feat(api): expose gitea owner response validation

apps/api/src/services/gitea_private_inventory_p0_scorecard.py

@@ -41,6 +41,7 @@ def _build_payload(scorecard: dict[str, Any], path: Path) -> dict[str, Any]:
     gitea_inventory = _dict(scorecard.get("gitea_inventory"))
     import_acceptance = _dict(scorecard.get("authenticated_import_acceptance"))
     coverage_attestation = _dict(scorecard.get("coverage_attestation"))
+    owner_response_validation = _dict(scorecard.get("owner_response_validation"))
     product_coverage = _dict(scorecard.get("product_row_coverage"))
     active_blockers = _strings(scorecard.get("active_blockers"))
     exit_criteria = _strings(scorecard.get("exit_criteria"))
@@ -70,6 +71,7 @@ def _build_payload(scorecard: dict[str, Any], path: Path) -> dict[str, Any]:
         "gitea_inventory": gitea_inventory,
         "authenticated_import_acceptance": import_acceptance,
         "coverage_attestation": coverage_attestation,
+        "owner_response_validation": owner_response_validation,
         "product_row_coverage": product_coverage,
         "active_blockers": active_blockers,
         "exit_criteria": exit_criteria,
@@ -93,6 +95,25 @@ def _build_payload(scorecard: dict[str, Any], path: Path) -> dict[str, Any]:
             "owner_coverage_attestation_accepted_count": _int(
                 coverage_attestation.get("accepted_attestation_count")
             ),
+            "owner_response_validation_received_count": _int(
+                owner_response_validation.get("received_response_count")
+            ),
+            "owner_response_validation_accepted_count": _int(
+                owner_response_validation.get("accepted_response_count")
+            ),
+            "owner_response_validation_rejected_count": _int(
+                owner_response_validation.get("rejected_response_count")
+            ),
+            "owner_response_validation_template_count": _int(
+                owner_response_validation.get("response_template_count")
+            ),
+            "owner_response_validation_guard_result": str(
+                owner_response_validation.get("latest_local_validation_result") or ""
+            ),
+            "next_owner_response_validation_lane_id": str(
+                owner_response_validation.get("next_collection_candidate_lane_id")
+                or ""
+            ),
             "expected_product_count": _int(
                 product_coverage.get("expected_product_count")
             ),
@@ -186,6 +207,36 @@ def _require_source_scorecard(payload: dict[str, Any], label: str) -> None:
     coverage_attestation = _dict(payload.get("coverage_attestation"))
     if coverage_attestation.get("execution_authorized") is not False:
         raise ValueError(f"{label}: attestation write must remain false")
+    owner_response_validation = _dict(payload.get("owner_response_validation"))
+    if (
+        owner_response_validation.get("lane_id")
+        != "s4_9_gitea_inventory_owner_attestation_response"
+    ):
+        raise ValueError(f"{label}: owner response validation lane must be S4.9")
+    if (
+        owner_response_validation.get("validator_source")
+        != "scripts/security/source-control-owner-response-guard.py"
+    ):
+        raise ValueError(f"{label}: owner response validator source mismatch")
+    owner_response_blocked_flags = {
+        "runtime_execution_authorized",
+        "token_value_collection_allowed",
+        "secret_value_collection_allowed",
+        "gitea_repo_write_authorized",
+        "refs_sync_authorized",
+        "github_primary_switch_authorized",
+        "action_buttons_allowed",
+    }
+    owner_response_drift = sorted(
+        flag
+        for flag in owner_response_blocked_flags
+        if owner_response_validation.get(flag) is not False
+    )
+    if owner_response_drift:
+        raise ValueError(
+            f"{label}: owner response validation boundaries must remain false: "
+            f"{owner_response_drift}"
+        )
 
 
 def _require_operation_boundaries(payload: dict[str, Any], label: str) -> None:
@@ -236,6 +287,11 @@ def _require_rollup_consistency(payload: dict[str, Any], label: str) -> None:
         is not True
     ):
         raise ValueError(f"{label}: active product owner readiness rows incomplete")
+    if (
+        rollups.get("next_owner_response_validation_lane_id")
+        != "s4_9_gitea_inventory_owner_attestation_response"
+    ):
+        raise ValueError(f"{label}: next owner response validation lane mismatch")
 
 
 def _met_exit_criteria(