------|
+| request draft | `38` | 每個 backup / restore / escrow surface 一份草稿 |
+| write-capable request draft | `27` | backup、restore、offsite、escrow、retention、Velero、health exporter 等可寫 / 可執行 surface |
+| live evidence required request | `38` | 全部都需 owner 提供非敏感 live evidence |
+| request field | `24` | 草稿欄位總數 |
+| required owner field | `14` | owner 必填欄位 |
+| blocked action | `18` | backup、restore、offsite sync、remote delete、marker write、retention、prune、rclone、Velero、kubectl、SSH、secret collection、runtime gate 等 |
+| request sent / recipient confirmed | `0 / 0` | 尚未送件 |
+| owner response received / accepted | `0 / 0` | 尚未收到或驗收 |
+| live evidence received | `0` | 不 SSH、不讀 offsite、不讀 live backup |
+| restore / offsite / escrow / retention accepted | `0 / 0 / 0 / 0` | 不得執行或標記完成 |
+| runtime gate / action button | `0 / 0` | 不提供操作入口 |
+
+## 3. Request Draft 類型
+
+| 類型 | 代表 request | 風險焦點 |
+|------|--------------|----------|
+| 備份總控 | `backup_restore_owner_request:backup_all_orchestrator` | 全服務備份、cron、失敗通知、restore drill owner |
+| 服務備份 | `backup_restore_owner_request:backup_awoooi_service_script`、`backup_restore_owner_request:backup_harbor_service_script` | DB / registry / route / trace data 的 freshness、restore target isolation、secret redaction |
+| Restic / retention | `backup_restore_owner_request:backup_common_restic_retention` | B2 / rclone owner、retention owner、prune window、no-secret-value evidence |
+| Offsite / escrow | `backup_restore_owner_request:offsite_sync_controller`、`backup_restore_owner_request:credential_escrow_marker` | remote delete、full sync window、escrow evidence id、marker write gate |
+| Velero | `backup_restore_owner_request:velero_restore_cronjob`、`backup_restore_owner_request:velero_credentials_manifest` | RBAC、MinIO endpoint、restore isolation、secret manager source |
+| Alert / health | `backup_restore_owner_request:backup_health_exporter`、`backup_restore_owner_request:backup_restore_alert_rules` | false-green metric、alert reload owner、freshness SLO |
+| DR / cold-start | `backup_restore_owner_request:cold_start_sop` | runbook freshness、restore observer、stop condition、rollback owner |
+
+## 4. Owner 必填欄位
+
+1. `owner_role_or_team`
+2. `decision`
+3. `decision_reason`
+4. `affected_scope`
+5. `redacted_evidence_refs`
+6. `latest_backup_status_ref`
+7. `restore_drill_plan`
+8. `offsite_sync_evidence_ref`
+9. `credential_escrow_evidence_ref`
+10. `maintenance_window`
+11. `rollback_owner`
+12. `validation_plan`
+13. `retention_owner`
+14. `followup_owner`
+
+## 5. 禁止動作
+
+1. `backup_run`
+2. `restore_run`
+3. `restore_drill`
+4. `offsite_sync`
+5. `offsite_remote_delete`
+6. `credential_escrow_marker_write`
+7. `retention_change`
+8. `restic_prune`
+9. `rclone_config`
+10. `velero_restore`
+11. `velero_backup`
+12. `kubectl_action`
+13. `ssh_read`
+14. `ssh_write`
+15. `secret_value_collection`
+16. `host_write`
+17. `active_scan`
+18. `runtime_gate_open`
+
+## 6. 指令
+
+產生 committed snapshot：
+
+```bash
+python3 scripts/security/backup-restore-owner-request-draft.py \
+  --root . \
+  --inventory-report docs/security/backup-restore-escrow-inventory.snapshot.json \
+  --output docs/security/backup-restore-owner-request-draft.snapshot.json \
+  --generated-at 2026-06-14T23:05:00+08:00
+```
+
+驗證 guard：
+
+```bash
+python3 scripts/security/security-mirror-progress-guard.py --root .
+```
+
+## 7. 完成度
+
+| 工作 | 完成度 | 說明 |
+|------|--------|------|
+| owner request draft artifact | `100%` | 38 份 request draft、snapshot、文件與 guard 已固定 |
+| request dispatch | `0%` | 尚未送件 |
+| owner response received / accepted | `0%` | 尚未收到，尚未驗收 |
+| live evidence collection | `0%` | 未 SSH、未讀 offsite、未讀 live backup |
+| backup / restore / offsite / escrow / retention gate | `0%` | 未授權且未執行 |
+| runtime gate / production write | `0%` | 未授權且未執行 |

docs/security/HIGH-VALUE-CONFIG-CONTROL-COVERAGE.md

@@ -55,7 +55,7 @@
 |------|------|------------|--------|
 | P1-1 | Docker Compose / systemd / host service config | `50%` | repo-only 清冊已納入 9 個 surface，owner request draft 已轉成 9 份草稿；仍缺 owner response、110 / 188 live hash、restart window、rollback owner 與 post-check 指標 |
 | P1-2 | SSH / sudoers / known_hosts / firewall / WireGuard / NodePort | `54%` | repo-only 清冊已納入 16 個 SSH / network access surface，owner request draft 已轉成 16 份草稿；仍缺 owner response、live access state、allowed source CIDR、maintenance window、rollback owner 與 validation plan |
-| P1-3 | Backup / restore / escrow / retention | `58%` | repo-only 清冊已納入 38 個 surface；仍缺 restore drill approval package、offsite / escrow owner、retention owner、rollback owner 與 no-secret-value evidence |
+| P1-3 | Backup / restore / escrow / retention | `58%` | repo-only 清冊已納入 38 個 surface，owner request draft 已轉成 38 份草稿；仍缺 owner response、restore drill approval package、offsite / escrow owner、retention owner、rollback owner 與 no-secret-value evidence |
 | P1-4 | Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse | `62%` | repo-only 清冊已納入 60 個 monitoring / alerting / observability surface；仍缺 live drift evidence、reload owner、receiver owner、route smoke 與 receipt proof |
 
 ## 4. 固定 0 / false 邊界
@@ -167,6 +167,8 @@ python3 scripts/security/high-value-config-control-coverage.py \
 
 `backup_restore_escrow_inventory_v1` 已把 backup orchestration、service backup scripts、restic retention、offsite sync、credential escrow、Velero restore drill、backup health alert 與 cold-start / DR runbook 納入 repo-only 清冊，共 `38` 個 surface、`15` 個 backup script surface、`8` 個 offsite / escrow surface、`5` 個 Velero surface 與 `27` 個 write-capable surface。此更新只讓 `backup_restore_credential` 從 `52%` 推進到 `58%`；owner response、live evidence、restore drill acceptance、offsite sync acceptance、credential escrow acceptance、retention change acceptance、runtime gate 與 action button 仍全部為 `0`。
 
+2026-06-14 再新增 `backup_restore_owner_request_draft_v1`，把 38 個 surface 轉成 `request_draft_count=38`、`write_capable_request_draft_count=27`、`live_evidence_required_request_count=38`、`required_owner_field_count=14`、`blocked_action_count=18` 的人工送件前草稿。此更新仍不調高類別成熟度，因為 request sent、owner response received / accepted、live backup evidence、backup run、restore run、offsite sync、escrow marker write、retention change、runtime gate 與 action button 仍全部為 `0`。
+
 ## 11. P1-4 Monitoring / alerting / observability 清冊更新
 
 `monitoring_alerting_observability_inventory_v1` 已把 Prometheus、Alertmanager、Grafana、SigNoz、Sentry、Langfuse、OTEL、Telegram / notification policy、deploy / reload scripts 與 alert chain smoke scripts 納入 repo-only 清冊，共 `60` 個 surface、`13` 個 alert rule surface、`6` 個 deploy / reload surface、`11` 個 write-capable surface 與 `1` 個 drift guard surface。此更新只讓 `monitoring_alerting_observability` 從 `56%` 推進到 `62%`；owner response、live evidence、reload owner、receiver owner、route smoke、runtime gate 與 action button 仍全部為 `0`。

docs/security/IWOOOS-CONFIG-CONTROL-INVENTORY.md

@@ -53,6 +53,8 @@
 
 2026-06-14 已新增 `docs/security/SSH-NETWORK-OWNER-REQUEST-DRAFT.md` 與 `docs/security/ssh-network-owner-request-draft.snapshot.json`，將 16 個 SSH / network access surface 轉成人工送件前 owner request draft。固定 `drafts=16`、`write_capable=6`、`live_evidence_required=16`、`owner_fields=13`、`blocked_actions=16`，但 request sent、owner response received / accepted、live access state、firewall / port change、NetworkPolicy apply、NodePort change、WireGuard change、host write、runtime gate 仍全部為 `0 / false`。
 
+`backup_restore_owner_request_draft_v1` 已把 backup、restore、offsite、credential escrow、retention、Velero、alert / health 與 DR runbook 的 38 個 surface 轉成人工送件前 owner request draft。固定 `drafts=38`、`write_capable=27`、`live_evidence_required=38`、`owner_fields=14`、`blocked_actions=18`，但 request sent、owner response received / accepted、live backup evidence、backup run、restore run、offsite sync、remote delete、escrow marker write、retention change、host write、runtime gate 仍全部為 `0 / false`。
+
 此更新仍不是 live network truth：live firewall、sudoers、known_hosts、NetworkPolicy、NodePort、WireGuard evidence、network owner、maintenance window、rollback owner 與 owner response received / accepted 全部仍為 `0`，也不得執行 SSH、keyscan、sudo、firewall change、NetworkPolicy apply、NodePort change 或 WireGuard cutover。
 
 ### 0.4 2026-06-11 Backup / restore / escrow / retention repo-only 清冊
@@ -133,7 +135,7 @@ Nginx 是目前必須最先資安控管的配置，原因是它同時控制公
 | P0 | Gitea workflows | `.gitea/workflows/*.yaml` | Gitea Actions | self-hosted runner, secret reference guard, deployment verification, no write action without owner |
 | P0 | Runner / deploy key / webhook / branch protection | `ops/runner/*`、source-control snapshots | Gitea / GitHub owner metadata | labels、key names、webhook names、ruleset metadata only；no token / key value |
 | P0 | Public admin / API route config | Nginx templates、`apps/web/src/lib/config.ts`、`apps/api/src/core/config.py` | Product owner + runtime owner | auth boundary、CORS、public URL、admin path smoke、frontend internal IP ban |
-| P0 | Backup / restore credential | `scripts/backup/*`、`k8s/velero/*`、DR runbooks、`docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md` | MinIO / restic / offsite escrow | credential value absent、restore drill gate、offsite owner、escrow owner、retention policy、rollback owner |
+| P0 | Backup / restore credential | `scripts/backup/*`、`k8s/velero/*`、DR runbooks、`docs/security/BACKUP-RESTORE-ESCROW-INVENTORY.md`、`docs/security/BACKUP-RESTORE-OWNER-REQUEST-DRAFT.md` | MinIO / restic / offsite escrow | owner request draft 已固定；credential value absent、restore drill gate、offsite owner、escrow owner、retention policy、rollback owner |
 | P0 | agent-bounty-protocol treasury / MCP / A2A | `docs/security/AGENT-BOUNTY-IWOOOS-ONBOARDING-HANDOFF.md` | agent-bounty owner response | no payout / claim / submit / daemon / webhook until explicit runtime approval |
 | P1 | Prometheus / Alertmanager | `k8s/monitoring/*`、`ops/alertmanager/alertmanager.yml`、`ops/monitoring/*`、`docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md` | 110 monitoring stack | repo-only 清冊、rule diff、receiver diff、reload gate、failure-only notification policy |
 | P1 | Grafana / SigNoz / Sentry / Langfuse | `ops/grafana/*`、`ops/signoz/*`、`ops/sentry-self-hosted/*`、`infra/langfuse/*`、`docs/security/MONITORING-ALERTING-OBSERVABILITY-INVENTORY.md` | 110 compose / public gateway | admin secret externalized、public route, backup, smoke, upgrade window |
@@ -195,6 +197,7 @@ Nginx 是目前必須最先資安控管的配置，原因是它同時控制公
 | owner response request / received / accepted | `0%` | Packet 只是草案；尚未送件、尚未收件、尚未 reviewer accepted |
 | Docker / systemd owner request draft | `100%` | 已將 9 個 host service surface 轉成 owner request draft；request sent / received / accepted 仍為 0 |
 | SSH / firewall / network owner request draft | `100%` | 已將 16 個 SSH / network access surface 轉成 owner request draft；request sent / received / accepted、port change、firewall change、NetworkPolicy apply、NodePort change、WireGuard change 仍為 0 |
+| Backup / restore / escrow owner request draft | `100%` | 已將 38 個 backup / restore / escrow surface 轉成 owner request draft；request sent / received / accepted、backup run、restore run、offsite sync、remote delete、escrow marker write、retention change 仍為 0 |
 | CI blocking / workflow gate | `0%` | 本階段刻意不修改 `.gitea/workflows`，避免初期資安流程摩擦過大 |
 | owner-provided live Nginx file compare | `70%` | 工具可吃 owner 匯出的 live conf 檔比較；本階段不主動 SSH 取得 |
 | live Nginx evidence collection | `0%` | 尚未 SSH / Ansible check-mode / live hash；需 owner 與維護窗口規則 |
@@ -211,7 +214,7 @@ Nginx 是目前必須最先資安控管的配置，原因是它同時控制公
 5. P0：把 agent-bounty-protocol compose / MCP / A2A / treasury 高價值配置欄位接入同一個 owner packet queue；不啟用 runtime。
 6. P1：向 owner 收 110 / 188 Docker Compose 與 systemd 脫敏 live hash、restart window、rollback owner 與 post-check 指標；不主動 SSH、不重啟、不跑 repair-bot。
 7. P1：向 owner 收 SSH / firewall / WireGuard / NodePort 脫敏 live access state、allowed source CIDR、maintenance window、rollback owner 與 validation plan；不主動 keyscan、不改 firewall、不開關端口。
-8. P1：把 backup / restore / offsite / escrow owner response packet 接入 AwoooP 只讀狀態；驗收前 backup run、restore drill、offsite sync、remote delete、escrow marker write、retention change 全部維持 `0 / false`。
+8. P1：向 owner 收 backup / restore / offsite / escrow 非敏感 evidence id、最新備份狀態、restore drill plan、maintenance window、rollback owner 與 validation plan；驗收前 backup run、restore drill、offsite sync、remote delete、escrow marker write、retention change 全部維持 `0 / false`。
 8. P1：把 Prometheus / Alertmanager / Grafana / SigNoz / Sentry / Langfuse owner response packet 接入 AwoooP 只讀狀態；驗收前 reload、receiver route change、silence change、Telegram send 與 alert chain smoke 全部維持 `0 / false`。
 9. P1：補 Kali 112、111、168 維護窗口 owner 欄位，仍不做 upgrade / restart / scan。
 10. P2：持續精簡 `/zh-TW/iwooos` 配置控管摘要，但不得顯示內部工作對話、token、secret 或可執行按鈕。

docs/security/SECURITY-SUPPLY-CHAIN-PROGRESS.md

@@ -397,6 +397,7 @@ headline 要再往上，需要 S4.9 / S4.10 / S4.11 / S4.12 任一 owner respons
 | K8s / ArgoCD Owner Request Draft | 已推送 / 已同步 | `e8de19d7` 已進 `gitea/main`；`k8s-argocd-owner-request-draft.snapshot.json` 已固定 `request_draft_count=4`、`c0_request_draft_count=3`、`request_field_count=20`、`required_owner_field_count=11`、`evidence_gap_count=8`、`blocked_action_count=13`、`request_sent_count=0`、`owner_response_received_count=0`、`runtime_gate_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 request ids、blocked actions 與 false flags；AwoooP 平行 Session 已同步 | 這是人工送件前 request draft，不是 request sent、recipient confirmed、owner response received / accepted、rendered manifest diff、ArgoCD API read、ArgoCD sync、kubectl action、live cluster read、secret collection、production write 或 runtime gate；不需要 production browser smoke |
 | Docker / systemd / Host Service Owner Request Draft | 本地完成 | `host-service-owner-request-draft.snapshot.json` 已固定 `request_draft_count=9`、`write_capable_request_draft_count=3`、`live_evidence_required_request_count=8`、`request_field_count=22`、`required_owner_field_count=12`、`blocked_action_count=14`、`request_sent_count=0`、`owner_response_received_count=0`、`runtime_gate_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 request ids、blocked actions 與 false flags | 這是 Docker Compose、systemd / repair-bot、Ansible role 與 host config backup 的人工送件前 request draft，不是 request sent、owner response received / accepted、live host read、Docker Compose action、systemctl action、repair-bot execution、Ansible apply、secret collection、host write、production write 或 runtime gate；不需要 production browser smoke |
 | SSH / Firewall / Network Access Owner Request Draft | 本地完成 | `ssh-network-owner-request-draft.snapshot.json` 已固定 `request_draft_count=16`、`write_capable_request_draft_count=6`、`live_evidence_required_request_count=16`、`request_field_count=23`、`required_owner_field_count=13`、`blocked_action_count=16`、`request_sent_count=0`、`owner_response_received_count=0`、`runtime_gate_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 request ids、blocked actions 與 false flags | 這是 SSH target、known_hosts、CI deploy SSH、monitoring SSH、backup SSH、sudoers、NetworkPolicy、NodePort、WireGuard 與 alert SSH action 的人工送件前 request draft，不是 request sent、owner response received / accepted、live host read、host keyscan、known_hosts patch、firewall / port change、NetworkPolicy apply、NodePort change、WireGuard change、secret collection、host write、production write 或 runtime gate；不需要 production browser smoke |
+| Backup / Restore / Escrow Owner Request Draft | 本地完成 | `backup-restore-owner-request-draft.snapshot.json` 已固定 `request_draft_count=38`、`write_capable_request_draft_count=27`、`live_evidence_required_request_count=38`、`request_field_count=24`、`required_owner_field_count=14`、`blocked_action_count=18`、`request_sent_count=0`、`owner_response_received_count=0`、`runtime_gate_count=0`，並由 `security-mirror-progress-guard.py` 鎖住 request ids、blocked actions 與 false flags | 這是 backup、restore、offsite、credential escrow、retention、Velero、alert / health 與 DR runbook 的人工送件前 request draft，不是 request sent、owner response received / accepted、live backup evidence、backup run、restore run、offsite sync、remote delete、escrow marker write、retention change、restic prune、rclone config、Velero restore / backup、secret collection、host write、production write 或 runtime gate；不需要 production browser smoke |
 | S3 approval gate | 進行中 | `security_approval_gate_v1` 已建立 8 個人工 gate items：7 pending、1 block candidate、0 approved | 不得繞過人工批准；批准後仍需 follow-up runtime gate |
 | S3.0 人工批准 Gate 契約 | 完成草案 | 定義批准範圍、決策選項、required reviewers、still forbidden 與 follow-up runtime gate | AwoooP 可記錄決策，不可執行 gate item |
 | S3.1 人工決策紀錄契約 | 完成草案 | `security_approval_decision_record_v1` 已建立；目前 0 筆 decision records、0 個 runtime action 授權 | AwoooP 可稽核決策，不可把決策當執行 |