feat(api): expose gitea owner response validation

apps/api/tests/test_gitea_private_inventory_p0_scorecard_api.py

@@ -26,6 +26,17 @@ def test_gitea_private_inventory_p0_scorecard_reports_active_gitea_blocker():
     assert payload["rollups"]["gitea_visibility_scope"] == "public_only"
     assert payload["rollups"]["accepted_inventory_payload_count"] == 0
     assert payload["rollups"]["owner_coverage_attestation_received_count"] == 0
+    assert payload["rollups"]["owner_response_validation_received_count"] == 0
+    assert payload["rollups"]["owner_response_validation_accepted_count"] == 0
+    assert payload["rollups"]["owner_response_validation_template_count"] == 5
+    assert (
+        payload["rollups"]["owner_response_validation_guard_result"]
+        == "SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK"
+    )
+    assert (
+        payload["rollups"]["next_owner_response_validation_lane_id"]
+        == "s4_9_gitea_inventory_owner_attestation_response"
+    )
     assert payload["rollups"]["expected_product_count"] == 11
     assert payload["rollups"]["present_product_row_count"] == 11
     assert payload["rollups"]["missing_product_row_count"] == 0
@@ -47,6 +58,12 @@ def test_gitea_private_inventory_p0_scorecard_endpoint_returns_readback():
     data = response.json()
     assert data["priority"] == "P0-003"
     assert data["rollups"]["active_blocker_count"] == 4
+    assert data["owner_response_validation"]["received_response_count"] == 0
+    assert data["owner_response_validation"]["accepted_response_count"] == 0
+    assert (
+        data["owner_response_validation"]["validator_source"]
+        == "scripts/security/source-control-owner-response-guard.py"
+    )
     assert data["operation_boundaries"]["read_only_api_allowed"] is True
     assert data["operation_boundaries"]["gitea_api_write_allowed"] is False
     assert data["operation_boundaries"]["gitea_repo_creation_allowed"] is False
@@ -87,6 +104,22 @@ def test_gitea_private_inventory_p0_scorecard_rejects_token_collection(tmp_path)
         load_latest_gitea_private_inventory_p0_scorecard(operations_dir)
 
 
+def test_gitea_private_inventory_p0_scorecard_rejects_owner_response_runtime_unlock(
+    tmp_path,
+):
+    operations_dir = tmp_path / "operations"
+    operations_dir.mkdir()
+    payload = _scorecard_payload()
+    payload["owner_response_validation"]["runtime_execution_authorized"] = True
+    (operations_dir / "awoooi-gitea-private-inventory-p0-scorecard.snapshot.json").write_text(
+        json.dumps(payload),
+        encoding="utf-8",
+    )
+
+    with pytest.raises(ValueError, match="owner response validation boundaries"):
+        load_latest_gitea_private_inventory_p0_scorecard(operations_dir)
+
+
 def _scorecard_payload() -> dict:
     return {
         "schema_version": "awoooi_gitea_private_inventory_p0_scorecard_v1",
@@ -120,6 +153,34 @@ def _scorecard_payload() -> dict:
             "accepted_attestation_count": 0,
             "execution_authorized": False,
         },
+        "owner_response_validation": {
+            "schema_version": "source_control_owner_response_validation_rollup_v1",
+            "status": "draft_waiting_owner_responses",
+            "rollup_status": "waiting_owner_responses",
+            "lane_id": "s4_9_gitea_inventory_owner_attestation_response",
+            "source_contract": "gitea_inventory_owner_attestation_response_v1",
+            "response_packet": (
+                "docs/security/gitea-inventory-owner-attestation-response.snapshot.json"
+            ),
+            "response_template_count": 5,
+            "received_response_count": 0,
+            "accepted_response_count": 0,
+            "rejected_response_count": 0,
+            "next_collection_candidate_lane_id": (
+                "s4_9_gitea_inventory_owner_attestation_response"
+            ),
+            "next_collection_candidate_status": "next_owner_response_required",
+            "latest_local_validation_status": "repo_snapshot_guard_pass",
+            "latest_local_validation_result": "SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK",
+            "validator_source": "scripts/security/source-control-owner-response-guard.py",
+            "runtime_execution_authorized": False,
+            "token_value_collection_allowed": False,
+            "secret_value_collection_allowed": False,
+            "gitea_repo_write_authorized": False,
+            "refs_sync_authorized": False,
+            "github_primary_switch_authorized": False,
+            "action_buttons_allowed": False,
+        },
         "product_row_coverage": {
             "expected_product_count": 11,
             "present_product_row_count": 11,