feat(iwooos): validate manager registry acceptance evidence

scripts/security/security-mirror-progress-guard.py

@@ -29583,6 +29583,9 @@ def validate(root: Path) -> None:
         "wazuh_manager_registry_reviewer_validation_passed_count=1",
         "wazuh_manager_registry_reviewer_validation_post_enable_readback_passed_count=1",
         "wazuh_manager_registry_reviewer_validation_manager_registry_accepted_count=0",
+        "wazuh_manager_registry_acceptance_validation_api_available=true",
+        "wazuh_manager_registry_acceptance_evidence_received_count=0",
+        "wazuh_manager_registry_acceptance_evidence_review_ready_count=0",
         "wazuh_manager_registry_reviewer_validation_runtime_gate_count=0",
     ]:
         assert_text_contains("iwooos_frontend_product_text.wazuh_managed_host_coverage", frontend_product_text, expected)
@@ -29602,17 +29605,25 @@ def validate(root: Path) -> None:
         "wazuh_manager_registry_reviewer_validation_v1",
         "iwooos_wazuh_manager_registry_reviewer_validation_readback_v1",
         "/api/v1/iwooos/wazuh-manager-registry-reviewer-validation/validate-owner-export",
+        "/api/v1/iwooos/wazuh-manager-registry-reviewer-validation/validate-manager-registry-acceptance",
         "iwooos_wazuh_manager_registry_owner_export_validation_result_v1",
+        "iwooos_wazuh_manager_registry_acceptance_evidence_validation_result_v1",
         "validate_iwooos_wazuh_manager_registry_owner_export",
+        "validate_iwooos_wazuh_manager_registry_acceptance_evidence",
         "test_iwooos_wazuh_manager_registry_reviewer_validation_api_is_public_safe",
         "test_iwooos_wazuh_manager_registry_owner_export_validation_accepts_redacted_payload",
         "test_iwooos_wazuh_manager_registry_owner_export_validation_quarantines_sensitive_payload",
         "test_iwooos_wazuh_manager_registry_owner_export_validation_rejects_runtime_action_request",
+        "test_iwooos_wazuh_manager_registry_acceptance_evidence_validation_accepts_redacted_packet_for_review_only",
+        "test_iwooos_wazuh_manager_registry_acceptance_evidence_api_does_not_persist_or_open_runtime",
         "wazuh_manager_registry_reviewer_validation_owner_registry_export_received_count=1",
         "wazuh_manager_registry_reviewer_validation_owner_registry_export_accepted_count=1",
         "wazuh_manager_registry_reviewer_validation_passed_count=1",
         "wazuh_manager_registry_reviewer_validation_post_enable_readback_passed_count=1",
         "wazuh_manager_registry_reviewer_validation_manager_registry_accepted_count=0",
+        "wazuh_manager_registry_acceptance_validation_api_available=true",
+        "wazuh_manager_registry_acceptance_evidence_received_count=0",
+        "wazuh_manager_registry_acceptance_evidence_review_ready_count=0",
         "wazuh_manager_registry_reviewer_validation_runtime_gate_count=0",
     ]:
         assert_text_contains(

scripts/security/wazuh-manager-registry-reviewer-validation.py

@@ -132,6 +132,12 @@ REVIEWER_VALIDATION_CHECKS = [
         "required_evidence": "production API 與前台 smoke 已讀回 reviewer passed；此讀回只更新 read-only posture，不查 live Wazuh、不保存 raw payload、不開 runtime gate。",
         "failure_lane": "post_enable_iwooos_readback_passed_no_runtime",
     },
+    {
+        "check_id": "RV-11",
+        "title": "Manager registry acceptance evidence 可收件但不自動上修",
+        "required_evidence": "新增 no-persist acceptance evidence validator；只有 reviewer packet 通過後才可進 commit review，global manager_registry_accepted_count 仍維持 0。",
+        "failure_lane": "waiting_manager_registry_acceptance_evidence",
+    },
 ]
 
 OUTCOME_LANES = [
@@ -149,6 +155,9 @@ OUTCOME_LANES = [
     "accepted_for_readonly_posture_only",
     "post_enable_iwooos_readback_passed",
     "manager_registry_acceptance_evidence_review",
+    "manager_registry_acceptance_evidence_intake_ready",
+    "accepted_for_manager_registry_acceptance_review_only",
+    "commit_manager_registry_accepted_readback_evidence",
 ]
 
 EVIDENCE_SLOTS = [
@@ -293,8 +302,8 @@ def build_snapshot(generated_at: str) -> dict[str, Any]:
     return {
         "schema_version": SCHEMA_VERSION,
         "generated_at": generated_at,
-        "status": "post_enable_iwooos_readback_passed_no_runtime_no_secret_collection",
-        "mode": "committed_post_enable_iwooos_readback_passed_no_runtime_no_secret_collection",
+        "status": "manager_registry_acceptance_evidence_intake_ready_no_runtime_no_secret_collection",
+        "mode": "committed_manager_registry_acceptance_evidence_intake_ready_no_runtime_no_secret_collection",
         "scope": "wazuh_manager_registry_owner_export_reviewer_validation",
         "source_refs": [
             "docs/security/wazuh-agent-visibility-owner-evidence-preflight.snapshot.json",
@@ -316,6 +325,9 @@ def build_snapshot(generated_at: str) -> dict[str, Any]:
             "reviewer_validation_failed_count": 0,
             "reviewer_validation_quarantined_count": 0,
             "manager_registry_accepted_count": 0,
+            "manager_registry_acceptance_intake_endpoint_available_count": 1,
+            "manager_registry_acceptance_evidence_received_count": 0,
+            "manager_registry_acceptance_evidence_review_ready_count": 0,
             "post_enable_readback_passed_count": 1,
             "runtime_gate_count": 0,
             "host_write_authorized_count": 0,
@@ -357,6 +369,7 @@ def build_snapshot(generated_at: str) -> dict[str, Any]:
         "no_false_green_rules": [
             "reviewer validation passed 只代表脫敏 owner export refs 通過 no-persist 驗證。",
             "post-enable IwoooS readback passed 只代表 production API / 前台已讀回 reviewer passed，不代表 live Wazuh 查詢或 runtime action。",
+            "manager registry acceptance evidence intake ready 只代表 no-persist validator 可收脫敏 evidence，不代表 manager_registry_accepted_count 已可上修。",
             "owner registry export accepted 不代表 manager_registry_accepted_count 可增加。",
             "Dashboard 可見、index pattern 三綠勾、HTTP 200 或 transport observed 不可替代 manager registry counts。",
             "reviewer accepted 只可更新只讀 posture；active response、agent restart、reenroll、host write、secret rotation 或掃描仍需獨立 runtime gate。",
@@ -367,11 +380,15 @@ def build_snapshot(generated_at: str) -> dict[str, Any]:
 def validate(root: Path) -> None:
     snapshot = load_json(root / SNAPSHOT_PATH)
     assert_equal("schema_version", snapshot.get("schema_version"), SCHEMA_VERSION)
-    assert_equal("status", snapshot.get("status"), "post_enable_iwooos_readback_passed_no_runtime_no_secret_collection")
+    assert_equal(
+        "status",
+        snapshot.get("status"),
+        "manager_registry_acceptance_evidence_intake_ready_no_runtime_no_secret_collection",
+    )
     assert_equal(
         "mode",
         snapshot.get("mode"),
-        "committed_post_enable_iwooos_readback_passed_no_runtime_no_secret_collection",
+        "committed_manager_registry_acceptance_evidence_intake_ready_no_runtime_no_secret_collection",
     )
     assert_equal("scope", snapshot.get("scope"), "wazuh_manager_registry_owner_export_reviewer_validation")
     assert_equal("expected_scope_aliases", snapshot.get("expected_scope_aliases"), EXPECTED_SCOPE_ALIASES)
@@ -401,12 +418,15 @@ def validate(root: Path) -> None:
         "reviewer_validation_ready_count",
         "reviewer_validation_passed_count",
         "post_enable_readback_passed_count",
+        "manager_registry_acceptance_intake_endpoint_available_count",
     ]:
         assert_equal(f"summary.{key}", summary.get(key), 1)
     for key in [
         "reviewer_validation_failed_count",
         "reviewer_validation_quarantined_count",
         "manager_registry_accepted_count",
+        "manager_registry_acceptance_evidence_received_count",
+        "manager_registry_acceptance_evidence_review_ready_count",
         "runtime_gate_count",
         "host_write_authorized_count",
         "active_response_authorized_count",
@@ -465,6 +485,7 @@ def main() -> None:
             f"received={summary['owner_registry_export_received_count']} "
             f"accepted={summary['owner_registry_export_accepted_count']} "
             f"post_enable={summary['post_enable_readback_passed_count']} "
+            f"acceptance_endpoint={summary['manager_registry_acceptance_intake_endpoint_available_count']} "
             f"runtime_gate={summary['runtime_gate_count']}"
         )