Merge remote-tracking branch 'gitea/main' into codex/github-redacted-evidence-validator-20260627

# Conflicts:
#	docs/LOGBOOK.md

AGENTS.md

@@ -23,12 +23,31 @@
 ## 四大核心原則
 
 1. **變更前 → 先讀註解** (理解設計意圖再動手) 🔴
-2. **不可逆操作 → 人工確認** (刪除、logOut、DROP、force push)
-3. **有疑問 → 先問統帥** (不確定就停下來)
+2. **事故級不可逆操作 → break-glass** (secret 明文、DROP / TRUNCATE / destructive restore、reboot、node drain、不可逆 firewall、外部攻擊型掃描、force push、repo / refs 破壞、付費 provider / 成本切換)
+3. **非事故級 gate → 受控自動執行** (不要把 owner / read-only / manual / `0 / false` 當阻擋)
 4. **任務完成 → 更新 Memory** (不等被問)
 
 ---
 
+## 🔴🔴🔴 統帥全面授權（2026-06-28）
+
+所有 AWOOOI / AwoooP / IwoooS / StockPlatform / VibeWork / MOMO / AwoooGo / 2026FIFA / Agent Bounty / Tsenyang 工作，除 `docs/HARD_RULES.md#commander-blanket-authorization` 定義的事故級硬阻擋外，一律直接進 AI controlled apply。
+
+舊規範、UI、Telegram、snapshot、test 或 Runbook 若出現下列狀態，不得作為停止實作理由：
+
+- `owner_response_received=0`
+- `owner_response_accepted=0`
+- `runtime_execution_authorized=false`
+- `runtime_write_gate=0`
+- `apply_allowed=false`
+- `read_only=true`
+- `manual_required`
+- `needs_human=true`
+
+正確動作是 AI 自動補齊 target selector、source-of-truth diff、check-mode / dry-run、rollback、post-apply verifier、KM / PlayBook trust writeback，然後推進可驗證、可回滾、低爆炸半徑的實作。
+
+---
+
 ## 🔴 絕對禁止 → [HARD_RULES.md](docs/HARD_RULES.md)
 
 ## 🔴 文件語言鐵律 → [文件語言規範](docs/HARD_RULES.md#文件語言規範)

apps/api/tests/test_awooop_controlled_automation_copy_guard.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import json
 import runpy
 from pathlib import Path
 
@@ -13,3 +14,36 @@ def test_awooop_controlled_automation_copy_guard_blocks_legacy_manual_gate_text(
     )
 
     guard["validate"](ROOT)
+
+
+def test_awooop_controlled_automation_copy_guard_blocks_live_owner_review_copy(tmp_path: Path) -> None:
+    guard = runpy.run_path(
+        str(ROOT / "scripts" / "security" / "awooop-controlled-automation-copy-guard.py")
+    )
+    messages_path = tmp_path / "apps" / "web" / "messages" / "zh-TW.json"
+    messages_path.parent.mkdir(parents=True)
+    messages_path.write_text(
+        json.dumps({"awooop": {"workItems": {"status": "Owner Review 等待人工"}}}),
+        encoding="utf-8",
+    )
+
+    violations = guard["_collect_awooop_message_violations"](messages_path, tmp_path)
+
+    assert any("Owner Review" in violation for violation in violations)
+    assert any("等待人工" in violation for violation in violations)
+
+
+def test_awooop_controlled_automation_copy_guard_allows_legacy_hitl_history(tmp_path: Path) -> None:
+    guard = runpy.run_path(
+        str(ROOT / "scripts" / "security" / "awooop-controlled-automation-copy-guard.py")
+    )
+    messages_path = tmp_path / "apps" / "web" / "messages" / "zh-TW.json"
+    messages_path.parent.mkdir(parents=True)
+    messages_path.write_text(
+        json.dumps({"awooop": {"approvals": {"legacyHitl": {"title": "既有 HITL 待人工處理"}}}}),
+        encoding="utf-8",
+    )
+
+    violations = guard["_collect_awooop_message_violations"](messages_path, tmp_path)
+
+    assert violations == []

apps/web/messages/en.json

@@ -8505,7 +8505,7 @@
             "detail": "來源事件是否回到 Run / Incident"
           },
           "gate": {
-            "label": "人工 Gate",
+            "label": "AI 受控 Gate",
             "detail": "待處理工作 {work}"
           },
           "verify": {
@@ -8569,7 +8569,7 @@
           "autoRepairedVerified": "已驗證自動修復",
           "executionUnverified": "已執行但未驗證",
           "executionFailed": "執行失敗",
-          "manualRequiredNoAction": "人工介入：NO_ACTION",
+          "manualRequiredNoAction": "AI 受控補齊：NO_ACTION",
           "approvalRequired": "等待審批",
           "observedNotExecuted": "已觀測但未執行",
           "receivedOnly": "僅收到告警"
@@ -8730,7 +8730,7 @@
         },
         "readinessRefs": {
           "primaryReadiness": "GitHub 主要來源就緒度閘門仍是候選狀態，不能觸發專案庫建立或可見性變更。",
-          "ownerValidation": "負責人回覆驗證彙總顯示四包回覆資料都仍等待人工回覆與驗收。",
+          "ownerValidation": "負責人回覆驗證彙總顯示四包回覆資料都仍等待負責人脫敏回覆與受控驗收。",
           "rollbackAdr": "回復架構決策紀錄尚未完成負責人批准的演練，因此不能把 GitHub 切為主要來源。",
           "workflowInventory": "工作流程 / 機密名稱清冊只收集名稱與路由，不收機密明文值、不改 GitHub 機密設定。"
         }
@@ -8810,7 +8810,7 @@
           },
           "reviewerChecklist": {
             "label": "審查清單",
-            "detail": "9 個清單項目給人工審查者判讀。"
+            "detail": "9 個清單項目給受控驗收流程判讀。"
           },
           "reviewerOutcomes": {
             "label": "審查結果",
@@ -8911,7 +8911,7 @@
           },
           "owner": {
             "title": "接手",
-            "detail": "AI 受控閘門與負責人審查"
+            "detail": "AI 受控閘門與受控 review"
           },
           "verifier": {
             "title": "驗證",
@@ -8988,7 +8988,7 @@
           },
           "learning": {
             "title": "KM / Trust 回寫",
-            "detail": "確認 KM、PlayBook trust 與學習責任已沉澱，避免下次重複人工判斷。"
+            "detail": "確認 KM、PlayBook trust 與學習責任已沉澱，避免下次重複 AI 補齊判斷。"
           }
         }
       },
@@ -9035,7 +9035,7 @@
         "items": {
           "km": {
             "title": "Knowledge Base",
-            "detail": "Hermes 草稿、陳舊 KM、負責人審查 與 stale ratio 回測。",
+            "detail": "Hermes 草稿、陳舊 KM、AI 受控 review 與 stale ratio 回測。",
             "next": "下一步：把待補 KM 與 Incident / PlayBook / verifier 結果綁定。"
           },
           "playbook": {
@@ -9061,7 +9061,7 @@
         },
         "sources": {
           "knowledgeBase": "Knowledge Base",
-          "ownerReview": "Owner review",
+          "ownerReview": "Controlled review",
           "staleRatio": "Stale ratio",
           "statusChain": "Status-chain",
           "remediationQueue": "補救佇列",
@@ -9078,17 +9078,17 @@
         }
       },
       "reportSourceGapOwnerReview": {
-        "eyebrow": "報表資料源 負責人審查",
+        "eyebrow": "報表資料源 AI 受控補齊",
         "title": "報表資料源 PlayBook / Verifier 處置板",
-        "subtitle": "把 report-source-gap 從報表頁接到 Work Items：每個缺口都要有 PlayBook 草案、Verifier 計畫、腳本 readback、排程 無發送 與 負責人審查。",
-        "loading": "正在讀取 report-source-gap 負責人審查 read model。",
+        "subtitle": "把 report-source-gap 從報表頁接到 Work Items：每個缺口都要有 PlayBook 草案、Verifier 計畫、腳本 readback、排程無發送與 AI 受控 review。",
+        "loading": "正在讀取 report-source-gap AI 受控補齊 read model。",
         "unavailable": "報表資料源 read model 尚未回應；不能把報表全 0 或缺資料判定為健康。",
-        "empty": "目前沒有 report-source-gap 負責人審查 卡。",
+        "empty": "目前沒有 report-source-gap AI 受控補齊卡。",
         "boundaryTitle": "不可誤讀合約",
-        "boundary": "live Telegram 發送={live}；runtime gate={gate}。這裡只做草案與 負責人審查讀回，不發送、不排程、不執行。",
+        "boundary": "live Telegram 發送={live}；runtime gate={gate}。這裡只做草案與 AI 受控 review 讀回，不發送、不排程、不執行。",
         "openReports": "回報表總控",
-        "ownerRequired": "需 負責人審查",
-        "ownerOptional": "負責人審查 可後補",
+        "ownerRequired": "需 AI 受控補齊",
+        "ownerOptional": "AI 受控補齊可後補",
         "scheduleBoundary": "排程仍維持 無發送 preview",
         "fieldsTitle": "PlayBook 必填欄位",
         "checksTitle": "Verifier 檢查",
@@ -9154,7 +9154,7 @@
           "title": "AI Provider primary lane 修復工作項"
         },
         "reportSourceGapOwnerReview": {
-          "title": "報表資料源 PlayBook / Verifier 負責人審查"
+          "title": "報表資料源 PlayBook / Verifier AI 受控補齊"
         },
         "configDriftFsm": {
           "title": "Config Drift fingerprint 狀態機"
@@ -9166,7 +9166,7 @@
           "title": "Telegram 詳情 / 歷史改為 DB 真相優先"
         },
         "callbackOwnerReview": {
-          "title": "Callback 未匹配 KM Owner Review 工作項"
+          "title": "Callback 未匹配 KM Controlled Review 工作項"
         },
         "callbackTraceRecoveryBacklog": {
           "title": "Callback trace 復原 backlog"
@@ -9204,9 +9204,9 @@
         "autoRepair": "必須同時有 auto_repair、verification_result=success與KM 回寫",
         "recurrenceWorkItems": "Run 完成無修復、修復失敗與 AI 受控閘門必須進入可追蹤工作項",
         "aiRouteRepairWorkItem": "Provider lane 降級時必須顯示 evidence、owner、PlayBook候選與是否可自動修復",
-        "reportSourceGapOwnerReview": "每個 report-source-gap 必須有 PlayBook 草案、Verifier 計畫、腳本 readback、排程 無發送 與 負責人審查；不得把全 0 當健康或自動執行授權",
+        "reportSourceGapOwnerReview": "每個 report-source-gap 必須有 PlayBook 草案、Verifier 計畫、腳本 readback、排程無發送與 AI 受控 review；不得把全 0 當健康或自動執行授權",
         "configDriftFsm": "同一 drift fingerprint 必須顯示重複、PR、零 diff、交接與下一步",
-        "remediationQueue": "每筆 degraded / failed / timeout都必須映射到重跑、重驗、Ticket或人工檢查",
+        "remediationQueue": "每筆 degraded / failed / timeout都必須映射到重跑、重驗、Ticket或 AI 受控檢查",
         "telegramCallbacks": "按下詳情與歷史不能再只依賴 Redis TTL或舊快照",
         "callbackOwnerReview": "Telegram 詳情 / 歷史若未連到 KM owner-review，必須變成可追蹤工作項",
         "callbackTraceRecoveryBacklog": "Callback trace 缺口必須顯示復原訊號、24h decay與backlog 下一步",
@@ -9260,7 +9260,7 @@
         "driftFingerprintNext": "下一步：{step}",
         "driftFingerprintRemediation": "修復：{kind} / {status}；驗證 Report：{report}",
         "driftFingerprintEmpty": "尚無 Config Drift fingerprint 狀態",
-        "remediationQueue": "補救工作：{total}；AI可接手：{ready}；人工：{human}",
+        "remediationQueue": "補救工作：{total}；AI可接手：{ready}；AI補齊：{human}",
         "telegramCallbacks": "目前修補 Telegram callback 查詢鏈與歷史摘要",
         "telegramCallbacksLive": "只讀 callback toast 400 已非致命；詳情 / 歷史改由 DB 真相鏈 回覆",
         "callbackOwnerReview": "Callback owner-review 缺口：{open} 個 open；callback evidence：{total}",
@@ -9273,7 +9273,7 @@
         "callbackOwnerReviewBlocker": "卡點：{reason}",
         "callbackOwnerReviewEmpty": "近期 callback evidence 均已匹配或尚無資料",
         "callbackTraceRecoveryBacklog": "Callback trace backlog：缺 trace {missing}；1h {recent1h}；24h {recent24h}；gap 後 traced {recovered}；復原 {status}",
-        "callbackTraceRecoveryAction": "接續處理：{action}；需要人工={human}",
+        "callbackTraceRecoveryAction": "接續處理：{action}；需AI補齊={human}",
         "callbackTraceRecoveryOwner": "主責：AwoooP Callback Evidence；協作：TelegramGateway / 執行時間線",
         "callbackTraceRecoveryEvidenceSurface": "查證入口：Runs / TG Callback 證據",
         "callbackTraceRecoveryClosure": "關閉條件：1h=0 且 24h=0；目前 1h {recent1h} / 24h {recent24h}",
@@ -9285,7 +9285,7 @@
         "governanceUnavailable": "治理事件 API 目前無法回應；待派送：{queued}",
         "governanceQueueMissing": "治理 dispatch 表尚未就緒；未解治理告警：{unresolved}",
         "knowledgeHealthcheck": "KM healthcheck 派工：{total}；目前階段：{stage}",
-        "knowledgeOwner": "主責：{lead}；人工覆核：{human}",
+        "knowledgeOwner": "主責：{lead}；受控覆核：{human}",
         "knowledgeNext": "下一步：{action}",
         "knowledgeDrafts": "KM 審核草稿：{drafts}；重複草稿：{duplicates}",
         "knowledgeStaleCandidates": "陳舊 KM 優先清單：{total} 筆；最高 {top} / {tier}",
@@ -9358,7 +9358,7 @@
         "investigateActiveGap": "仍有新缺口，檢查新 Telegram reply_markup trace 寫入",
         "verifyInstrumentation": "沒有復原訊號，檢查 TelegramGateway / 時間線觀測埋點",
         "waitDecay": "等待舊 backlog 24h decay，不需 AI 補齊處理",
-        "observeRecovery": "觀察復原訊號，先不開人工任務"
+        "observeRecovery": "觀察復原訊號，先不開受控任務"
       },
       "claim": {
         "ready": "完整自動修復聲明：可宣稱",
@@ -9390,7 +9390,7 @@
         "stage": "階段：{stage}",
         "next": "下一步：{action}",
         "lead": "主責：{agent}",
-        "human": "人工覆核：{owner}",
+        "human": "受控覆核：{owner}",
         "support": "支援：{agents}",
         "worker": "Worker 狀態：{status}",
         "draft": "KM 草稿：{id}",
@@ -9417,17 +9417,17 @@
           "openKnowledge": "開啟 KM",
           "queueReview": "排入審核",
           "queueingReview": "排入中",
-          "queueFailed": "排入 負責人審查 失敗；請重新整理後再確認此 KM 是否仍為陳舊候選。",
+          "queueFailed": "排入 AI 受控 review 失敗；請重新整理後再確認此 KM 是否仍為陳舊候選。",
           "queueResult": "審核狀態：{status}；Dispatch：{dispatch}；Event：{event}",
-          "ownerReviewState": "Owner review：{status}；階段：{stage}；Dispatch：{dispatch}",
-          "guardrail": "防護：讀取不寫入={writes}；人工覆核={review}",
+          "ownerReviewState": "Controlled review：{status}；階段：{stage}；Dispatch：{dispatch}",
+          "guardrail": "防護：讀取不寫入={writes}；受控覆核={review}",
           "queueStatuses": {
             "dry_run": "乾跑",
-            "queued": "已排入 負責人審查",
-            "already_queued": "已在 負責人審查"
+            "queued": "已排入 AI 受控 review",
+            "already_queued": "已在 AI 受控 review"
           },
           "operationRail": {
-            "title": "Owner Review 操作軌道",
+            "title": "Controlled Review 操作軌道",
             "subtitle": "把陳舊 KM 從偵測、審核、乾跑、確認、寫回到比例回測收斂成一條可掃描流程。",
             "nextAction": "建議下一步",
             "guardrailTitle": "寫入防護",
@@ -9451,7 +9451,7 @@
             "flow": {
               "node": {
                 "detected": "偵測",
-                "ownerReview": "Owner Review",
+                "ownerReview": "Controlled Review",
                 "dryRun": "乾跑預覽",
                 "ownerConfirm": "Owner 確認",
                 "writeback": "寫回 KM",
@@ -9484,12 +9484,12 @@
             },
             "guardrail": {
               "writesOnRead": "讀取即寫入：{value}",
-              "manualReview": "人工覆核必要：{value}",
+              "manualReview": "受控覆核必要：{value}",
               "batchWrites": "批次寫入允許：{value}"
             }
           },
           "singleItemRail": {
-            "title": "單筆 Owner Review 處理",
+            "title": "單筆 Controlled Review 處理",
             "subtitle": "先乾跑取得 plan fingerprint；Owner 確認後才允許寫 KM、寫 audit 並排比例回測。",
             "outcome": "策略：{outcome}",
             "writeGate": "確認寫 KM={writes}；可確認={confirm}",
@@ -9507,10 +9507,10 @@
               "dispatch": "Dispatch {dispatch}",
               "dryRunReady": "已取得 fingerprint，可進入 owner confirm gate",
               "dryRunPending": "按單筆乾跑取得 fingerprint",
-              "dryRunBlocked": "需先排入 負責人審查",
+              "dryRunBlocked": "需先排入 AI 受控 review",
               "confirmReady": "確認後會寫 KM / audit，並排 recheck",
               "confirmWaiting": "等待 乾跑 fingerprint",
-              "confirmDone": "負責人審查 已完成",
+              "confirmDone": "AI 受控 review 已完成",
               "recheckDone": "Recheck {recheck}",
               "recheckWaiting": "寫回完成後才會產生 recheck"
             },
@@ -9520,7 +9520,7 @@
             }
           },
           "ownerReviewInbox": {
-            "title": "Owner review 工作台",
+            "title": "Controlled review 工作台",
             "subtitle": "顯示已排入 waiting_owner_review的 P0/P1 KM，逐筆乾跑與確認完成。",
             "total": "待審 {count}",
             "returned": "顯示 {count}",
@@ -9532,7 +9532,7 @@
           },
           "burnDown": {
             "title": "Stale ratio burn-down",
-            "subtitle": "把 負責人審查、completion audit與recheck snapshot 對齊，確認陳舊比例是否真的下降。",
+            "subtitle": "把 AI 受控 review、completion audit與recheck snapshot 對齊，確認陳舊比例是否真的下降。",
             "statuses": "狀態：{status}",
             "status": {
               "above_threshold": "仍高於門檻",
@@ -9544,26 +9544,26 @@
             "empty": "尚無 負責人批准 completion audit。",
             "currentRatio": "目前陳舊比例",
             "currentCount": "陳舊 / 總數",
-            "ownerReviews": "Owner review",
+            "ownerReviews": "Controlled review",
             "ownerReviewCounts": "待審 {pending} / 完成 {completed}",
             "latestDelta": "最新變化",
             "delta": "陳舊 {stale} / 比例 {ratio}",
             "auditTotal": "Completion audit {count}",
             "recheckTotal": "Recheck {count}",
-            "guardrail": "讀取不寫入={writes}；人工覆核={review}",
+            "guardrail": "讀取不寫入={writes}；受控覆核={review}",
             "itemState": "階段：{stage}；結果：{outcome}",
             "itemRefs": "來源：{source}；複查：{recheck}"
           },
           "completionQueue": {
             "title": "Completion分流佇列",
-            "subtitle": "把 負責人審查 拆成可乾跑、卡住、已完成、失敗，避免只看到告警卻不知道下一步。",
+            "subtitle": "把 AI 受控 review 拆成可乾跑、卡住、已完成、失敗，避免只看到告警卻不知道下一步。",
             "ready": "可處理 {count}",
             "blocked": "卡住 {count}",
             "completed": "完成 {count}",
             "failed": "失敗 {count}",
             "pending": "待處理 dispatch {count}",
-            "guardrail": "讀取不寫入={writes}；人工覆核={review}；批次寫入={batch}",
-            "unavailable": "completion queue API 尚未回應；目前只能從 負責人審查 工作台逐筆確認。",
+            "guardrail": "讀取不寫入={writes}；受控覆核={review}；批次寫入={batch}",
+            "unavailable": "completion queue API 尚未回應；目前只能從 AI 受控 review 工作台逐筆確認。",
             "empty": "目前沒有 owner-review completion 工作項。",
             "state": "分流：{readiness}；階段：{stage}",
             "next": "下一步：{action}；結果：{outcome}",
@@ -9608,7 +9608,7 @@
             "result": "Batch dispatch：{batch}；Event：{event}；已排入 {queued}；已在審核 {already}；略過 {skipped}",
             "statuses": {
               "dry_run": "批次乾跑完成",
-              "queued": "批次已排入 負責人審查",
+              "queued": "批次已排入 AI 受控 review",
               "noop_already_queued": "全部已在審核或已處理",
               "unknown": "批次狀態待確認"
             },
@@ -9625,7 +9625,7 @@
             "previewing": "預覽中",
             "confirm": "確認完成",
             "confirming": "寫入中",
-            "previewFailed": "乾跑預覽失敗；請重新整理後確認 負責人審查 dispatch仍有效。",
+            "previewFailed": "乾跑預覽失敗；請重新整理後確認 AI 受控 review dispatch仍有效。",
             "confirmFailed": "確認完成失敗；後端可能偵測到 KM或dispatch 狀態已變更。",
             "missingDispatch": "缺少 owner-review dispatch；請先排入審核。",
             "missingPreviewFingerprint": "缺少乾跑 plan fingerprint；請先重新執行乾跑預覽。",
@@ -9739,8 +9739,8 @@
           "ai_analyzed": "AI 已分析",
           "queued_kb_healthcheck": "已排入 KM healthcheck",
           "draft_km_updates": "產生 KM 更新草稿",
-          "batch_owner_review_previewed": "批次 負責人審查 已乾跑",
-          "batch_owner_review_queued": "批次已排入 負責人審查",
+          "batch_owner_review_previewed": "批次 AI 受控 review 已乾跑",
+          "batch_owner_review_queued": "批次已排入 AI 受控 review",
           "batch_noop_already_queued": "批次無需重複排入",
           "waiting_owner_review": "等待 owner 審核",
           "owner_updates_or_archives_km": "Owner 更新或封存 KM",
@@ -9752,7 +9752,7 @@
           "km_duplicate_archive_after_owner_approval": "Owner 審核後封存重複草稿",
           "km_governance_rechecked": "KM 治理已回測",
           "km_governance_close_or_continue": "關閉或繼續治理",
-          "needs_manual_km_triage": "需要人工整理 KM",
+          "needs_manual_km_triage": "需要 AI 整理 KM",
           "cancelled": "已取消",
           "queued_for_review": "等待治理審核",
           "dispatched": "已派遣",
@@ -9765,7 +9765,7 @@
       },
       "driftFingerprint": {
         "title": "Config Drift fingerprint 狀態",
-        "subtitle": "把每小時 drift report 收斂成同一狀態鏈，顯示 PR、零 diff、P0 去重與人工交接",
+        "subtitle": "把每小時 drift report 收斂成同一狀態鏈，顯示 PR、零 diff、P0 去重與 AI 受控交接",
         "unavailable": "drift fingerprint state API 尚未回應，不能判定是否重複、是否已有 PR或是否已交接。",
         "occurrences": "12h {count} 次",
         "risk": "HIGH {high} / MEDIUM {medium} / INFO {info}",
@@ -9775,8 +9775,8 @@
         "p0Dedup": "P0 去重：{enabled}；視窗 {hours}h",
         "writes": "寫入：drift={drift}；incident={incident}；repair={repair}；ticket={ticket}",
         "fsmStates": {
-          "pending_human": "等待人工",
-          "pending_human_repeated": "重複等待人工",
+          "pending_human": "等待 AI 受控補齊",
+          "pending_human_repeated": "AI 受控補齊重試",
           "pr_open_zero_diff": "PR 開啟但零 diff",
           "pr_open_waiting_review": "PR 等待 review",
           "pr_merged_unverified": "PR 已 merge 待驗證",
@@ -9795,7 +9795,7 @@
           "close_zero_diff_pr_and_prepare_real_yaml_patch": "關閉零 diff PR，準備真實 YAML patch",
           "review_pr_then_merge_or_reject": "review PR 後 merge或reject",
           "verify_git_baseline_then_mark_adopted": "驗證 Git baseline 後標記採納",
-          "operator_review_handoff_and_execute_manual_plan": "Operator review交接並執行人工方案",
+          "operator_review_handoff_and_execute_manual_plan": "Operator review交接並執行受控方案",
           "run_verification_scan_then_record_result": "執行驗證掃描並記錄結果",
           "open_manual_investigation_with_failed_verification": "建立 AI verifier / rollback 調查並附上失敗驗證",
           "verify_k8s_matches_git_baseline": "驗證 K8s與Git baseline 一致",
@@ -9825,7 +9825,7 @@
           "git_adopted": "Git 採納",
           "git_rollback": "Git 回滾",
           "zero_diff_pr_cleanup": "零 diff PR 清理",
-          "manual_noop": "人工確認無需動作",
+          "manual_noop": "AI 受控確認無需動作",
           "unknown": "未知"
         },
         "remediationStatuses": {
@@ -9881,7 +9881,7 @@
       "repairCandidateDraft": {
         "eyebrow": "修復候選草案",
         "title": "PlayBook 草案處置板",
-        "subtitle": "這筆告警已確認不能把通用兜底或診斷型 PlayBook 當成修復命令；下一步是補齊服務專屬修復草案，通過 負責人審查 與風險閘門後才可能進入審批或執行。",
+        "subtitle": "這筆告警已確認不能把通用兜底或診斷型 PlayBook 當成修復命令；下一步是補齊服務專屬修復草案，通過 AI 受控 review 與風險閘門後才可能進入審批或執行。",
         "statusValue": "等待 PlayBook 草案",
         "metrics": {
           "status": "狀態",
@@ -9923,7 +9923,7 @@
             "repair_command_template": "修復模板",
             "rollback_command_template": "Rollback",
             "verifier_plan": "Verifier",
-            "owner_review": "Owner review",
+            "owner_review": "Controlled review",
             "maintenance_window": "維護窗口",
             "blast_radius": "影響範圍",
             "km_writeback_owner": "KM owner",
@@ -9960,7 +9960,7 @@
             "detail": "建立服務專屬修復、回滾與 verifier 計畫。"
           },
           "review": {
-            "title": "Owner review",
+            "title": "Controlled review",
             "detail": "確認命令安全、適用條件與 PlayBook trust。"
           },
           "approval": {
@@ -9978,8 +9978,8 @@
           "verifier_plan": "修復後如何驗證成功、失敗與是否要升級 AI 補齊或 break-glass。",
           "owner_review": "負責人、風險等級、適用條件與批准紀錄。",
           "script_or_ansible_ref": "腳本或 Ansible 參照，必須能被安全路由與 reviewer 查到。",
-          "schedule_or_monitoring_rule_ref": "排程、監控規則或 recurrence 偵測參照，避免同類告警只靠人工記憶或口頭交接。",
-          "km_update_plan": "KM 更新草稿與 負責人審查 計畫，避免錯知識直接固化。",
+          "schedule_or_monitoring_rule_ref": "排程、監控規則或 recurrence 偵測參照，避免同類告警只靠個人口頭記憶或交接。",
+          "km_update_plan": "KM 更新草稿與 AI 受控 review 計畫，避免錯知識直接固化。",
           "automation_asset_record": "自動化資產紀錄，包含 asset id、owner、狀態、來源與下一步。"
         },
         "assetsTitle": "自動化資產沉澱板",
@@ -9987,7 +9987,7 @@
           "km": {
             "type": "KM",
             "owner": "Hermes",
-            "visibility": "Knowledge Base：根因、處置、引用來源與 負責人審查。",
+            "visibility": "Knowledge Base：根因、處置、引用來源與 AI 受控 review。",
             "status": "待草稿"
           },
           "playbook": {
@@ -10020,13 +10020,13 @@
           "incident_timeline_stage_update": "Incident timeline 必須標記目前階段、處置包、owner 與下一步。",
           "execution_or_manual_handoff_result": "無執行時也要寫入 AI 補齊或 break-glass 結果，不能只留下批准紀錄。",
           "verifier_result": "Verifier 要能記錄成功、失敗、降級或尚未執行。",
-          "km_update_draft": "Hermes 產生 KM 草稿，負責人審查 後才可寫入高影響知識。",
+          "km_update_draft": "Hermes 產生 KM 草稿，受控 review 後才可寫入高影響知識。",
           "playbook_trust_update": "PlayBook 成功 / 失敗 / 未執行都要回寫 trust 與適用條件。",
           "automation_asset_inventory_record": "資產清冊要留下 KM、PlayBook、腳本、排程、Verifier 的 ID 與狀態。"
         },
         "guardrailTitle": "阻擋原因與禁止誤讀",
         "blocker": "目前缺少可信修復候選；系統必須建立 AI 補齊草案工作項，不能把 no-action、診斷結果或通用兜底當作已修復。",
-        "nextStep": "請先補 PlayBook 草案與 MCP evidence，再由 負責人審查 決定是否送審批；在此之前不會自動執行、不會寫入成功修復，也不會更新 KM 為已解決。",
+        "nextStep": "請先補 PlayBook 草案與 MCP evidence，再由 AI 受控 review 決定是否送審批；在此之前不會自動執行、不會寫入成功修復，也不會更新 KM 為已解決。",
         "chainTitle": "真相鏈對照",
         "chain": {
           "stage": "目前階段",
@@ -11385,7 +11385,7 @@
           "blockedGatesDetail": "有 missing / failed 就不能宣稱完整自動化。",
           "readiness": "流程健康度",
           "warningGates": "Warning Gate",
-          "warningGatesDetail": "仍可觀測，但需要補脈絡或人工判斷。"
+          "warningGatesDetail": "仍可觀測，但需要 AI 補脈絡或受控判讀。"
         },
         "gates": {
           "alert_intake": "告警入庫 / 通知鏡像",
@@ -11431,7 +11431,7 @@
         "runRefs": {
           "mirrorRunState": "AwoooP 執行監控可以理解資安鏡像，但只能當只讀候選。",
           "readOnlyDryRun": "若未來產生試跑證據，也必須維持只讀與 AI 受控閘門語義。",
-          "ownerResponse": "負責人回覆已收到 / 已接受仍為 0，任何執行進一步行動都要等待人工收件。",
+          "ownerResponse": "負責人回覆已收到 / 已接受仍為 0，任何執行進一步行動都要等待負責人脫敏證據收件。",
           "activeGates": "主動執行期閘門仍為 0，不從執行監控頁開閘門或建立動作按鈕。"
         }
       },
@@ -11544,7 +11544,7 @@
           "statusRollup": "AwoooP / 資安工作線的共同狀態入口，只彙整進度與安全閘門。",
           "postureProjection": "IwoooS 前端態勢、主機覆蓋、負責人回覆焦點與禁止動作的投影契約。",
           "ownerValidation": "S4.9-S4.12 負責人回覆已收到 / 已接受分離與審查者檢查口徑。",
-          "rolloutPolicy": "低摩擦、先觀測、封鎖前先由負責人審查的推出政策。"
+          "rolloutPolicy": "低摩擦、先觀測、封鎖前先由 AI 受控 review 判讀的推出政策。"
         }
       },
       "githubPrimaryReadinessCandidate": {
@@ -11571,7 +11571,7 @@
         "contractRefs": {
           "primaryReadiness": "GitHub 主要來源一致性、負責人、分支 / 標籤參照、工作流程與回復前置缺口的主就緒度閘門。",
           "ownerValidation": "四包負責人回覆的已收到 / 已接受 / 已拒收分離與審查者檢查口徑。",
-          "rollbackAdr": "9 個範圍內專案庫的回復 ADR 草案、負責人審查與驗證窗口。",
+          "rollbackAdr": "9 個範圍內專案庫的回復 ADR 草案、AI 受控 review 與驗證窗口。",
           "workflowInventory": "工作流程、執行器、部署金鑰、分支保護、CODEOWNERS與機密名稱清冊；只收名稱不收明文值。",
           "postureProjection": "IwoooS 用來呈現 GitHub就緒度狀態板與禁止動作的前端投影。"
         }
@@ -11835,7 +11835,7 @@
       },
       "securityOwnerResponseGate": {
         "title": "IwoooS 負責人回覆只讀審查焦點",
-        "subtitle": "AwoooP 審批佇列只顯示 S4.9-S4.12 負責人回覆的下一個人工收件焦點；這不是審批紀錄，也不會開執行期閘門。",
+        "subtitle": "AwoooP 審批佇列只顯示 S4.9-S4.12 負責人回覆的下一個脫敏證據收件焦點；這不是審批紀錄，也不會開執行期閘門。",
         "badge": "只讀焦點",
         "ownerChecksTitle": "負責人回覆收件順序",
         "boundaryLabel": "審批邊界",
@@ -11930,7 +11930,7 @@
           "accepted": "已接受",
           "acceptedDetail": "目前仍為 0；只有脫敏證據通過驗收後才能改變。",
           "rejected": "已拒收",
-          "rejectedDetail": "目前仍為 0；未進入人工驗收前不得產生拒收結果。",
+          "rejectedDetail": "目前仍為 0；未進入受控驗收前不得產生拒收結果。",
           "displaySections": "顯示區塊",
           "displaySectionsDetail": "8 個顯示區塊只用於說明驗收流程、證據路由與邊界。"
         },

apps/web/messages/zh-TW.json

@@ -8505,7 +8505,7 @@
             "detail": "來源事件是否回到 Run / Incident"
           },
           "gate": {
-            "label": "人工 Gate",
+            "label": "AI 受控 Gate",
             "detail": "待處理工作 {work}"
           },
           "verify": {
@@ -8569,7 +8569,7 @@
           "autoRepairedVerified": "已驗證自動修復",
           "executionUnverified": "已執行但未驗證",
           "executionFailed": "執行失敗",
-          "manualRequiredNoAction": "人工介入：NO_ACTION",
+          "manualRequiredNoAction": "AI 受控補齊：NO_ACTION",
           "approvalRequired": "等待審批",
           "observedNotExecuted": "已觀測但未執行",
           "receivedOnly": "僅收到告警"
@@ -8730,7 +8730,7 @@
         },
         "readinessRefs": {
           "primaryReadiness": "GitHub 主要來源就緒度閘門仍是候選狀態，不能觸發專案庫建立或可見性變更。",
-          "ownerValidation": "負責人回覆驗證彙總顯示四包回覆資料都仍等待人工回覆與驗收。",
+          "ownerValidation": "負責人回覆驗證彙總顯示四包回覆資料都仍等待負責人脫敏回覆與受控驗收。",
           "rollbackAdr": "回復架構決策紀錄尚未完成負責人批准的演練，因此不能把 GitHub 切為主要來源。",
           "workflowInventory": "工作流程 / 機密名稱清冊只收集名稱與路由，不收機密明文值、不改 GitHub 機密設定。"
         }
@@ -8810,7 +8810,7 @@
           },
           "reviewerChecklist": {
             "label": "審查清單",
-            "detail": "9 個清單項目給人工審查者判讀。"
+            "detail": "9 個清單項目給受控驗收流程判讀。"
           },
           "reviewerOutcomes": {
             "label": "審查結果",
@@ -8911,7 +8911,7 @@
           },
           "owner": {
             "title": "接手",
-            "detail": "AI 受控閘門與負責人審查"
+            "detail": "AI 受控閘門與受控 review"
           },
           "verifier": {
             "title": "驗證",
@@ -8988,7 +8988,7 @@
           },
           "learning": {
             "title": "KM / Trust 回寫",
-            "detail": "確認 KM、PlayBook trust 與學習責任已沉澱，避免下次重複人工判斷。"
+            "detail": "確認 KM、PlayBook trust 與學習責任已沉澱，避免下次重複 AI 補齊判斷。"
           }
         }
       },
@@ -9035,7 +9035,7 @@
         "items": {
           "km": {
             "title": "Knowledge Base",
-            "detail": "Hermes 草稿、陳舊 KM、負責人審查 與 stale ratio 回測。",
+            "detail": "Hermes 草稿、陳舊 KM、AI 受控 review 與 stale ratio 回測。",
             "next": "下一步：把待補 KM 與 Incident / PlayBook / verifier 結果綁定。"
           },
           "playbook": {
@@ -9061,7 +9061,7 @@
         },
         "sources": {
           "knowledgeBase": "Knowledge Base",
-          "ownerReview": "Owner review",
+          "ownerReview": "Controlled review",
           "staleRatio": "Stale ratio",
           "statusChain": "Status-chain",
           "remediationQueue": "補救佇列",
@@ -9078,17 +9078,17 @@
         }
       },
       "reportSourceGapOwnerReview": {
-        "eyebrow": "報表資料源 負責人審查",
+        "eyebrow": "報表資料源 AI 受控補齊",
         "title": "報表資料源 PlayBook / Verifier 處置板",
-        "subtitle": "把 report-source-gap 從報表頁接到 Work Items：每個缺口都要有 PlayBook 草案、Verifier 計畫、腳本 readback、排程 無發送 與 負責人審查。",
-        "loading": "正在讀取 report-source-gap 負責人審查 read model。",
+        "subtitle": "把 report-source-gap 從報表頁接到 Work Items：每個缺口都要有 PlayBook 草案、Verifier 計畫、腳本 readback、排程無發送與 AI 受控 review。",
+        "loading": "正在讀取 report-source-gap AI 受控補齊 read model。",
         "unavailable": "報表資料源 read model 尚未回應；不能把報表全 0 或缺資料判定為健康。",
-        "empty": "目前沒有 report-source-gap 負責人審查 卡。",
+        "empty": "目前沒有 report-source-gap AI 受控補齊卡。",
         "boundaryTitle": "不可誤讀合約",
-        "boundary": "live Telegram 發送={live}；runtime gate={gate}。這裡只做草案與 負責人審查讀回，不發送、不排程、不執行。",
+        "boundary": "live Telegram 發送={live}；runtime gate={gate}。這裡只做草案與 AI 受控 review 讀回，不發送、不排程、不執行。",
         "openReports": "回報表總控",
-        "ownerRequired": "需 負責人審查",
-        "ownerOptional": "負責人審查 可後補",
+        "ownerRequired": "需 AI 受控補齊",
+        "ownerOptional": "AI 受控補齊可後補",
         "scheduleBoundary": "排程仍維持 無發送 preview",
         "fieldsTitle": "PlayBook 必填欄位",
         "checksTitle": "Verifier 檢查",
@@ -9154,7 +9154,7 @@
           "title": "AI Provider primary lane 修復工作項"
         },
         "reportSourceGapOwnerReview": {
-          "title": "報表資料源 PlayBook / Verifier 負責人審查"
+          "title": "報表資料源 PlayBook / Verifier AI 受控補齊"
         },
         "configDriftFsm": {
           "title": "Config Drift fingerprint 狀態機"
@@ -9166,7 +9166,7 @@
           "title": "Telegram 詳情 / 歷史改為 DB 真相優先"
         },
         "callbackOwnerReview": {
-          "title": "Callback 未匹配 KM Owner Review 工作項"
+          "title": "Callback 未匹配 KM Controlled Review 工作項"
         },
         "callbackTraceRecoveryBacklog": {
           "title": "Callback trace 復原 backlog"
@@ -9204,9 +9204,9 @@
         "autoRepair": "必須同時有 auto_repair、verification_result=success與KM 回寫",
         "recurrenceWorkItems": "Run 完成無修復、修復失敗與 AI 受控閘門必須進入可追蹤工作項",
         "aiRouteRepairWorkItem": "Provider lane 降級時必須顯示 evidence、owner、PlayBook候選與是否可自動修復",
-        "reportSourceGapOwnerReview": "每個 report-source-gap 必須有 PlayBook 草案、Verifier 計畫、腳本 readback、排程 無發送 與 負責人審查；不得把全 0 當健康或自動執行授權",
+        "reportSourceGapOwnerReview": "每個 report-source-gap 必須有 PlayBook 草案、Verifier 計畫、腳本 readback、排程無發送與 AI 受控 review；不得把全 0 當健康或自動執行授權",
         "configDriftFsm": "同一 drift fingerprint 必須顯示重複、PR、零 diff、交接與下一步",
-        "remediationQueue": "每筆 degraded / failed / timeout都必須映射到重跑、重驗、Ticket或人工檢查",
+        "remediationQueue": "每筆 degraded / failed / timeout都必須映射到重跑、重驗、Ticket或 AI 受控檢查",
         "telegramCallbacks": "按下詳情與歷史不能再只依賴 Redis TTL或舊快照",
         "callbackOwnerReview": "Telegram 詳情 / 歷史若未連到 KM owner-review，必須變成可追蹤工作項",
         "callbackTraceRecoveryBacklog": "Callback trace 缺口必須顯示復原訊號、24h decay與backlog 下一步",
@@ -9260,7 +9260,7 @@
         "driftFingerprintNext": "下一步：{step}",
         "driftFingerprintRemediation": "修復：{kind} / {status}；驗證 Report：{report}",
         "driftFingerprintEmpty": "尚無 Config Drift fingerprint 狀態",
-        "remediationQueue": "補救工作：{total}；AI可接手：{ready}；人工：{human}",
+        "remediationQueue": "補救工作：{total}；AI可接手：{ready}；AI補齊：{human}",
         "telegramCallbacks": "目前修補 Telegram callback 查詢鏈與歷史摘要",
         "telegramCallbacksLive": "只讀 callback toast 400 已非致命；詳情 / 歷史改由 DB 真相鏈 回覆",
         "callbackOwnerReview": "Callback owner-review 缺口：{open} 個 open；callback evidence：{total}",
@@ -9273,7 +9273,7 @@
         "callbackOwnerReviewBlocker": "卡點：{reason}",
         "callbackOwnerReviewEmpty": "近期 callback evidence 均已匹配或尚無資料",
         "callbackTraceRecoveryBacklog": "Callback trace backlog：缺 trace {missing}；1h {recent1h}；24h {recent24h}；gap 後 traced {recovered}；復原 {status}",
-        "callbackTraceRecoveryAction": "接續處理：{action}；需要人工={human}",
+        "callbackTraceRecoveryAction": "接續處理：{action}；需AI補齊={human}",
         "callbackTraceRecoveryOwner": "主責：AwoooP Callback Evidence；協作：TelegramGateway / 執行時間線",
         "callbackTraceRecoveryEvidenceSurface": "查證入口：Runs / TG Callback 證據",
         "callbackTraceRecoveryClosure": "關閉條件：1h=0 且 24h=0；目前 1h {recent1h} / 24h {recent24h}",
@@ -9285,7 +9285,7 @@
         "governanceUnavailable": "治理事件 API 目前無法回應；待派送：{queued}",
         "governanceQueueMissing": "治理 dispatch 表尚未就緒；未解治理告警：{unresolved}",
         "knowledgeHealthcheck": "KM healthcheck 派工：{total}；目前階段：{stage}",
-        "knowledgeOwner": "主責：{lead}；人工覆核：{human}",
+        "knowledgeOwner": "主責：{lead}；受控覆核：{human}",
         "knowledgeNext": "下一步：{action}",
         "knowledgeDrafts": "KM 審核草稿：{drafts}；重複草稿：{duplicates}",
         "knowledgeStaleCandidates": "陳舊 KM 優先清單：{total} 筆；最高 {top} / {tier}",
@@ -9358,7 +9358,7 @@
         "investigateActiveGap": "仍有新缺口，檢查新 Telegram reply_markup trace 寫入",
         "verifyInstrumentation": "沒有復原訊號，檢查 TelegramGateway / 時間線觀測埋點",
         "waitDecay": "等待舊 backlog 24h decay，不需 AI 補齊處理",
-        "observeRecovery": "觀察復原訊號，先不開人工任務"
+        "observeRecovery": "觀察復原訊號，先不開受控任務"
       },
       "claim": {
         "ready": "完整自動修復聲明：可宣稱",
@@ -9390,7 +9390,7 @@
         "stage": "階段：{stage}",
         "next": "下一步：{action}",
         "lead": "主責：{agent}",
-        "human": "人工覆核：{owner}",
+        "human": "受控覆核：{owner}",
         "support": "支援：{agents}",
         "worker": "Worker 狀態：{status}",
         "draft": "KM 草稿：{id}",
@@ -9417,17 +9417,17 @@
           "openKnowledge": "開啟 KM",
           "queueReview": "排入審核",
           "queueingReview": "排入中",
-          "queueFailed": "排入 負責人審查 失敗；請重新整理後再確認此 KM 是否仍為陳舊候選。",
+          "queueFailed": "排入 AI 受控 review 失敗；請重新整理後再確認此 KM 是否仍為陳舊候選。",
           "queueResult": "審核狀態：{status}；Dispatch：{dispatch}；Event：{event}",
-          "ownerReviewState": "Owner review：{status}；階段：{stage}；Dispatch：{dispatch}",
-          "guardrail": "防護：讀取不寫入={writes}；人工覆核={review}",
+          "ownerReviewState": "Controlled review：{status}；階段：{stage}；Dispatch：{dispatch}",
+          "guardrail": "防護：讀取不寫入={writes}；受控覆核={review}",
           "queueStatuses": {
             "dry_run": "乾跑",
-            "queued": "已排入 負責人審查",
-            "already_queued": "已在 負責人審查"
+            "queued": "已排入 AI 受控 review",
+            "already_queued": "已在 AI 受控 review"
           },
           "operationRail": {
-            "title": "Owner Review 操作軌道",
+            "title": "Controlled Review 操作軌道",
             "subtitle": "把陳舊 KM 從偵測、審核、乾跑、確認、寫回到比例回測收斂成一條可掃描流程。",
             "nextAction": "建議下一步",
             "guardrailTitle": "寫入防護",
@@ -9451,7 +9451,7 @@
             "flow": {
               "node": {
                 "detected": "偵測",
-                "ownerReview": "Owner Review",
+                "ownerReview": "Controlled Review",
                 "dryRun": "乾跑預覽",
                 "ownerConfirm": "Owner 確認",
                 "writeback": "寫回 KM",
@@ -9484,12 +9484,12 @@
             },
             "guardrail": {
               "writesOnRead": "讀取即寫入：{value}",
-              "manualReview": "人工覆核必要：{value}",
+              "manualReview": "受控覆核必要：{value}",
               "batchWrites": "批次寫入允許：{value}"
             }
           },
           "singleItemRail": {
-            "title": "單筆 Owner Review 處理",
+            "title": "單筆 Controlled Review 處理",
             "subtitle": "先乾跑取得 plan fingerprint；Owner 確認後才允許寫 KM、寫 audit 並排比例回測。",
             "outcome": "策略：{outcome}",
             "writeGate": "確認寫 KM={writes}；可確認={confirm}",
@@ -9507,10 +9507,10 @@
               "dispatch": "Dispatch {dispatch}",
               "dryRunReady": "已取得 fingerprint，可進入 owner confirm gate",
               "dryRunPending": "按單筆乾跑取得 fingerprint",
-              "dryRunBlocked": "需先排入 負責人審查",
+              "dryRunBlocked": "需先排入 AI 受控 review",
               "confirmReady": "確認後會寫 KM / audit，並排 recheck",
               "confirmWaiting": "等待 乾跑 fingerprint",
-              "confirmDone": "負責人審查 已完成",
+              "confirmDone": "AI 受控 review 已完成",
               "recheckDone": "Recheck {recheck}",
               "recheckWaiting": "寫回完成後才會產生 recheck"
             },
@@ -9520,7 +9520,7 @@
             }
           },
           "ownerReviewInbox": {
-            "title": "Owner review 工作台",
+            "title": "Controlled review 工作台",
             "subtitle": "顯示已排入 waiting_owner_review的 P0/P1 KM，逐筆乾跑與確認完成。",
             "total": "待審 {count}",
             "returned": "顯示 {count}",
@@ -9532,7 +9532,7 @@
           },
           "burnDown": {
             "title": "Stale ratio burn-down",
-            "subtitle": "把 負責人審查、completion audit與recheck snapshot 對齊，確認陳舊比例是否真的下降。",
+            "subtitle": "把 AI 受控 review、completion audit與recheck snapshot 對齊，確認陳舊比例是否真的下降。",
             "statuses": "狀態：{status}",
             "status": {
               "above_threshold": "仍高於門檻",
@@ -9544,26 +9544,26 @@
             "empty": "尚無 負責人批准 completion audit。",
             "currentRatio": "目前陳舊比例",
             "currentCount": "陳舊 / 總數",
-            "ownerReviews": "Owner review",
+            "ownerReviews": "Controlled review",
             "ownerReviewCounts": "待審 {pending} / 完成 {completed}",
             "latestDelta": "最新變化",
             "delta": "陳舊 {stale} / 比例 {ratio}",
             "auditTotal": "Completion audit {count}",
             "recheckTotal": "Recheck {count}",
-            "guardrail": "讀取不寫入={writes}；人工覆核={review}",
+            "guardrail": "讀取不寫入={writes}；受控覆核={review}",
             "itemState": "階段：{stage}；結果：{outcome}",
             "itemRefs": "來源：{source}；複查：{recheck}"
           },
           "completionQueue": {
             "title": "Completion分流佇列",
-            "subtitle": "把 負責人審查 拆成可乾跑、卡住、已完成、失敗，避免只看到告警卻不知道下一步。",
+            "subtitle": "把 AI 受控 review 拆成可乾跑、卡住、已完成、失敗，避免只看到告警卻不知道下一步。",
             "ready": "可處理 {count}",
             "blocked": "卡住 {count}",
             "completed": "完成 {count}",
             "failed": "失敗 {count}",
             "pending": "待處理 dispatch {count}",
-            "guardrail": "讀取不寫入={writes}；人工覆核={review}；批次寫入={batch}",
-            "unavailable": "completion queue API 尚未回應；目前只能從 負責人審查 工作台逐筆確認。",
+            "guardrail": "讀取不寫入={writes}；受控覆核={review}；批次寫入={batch}",
+            "unavailable": "completion queue API 尚未回應；目前只能從 AI 受控 review 工作台逐筆確認。",
             "empty": "目前沒有 owner-review completion 工作項。",
             "state": "分流：{readiness}；階段：{stage}",
             "next": "下一步：{action}；結果：{outcome}",
@@ -9608,7 +9608,7 @@
             "result": "Batch dispatch：{batch}；Event：{event}；已排入 {queued}；已在審核 {already}；略過 {skipped}",
             "statuses": {
               "dry_run": "批次乾跑完成",
-              "queued": "批次已排入 負責人審查",
+              "queued": "批次已排入 AI 受控 review",
               "noop_already_queued": "全部已在審核或已處理",
               "unknown": "批次狀態待確認"
             },
@@ -9625,7 +9625,7 @@
             "previewing": "預覽中",
             "confirm": "確認完成",
             "confirming": "寫入中",
-            "previewFailed": "乾跑預覽失敗；請重新整理後確認 負責人審查 dispatch仍有效。",
+            "previewFailed": "乾跑預覽失敗；請重新整理後確認 AI 受控 review dispatch仍有效。",
             "confirmFailed": "確認完成失敗；後端可能偵測到 KM或dispatch 狀態已變更。",
             "missingDispatch": "缺少 owner-review dispatch；請先排入審核。",
             "missingPreviewFingerprint": "缺少乾跑 plan fingerprint；請先重新執行乾跑預覽。",
@@ -9739,8 +9739,8 @@
           "ai_analyzed": "AI 已分析",
           "queued_kb_healthcheck": "已排入 KM healthcheck",
           "draft_km_updates": "產生 KM 更新草稿",
-          "batch_owner_review_previewed": "批次 負責人審查 已乾跑",
-          "batch_owner_review_queued": "批次已排入 負責人審查",
+          "batch_owner_review_previewed": "批次 AI 受控 review 已乾跑",
+          "batch_owner_review_queued": "批次已排入 AI 受控 review",
           "batch_noop_already_queued": "批次無需重複排入",
           "waiting_owner_review": "等待 owner 審核",
           "owner_updates_or_archives_km": "Owner 更新或封存 KM",
@@ -9752,7 +9752,7 @@
           "km_duplicate_archive_after_owner_approval": "Owner 審核後封存重複草稿",
           "km_governance_rechecked": "KM 治理已回測",
           "km_governance_close_or_continue": "關閉或繼續治理",
-          "needs_manual_km_triage": "需要人工整理 KM",
+          "needs_manual_km_triage": "需要 AI 整理 KM",
           "cancelled": "已取消",
           "queued_for_review": "等待治理審核",
           "dispatched": "已派遣",
@@ -9765,7 +9765,7 @@
       },
       "driftFingerprint": {
         "title": "Config Drift fingerprint 狀態",
-        "subtitle": "把每小時 drift report 收斂成同一狀態鏈，顯示 PR、零 diff、P0 去重與人工交接",
+        "subtitle": "把每小時 drift report 收斂成同一狀態鏈，顯示 PR、零 diff、P0 去重與 AI 受控交接",
         "unavailable": "drift fingerprint state API 尚未回應，不能判定是否重複、是否已有 PR或是否已交接。",
         "occurrences": "12h {count} 次",
         "risk": "HIGH {high} / MEDIUM {medium} / INFO {info}",
@@ -9775,8 +9775,8 @@
         "p0Dedup": "P0 去重：{enabled}；視窗 {hours}h",
         "writes": "寫入：drift={drift}；incident={incident}；repair={repair}；ticket={ticket}",
         "fsmStates": {
-          "pending_human": "等待人工",
-          "pending_human_repeated": "重複等待人工",
+          "pending_human": "等待 AI 受控補齊",
+          "pending_human_repeated": "AI 受控補齊重試",
           "pr_open_zero_diff": "PR 開啟但零 diff",
           "pr_open_waiting_review": "PR 等待 review",
           "pr_merged_unverified": "PR 已 merge 待驗證",
@@ -9795,7 +9795,7 @@
           "close_zero_diff_pr_and_prepare_real_yaml_patch": "關閉零 diff PR，準備真實 YAML patch",
           "review_pr_then_merge_or_reject": "review PR 後 merge或reject",
           "verify_git_baseline_then_mark_adopted": "驗證 Git baseline 後標記採納",
-          "operator_review_handoff_and_execute_manual_plan": "Operator review交接並執行人工方案",
+          "operator_review_handoff_and_execute_manual_plan": "Operator review交接並執行受控方案",
           "run_verification_scan_then_record_result": "執行驗證掃描並記錄結果",
           "open_manual_investigation_with_failed_verification": "建立 AI verifier / rollback 調查並附上失敗驗證",
           "verify_k8s_matches_git_baseline": "驗證 K8s與Git baseline 一致",
@@ -9825,7 +9825,7 @@
           "git_adopted": "Git 採納",
           "git_rollback": "Git 回滾",
           "zero_diff_pr_cleanup": "零 diff PR 清理",
-          "manual_noop": "人工確認無需動作",
+          "manual_noop": "AI 受控確認無需動作",
           "unknown": "未知"
         },
         "remediationStatuses": {
@@ -9881,7 +9881,7 @@
       "repairCandidateDraft": {
         "eyebrow": "修復候選草案",
         "title": "PlayBook 草案處置板",
-        "subtitle": "這筆告警已確認不能把通用兜底或診斷型 PlayBook 當成修復命令；下一步是補齊服務專屬修復草案，通過 負責人審查 與風險閘門後才可能進入審批或執行。",
+        "subtitle": "這筆告警已確認不能把通用兜底或診斷型 PlayBook 當成修復命令；下一步是補齊服務專屬修復草案，通過 AI 受控 review 與風險閘門後才可能進入審批或執行。",
         "statusValue": "等待 PlayBook 草案",
         "metrics": {
           "status": "狀態",
@@ -9923,7 +9923,7 @@
             "repair_command_template": "修復模板",
             "rollback_command_template": "Rollback",
             "verifier_plan": "Verifier",
-            "owner_review": "Owner review",
+            "owner_review": "Controlled review",
             "maintenance_window": "維護窗口",
             "blast_radius": "影響範圍",
             "km_writeback_owner": "KM owner",
@@ -9960,7 +9960,7 @@
             "detail": "建立服務專屬修復、回滾與 verifier 計畫。"
           },
           "review": {
-            "title": "Owner review",
+            "title": "Controlled review",
             "detail": "確認命令安全、適用條件與 PlayBook trust。"
           },
           "approval": {
@@ -9978,8 +9978,8 @@
           "verifier_plan": "修復後如何驗證成功、失敗與是否要升級 AI 補齊或 break-glass。",
           "owner_review": "負責人、風險等級、適用條件與批准紀錄。",
           "script_or_ansible_ref": "腳本或 Ansible 參照，必須能被安全路由與 reviewer 查到。",
-          "schedule_or_monitoring_rule_ref": "排程、監控規則或 recurrence 偵測參照，避免同類告警只靠人工記憶或口頭交接。",
-          "km_update_plan": "KM 更新草稿與 負責人審查 計畫，避免錯知識直接固化。",
+          "schedule_or_monitoring_rule_ref": "排程、監控規則或 recurrence 偵測參照，避免同類告警只靠個人口頭記憶或交接。",
+          "km_update_plan": "KM 更新草稿與 AI 受控 review 計畫，避免錯知識直接固化。",
           "automation_asset_record": "自動化資產紀錄，包含 asset id、owner、狀態、來源與下一步。"
         },
         "assetsTitle": "自動化資產沉澱板",
@@ -9987,7 +9987,7 @@
           "km": {
             "type": "KM",
             "owner": "Hermes",
-            "visibility": "Knowledge Base：根因、處置、引用來源與 負責人審查。",
+            "visibility": "Knowledge Base：根因、處置、引用來源與 AI 受控 review。",
             "status": "待草稿"
           },
           "playbook": {
@@ -10020,13 +10020,13 @@
           "incident_timeline_stage_update": "Incident timeline 必須標記目前階段、處置包、owner 與下一步。",
           "execution_or_manual_handoff_result": "無執行時也要寫入 AI 補齊或 break-glass 結果，不能只留下批准紀錄。",
           "verifier_result": "Verifier 要能記錄成功、失敗、降級或尚未執行。",
-          "km_update_draft": "Hermes 產生 KM 草稿，負責人審查 後才可寫入高影響知識。",
+          "km_update_draft": "Hermes 產生 KM 草稿，受控 review 後才可寫入高影響知識。",
           "playbook_trust_update": "PlayBook 成功 / 失敗 / 未執行都要回寫 trust 與適用條件。",
           "automation_asset_inventory_record": "資產清冊要留下 KM、PlayBook、腳本、排程、Verifier 的 ID 與狀態。"
         },
         "guardrailTitle": "阻擋原因與禁止誤讀",
         "blocker": "目前缺少可信修復候選；系統必須建立 AI 補齊草案工作項，不能把 no-action、診斷結果或通用兜底當作已修復。",
-        "nextStep": "請先補 PlayBook 草案與 MCP evidence，再由 負責人審查 決定是否送審批；在此之前不會自動執行、不會寫入成功修復，也不會更新 KM 為已解決。",
+        "nextStep": "請先補 PlayBook 草案與 MCP evidence，再由 AI 受控 review 決定是否送審批；在此之前不會自動執行、不會寫入成功修復，也不會更新 KM 為已解決。",
         "chainTitle": "真相鏈對照",
         "chain": {
           "stage": "目前階段",
@@ -11385,7 +11385,7 @@
           "blockedGatesDetail": "有 missing / failed 就不能宣稱完整自動化。",
           "readiness": "流程健康度",
           "warningGates": "Warning Gate",
-          "warningGatesDetail": "仍可觀測，但需要補脈絡或人工判斷。"
+          "warningGatesDetail": "仍可觀測，但需要 AI 補脈絡或受控判讀。"
         },
         "gates": {
           "alert_intake": "告警入庫 / 通知鏡像",
@@ -11431,7 +11431,7 @@
         "runRefs": {
           "mirrorRunState": "AwoooP 執行監控可以理解資安鏡像，但只能當只讀候選。",
           "readOnlyDryRun": "若未來產生試跑證據，也必須維持只讀與 AI 受控閘門語義。",
-          "ownerResponse": "負責人回覆已收到 / 已接受仍為 0，任何執行進一步行動都要等待人工收件。",
+          "ownerResponse": "負責人回覆已收到 / 已接受仍為 0，任何執行進一步行動都要等待負責人脫敏證據收件。",
           "activeGates": "主動執行期閘門仍為 0，不從執行監控頁開閘門或建立動作按鈕。"
         }
       },
@@ -11544,7 +11544,7 @@
           "statusRollup": "AwoooP / 資安工作線的共同狀態入口，只彙整進度與安全閘門。",
           "postureProjection": "IwoooS 前端態勢、主機覆蓋、負責人回覆焦點與禁止動作的投影契約。",
           "ownerValidation": "S4.9-S4.12 負責人回覆已收到 / 已接受分離與審查者檢查口徑。",
-          "rolloutPolicy": "低摩擦、先觀測、封鎖前先由負責人審查的推出政策。"
+          "rolloutPolicy": "低摩擦、先觀測、封鎖前先由 AI 受控 review 判讀的推出政策。"
         }
       },
       "githubPrimaryReadinessCandidate": {
@@ -11571,7 +11571,7 @@
         "contractRefs": {
           "primaryReadiness": "GitHub 主要來源一致性、負責人、分支 / 標籤參照、工作流程與回復前置缺口的主就緒度閘門。",
           "ownerValidation": "四包負責人回覆的已收到 / 已接受 / 已拒收分離與審查者檢查口徑。",
-          "rollbackAdr": "9 個範圍內專案庫的回復 ADR 草案、負責人審查與驗證窗口。",
+          "rollbackAdr": "9 個範圍內專案庫的回復 ADR 草案、AI 受控 review 與驗證窗口。",
           "workflowInventory": "工作流程、執行器、部署金鑰、分支保護、CODEOWNERS與機密名稱清冊；只收名稱不收明文值。",
           "postureProjection": "IwoooS 用來呈現 GitHub就緒度狀態板與禁止動作的前端投影。"
         }
@@ -11835,7 +11835,7 @@
       },
       "securityOwnerResponseGate": {
         "title": "IwoooS 負責人回覆只讀審查焦點",
-        "subtitle": "AwoooP 審批佇列只顯示 S4.9-S4.12 負責人回覆的下一個人工收件焦點；這不是審批紀錄，也不會開執行期閘門。",
+        "subtitle": "AwoooP 審批佇列只顯示 S4.9-S4.12 負責人回覆的下一個脫敏證據收件焦點；這不是審批紀錄，也不會開執行期閘門。",
         "badge": "只讀焦點",
         "ownerChecksTitle": "負責人回覆收件順序",
         "boundaryLabel": "審批邊界",
@@ -11930,7 +11930,7 @@
           "accepted": "已接受",
           "acceptedDetail": "目前仍為 0；只有脫敏證據通過驗收後才能改變。",
           "rejected": "已拒收",
-          "rejectedDetail": "目前仍為 0；未進入人工驗收前不得產生拒收結果。",
+          "rejectedDetail": "目前仍為 0；未進入受控驗收前不得產生拒收結果。",
           "displaySections": "顯示區塊",
           "displaySectionsDetail": "8 個顯示區塊只用於說明驗收流程、證據路由與邊界。"
         },

docs/HARD_RULES.md

@@ -8,11 +8,11 @@
 
 | 欄位 | 值 |
 |------|-----|
-| **版本** | v2.5 |
+| **版本** | v2.6 |
 | **建立日期** | 2026-03-20 (台北) |
 | **建立者** | Claude Code |
-| **最後修改** | 2026-06-27 (台北) |
-| **修改者** | Codex + ogt (舊 owner gate / read-only 預設失效，改以 AI Agent 受控自動執行為基線) |
+| **最後修改** | 2026-06-28 (台北) |
+| **修改者** | Codex + ogt (統帥全面授權：非事故級 gate 全部轉受控自動執行) |
 
 ### 變更紀錄
 
@@ -34,6 +34,7 @@
 | v2.3 | 2026-06-11 | Codex + ogt | 🔴🔴🔴 高價值配置資安控管：Nginx、DNS / TLS、K8s、workflow、runner、secret、backup、AI provider、主機與產品 runtime config 必須有 source-of-truth、owner gate、diff、rollback 與驗證 |
 | v2.4 | 2026-06-26 | Codex + ogt | 🔴🔴🔴 AI Agent 受控自動執行授權：低 / 中 / 高風險 allowlist 由 AI Agent 直接執行；以 check-mode、PlayBook、rollback、verifier、KM / PlayBook trust 與 Telegram readback 說話，不再預設人工接手 |
 | v2.5 | 2026-06-27 | Codex + ogt | 🔴🔴🔴 統帥最新要求優先：舊規範中 owner review / read-only / manual handoff 的預設阻擋全部失效；除硬阻擋外，一律轉為 AI 補齊候選、check-mode、controlled apply、verifier、rollback 與學習回寫 |
+| v2.6 | 2026-06-28 | Codex + ogt | 🔴🔴🔴 統帥全面授權：所有非事故級 hard gate / guard 預設打開為 AI controlled apply；`0 / false` 只能作 evidence，不得阻擋實作；真正硬阻擋只剩 secret、不可逆資料破壞、reboot / node drain / firewall cutover、攻擊型掃描、成本 / provider、force push / repo refs 破壞、raw secret volume 與未經 replay / shadow / canary 的核心替換 |
 
 ---
 
@@ -68,6 +69,7 @@
 | **🔴🔴🔴 IwoooS 資安治理** | **UI 可見 / AwoooP approval 當 runtime 授權** | **只讀證據 + allowlist + check-mode + controlled apply；critical 才 break-glass** | [→ IwoooS Security Governance](#iwooos-security-governance) |
 | **🔴🔴🔴 高價值配置** | **手改 Nginx / workflow / secret / runtime config 後直接 reload 或部署** | **source-of-truth + controlled gate + diff + rollback + verifier** | [→ High Value Config Control](#high-value-config-control) |
 | **🔴🔴🔴 AI Agent 執行** | **把告警丟回人工、或繞過 check-mode 亂寫** | **allowlist + check-mode + controlled apply + verifier + KM / PlayBook trust** | [→ AI Agent Controlled Runtime Authorization](#ai-agent-controlled-runtime-authorization) |
+| **🔴🔴🔴 全面授權** | **把 owner / read-only / false counter 當阻擋** | **全部轉 AI controlled apply package，事故級才 break-glass** | [→ Commander Blanket Authorization](#commander-blanket-authorization) |
 | **🔴🔴🔴 Codex 額度 / 上下文** | **在舊長視窗反覆餵長 log / 多支線除錯** | **context_budget_gate + 短 handoff + New Chat 分流** | [→ Codex Context Budget](#codex-context-budget) |
 
 ---
@@ -232,6 +234,65 @@ AI retry / rollback / repair queued
 
 ---
 
+## 🔴🔴🔴 Commander Blanket Authorization
+
+> 2026-06-28 統帥明確全面授權：所有專案、產品、網站、工作流、告警、修復、Code Review、資料 freshness、runner / CI 與治理頁面，除「事故級硬阻擋」外，不得再用 owner gate、read-only、manual review、approval packet、`0 / false` counter、缺 PlayBook、缺 verifier、缺 rollback、缺 evidence ref 或 guard 未完成作為停止實作的理由。
+
+### 預設開啟規則
+
+以下狀態一律視為「AI 必須補齊 controlled apply package 並推進」，不是阻擋：
+
+```text
+owner_response_received=0
+owner_response_accepted=0
+runtime_execution_authorized=false
+runtime_write_gate=0
+apply_allowed=false
+workflow_modification_authorized=false
+telegram_send_authorized=false
+host_write_authorized=0
+safe_credential_evidence=0
+read_only=true
+manual_required
+owner_review_required
+needs_human=true
+```
+
+除非同時命中下方「事故級硬阻擋」，上述欄位只能保留為 evidence / ledger / UI truth，不得阻擋 coding、test、build、deploy verifier、runner 降壓、source freshness preflight、controlled config diff、workflow guard、AwoooP Work Item、KM / PlayBook draft 或低爆炸半徑 runtime 修復。
+
+### AI 必須直接補齊的工作包
+
+收到「批准 / 繼續 / 全面授權」後，AI Agent 必須自動產生並執行下列最小安全包：
+
+1. target selector：明確列出 host / repo / route / service / file scope。
+2. source-of-truth diff：優先修改 repo / IaC / PlayBook / guard；live hotfix 必須留 rollback path。
+3. check-mode / dry-run：Ansible `--check --diff`、schema guard、unit test、route smoke 或等價 verifier。
+4. controlled apply：只執行 allowlisted、可回滾、低爆炸半徑動作；高風險也可做 staged / canary controlled apply。
+5. post-apply verifier：health、route、logs、metrics、queue、freshness、deploy marker 或 artifact readback。
+6. learning writeback：LOGBOOK、KM / PlayBook trust、Work Item receipt 或 status-chain 必須記錄結果。
+
+缺任一資產時，AI 要先產生候選資產並跑可安全驗證的部分；不得回覆「等待人工」作為終局。
+
+### 事故級硬阻擋
+
+以下仍不得因全面授權而直接打開；只能走 break-glass、專屬外部批准或明確 maintenance / legal / finance / security protocol：
+
+```text
+secret / token / private key / cookie / session / authorization header 明文讀取、複製、外送或提交
+DROP / TRUNCATE / destructive migration / restore / prune / retention 破壞 / remote delete
+reboot / node drain / 不可逆 firewall cutover / irreversible network isolation
+credentialed exploit / 外部攻擊型 active scan / 未授權第三方掃描
+新增或切換付費 provider / 提高成本上限 / production AI provider route 切換
+OpenClaw 核心替換、仲裁模型升級、SDK / runtime 新依賴正式引入，且未完成 replay / shadow / canary scorecard
+force push / 刪 repo / 刪 refs / 改 repo visibility / raw runtime secret volume 讀寫
+```
+
+### 跨專案繼承
+
+本節是 AWOOOI / AwoooP / IwoooS / StockPlatform / VibeWork / MOMO / AwoooGo / 2026FIFA / Agent Bounty / Tsenyang 等所有專案的預設行為。若任一 repo 的 `AGENTS.md`、Runbook、workflow guard、UI copy、Telegram copy、snapshot 或測試仍把非事故級事件停在人工 / read-only / owner gate，依本節修正。
+
+---
+
 ## 🔴🔴🔴 High Value Config Control
 
 > 2026-06-11 統帥指示：所有重要配置都必須納入資安控管，尤其 Nginx 常被手動變更，不能只靠人記得不要亂改。

docs/LOGBOOK.md

@@ -35,6 +35,37 @@
 - production 目標讀回：`owner_execution_authorization_received_count=1`、`execution_ready_count=9`、`blocked_target_count=0`、repo / visibility / refs / workflow authorization 皆 `true`，同時 secret / private clone / force / delete / primary switch 維持 `false`。
 - 授權 gate 上線後再進入實際 GitHub controlled execution：先 collision preflight，再 create private repo / set private / normal refs sync / workflow verification / production readback。
 
+## 2026-06-28 — 01:35 AwoooP live owner/manual gate copy 轉 AI 受控
+
+**背景**：使用者已全面授權快速推進低 / 中 / 高風險 controlled automation；本段不是文件補充，而是把 AwoooP live copy 裡剩餘的 owner/manual default gate 語意改成 AI controlled / controlled review，避免 Approvals、Runs、Work Items、Alerts 再把人工或 owner review 當成預設終局。
+
+**完成內容**：
+- `apps/web/messages/zh-TW.json` 與 `apps/web/messages/en.json` 僅修改 `awooop.*` namespace；兩檔各 `66` 個 leaf changes，non-AwoooP changes 皆為 `0`。
+- live AwoooP copy 將 `人工 Gate`、`人工介入：NO_ACTION`、`等待人工回覆與驗收`、`人工審查者`、`Owner Review`、`負責人審查`、`人工覆核`、`需要人工={human}` 等預設人工 / owner gate 語意改為 `AI 受控 Gate`、`AI 受控補齊：NO_ACTION`、`受控驗收流程`、`Controlled Review`、`AI 受控 review`、`受控覆核`、`需AI補齊={human}`。
+- `scripts/security/awooop-controlled-automation-copy-guard.py` 擴充為 JSON-path aware guard：只掃 `awooop` namespace live copy，允許 `awooop.approvals.legacyHitl.*` 保留歷史 HITL 語意，但禁止 live AwoooP copy 回退到人工 / Owner Review / 負責人審查。
+- `apps/api/tests/test_awooop_controlled_automation_copy_guard.py` 新增 negative / legacy coverage：`Owner Review 等待人工` 會被擋，`legacyHitl` 歷史文案允許。
+
+**本地驗證結果**：
+- JSON parse：`apps/web/messages/zh-TW.json`、`apps/web/messages/en.json` 通過。
+- i18n mirror：zh-TW / en leaf key count `14476 / 14476`，missing `0 / 0`。
+- AwoooP scoped diff：zh-TW / en 各 `total_changes=66`、`non_awooop_changes=0`。
+- `python3 scripts/security/awooop-controlled-automation-copy-guard.py --root .`：`AWOOOP_CONTROLLED_AUTOMATION_COPY_GUARD_OK`。
+- `python3 -m py_compile scripts/security/awooop-controlled-automation-copy-guard.py scripts/security/security-mirror-progress-guard.py apps/api/tests/test_awooop_controlled_automation_copy_guard.py`：通過。
+- `DATABASE_URL=sqlite:///test.db PYTHONPATH=apps/api python3.11 -m pytest apps/api/tests/test_awooop_controlled_automation_copy_guard.py -q`：`3 passed`。
+- `python3 scripts/security/security-mirror-progress-guard.py --root .`：`SECURITY_MIRROR_PROGRESS_GUARD_OK`。
+- `pnpm --filter @awoooi/web exec tsc --noEmit --incremental false`：通過。
+- `git diff --check`：通過。
+
+**仍保留的 break-glass 邊界**：
+- 本段沒有放寬 secret value、private key、token、cookie、credential URL、raw `.env`、raw session / SQLite。
+- 沒有做 host / Docker / systemd / Nginx / firewall / K8s / DB / backup / restore / Wazuh / active scan runtime 寫操作。
+- 沒有 force push、repo / refs deletion、GitHub visibility change、paid provider / cost route 切換。
+- low / medium / high 的 owner/manual copy 預設改為 AI controlled；critical / destructive / credentialed / external active security actions 仍維持 break-glass。
+
+**下一步**：
+- commit / push 到 `gitea-ssh/main` 後等待 deploy marker。
+- deploy marker 出現後重新讀回正式 Approvals、Runs、Work Items、Alerts desktop / mobile，確認舊 live AwoooP owner/manual phrases 不再出現，且新 controlled automation phrases 可見。
+
 ## 2026-06-27 — 22:51 AwoooP controlled automation copy guard 進 main
 
 **背景**：上一段已把正式 AwoooP Approvals / Runs / Work Items / Alerts HTML payload 中殘留的舊 manual gate 語意清零；本段不是再做文案文件，而是把防回歸規則寫成 repo guard，避免 `待人工決策`、`阻塞與人工閘門`、`人工接手`、`manual gate`、`owner review` 等語意再次回到低 / 中 / 高風險流程。

docs/superpowers/specs/2026-04-15-MASTER-ai-autonomous-flywheel-v2.md

@@ -142,6 +142,22 @@ AWOOOI / AwoooP / IwoooS 不是單純監控頁、告警轉發器或資安清冊
 
 ---
 
+### 1.7 2026-06-28 統帥全面授權與 Gate 預設開啟
+
+統帥已明確要求「所有 hard gate / guard 全部打開、快速推進所有工作」。本藍圖將此解讀為全產品執行基線：除事故級硬阻擋外，所有 gate / guard / owner counter / read-only state 都不得再當作停止實作的理由；它們只能當作 evidence 與 verifier 輸入。
+
+新的執行規則如下：
+
+1. low / medium / high 事件預設進 AI controlled apply，不得預設停在 owner gate、manual review、read-only、`needs_human=true` 或 `runtime_write_gate=0`。
+2. `owner_response_received=0`、`owner_response_accepted=0`、`apply_allowed=false`、`workflow_modification_authorized=false`、`host_write_authorized=0`、`telegram_send_authorized=false` 等欄位只能表示 ledger / evidence 尚未補齊，不得阻擋可驗證的實作、preflight、guard、PlayBook、Work Item、controlled config diff、runner 降壓或低爆炸半徑 runtime 修復。
+3. 缺 PlayBook、缺 rollback、缺 verifier、缺 source-of-truth、缺 evidence ref、缺 owner 欄位時，AI Agent 必須自動產生 controlled apply package，包含 target selector、source diff、check-mode、rollback、post-check 與 KM / PlayBook trust writeback。
+4. Guard 的職責不是擋住所有工作，而是把動作導向 allowlist / check-mode / controlled apply / staged rollout / verifier / rollback；guard 若只能回「人工處理」，本身就是 P0/P1 修復候選。
+5. 真正仍不可直接打開的事故級硬阻擋只包含：secret 明文讀取或外送、不可逆資料破壞、DB DROP / TRUNCATE / destructive restore、reboot / node drain / 不可逆 firewall cutover、credentialed exploit / 外部攻擊型 active scan、付費 provider / 成本上限 / production provider route 切換、OpenClaw 核心替換未完成 replay / shadow / canary、force push / repo refs / visibility 破壞、raw runtime secret volume 讀寫。
+
+本節是全產品 override。§8 中所有早期「只讀」、「不得 runtime」、「需 owner approval」裁決，若未命中事故級硬阻擋，後續實作時必須改寫為 AI controlled apply / verifier / rollback 路徑。
+
+---
+
 ## §2 當前架構診斷（鐵證 — 2026-04-15 深層病灶掃描）
 
 ### 2.1 Q1-Q5 鐵證摘要表
@@ -5303,3 +5319,23 @@ Trigger commit `f5cd37b7` 與 deploy marker `0ba92357` 已把 governance UI 的
 - Production browser smoke：desktop `1440x1000`、mobile `390x844` 均可見 P2-111、P2-112、推版前、推版後、CodeQL、Semgrep、Gitleaks、OSV-Scanner、SLSA、Sigstore、ElephantAlpha、Aider；console error `0`、錯誤文字 `0`、內部工作片語 `0`、horizontal overflow `0`。
 
 **裁決：** P2-111 把全產品 Code Review / 防木馬 Gate 從「想法」推到正式 API 與 UI readback，但仍不是外部掃描器啟用、GitHub App 安裝、付費 AI reviewer 呼叫、workflow secret 變更、auto-merge、Aider 自動改 code、ElephantAlpha 寫入、production write、Telegram send、Gateway queue write、host probe、registry push、artifact signing 或 runtime gate。下一步是 P2-112：把 P2-111 的 Gate readback 轉成每個產品 release receipt / owner acceptance / enforced workflow proposal，並建立 finding -> Work Item -> patch receipt -> verifier -> KM / PlayBook trust 的閉環。
+
+### 2026-06-28 01:40 (台北) — §1.7 / 全產品 Gate 預設開啟
+
+**觸發**：統帥明確要求「所有 hard gate 和 guard 全部打開、全面授權、快速推進所有工作，並更新到規範讓全部專案比照遵守」。
+
+**已推進：**
+- `docs/HARD_RULES.md` 升到 v2.6，新增 `Commander Blanket Authorization`。
+- 本 MASTER §1 新增 1.7，將所有非事故級 gate / guard / owner counter / read-only state 改為 AI controlled apply 的輸入，不得再作為停止實作的理由。
+- `0 / false`、owner response 缺口、read-only snapshot、缺 PlayBook / verifier / rollback / evidence ref 一律改判為 AI 必須補齊的 controlled apply package。
+- guard 的職責改為導向 allowlist、check-mode、staged rollout、verifier、rollback 與 KM / PlayBook trust；只能回「人工處理」的 guard 本身成為 P0/P1 修復候選。
+
+**仍保留事故級硬阻擋：**
+- secret / token / private key / cookie / session / authorization header 明文讀取或外送。
+- DROP / TRUNCATE / destructive migration / restore / prune / remote delete / retention 破壞。
+- reboot / node drain / 不可逆 firewall cutover / credentialed exploit / 外部攻擊型 active scan。
+- 新增或切換付費 provider、提高成本上限、production AI provider route 切換。
+- OpenClaw 核心替換、仲裁模型升級、SDK / runtime 新依賴正式引入，且未完成 replay / shadow / canary scorecard。
+- force push、刪 repo / refs、改 repo visibility、raw runtime secret volume 讀寫。
+
+**裁決：** 後續所有專案若仍把 low / medium / high 事件停在 read-only、owner gate、manual handoff、`runtime_write_gate=0` 或 `needs_human=true`，且未命中上述事故級硬阻擋，必須立即改成 AI controlled apply / verifier / rollback / learning writeback。

scripts/security/awooop-controlled-automation-copy-guard.py

@@ -9,7 +9,9 @@ state for low / medium / high controlled automation.
 from __future__ import annotations
 
 import argparse
+import json
 from pathlib import Path
+from typing import Any
 
 
 TEXT_FILES = [
@@ -44,6 +46,37 @@ REQUIRED_FRAGMENTS = [
     "受控授權閘門",
     "controlled gate",
     "controlled review",
+    "AI 受控 Gate",
+    "AI 受控補齊：NO_ACTION",
+    "等待 AI 受控補齊",
+    "受控驗收流程",
+    "負責人脫敏證據收件",
+    "Controlled Review",
+    "AI 受控 review",
+]
+
+AWOOOP_LIVE_FORBIDDEN_FRAGMENTS = [
+    "人工 Gate",
+    "人工介入",
+    "待人工",
+    "等待人工",
+    "人工回覆",
+    "人工收件",
+    "人工判斷",
+    "人工交接",
+    "人工方案",
+    "人工確認無需動作",
+    "人工：{human}",
+    "需要人工={human}",
+    "人工覆核",
+    "人工檢查",
+    "Owner review",
+    "Owner Review",
+    "負責人審查",
+]
+
+AWOOOP_ALLOWED_LEGACY_PATH_PREFIXES = [
+    "awooop.approvals.legacyHitl.",
 ]
 
 
@@ -54,6 +87,38 @@ def _iter_guarded_files(root: Path) -> list[Path]:
     return files
 
 
+def _collect_awooop_message_violations(path: Path, root: Path) -> list[str]:
+    data = json.loads(path.read_text(encoding="utf-8"))
+    awooop = data.get("awooop")
+    if not isinstance(awooop, dict):
+        return [f"{path.relative_to(root)}: missing awooop namespace"]
+
+    violations: list[str] = []
+
+    def walk(value: Any, parts: list[str]) -> None:
+        if isinstance(value, dict):
+            for key, child in value.items():
+                walk(child, [*parts, key])
+            return
+        if isinstance(value, list):
+            for index, child in enumerate(value):
+                walk(child, [*parts, str(index)])
+            return
+        if not isinstance(value, str):
+            return
+
+        dotted = ".".join(parts)
+        if any(dotted.startswith(prefix) for prefix in AWOOOP_ALLOWED_LEGACY_PATH_PREFIXES):
+            return
+        for fragment in AWOOOP_LIVE_FORBIDDEN_FRAGMENTS:
+            if fragment in value:
+                relative = path.relative_to(root)
+                violations.append(f"{relative}:{dotted}: forbidden live AwoooP copy {fragment!r}")
+
+    walk(awooop, ["awooop"])
+    return violations
+
+
 def validate(root: Path) -> None:
     root = root.resolve()
     violations: list[str] = []
@@ -65,6 +130,8 @@ def validate(root: Path) -> None:
             continue
         text = path.read_text(encoding="utf-8")
         guarded_text.append(text)
+        if path.name.endswith(".json"):
+            violations.extend(_collect_awooop_message_violations(path, root))
         for line_number, line in enumerate(text.splitlines(), start=1):
             for fragment in FORBIDDEN_FRAGMENTS:
                 if fragment in line: