feat(governance): 新增 Status Cleanup Dashboard read model

2026-06-24 23:45:37 +08:00
parent bb2ad03271
commit ed755dc3b8
12 changed files with 1845 additions and 0 deletions
--- a/docs/LOGBOOK.md
+++ b/docs/LOGBOOK.md
@@ -20,7 +20,22 @@
 - 不可宣稱：full-stack green、MOMO data current、DR complete、credential escrow complete、或 110 live monitor 已同步 repo v1.42。Live 110 script parity 仍需獨立維護窗口。

 **邊界**：本輪沒有主機寫入、沒有 `scp` live script、沒有 Docker / Nginx / firewall / K8s / ArgoCD 操作、沒有 Wazuh / SOC 修改、沒有讀取或保存 secret。
+## 2026-06-24｜Status Cleanup Dashboard 繁中化與 read-only API 切片

+**本輪收斂範圍：**
+- 新增 AWOOOI Status Cleanup Dashboard read-only service / schema / snapshot / Markdown / generator，將狀態清理完成度、owner gate、apply gate、artifact sync 與 Wazuh handoff 邊界整理成單一資料模型。
+- 人類可讀標題、卡片 caption、Markdown 區塊標題與 risk control 顯示文字使用繁體中文；保留 `metric_id`、`gate_id`、API status、schema key 等技術識別碼。
+- 修正 Wazuh visibility boundary：將 `manager_agent_registry_readback_passed=false`、`iwooos_live_route_readback_passed=false`、`dashboard_agent_list_recovered=false` 與 `agent_visibility_runtime_gate_count=0` 寫入 boundary，讓 read-model guard、報告文字與 API payload 對齊。
+- 新增 `GET /api/v1/agents/awoooi-status-cleanup-dashboard` 與 `getAwoooIStatusCleanupDashboard()`；端點回傳前會走既有 public LAN topology redaction。
+
+**readback：**
+- Status Cleanup Dashboard：`AWOOOI_STATUS_CLEANUP_DASHBOARD_OK status=blocked_status_cleanup_apply_not_authorized gates=5/5 owner_flags=0/6 apply_allowed=False memory_write=False`。
+- API / read-model tests：`PYTHONPATH=apps/api PYTHONDONTWRITEBYTECODE=1 apps/api/.venv/bin/python -m pytest apps/api/tests/test_awoooi_status_cleanup_dashboard.py apps/api/tests/test_awoooi_status_cleanup_dashboard_api.py -q` → `6 passed`。
+
+**仍禁止 / 未完成：**
+- 整體治理完成度維持 `41.9%`；Status Cleanup 仍 `gates=5/5 blocked`、`owner_flags=0/6`、`apply_allowed=false`、`memory_write_authorized=false`。
+- 本輪沒有更新 `project_current_status` / memory，沒有 Wazuh live query / active response / runtime deploy，沒有 host、Nginx、Docker、K8s、firewall、workflow、repo refs、backup、restore 或 migration 操作。
+- 本輪只交付 read-only API / client / report model，未宣稱可視 UI 已恢復或正式展示完成。
 ## 2026-06-24｜23:15 110 cold-start monitor live-sync gate readback

 **背景**：23:04 已把 MOMO source absence classifier 納入 repo-side cold-start v1.42，但這不等於 110 上 `/home/wooo/scripts/full-stack-cold-start-check.sh` 已更新。為避免下次重啟時 operator 以 live 110 舊腳本輸出做錯判，本輪只做部署 parity 的 read-only 驗證與 SOP gate 補強。
--- a/docs/operations/AWOOOI-STATUS-CLEANUP-DASHBOARD-2026-06-24.md
+++ b/docs/operations/AWOOOI-STATUS-CLEANUP-DASHBOARD-2026-06-24.md
@@ -0,0 +1,121 @@
+# AWOOOI 狀態清理儀表板
+
+- generated_at: `2026-06-24T15:39:52+00:00`
+- dashboard_status: `blocked_status_cleanup_apply_not_authorized`
+- overall_completion_percent: `41.9%`
+- gates: `5/5 blocked`
+- owner_flags: `0/6`
+- sections: `0/7`
+- confirmed_commands: `0/1`
+- artifact_count: `47`
+- wazuh_handoff: `blocked_not_released base=b540fc0c patches=7`
+- wazuh_live_metadata: `owner=0 secret_metadata=0`
+- wazuh_live_agent_registry_readback: `0`
+- iwooos_wazuh_runtime_gate: `0`
+- wazuh_active_response_count: `0`
+- wazuh_agent_visibility_status: `blocked_waiting_manager_agent_registry_readback`
+- memory_write_authorized: `False`
+- runtime_execution_authorized: `False`
+- wazuh_api_live_query_authorized: `False`
+
+## 指標卡片
+
+| 指標 | 數值 | 狀態 | 說明 |
+|--------|-------|--------|---------|
+| `overall_completion` | `41.9%` | `orange` | 產品 Runtime 治理完成度計分卡 |
+| `project_status_age` | `11 days` | `blocked` | stale_after_days=2 |
+| `owner_flags` | `0/6` | `blocked` | pending_owner_response |
+| `approved_sections` | `0/7` | `blocked` | targets=0/1 |
+| `execution_preview` | `blocked_owner_response_preflight_not_ready` | `blocked` | dry_run_only=true |
+| `apply_confirmation` | `0/1` | `blocked` | pending_final_confirmation |
+| `artifact_sync` | `1/2` | `blocked` | artifacts=47 |
+
+## 閘門卡片
+
+| 閘門 | 狀態 | 是否封鎖 | 證據 |
+|------|------|----------|------|
+| `status_cleanup_preflight` | `blocked_status_cleanup_required` | `True` | `docs/operations/codex-status-cleanup-preflight.snapshot.json` |
+| `owner_review_package` | `owner_decision_required` | `True` | `docs/operations/codex-status-cleanup-owner-review-package.snapshot.json` |
+| `owner_response_preflight` | `blocked_owner_response_required` | `True` | `docs/operations/codex-status-cleanup-owner-response-preflight.snapshot.json` |
+| `execution_plan` | `blocked_owner_response_preflight_not_ready` | `True` | `docs/operations/codex-status-cleanup-execution-plan.snapshot.json` |
+| `apply_gate` | `blocked_status_cleanup_apply_not_authorized` | `True` | `docs/operations/codex-status-cleanup-apply-gate.snapshot.json` |
+
+## 風險控制
+
+| 控制項 | 狀態 | 已授權 |
+|--------|------|--------|
+| `memory_write` | `blocked_final_apply_gate_required` | `False` |
+| `raw_codex_history` | `blocked_raw_history_never_synced` | `False` |
+| `wazuh_runtime` | `blocked_iwooos_runtime_lane_only` | `False` |
+| `workflow` | `blocked_workflow_authorization_required` | `False` |
+| `repo_refs` | `blocked_source_control_approval_required` | `False` |
+| `host` | `blocked_host_maintenance_required` | `False` |
+| `backup_restore` | `blocked_data_owner_approval_required` | `False` |
+| `ui` | `blocked_apps_web_readiness_required` | `False` |
+
+## 下一步
+
+- 收齊 owner 旗標：0/6。
+- 收齊已批准章節：0/7。
+- 確認目標路徑：0/1。
+- 確認邊界 acknowledgement：0/5。
+- owner response preflight ready 後，重新產生 dry-run execution plan。
+- apply gate 目前 apply_allowed=False；未變 true 前不得寫 project_current_status。
+
+## 封鎖原因
+
+- `project_current_status 過期只代表需要狀態清理，不代表可修改 memory / runtime。`
+- `不得把一般『批准繼續』解讀成 force push、workflow copy、workflow trigger、repo creation 或 refs sync 授權。`
+- `不得同步 raw Codex App DB / auth / conversations / sessions。`
+- `不得碰 MacBook Pro MOMO PRO protected legacy paths。`
+- `不得新增 Wazuh / Kali / SOC runtime UI/API 或 live query。`
+- `不得 SSH 修改主機、改 firewall / Nginx / Docker / K8s 或執行 active scan。`
+- `Data / Backup coverage 是治理 evidence，不是 backup / restore / migration executor。`
+- `owner_response_preflight:owner_response_status_not_approved_status_cleanup_preview`
+- `owner_response_preflight:owner_flag_not_accepted:accept_status_cleanup_scope`
+- `owner_response_preflight:owner_flag_not_accepted:approve_project_current_status_update_preview`
+- `owner_response_preflight:owner_flag_not_accepted:confirm_latest_logbook_and_scorecard_as_sources`
+- `owner_response_preflight:owner_flag_not_accepted:confirm_no_runtime_or_host_authorization`
+- `owner_response_preflight:owner_flag_not_accepted:confirm_no_raw_codex_history_sync`
+- `owner_response_preflight:owner_flag_not_accepted:confirm_iwooos_wazuh_boundary_preserved`
+- `owner_response_preflight:update_section_not_approved:artifact_sync_gate`
+- `owner_response_preflight:update_section_not_approved:completion_scorecard`
+- `owner_response_preflight:update_section_not_approved:data_backup_gate`
+- `owner_response_preflight:update_section_not_approved:gitea_warning_gate`
+- `owner_response_preflight:update_section_not_approved:iwooos_wazuh_boundary`
+- `owner_response_preflight:update_section_not_approved:latest_logbook_heading`
+- `owner_response_preflight:update_section_not_approved:operation_boundaries`
+- `owner_response_preflight:target_path_not_approved:/Users/ogt/.claude/projects/-Users-ogt-awoooi/memory/project_current_status.md`
+- `owner_response_preflight:boundary_not_acknowledged:memory_write_authorized=false`
+- `owner_response_preflight:boundary_not_acknowledged:refs_sync_authorized=false`
+- `owner_response_preflight:boundary_not_acknowledged:repo_creation_authorized=false`
+- `owner_response_preflight:boundary_not_acknowledged:runtime_execution_authorized=false`
+- `owner_response_preflight:boundary_not_acknowledged:wazuh_api_live_query_authorized=false`
+- `execution_plan_blocked_until:owner response preflight ready_for_status_cleanup_apply_gate=true`
+- `execution_plan_blocked_until:all owner flags accepted`
+- `execution_plan_blocked_until:all update sections approved`
+- `execution_plan_blocked_until:target path approved`
+- `execution_plan_blocked_until:all critical false boundaries acknowledged`
+- `execution_plan_blocked_until:final status cleanup apply confirmation accepted`
+- `apply_gate:execution_plan_not_ready_for_final_confirmation`
+- `apply_gate:owner_response_preflight_not_ready`
+- `apply_gate:final_confirmation_status_not_approved_status_cleanup_apply`
+- `apply_gate:final_flag_not_accepted:confirm_status_cleanup_command_preview`
+- `apply_gate:final_flag_not_accepted:confirm_project_current_status_target_path`
+- `apply_gate:final_flag_not_accepted:confirm_post_apply_validation`
+- `apply_gate:final_flag_not_accepted:confirm_no_runtime_or_wazuh_deploy`
+- `apply_gate:command_preview_not_confirmed`
+- `apply_gate:target_path_not_confirmed:/Users/ogt/.claude/projects/-Users-ogt-awoooi/memory/project_current_status.md`
+- `wazuh_boundary:Wazuh route / production 404 由另一受控 branch 處理；branch=codex/iwooos-wazuh-boundary-guard-20260624 base=b540fc0c commits=38dc3c2f,9a53d3e1,e9972d47,758d419e,04db4b8a,8eec298e,325f262a patch_sha_1=08f8b36d7261b0dde6bfb0c47597bd0727d578dec3335c5ff7ded2bcaa2b7eb4 patch_sha_2=e6ec8f8d10e8a2bd711c399fa14ba0ab2dfb22f8ab6a733402944302eec7da7c patch_sha_3=7e99bd5284a25519313aea05bb314d3386454b91ce86241424385752d358900d patch_sha_4=f4ffbaecd94d3696660766cc6f4a6bd195762bc533d9502f8edfed2bb8379fab patch_sha_5=9035d6c411bf86d0857970b69dd33631f052aa90de27e52d82d448d4b8e4cec5 patch_sha_6=d3bb98711a3ebf91b9936b41bc232b689befc68a4a7cec38bf9cab4c8d015827 patch_sha_7=5aa3e69fee9624d0ff3f2bfad90595a81eb9306ad6387d640690a85a2f8038d7 apply_proof=release_apply_check_20260624_2248 release_gate=source1_push0_deploy0_readback0_runtime0 release_lane_preflight=ready0_acks0of6_evidence0of6_push0_deploy0_readback0_runtime0 owner_gate=request_sent0_response_accepted0_acks0of6_evidence0of6_push0_deploy0_readback0_runtime0 live_metadata_env_gate=owner0_secret_metadata0_push0_deploy0_readback0_runtime0；wazuh_live_agent_registry_readback=0 manager_agent_registry_readback_passed=false iwooos_live_route_readback_passed=false dashboard_agent_list_recovered=false iwooos_wazuh_runtime_gate=0 active_response=0；push_blocked=missing_noninteractive_gitea_https_credential；本視窗不改 runtime / Nginx / Docker / K8s / firewall / Wazuh secret。 agent_visibility_status=blocked_waiting_manager_agent_registry_readback agent_visibility_runtime_gate_count=0`
+
+## 強制閘門
+
+- 本 dashboard 只整合 read-only snapshots，不代表 project_current_status / memory 已更新。
+- memory_write_authorized=false 時不得修改 project_current_status 或任何 Memory 檔案。
+- 不得同步 raw Codex App DB / auth / conversations / sessions。
+- 不得把一般批准繼續視為 owner response 或 final apply confirmation。
+- 不得新增 Wazuh / Kali / SOC runtime UI/API、live query、active response 或 host containment。
+- 不得修改 Nginx / Docker / K8s / firewall / Wazuh secret，也不得重啟 host。
+- 不得修改 .gitea/workflows、workflow_dispatch、repo refs、GitHub mirror 或 Gitea environment。
+- 不得執行 backup、restore、migration、kubectl、docker compose up 或資料庫寫入。
+- apps/web build/i18n 必要檔案未恢復前，本 dashboard 只可作 page model 資料，不代表 UI 實作授權。
--- a/docs/operations/AWOOOI-STATUS-CLEANUP-DASHBOARD.md
+++ b/docs/operations/AWOOOI-STATUS-CLEANUP-DASHBOARD.md
@@ -0,0 +1,121 @@
+# AWOOOI 狀態清理儀表板
+
+- generated_at: `2026-06-24T15:39:52+00:00`
+- dashboard_status: `blocked_status_cleanup_apply_not_authorized`
+- overall_completion_percent: `41.9%`
+- gates: `5/5 blocked`
+- owner_flags: `0/6`
+- sections: `0/7`
+- confirmed_commands: `0/1`
+- artifact_count: `47`
+- wazuh_handoff: `blocked_not_released base=b540fc0c patches=7`
+- wazuh_live_metadata: `owner=0 secret_metadata=0`
+- wazuh_live_agent_registry_readback: `0`
+- iwooos_wazuh_runtime_gate: `0`
+- wazuh_active_response_count: `0`
+- wazuh_agent_visibility_status: `blocked_waiting_manager_agent_registry_readback`
+- memory_write_authorized: `False`
+- runtime_execution_authorized: `False`
+- wazuh_api_live_query_authorized: `False`
+
+## 指標卡片
+
+| 指標 | 數值 | 狀態 | 說明 |
+|--------|-------|--------|---------|
+| `overall_completion` | `41.9%` | `orange` | 產品 Runtime 治理完成度計分卡 |
+| `project_status_age` | `11 days` | `blocked` | stale_after_days=2 |
+| `owner_flags` | `0/6` | `blocked` | pending_owner_response |
+| `approved_sections` | `0/7` | `blocked` | targets=0/1 |
+| `execution_preview` | `blocked_owner_response_preflight_not_ready` | `blocked` | dry_run_only=true |
+| `apply_confirmation` | `0/1` | `blocked` | pending_final_confirmation |
+| `artifact_sync` | `1/2` | `blocked` | artifacts=47 |
+
+## 閘門卡片
+
+| 閘門 | 狀態 | 是否封鎖 | 證據 |
+|------|------|----------|------|
+| `status_cleanup_preflight` | `blocked_status_cleanup_required` | `True` | `docs/operations/codex-status-cleanup-preflight.snapshot.json` |
+| `owner_review_package` | `owner_decision_required` | `True` | `docs/operations/codex-status-cleanup-owner-review-package.snapshot.json` |
+| `owner_response_preflight` | `blocked_owner_response_required` | `True` | `docs/operations/codex-status-cleanup-owner-response-preflight.snapshot.json` |
+| `execution_plan` | `blocked_owner_response_preflight_not_ready` | `True` | `docs/operations/codex-status-cleanup-execution-plan.snapshot.json` |
+| `apply_gate` | `blocked_status_cleanup_apply_not_authorized` | `True` | `docs/operations/codex-status-cleanup-apply-gate.snapshot.json` |
+
+## 風險控制
+
+| 控制項 | 狀態 | 已授權 |
+|--------|------|--------|
+| `memory_write` | `blocked_final_apply_gate_required` | `False` |
+| `raw_codex_history` | `blocked_raw_history_never_synced` | `False` |
+| `wazuh_runtime` | `blocked_iwooos_runtime_lane_only` | `False` |
+| `workflow` | `blocked_workflow_authorization_required` | `False` |
+| `repo_refs` | `blocked_source_control_approval_required` | `False` |
+| `host` | `blocked_host_maintenance_required` | `False` |
+| `backup_restore` | `blocked_data_owner_approval_required` | `False` |
+| `ui` | `blocked_apps_web_readiness_required` | `False` |
+
+## 下一步
+
+- 收齊 owner 旗標：0/6。
+- 收齊已批准章節：0/7。
+- 確認目標路徑：0/1。
+- 確認邊界 acknowledgement：0/5。
+- owner response preflight ready 後，重新產生 dry-run execution plan。
+- apply gate 目前 apply_allowed=False；未變 true 前不得寫 project_current_status。
+
+## 封鎖原因
+
+- `project_current_status 過期只代表需要狀態清理，不代表可修改 memory / runtime。`
+- `不得把一般『批准繼續』解讀成 force push、workflow copy、workflow trigger、repo creation 或 refs sync 授權。`
+- `不得同步 raw Codex App DB / auth / conversations / sessions。`
+- `不得碰 MacBook Pro MOMO PRO protected legacy paths。`
+- `不得新增 Wazuh / Kali / SOC runtime UI/API 或 live query。`
+- `不得 SSH 修改主機、改 firewall / Nginx / Docker / K8s 或執行 active scan。`
+- `Data / Backup coverage 是治理 evidence，不是 backup / restore / migration executor。`
+- `owner_response_preflight:owner_response_status_not_approved_status_cleanup_preview`
+- `owner_response_preflight:owner_flag_not_accepted:accept_status_cleanup_scope`
+- `owner_response_preflight:owner_flag_not_accepted:approve_project_current_status_update_preview`
+- `owner_response_preflight:owner_flag_not_accepted:confirm_latest_logbook_and_scorecard_as_sources`
+- `owner_response_preflight:owner_flag_not_accepted:confirm_no_runtime_or_host_authorization`
+- `owner_response_preflight:owner_flag_not_accepted:confirm_no_raw_codex_history_sync`
+- `owner_response_preflight:owner_flag_not_accepted:confirm_iwooos_wazuh_boundary_preserved`
+- `owner_response_preflight:update_section_not_approved:artifact_sync_gate`
+- `owner_response_preflight:update_section_not_approved:completion_scorecard`
+- `owner_response_preflight:update_section_not_approved:data_backup_gate`
+- `owner_response_preflight:update_section_not_approved:gitea_warning_gate`
+- `owner_response_preflight:update_section_not_approved:iwooos_wazuh_boundary`
+- `owner_response_preflight:update_section_not_approved:latest_logbook_heading`
+- `owner_response_preflight:update_section_not_approved:operation_boundaries`
+- `owner_response_preflight:target_path_not_approved:/Users/ogt/.claude/projects/-Users-ogt-awoooi/memory/project_current_status.md`
+- `owner_response_preflight:boundary_not_acknowledged:memory_write_authorized=false`
+- `owner_response_preflight:boundary_not_acknowledged:refs_sync_authorized=false`
+- `owner_response_preflight:boundary_not_acknowledged:repo_creation_authorized=false`
+- `owner_response_preflight:boundary_not_acknowledged:runtime_execution_authorized=false`
+- `owner_response_preflight:boundary_not_acknowledged:wazuh_api_live_query_authorized=false`
+- `execution_plan_blocked_until:owner response preflight ready_for_status_cleanup_apply_gate=true`
+- `execution_plan_blocked_until:all owner flags accepted`
+- `execution_plan_blocked_until:all update sections approved`
+- `execution_plan_blocked_until:target path approved`
+- `execution_plan_blocked_until:all critical false boundaries acknowledged`
+- `execution_plan_blocked_until:final status cleanup apply confirmation accepted`
+- `apply_gate:execution_plan_not_ready_for_final_confirmation`
+- `apply_gate:owner_response_preflight_not_ready`
+- `apply_gate:final_confirmation_status_not_approved_status_cleanup_apply`
+- `apply_gate:final_flag_not_accepted:confirm_status_cleanup_command_preview`
+- `apply_gate:final_flag_not_accepted:confirm_project_current_status_target_path`
+- `apply_gate:final_flag_not_accepted:confirm_post_apply_validation`
+- `apply_gate:final_flag_not_accepted:confirm_no_runtime_or_wazuh_deploy`
+- `apply_gate:command_preview_not_confirmed`
+- `apply_gate:target_path_not_confirmed:/Users/ogt/.claude/projects/-Users-ogt-awoooi/memory/project_current_status.md`
+- `wazuh_boundary:Wazuh route / production 404 由另一受控 branch 處理；branch=codex/iwooos-wazuh-boundary-guard-20260624 base=b540fc0c commits=38dc3c2f,9a53d3e1,e9972d47,758d419e,04db4b8a,8eec298e,325f262a patch_sha_1=08f8b36d7261b0dde6bfb0c47597bd0727d578dec3335c5ff7ded2bcaa2b7eb4 patch_sha_2=e6ec8f8d10e8a2bd711c399fa14ba0ab2dfb22f8ab6a733402944302eec7da7c patch_sha_3=7e99bd5284a25519313aea05bb314d3386454b91ce86241424385752d358900d patch_sha_4=f4ffbaecd94d3696660766cc6f4a6bd195762bc533d9502f8edfed2bb8379fab patch_sha_5=9035d6c411bf86d0857970b69dd33631f052aa90de27e52d82d448d4b8e4cec5 patch_sha_6=d3bb98711a3ebf91b9936b41bc232b689befc68a4a7cec38bf9cab4c8d015827 patch_sha_7=5aa3e69fee9624d0ff3f2bfad90595a81eb9306ad6387d640690a85a2f8038d7 apply_proof=release_apply_check_20260624_2248 release_gate=source1_push0_deploy0_readback0_runtime0 release_lane_preflight=ready0_acks0of6_evidence0of6_push0_deploy0_readback0_runtime0 owner_gate=request_sent0_response_accepted0_acks0of6_evidence0of6_push0_deploy0_readback0_runtime0 live_metadata_env_gate=owner0_secret_metadata0_push0_deploy0_readback0_runtime0；wazuh_live_agent_registry_readback=0 manager_agent_registry_readback_passed=false iwooos_live_route_readback_passed=false dashboard_agent_list_recovered=false iwooos_wazuh_runtime_gate=0 active_response=0；push_blocked=missing_noninteractive_gitea_https_credential；本視窗不改 runtime / Nginx / Docker / K8s / firewall / Wazuh secret。 agent_visibility_status=blocked_waiting_manager_agent_registry_readback agent_visibility_runtime_gate_count=0`
+
+## 強制閘門
+
+- 本 dashboard 只整合 read-only snapshots，不代表 project_current_status / memory 已更新。
+- memory_write_authorized=false 時不得修改 project_current_status 或任何 Memory 檔案。
+- 不得同步 raw Codex App DB / auth / conversations / sessions。
+- 不得把一般批准繼續視為 owner response 或 final apply confirmation。
+- 不得新增 Wazuh / Kali / SOC runtime UI/API、live query、active response 或 host containment。
+- 不得修改 Nginx / Docker / K8s / firewall / Wazuh secret，也不得重啟 host。
+- 不得修改 .gitea/workflows、workflow_dispatch、repo refs、GitHub mirror 或 Gitea environment。
+- 不得執行 backup、restore、migration、kubectl、docker compose up 或資料庫寫入。
+- apps/web build/i18n 必要檔案未恢復前，本 dashboard 只可作 page model 資料，不代表 UI 實作授權。
--- a/docs/operations/awoooi-status-cleanup-dashboard.snapshot.json
+++ b/docs/operations/awoooi-status-cleanup-dashboard.snapshot.json
@@ -0,0 +1,399 @@
+{
+  "schema_version": "awoooi_status_cleanup_dashboard_v1",
+  "generated_at": "2026-06-24T15:39:52+00:00",
+  "target_route": "/workspace/status-cleanup",
+  "source_reviews": {
+    "status_cleanup_preflight": "docs/operations/codex-status-cleanup-preflight.snapshot.json",
+    "owner_review_package": "docs/operations/codex-status-cleanup-owner-review-package.snapshot.json",
+    "owner_response_preflight": "docs/operations/codex-status-cleanup-owner-response-preflight.snapshot.json",
+    "execution_plan": "docs/operations/codex-status-cleanup-execution-plan.snapshot.json",
+    "apply_gate": "docs/operations/codex-status-cleanup-apply-gate.snapshot.json",
+    "artifact_sync_readback": "docs/operations/codex-workstation-artifact-sync-readback.snapshot.json",
+    "scorecard": "docs/operations/product-runtime-governance-completion-scorecard.snapshot.json",
+    "iwooos_wazuh_release_handoff": "docs/operations/iwooos-wazuh-release-handoff.snapshot.json"
+  },
+  "summary": {
+    "dashboard_status": "blocked_status_cleanup_apply_not_authorized",
+    "overall_completion_percent": 41.9,
+    "p0_009_completion_percent": 87,
+    "p0_010_completion_percent": 50,
+    "p1_006_completion_percent": 83,
+    "p2_001_completion_percent": 41,
+    "p2_002_completion_percent": 72,
+    "gate_count": 5,
+    "blocked_gate_count": 5,
+    "project_current_status_age_days": 11,
+    "cleanup_required": true,
+    "accepted_owner_flag_count": 0,
+    "required_owner_flag_count": 6,
+    "approved_update_section_count": 0,
+    "required_update_section_count": 7,
+    "approved_target_path_count": 0,
+    "target_path_count": 1,
+    "boundary_ack_count": 0,
+    "required_boundary_ack_count": 5,
+    "execution_plan_status": "blocked_owner_response_preflight_not_ready",
+    "apply_gate_status": "blocked_status_cleanup_apply_not_authorized",
+    "confirmed_command_count": 0,
+    "planned_command_count": 1,
+    "artifact_count": 47,
+    "artifact_sync_blocked_count": 1,
+    "wazuh_handoff_status": "blocked_not_released",
+    "wazuh_handoff_base_commit": "b540fc0c",
+    "wazuh_handoff_commit_count": 7,
+    "wazuh_handoff_patch_count": 7,
+    "wazuh_release_owner_request_sent_count": 0,
+    "wazuh_release_owner_response_accepted_count": 0,
+    "wazuh_acknowledged_release_owner_ack_count": 0,
+    "wazuh_required_release_owner_ack_count": 6,
+    "wazuh_accepted_evidence_count": 0,
+    "wazuh_required_evidence_count": 6,
+    "wazuh_live_metadata_owner_count": 0,
+    "wazuh_secret_metadata_count": 0,
+    "wazuh_live_agent_registry_readback": 0,
+    "iwooos_wazuh_runtime_gate": 0,
+    "wazuh_active_response_count": 0,
+    "wazuh_agent_visibility_status": "blocked_waiting_manager_agent_registry_readback",
+    "wazuh_manager_agent_registry_readback_passed": false,
+    "wazuh_iwooos_live_route_readback_passed": false,
+    "wazuh_dashboard_agent_list_recovered": false,
+    "wazuh_agent_visibility_runtime_gate_count": 0,
+    "wazuh_push_gate_count": 0,
+    "wazuh_deploy_gate_count": 0,
+    "wazuh_readback_gate_count": 0,
+    "wazuh_runtime_gate_count": 0,
+    "blocking_reason_count": 43,
+    "next_action_count": 6,
+    "apply_allowed": false,
+    "memory_write_authorized": false,
+    "wazuh_api_live_query_authorized": false,
+    "runtime_execution_authorized": false,
+    "ui_implementation_allowed": false
+  },
+  "metric_cards": [
+    {
+      "metric_id": "overall_completion",
+      "title": "整體治理完成度",
+      "value": "41.9%",
+      "status": "orange",
+      "caption": "產品 Runtime 治理完成度計分卡"
+    },
+    {
+      "metric_id": "project_status_age",
+      "title": "project_current_status 年齡",
+      "value": "11 days",
+      "status": "blocked",
+      "caption": "stale_after_days=2"
+    },
+    {
+      "metric_id": "owner_flags",
+      "title": "Owner 旗標",
+      "value": "0/6",
+      "status": "blocked",
+      "caption": "pending_owner_response"
+    },
+    {
+      "metric_id": "approved_sections",
+      "title": "已批准章節",
+      "value": "0/7",
+      "status": "blocked",
+      "caption": "targets=0/1"
+    },
+    {
+      "metric_id": "execution_preview",
+      "title": "執行預覽",
+      "value": "blocked_owner_response_preflight_not_ready",
+      "status": "blocked",
+      "caption": "dry_run_only=true"
+    },
+    {
+      "metric_id": "apply_confirmation",
+      "title": "套用確認",
+      "value": "0/1",
+      "status": "blocked",
+      "caption": "pending_final_confirmation"
+    },
+    {
+      "metric_id": "artifact_sync",
+      "title": "安全交接 artifacts",
+      "value": "1/2",
+      "status": "blocked",
+      "caption": "artifacts=47"
+    }
+  ],
+  "gate_cards": [
+    {
+      "gate_id": "status_cleanup_preflight",
+      "title": "狀態清理預檢",
+      "status": "blocked_status_cleanup_required",
+      "completion_label": "age_days=11 stale_after=2",
+      "evidence_ref": "docs/operations/codex-status-cleanup-preflight.snapshot.json",
+      "blocked": true,
+      "memory_write_authorized": false,
+      "execution_authorized": false
+    },
+    {
+      "gate_id": "owner_review_package",
+      "title": "Owner 審核包",
+      "status": "owner_decision_required",
+      "completion_label": "7 sections / 6 owner flags",
+      "evidence_ref": "docs/operations/codex-status-cleanup-owner-review-package.snapshot.json",
+      "blocked": true,
+      "memory_write_authorized": false,
+      "execution_authorized": false
+    },
+    {
+      "gate_id": "owner_response_preflight",
+      "title": "Owner 回覆預檢",
+      "status": "blocked_owner_response_required",
+      "completion_label": "0/6 flags, 0/7 sections",
+      "evidence_ref": "docs/operations/codex-status-cleanup-owner-response-preflight.snapshot.json",
+      "blocked": true,
+      "memory_write_authorized": false,
+      "execution_authorized": false
+    },
+    {
+      "gate_id": "execution_plan",
+      "title": "Dry-run 執行計畫",
+      "status": "blocked_owner_response_preflight_not_ready",
+      "completion_label": "0/7 sections, 0/1 targets",
+      "evidence_ref": "docs/operations/codex-status-cleanup-execution-plan.snapshot.json",
+      "blocked": true,
+      "memory_write_authorized": false,
+      "execution_authorized": false
+    },
+    {
+      "gate_id": "apply_gate",
+      "title": "最終套用閘門",
+      "status": "blocked_status_cleanup_apply_not_authorized",
+      "completion_label": "0/1 commands, 0/1 targets",
+      "evidence_ref": "docs/operations/codex-status-cleanup-apply-gate.snapshot.json",
+      "blocked": true,
+      "memory_write_authorized": false,
+      "execution_authorized": false
+    }
+  ],
+  "workflow_rows": [
+    {
+      "step_id": "status_cleanup_preflight",
+      "title": "狀態清理預檢",
+      "status": "blocked_status_cleanup_required",
+      "evidence_ref": "docs/operations/codex-status-cleanup-preflight.snapshot.json",
+      "next_step": "owner_review_package",
+      "blocked": true,
+      "memory_write_authorized": false,
+      "execution_authorized": false
+    },
+    {
+      "step_id": "owner_review_package",
+      "title": "Owner 審核包",
+      "status": "owner_decision_required",
+      "evidence_ref": "docs/operations/codex-status-cleanup-owner-review-package.snapshot.json",
+      "next_step": "owner_response_preflight",
+      "blocked": true,
+      "memory_write_authorized": false,
+      "execution_authorized": false
+    },
+    {
+      "step_id": "owner_response_preflight",
+      "title": "Owner 回覆預檢",
+      "status": "blocked_owner_response_required",
+      "evidence_ref": "docs/operations/codex-status-cleanup-owner-response-preflight.snapshot.json",
+      "next_step": "execution_plan",
+      "blocked": true,
+      "memory_write_authorized": false,
+      "execution_authorized": false
+    },
+    {
+      "step_id": "execution_plan",
+      "title": "Dry-run 執行計畫",
+      "status": "blocked_owner_response_preflight_not_ready",
+      "evidence_ref": "docs/operations/codex-status-cleanup-execution-plan.snapshot.json",
+      "next_step": "apply_gate",
+      "blocked": true,
+      "memory_write_authorized": false,
+      "execution_authorized": false
+    },
+    {
+      "step_id": "apply_gate",
+      "title": "最終套用閘門",
+      "status": "blocked_status_cleanup_apply_not_authorized",
+      "evidence_ref": "docs/operations/codex-status-cleanup-apply-gate.snapshot.json",
+      "next_step": "manual_project_current_status_update_after_explicit_final_confirmation",
+      "blocked": true,
+      "memory_write_authorized": false,
+      "execution_authorized": false
+    }
+  ],
+  "risk_controls": [
+    {
+      "control_id": "memory_write",
+      "title": "更新 project_current_status / memory",
+      "status": "blocked_final_apply_gate_required",
+      "authorized": false
+    },
+    {
+      "control_id": "raw_codex_history",
+      "title": "同步 raw Codex App history",
+      "status": "blocked_raw_history_never_synced",
+      "authorized": false
+    },
+    {
+      "control_id": "wazuh_runtime",
+      "title": "部署或查詢 live Wazuh runtime",
+      "status": "blocked_iwooos_runtime_lane_only",
+      "authorized": false
+    },
+    {
+      "control_id": "workflow",
+      "title": "修改或觸發 CI/CD workflow",
+      "status": "blocked_workflow_authorization_required",
+      "authorized": false
+    },
+    {
+      "control_id": "repo_refs",
+      "title": "建立 repo / branch / mirror refs",
+      "status": "blocked_source_control_approval_required",
+      "authorized": false
+    },
+    {
+      "control_id": "host",
+      "title": "SSH / restart / firewall / Nginx / Docker / K8s",
+      "status": "blocked_host_maintenance_required",
+      "authorized": false
+    },
+    {
+      "control_id": "backup_restore",
+      "title": "執行 backup / restore / migration",
+      "status": "blocked_data_owner_approval_required",
+      "authorized": false
+    },
+    {
+      "control_id": "ui",
+      "title": "實作可見 AWOOOI UI",
+      "status": "blocked_apps_web_readiness_required",
+      "authorized": false
+    }
+  ],
+  "blocking_reasons": [
+    "project_current_status 過期只代表需要狀態清理，不代表可修改 memory / runtime。",
+    "不得把一般『批准繼續』解讀成 force push、workflow copy、workflow trigger、repo creation 或 refs sync 授權。",
+    "不得同步 raw Codex App DB / auth / conversations / sessions。",
+    "不得碰 MacBook Pro MOMO PRO protected legacy paths。",
+    "不得新增 Wazuh / Kali / SOC runtime UI/API 或 live query。",
+    "不得 SSH 修改主機、改 firewall / Nginx / Docker / K8s 或執行 active scan。",
+    "Data / Backup coverage 是治理 evidence，不是 backup / restore / migration executor。",
+    "owner_response_preflight:owner_response_status_not_approved_status_cleanup_preview",
+    "owner_response_preflight:owner_flag_not_accepted:accept_status_cleanup_scope",
+    "owner_response_preflight:owner_flag_not_accepted:approve_project_current_status_update_preview",
+    "owner_response_preflight:owner_flag_not_accepted:confirm_latest_logbook_and_scorecard_as_sources",
+    "owner_response_preflight:owner_flag_not_accepted:confirm_no_runtime_or_host_authorization",
+    "owner_response_preflight:owner_flag_not_accepted:confirm_no_raw_codex_history_sync",
+    "owner_response_preflight:owner_flag_not_accepted:confirm_iwooos_wazuh_boundary_preserved",
+    "owner_response_preflight:update_section_not_approved:artifact_sync_gate",
+    "owner_response_preflight:update_section_not_approved:completion_scorecard",
+    "owner_response_preflight:update_section_not_approved:data_backup_gate",
+    "owner_response_preflight:update_section_not_approved:gitea_warning_gate",
+    "owner_response_preflight:update_section_not_approved:iwooos_wazuh_boundary",
+    "owner_response_preflight:update_section_not_approved:latest_logbook_heading",
+    "owner_response_preflight:update_section_not_approved:operation_boundaries",
+    "owner_response_preflight:target_path_not_approved:/Users/ogt/.claude/projects/-Users-ogt-awoooi/memory/project_current_status.md",
+    "owner_response_preflight:boundary_not_acknowledged:memory_write_authorized=false",
+    "owner_response_preflight:boundary_not_acknowledged:refs_sync_authorized=false",
+    "owner_response_preflight:boundary_not_acknowledged:repo_creation_authorized=false",
+    "owner_response_preflight:boundary_not_acknowledged:runtime_execution_authorized=false",
+    "owner_response_preflight:boundary_not_acknowledged:wazuh_api_live_query_authorized=false",
+    "execution_plan_blocked_until:owner response preflight ready_for_status_cleanup_apply_gate=true",
+    "execution_plan_blocked_until:all owner flags accepted",
+    "execution_plan_blocked_until:all update sections approved",
+    "execution_plan_blocked_until:target path approved",
+    "execution_plan_blocked_until:all critical false boundaries acknowledged",
+    "execution_plan_blocked_until:final status cleanup apply confirmation accepted",
+    "apply_gate:execution_plan_not_ready_for_final_confirmation",
+    "apply_gate:owner_response_preflight_not_ready",
+    "apply_gate:final_confirmation_status_not_approved_status_cleanup_apply",
+    "apply_gate:final_flag_not_accepted:confirm_status_cleanup_command_preview",
+    "apply_gate:final_flag_not_accepted:confirm_project_current_status_target_path",
+    "apply_gate:final_flag_not_accepted:confirm_post_apply_validation",
+    "apply_gate:final_flag_not_accepted:confirm_no_runtime_or_wazuh_deploy",
+    "apply_gate:command_preview_not_confirmed",
+    "apply_gate:target_path_not_confirmed:/Users/ogt/.claude/projects/-Users-ogt-awoooi/memory/project_current_status.md",
+    "wazuh_boundary:Wazuh route / production 404 由另一受控 branch 處理；branch=codex/iwooos-wazuh-boundary-guard-20260624 base=b540fc0c commits=38dc3c2f,9a53d3e1,e9972d47,758d419e,04db4b8a,8eec298e,325f262a patch_sha_1=08f8b36d7261b0dde6bfb0c47597bd0727d578dec3335c5ff7ded2bcaa2b7eb4 patch_sha_2=e6ec8f8d10e8a2bd711c399fa14ba0ab2dfb22f8ab6a733402944302eec7da7c patch_sha_3=7e99bd5284a25519313aea05bb314d3386454b91ce86241424385752d358900d patch_sha_4=f4ffbaecd94d3696660766cc6f4a6bd195762bc533d9502f8edfed2bb8379fab patch_sha_5=9035d6c411bf86d0857970b69dd33631f052aa90de27e52d82d448d4b8e4cec5 patch_sha_6=d3bb98711a3ebf91b9936b41bc232b689befc68a4a7cec38bf9cab4c8d015827 patch_sha_7=5aa3e69fee9624d0ff3f2bfad90595a81eb9306ad6387d640690a85a2f8038d7 apply_proof=release_apply_check_20260624_2248 release_gate=source1_push0_deploy0_readback0_runtime0 release_lane_preflight=ready0_acks0of6_evidence0of6_push0_deploy0_readback0_runtime0 owner_gate=request_sent0_response_accepted0_acks0of6_evidence0of6_push0_deploy0_readback0_runtime0 live_metadata_env_gate=owner0_secret_metadata0_push0_deploy0_readback0_runtime0；wazuh_live_agent_registry_readback=0 manager_agent_registry_readback_passed=false iwooos_live_route_readback_passed=false dashboard_agent_list_recovered=false iwooos_wazuh_runtime_gate=0 active_response=0；push_blocked=missing_noninteractive_gitea_https_credential；本視窗不改 runtime / Nginx / Docker / K8s / firewall / Wazuh secret。 agent_visibility_status=blocked_waiting_manager_agent_registry_readback agent_visibility_runtime_gate_count=0"
+  ],
+  "next_actions": [
+    "收齊 owner 旗標：0/6。",
+    "收齊已批准章節：0/7。",
+    "確認目標路徑：0/1。",
+    "確認邊界 acknowledgement：0/5。",
+    "owner response preflight ready 後，重新產生 dry-run execution plan。",
+    "apply gate 目前 apply_allowed=False；未變 true 前不得寫 project_current_status。"
+  ],
+  "wazuh_handoff": {
+    "status": "blocked_not_released",
+    "source_ref": "docs/operations/iwooos-wazuh-release-handoff.snapshot.json",
+    "branch": "codex/iwooos-wazuh-boundary-guard-20260624",
+    "base_commit": "b540fc0c",
+    "commit_count": 7,
+    "patch_count": 7,
+    "release_owner_request_sent_count": 0,
+    "release_owner_response_accepted_count": 0,
+    "acknowledged_release_owner_ack_count": 0,
+    "required_release_owner_ack_count": 6,
+    "accepted_evidence_count": 0,
+    "required_evidence_count": 6,
+    "live_metadata_owner_count": 0,
+    "secret_metadata_count": 0,
+    "wazuh_live_agent_registry_readback": 0,
+    "iwooos_wazuh_runtime_gate": 0,
+    "active_response": 0,
+    "stored_api_secret_metadata_changed": false,
+    "agent_visibility_status": "blocked_waiting_manager_agent_registry_readback",
+    "manager_agent_registry_readback_passed": false,
+    "iwooos_live_route_readback_passed": false,
+    "dashboard_agent_list_recovered": false,
+    "agent_visibility_runtime_gate_count": 0,
+    "push_gate_count": 0,
+    "deploy_gate_count": 0,
+    "readback_gate_count": 0,
+    "runtime_gate_count": 0,
+    "production_readback_status": "predeploy_404",
+    "boundary": "Wazuh route / production 404 由另一受控 branch 處理；branch=codex/iwooos-wazuh-boundary-guard-20260624 base=b540fc0c commits=38dc3c2f,9a53d3e1,e9972d47,758d419e,04db4b8a,8eec298e,325f262a patch_sha_1=08f8b36d7261b0dde6bfb0c47597bd0727d578dec3335c5ff7ded2bcaa2b7eb4 patch_sha_2=e6ec8f8d10e8a2bd711c399fa14ba0ab2dfb22f8ab6a733402944302eec7da7c patch_sha_3=7e99bd5284a25519313aea05bb314d3386454b91ce86241424385752d358900d patch_sha_4=f4ffbaecd94d3696660766cc6f4a6bd195762bc533d9502f8edfed2bb8379fab patch_sha_5=9035d6c411bf86d0857970b69dd33631f052aa90de27e52d82d448d4b8e4cec5 patch_sha_6=d3bb98711a3ebf91b9936b41bc232b689befc68a4a7cec38bf9cab4c8d015827 patch_sha_7=5aa3e69fee9624d0ff3f2bfad90595a81eb9306ad6387d640690a85a2f8038d7 apply_proof=release_apply_check_20260624_2248 release_gate=source1_push0_deploy0_readback0_runtime0 release_lane_preflight=ready0_acks0of6_evidence0of6_push0_deploy0_readback0_runtime0 owner_gate=request_sent0_response_accepted0_acks0of6_evidence0of6_push0_deploy0_readback0_runtime0 live_metadata_env_gate=owner0_secret_metadata0_push0_deploy0_readback0_runtime0；wazuh_live_agent_registry_readback=0 manager_agent_registry_readback_passed=false iwooos_live_route_readback_passed=false dashboard_agent_list_recovered=false iwooos_wazuh_runtime_gate=0 active_response=0；push_blocked=missing_noninteractive_gitea_https_credential；本視窗不改 runtime / Nginx / Docker / K8s / firewall / Wazuh secret。 agent_visibility_status=blocked_waiting_manager_agent_registry_readback agent_visibility_runtime_gate_count=0",
+    "runtime_execution_authorized": false,
+    "wazuh_api_live_query_authorized": false
+  },
+  "hard_gates": [
+    "本 dashboard 只整合 read-only snapshots，不代表 project_current_status / memory 已更新。",
+    "memory_write_authorized=false 時不得修改 project_current_status 或任何 Memory 檔案。",
+    "不得同步 raw Codex App DB / auth / conversations / sessions。",
+    "不得把一般批准繼續視為 owner response 或 final apply confirmation。",
+    "不得新增 Wazuh / Kali / SOC runtime UI/API、live query、active response 或 host containment。",
+    "不得修改 Nginx / Docker / K8s / firewall / Wazuh secret，也不得重啟 host。",
+    "不得修改 .gitea/workflows、workflow_dispatch、repo refs、GitHub mirror 或 Gitea environment。",
+    "不得執行 backup、restore、migration、kubectl、docker compose up 或資料庫寫入。",
+    "apps/web build/i18n 必要檔案未恢復前，本 dashboard 只可作 page model 資料，不代表 UI 實作授權。"
+  ],
+  "operation_boundaries": {
+    "memory_write_authorized": false,
+    "raw_codex_history_sync_authorized": false,
+    "runtime_execution_authorized": false,
+    "active_scan_authorized": false,
+    "wazuh_api_live_query_authorized": false,
+    "wazuh_active_response_authorized": false,
+    "repo_creation_authorized": false,
+    "refs_sync_authorized": false,
+    "workflow_modification_authorized": false,
+    "workflow_trigger_authorized": false,
+    "host_update_authorized": false,
+    "backup_execution_authorized": false,
+    "restore_execution_authorized": false,
+    "migration_authorized": false
+  },
+  "secret_values_collected": false,
+  "remote_write_performed": false,
+  "local_product_write_performed": false,
+  "execution_authorized": false,
+  "memory_write_authorized": false,
+  "wazuh_api_live_query_authorized": false,
+  "runtime_execution_authorized": false,
+  "ui_implementation_authorized": false
+}
--- a/docs/schemas/awoooi_status_cleanup_dashboard_v1.schema.json
+++ b/docs/schemas/awoooi_status_cleanup_dashboard_v1.schema.json
@@ -0,0 +1,88 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "awoooi_status_cleanup_dashboard_v1",
+  "title": "AWOOOI 狀態清理儀表板",
+  "type": "object",
+  "required": [
+    "schema_version",
+    "generated_at",
+    "target_route",
+    "source_reviews",
+    "summary",
+    "metric_cards",
+    "gate_cards",
+    "workflow_rows",
+    "risk_controls",
+    "blocking_reasons",
+    "next_actions",
+    "wazuh_handoff",
+    "hard_gates",
+    "operation_boundaries",
+    "secret_values_collected",
+    "remote_write_performed",
+    "local_product_write_performed",
+    "execution_authorized",
+    "memory_write_authorized",
+    "wazuh_api_live_query_authorized",
+    "runtime_execution_authorized",
+    "ui_implementation_authorized"
+  ],
+  "properties": {
+    "schema_version": {"const": "awoooi_status_cleanup_dashboard_v1"},
+    "generated_at": {"type": "string"},
+    "target_route": {"const": "/workspace/status-cleanup"},
+    "source_reviews": {"type": "object", "additionalProperties": {"type": "string"}},
+    "summary": {
+      "type": "object",
+      "required": [
+        "dashboard_status",
+        "overall_completion_percent",
+        "gate_count",
+        "blocked_gate_count",
+        "accepted_owner_flag_count",
+        "required_owner_flag_count",
+        "approved_update_section_count",
+        "required_update_section_count",
+        "wazuh_handoff_status",
+        "wazuh_handoff_base_commit",
+        "wazuh_handoff_commit_count",
+        "wazuh_handoff_patch_count",
+        "wazuh_live_metadata_owner_count",
+        "wazuh_secret_metadata_count",
+        "wazuh_live_agent_registry_readback",
+        "iwooos_wazuh_runtime_gate",
+        "wazuh_active_response_count",
+        "wazuh_agent_visibility_status",
+        "wazuh_manager_agent_registry_readback_passed",
+        "wazuh_iwooos_live_route_readback_passed",
+        "wazuh_dashboard_agent_list_recovered",
+        "wazuh_agent_visibility_runtime_gate_count",
+        "wazuh_runtime_gate_count",
+        "apply_allowed",
+        "memory_write_authorized",
+        "wazuh_api_live_query_authorized",
+        "runtime_execution_authorized",
+        "ui_implementation_allowed"
+      ],
+      "additionalProperties": true
+    },
+    "metric_cards": {"type": "array", "items": {"type": "object"}},
+    "gate_cards": {"type": "array", "items": {"type": "object"}},
+    "workflow_rows": {"type": "array", "items": {"type": "object"}},
+    "risk_controls": {"type": "array", "items": {"type": "object"}},
+    "blocking_reasons": {"type": "array", "items": {"type": "string"}},
+    "next_actions": {"type": "array", "items": {"type": "string"}},
+    "wazuh_handoff": {"type": "object", "additionalProperties": true},
+    "hard_gates": {"type": "array", "items": {"type": "string"}},
+    "operation_boundaries": {"type": "object", "additionalProperties": {"const": false}},
+    "secret_values_collected": {"const": false},
+    "remote_write_performed": {"const": false},
+    "local_product_write_performed": {"const": false},
+    "execution_authorized": {"const": false},
+    "memory_write_authorized": {"const": false},
+    "wazuh_api_live_query_authorized": {"const": false},
+    "runtime_execution_authorized": {"const": false},
+    "ui_implementation_authorized": {"const": false}
+  },
+  "additionalProperties": false
+}