feat(iwooos): add live security control plane

apps/web/src/lib/__tests__/security-asset-control-plane.test.ts

@@ -0,0 +1,135 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  isSecurityAssetControlPlanePayload,
+  securityControlPlaneTone,
+  topSecurityControlPlaneWorkItems,
+  type SecurityAssetControlPlanePayload,
+} from "../security-asset-control-plane";
+
+function payload(): SecurityAssetControlPlanePayload {
+  return {
+    schema_version: "iwooos_security_asset_control_plane_v1",
+    generated_at: "2026-07-11T04:00:00+00:00",
+    status: "ready",
+    source_status: "live_database_aggregate",
+    summary: {
+      managed_asset_count: 24,
+      expected_asset_type_count: 28,
+      present_asset_type_count: 20,
+      asset_type_coverage_percent: 71,
+      scope_count: 6,
+      controlled_scope_count: 3,
+      unowned_asset_count: 0,
+      stale_asset_count: 0,
+      orphan_asset_count: 0,
+      relationship_count: 40,
+      automation_coverage_green_percent: 85,
+      automation_coverage_unknown_count: 0,
+      compliance_violation_count: 0,
+      compliance_unknown_count: 0,
+      nist_controlled_percent: 82,
+      siem_stage_count: 8,
+      siem_observed_stage_count: 8,
+      siem_stage_coverage_percent: 100,
+      ai_loop_stage_count: 7,
+      ai_loop_observed_stage_count: 7,
+      ai_loop_stage_coverage_percent: 100,
+      verified_remediation_receipt_count_24h: 2,
+      active_work_item_count: 2,
+    },
+    discovery: {
+      latest_status: "success",
+      latest_success_at: "2026-07-11T03:50:00+00:00",
+      age_seconds: 600,
+      freshness_slo_seconds: 7200,
+      fresh: true,
+    },
+    asset_scopes: [],
+    nist_csf_functions: [],
+    siem: { pipeline: [] },
+    ai_automation: {
+      stages: [],
+      aggregate_stage_coverage_percent: 100,
+      accepted_ai_trace_count: 2,
+      verified_remediation_receipt_count: 2,
+      rollback_receipt_count: 0,
+      failed_operation_count: 0,
+      same_run_closed_loop_proven: false,
+      same_run_closed_loop_count: 0,
+    },
+    security_audit: {
+      k8s_execution_audit_count_24h: 2,
+      k8s_execution_failure_count_24h: 0,
+      mcp_tool_audit_count_24h: 4,
+      mcp_tool_failure_count_24h: 0,
+      asset_change_event_count_24h: 3,
+      automation_operation_count_24h: 12,
+      automation_failure_count_24h: 0,
+      ai_trace_count_24h: 4,
+      accepted_ai_trace_count_24h: 2,
+      immutable_external_audit_store_evidenced: false,
+    },
+    work_items: [
+      {
+        work_item_id: "AIA-P1-001-01",
+        priority: "P1",
+        control_id: "audit",
+        title: "audit",
+        gap_count: 1,
+        status: "open",
+        next_action: "audit",
+      },
+      {
+        work_item_id: "AIA-P0-007-01",
+        priority: "P0",
+        control_id: "siem",
+        title: "siem",
+        gap_count: 2,
+        status: "open",
+        next_action: "siem",
+      },
+    ],
+    boundaries: {
+      aggregate_only: true,
+      raw_asset_identity_returned: false,
+      raw_event_payload_returned: false,
+      secret_value_collection_allowed: false,
+      live_scan_triggered: false,
+      runtime_action_triggered: false,
+      completion_requires_same_run_receipts: true,
+    },
+  };
+}
+
+describe("security asset control plane projection", () => {
+  it("accepts only the public-safe aggregate contract", () => {
+    const safe = payload();
+    expect(isSecurityAssetControlPlanePayload(safe)).toBe(true);
+
+    const unsafe = {
+      ...safe,
+      boundaries: { ...safe.boundaries, raw_asset_identity_returned: true },
+    };
+    expect(isSecurityAssetControlPlanePayload(unsafe)).toBe(false);
+  });
+
+  it("does not show healthy before same-run closure is proven", () => {
+    const value = payload();
+    expect(securityControlPlaneTone(value)).toBe("warning");
+
+    value.ai_automation.same_run_closed_loop_proven = true;
+    expect(securityControlPlaneTone(value)).toBe("healthy");
+
+    value.discovery.fresh = false;
+    expect(securityControlPlaneTone(value)).toBe("critical");
+  });
+
+  it("keeps P0 work ahead of P1 regardless of API order", () => {
+    const items = topSecurityControlPlaneWorkItems(payload(), 2);
+    expect(items.map((item) => item.work_item_id)).toEqual([
+      "AIA-P0-007-01",
+      "AIA-P1-001-01",
+    ]);
+  });
+});