diff --git a/apps/web/messages/en.json b/apps/web/messages/en.json index d716518f0..b401af7a9 100644 --- a/apps/web/messages/en.json +++ b/apps/web/messages/en.json @@ -2294,6 +2294,54 @@ "next": "active runtime gates=0; action buttons=false" } } + }, + "hostOwnerDecisionRecordHumanHandoffReadiness": { + "title": "Host Owner Decision Record Human Record Owner Handoff Readiness Packets", + "subtitle": "Human record owner handoff readiness packets only display metadata to prepare before a future human record owner handoff. They do not start handoff, mark handoff ready, mark review passed, create decision records, accept owner decisions, or open runtime gates.", + "packetLabel": "Handoff readiness packet", + "guardLabel": "Guardrail", + "items": { + "handoffIdentityTrace": { + "title": "Handoff identity and trace", + "body": "Shows whether candidate record id, version, source outcome lane, source queue review, and trace pointer are readable enough for a future human record owner to identify.", + "guard": "handoff started=0; ready=0" + }, + "handoffOwnerBoundary": { + "title": "Human record owner boundary", + "body": "Shows future record owner, backup owner, contact point, and responsibility boundary without sending notifications, collecting decisions, or creating approval records.", + "guard": "owner decision received=0" + }, + "handoffDecisionSummary": { + "title": "Decision summary packet", + "body": "Shows whether decision summary, no-execution statement, and candidate conclusion are readable so the handoff cannot be mistaken for approval.", + "guard": "decision record created=false" + }, + "handoffScopeExpiry": { + "title": "Scope and expiry packet", + "body": "Shows the handoff summary for host, network, service, exclusion, observation intent, and expiry; stale or out-of-scope data can only route back to scope refresh.", + "guard": "review passed=0" + }, + "handoffScanLimits": { + "title": "Scan limits packet", + "body": "Shows the wording for observe-only, future active scan, and credentialed scan limits so the human record owner can see this is not scan authorization.", + "guard": "scan authorized=false" + }, + "handoffCredentialBoundary": { + "title": "Credential boundary packet", + "body": "Shows credential boundary metadata, retention, and masking responsibility without collecting plaintext, token values, or raw secrets.", + "guard": "secret collection=false" + }, + "handoffMaintenanceRollback": { + "title": "Maintenance and rollback packet", + "body": "Shows maintenance window, constraints, rollback owner, recovery path, and human contact while still disallowing SSH, package updates, or host tuning.", + "guard": "host change=false" + }, + "handoffRuntimeGate": { + "title": "Runtime gate separation packet", + "body": "Shows validation evidence and follow-up runtime gate pointer as a separate gate that cannot open from handoff readiness.", + "guard": "active runtime gates=0; action buttons=false" + } + } } }, "tickets": { diff --git a/apps/web/messages/zh-TW.json b/apps/web/messages/zh-TW.json index d0166be9c..15e8a1c57 100644 --- a/apps/web/messages/zh-TW.json +++ b/apps/web/messages/zh-TW.json @@ -2295,6 +2295,54 @@ "next": "active runtime gates=0；action buttons=false" } } + }, + "hostOwnerDecisionRecordHumanHandoffReadiness": { + "title": "主機 Owner Decision Record Human Record Owner Handoff Readiness Packets", + "subtitle": "Human record owner handoff readiness packets 只顯示未來交給人工 record owner 前要準備的 metadata。不代表 handoff started、不代表 handoff ready、不代表 review passed、不建立 decision record、不接受 owner decision、不開 runtime gate。", + "packetLabel": "Handoff readiness packet", + "guardLabel": "保護邊界", + "items": { + "handoffIdentityTrace": { + "title": "Handoff identity and trace", + "body": "顯示 candidate record id、版本、來源 outcome lane、source queue review 與 trace pointer 是否足夠供未來人工 record owner 辨識。", + "guard": "handoff started=0；ready=0" + }, + "handoffOwnerBoundary": { + "title": "Human record owner boundary", + "body": "顯示未來 record owner、backup owner、聯絡窗口與責任邊界，但不自動通知、不收 decision、不建立 approval record。", + "guard": "owner decision received=0" + }, + "handoffDecisionSummary": { + "title": "Decision summary packet", + "body": "顯示 decision summary、no-execution statement 與候選結論是否可讀，避免 handoff 時把摘要當成批准。", + "guard": "decision record created=false" + }, + "handoffScopeExpiry": { + "title": "Scope and expiry packet", + "body": "顯示 host、network、service、exclusion、觀察目的與 expiry 的 handoff 摘要，過期或越界時仍只能回補 scope。", + "guard": "review passed=0" + }, + "handoffScanLimits": { + "title": "Scan limits packet", + "body": "顯示 observe-only、future active scan 與 credentialed scan limits 的限制文字，讓人工 record owner 清楚這不是掃描授權。", + "guard": "scan authorized=false" + }, + "handoffCredentialBoundary": { + "title": "Credential boundary packet", + "body": "顯示 credential boundary metadata、retention 與 masking 責任，不收 plaintext、不收 token value、不收 raw secret。", + "guard": "secret collection=false" + }, + "handoffMaintenanceRollback": { + "title": "Maintenance and rollback packet", + "body": "顯示維護窗口、限制條件、rollback owner、復原路徑與人工聯絡點，仍不允許 SSH、package update 或主機調校。", + "guard": "host change=false" + }, + "handoffRuntimeGate": { + "title": "Runtime gate separation packet", + "body": "顯示 validation evidence 與 follow-up runtime gate pointer 仍是獨立 gate，不能由 handoff readiness 開啟。", + "guard": "active runtime gates=0；action buttons=false" + } + } } }, "tickets": { diff --git a/apps/web/src/app/[locale]/iwooos/page.tsx b/apps/web/src/app/[locale]/iwooos/page.tsx index 9fb08ec57..274cc47d3 100644 --- a/apps/web/src/app/[locale]/iwooos/page.tsx +++ b/apps/web/src/app/[locale]/iwooos/page.tsx @@ -243,6 +243,13 @@ type HostOwnerDecisionRecordFormalRecordQueueReviewOutcomeLane = { tone: 'steady' | 'warn' | 'locked' } +type HostOwnerDecisionRecordHumanHandoffReadinessPacket = { + key: string + packet: string + icon: typeof ShieldCheck + tone: 'steady' | 'warn' | 'locked' +} + const postureMetrics: PostureMetric[] = [ { key: 'overall', value: '58%', tone: 'warn' }, { key: 'framework', value: '80-85%', tone: 'steady' }, @@ -578,6 +585,17 @@ const hostOwnerDecisionRecordFormalRecordQueueReviewOutcomeLanes: HostOwnerDecis { key: 'runtimeGateStillRequired', lane: 'FQV8', icon: ShieldCheck, tone: 'locked' }, ] +const hostOwnerDecisionRecordHumanHandoffReadinessPackets: HostOwnerDecisionRecordHumanHandoffReadinessPacket[] = [ + { key: 'handoffIdentityTrace', packet: 'FHO1', icon: FileText, tone: 'warn' }, + { key: 'handoffOwnerBoundary', packet: 'FHO2', icon: Bell, tone: 'warn' }, + { key: 'handoffDecisionSummary', packet: 'FHO3', icon: ClipboardCheck, tone: 'warn' }, + { key: 'handoffScopeExpiry', packet: 'FHO4', icon: Radar, tone: 'warn' }, + { key: 'handoffScanLimits', packet: 'FHO5', icon: Activity, tone: 'locked' }, + { key: 'handoffCredentialBoundary', packet: 'FHO6', icon: Lock, tone: 'locked' }, + { key: 'handoffMaintenanceRollback', packet: 'FHO7', icon: Clock3, tone: 'warn' }, + { key: 'handoffRuntimeGate', packet: 'FHO8', icon: ShieldCheck, tone: 'locked' }, +] + const evidenceItems = [ 'iwooos-posture-projection.snapshot.json', 'security-rollout-policy.snapshot.json', @@ -1528,6 +1546,38 @@ function HostOwnerDecisionRecordFormalRecordQueueReviewOutcomeCard({ ) } +function HostOwnerDecisionRecordHumanHandoffReadinessCard({ + item, +}: { + item: HostOwnerDecisionRecordHumanHandoffReadinessPacket +}) { + const t = useTranslations('iwooos.hostOwnerDecisionRecordHumanHandoffReadiness') + const Icon = item.icon + return ( +
+
+
+ + {t('packetLabel')} +
+ {item.packet} +
+

+ {t(`items.${item.key}.title` as never)} +

+

+ {t(`items.${item.key}.body` as never)} +

+
+
{t('guardLabel')}
+
+ {t(`items.${item.key}.guard` as never)} +
+
+
+ ) +} + export default function IwoooSPage({ params }: { params: { locale: string } }) { const t = useTranslations('iwooos') @@ -2080,6 +2130,26 @@ export default function IwoooSPage({ params }: { params: { locale: string } }) { +
+
+

{t('hostOwnerDecisionRecordHumanHandoffReadiness.title')}

+

+ {t('hostOwnerDecisionRecordHumanHandoffReadiness.subtitle')} +

+
+
+ {hostOwnerDecisionRecordHumanHandoffReadinessPackets.map(item => ( + + ))} +
+
+
None: "s2_35_iwooos_host_owner_decision_record_formal_record_queue_packets", "s2_36_iwooos_host_owner_decision_record_formal_record_queue_review_checklist", "s2_37_iwooos_host_owner_decision_record_formal_record_queue_review_outcome_lanes", + "s2_38_iwooos_host_owner_decision_record_human_handoff_readiness_packets", ] assert_equal( "progress_delta_ledger.delta_ids", @@ -572,6 +573,16 @@ def validate(root: Path) -> None: "host_decision_record_formal_record_queue_review_maintenance_rollback_incomplete_outcome_lane", "host_decision_record_formal_record_queue_review_runtime_gate_required_outcome_lane", ] + expected_iwooos_host_owner_decision_record_human_handoff_readiness_packet_ids = [ + "host_decision_record_handoff_readiness_identity_trace_packet", + "host_decision_record_handoff_readiness_owner_boundary_packet", + "host_decision_record_handoff_readiness_decision_summary_packet", + "host_decision_record_handoff_readiness_scope_expiry_packet", + "host_decision_record_handoff_readiness_scan_limits_packet", + "host_decision_record_handoff_readiness_credential_boundary_packet", + "host_decision_record_handoff_readiness_maintenance_rollback_packet", + "host_decision_record_handoff_readiness_runtime_gate_packet", + ] assert_equal( "iwooos_projection.summary.frontend_surface_coverage_group_count", iwooos_projection["summary"]["frontend_surface_coverage_group_count"], @@ -712,6 +723,11 @@ def validate(root: Path) -> None: iwooos_projection["summary"]["host_owner_decision_record_formal_record_queue_review_outcome_lane_count"], len(expected_iwooos_host_owner_decision_record_formal_record_queue_review_outcome_lane_ids), ) + assert_equal( + "iwooos_projection.summary.host_owner_decision_record_human_handoff_readiness_packet_count", + iwooos_projection["summary"]["host_owner_decision_record_human_handoff_readiness_packet_count"], + len(expected_iwooos_host_owner_decision_record_human_handoff_readiness_packet_ids), + ) iwooos_progress = iwooos_projection["progress"] assert_equal("iwooos_projection.progress.overall_percent", iwooos_progress["overall_percent"], progress["overall_percent"]) assert_equal( @@ -2663,6 +2679,107 @@ def validate(root: Path) -> None: f"iwooos_projection.host_owner_decision_record_formal_record_queue_review_outcome_lanes.{item['lane_id']}.not_authorization", item["not_authorization"], ) + iwooos_host_owner_decision_record_human_handoff_readiness_packets = iwooos_projection[ + "host_owner_decision_record_human_handoff_readiness_packets" + ] + assert_equal( + "iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.ids", + [item["packet_id"] for item in iwooos_host_owner_decision_record_human_handoff_readiness_packets], + expected_iwooos_host_owner_decision_record_human_handoff_readiness_packet_ids, + ) + assert_equal( + "iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.display_order", + [item["display_order"] for item in iwooos_host_owner_decision_record_human_handoff_readiness_packets], + list(range(1, len(expected_iwooos_host_owner_decision_record_human_handoff_readiness_packet_ids) + 1)), + ) + expected_iwooos_host_owner_decision_record_human_handoff_readiness_fields = [ + "record_identity_and_trace", + "human_record_owner_contact_boundary", + "decision_summary_and_no_execution_statement", + "approved_scope_and_expiry_window", + "observe_only_and_future_scan_limits", + "metadata_only_credential_boundary", + "maintenance_constraints_and_rollback_owner", + "independent_runtime_gate_and_no_action_buttons", + ] + assert_equal( + "iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.readiness_fields", + [item["readiness_field"] for item in iwooos_host_owner_decision_record_human_handoff_readiness_packets], + expected_iwooos_host_owner_decision_record_human_handoff_readiness_fields, + ) + for item in iwooos_host_owner_decision_record_human_handoff_readiness_packets: + assert_equal( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.{item['packet_id']}.display_mode", + item["display_mode"], + "owner_decision_record_human_handoff_readiness_only", + ) + assert_equal( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.{item['packet_id']}.source_outcome_lane_id", + item["source_outcome_lane_id"], + "host_decision_record_formal_record_queue_review_ready_for_human_record_owner_handoff_outcome_lane", + ) + assert_equal( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.{item['packet_id']}.human_record_owner_handoff_started_count", + item["human_record_owner_handoff_started_count"], + 0, + ) + assert_equal( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.{item['packet_id']}.human_record_owner_handoff_ready_count", + item["human_record_owner_handoff_ready_count"], + 0, + ) + assert_equal( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.{item['packet_id']}.formal_record_queue_review_passed_count", + item["formal_record_queue_review_passed_count"], + 0, + ) + assert_equal( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.{item['packet_id']}.formal_record_queue_enqueued_count", + item["formal_record_queue_enqueued_count"], + 0, + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.{item['packet_id']}.decision_record_created", + item["decision_record_created"], + ) + assert_equal( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.{item['packet_id']}.owner_decision_received_count", + item["owner_decision_received_count"], + 0, + ) + assert_equal( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.{item['packet_id']}.owner_decision_accepted_count", + item["owner_decision_accepted_count"], + 0, + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.{item['packet_id']}.owner_approval_record_created", + item["owner_approval_record_created"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.{item['packet_id']}.runtime_gate_opened", + item["runtime_gate_opened"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.{item['packet_id']}.raw_payload_allowed", + item["raw_payload_allowed"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.{item['packet_id']}.secret_value_collection_allowed", + item["secret_value_collection_allowed"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.{item['packet_id']}.runtime_execution_authorized", + item["runtime_execution_authorized"], + ) + assert_false( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.{item['packet_id']}.action_buttons_allowed", + item["action_buttons_allowed"], + ) + assert_true( + f"iwooos_projection.host_owner_decision_record_human_handoff_readiness_packets.{item['packet_id']}.not_authorization", + item["not_authorization"], + ) assert_equal( "iwooos_projection.non_blocking_lane_ids", iwooos_projection["non_blocking_lane_ids"], @@ -2709,6 +2826,7 @@ def validate(root: Path) -> None: "display_host_owner_decision_record_formal_record_queue_packets", "display_host_owner_decision_record_formal_record_queue_review_checklist", "display_host_owner_decision_record_formal_record_queue_review_outcome_lanes", + "display_host_owner_decision_record_human_handoff_readiness_packets", "display_evidence_refs", "display_forbidden_actions", ]: @@ -2814,6 +2932,11 @@ def validate(root: Path) -> None: "enqueue_host_owner_decision_record_from_formal_record_queue_review_outcome", "create_host_owner_decision_record_from_formal_record_queue_review_outcome", "open_runtime_gate_from_formal_record_queue_review_outcome", + "treat_host_owner_decision_record_handoff_readiness_as_approval", + "start_human_record_owner_handoff_from_readiness_packet", + "mark_human_record_owner_handoff_ready_from_frontend", + "create_host_owner_decision_record_from_handoff_readiness", + "open_runtime_gate_from_handoff_readiness", "apply_runtime_blocking_control", "switch_github_primary", "production_deploy",