feat(iwooos): classify Wazuh dashboard readback degradation

apps/api/src/services/telegram_gateway.py

@@ -171,6 +171,30 @@ class AiOpsSignalSpec:
 
 
 _AI_OPS_SIGNAL_SPECS: tuple[AiOpsSignalSpec, ...] = (
+    AiOpsSignalSpec(
+        event_type="wazuh_dashboard_api_readback_degraded",
+        title="Wazuh Dashboard / API 讀回退化",
+        lane="siem_observability_readback_degraded",
+        source_tokens=(
+            "wazuh_dashboard_api_readback_degraded",
+            "check-stored-api",
+            "check-api",
+            "dashboard agent list",
+            "agent list disappeared",
+            "agents disappeared",
+            "wazuh api check",
+        ),
+        gate_tokens=("429", "500", "unreachable", "registry", "readback", "dashboard", "api"),
+        impact="Dashboard 顯示與 Wazuh API / manager registry 讀回不一致；這是觀測盲點，不可宣稱 agent 全部消失或已恢復",
+        next_step="建立 Wazuh dashboard/API mismatch candidate，要求 manager registry 只讀計數、stored API 狀態、rate-limit / TLS trust 與 owner 回覆",
+        recommendation_lines=(
+            "├ 比對 dashboard stored API、Wazuh API 只讀 metadata、manager registry counts 與 agent transport evidence",
+            "├ 在 registry 未驗收前維持 no-false-green：agent_total / active / disconnected / last_seen 皆不得補假值",
+            "└ 回寫 IwoooS Wazuh visibility gate、AwoooP timeline、KM / PlayBook / Verifier",
+        ),
+        forbidden_summary="不重啟 Wazuh、不重新註冊 agent、不改 stored API / secret / firewall、不宣稱 registry 已恢復；先補只讀 evidence。",
+        default_severity="P1",
+    ),
     AiOpsSignalSpec(
         event_type="wazuh_intrusion_signal",
         title="Wazuh 入侵訊號",
@@ -346,6 +370,8 @@ def _aiops_signal_target(text: str, spec: AiOpsSignalSpec) -> str:
         return target or spec.event_type
     if spec.event_type == "backup_restore_escrow_signal":
         return "backup_restore"
+    if spec.event_type == "wazuh_dashboard_api_readback_degraded":
+        return "wazuh_dashboard_api"
     if spec.event_type == "nginx_config_drift":
         return "public_gateway"
     if spec.event_type == "supply_chain_drift":

apps/api/tests/test_telegram_message_templates.py

@@ -164,6 +164,32 @@ syscheck integrity changed on /etc/nginx/sites-enabled/awoooi.conf
     assert "super-secret" not in result
 
 
+def test_wazuh_dashboard_api_degraded_alert_becomes_readback_gap_event_packet() -> None:
+    """Wazuh Dashboard/API mismatch 必須轉成讀回退化事件卡，不可誤報成已修復。"""
+    raw_alert = """
+wazuh_dashboard_api_readback_degraded dashboard agent list disappeared
+POST /api/check-stored-api status=429 POST /api/check-api status=500
+https://127.0.0.1:55000 is unreachable manager registry readback blocked
+full_log=/var/ossec/logs/alerts/alerts.json Authorization: Bearer abcdefghijklmnopqrstuvwxyz
+"""
+
+    result = format_aiops_signal_alert_card(raw_alert)
+
+    assert "P1 AIOps 訊號｜Wazuh Dashboard / API 讀回退化" in result
+    assert "ai_automation_alert_card_v1" in result
+    assert "wazuh_dashboard_api_readback_degraded" in result
+    assert "siem_observability_readback_degraded" in result
+    assert "candidate_only" in result
+    assert "runtime_write_gate=0" in result
+    assert "manager registry 只讀計數" in result
+    assert "no-false-green" in result
+    assert "不重啟 Wazuh" in result
+    assert "不重新註冊 agent" in result
+    assert "127.0.0.1:55000" not in result
+    assert "/var/ossec" not in result
+    assert "abcdefghijkl" not in result
+
+
 def test_nginx_drift_alert_becomes_public_gateway_event_packet() -> None:
     """Nginx drift 應進 Public Gateway gate，而不是直接要求 reload。"""
     raw_alert = """