feat(iwooos): add wazuh runtime owner review readback

apps/api/tests/test_iwooos_runtime_security_readback.py

@@ -10,6 +10,9 @@ from src.services.iwooos_runtime_security_readback import (
 from src.services.iwooos_wazuh_runtime_controlled_apply_preflight import (
     load_latest_iwooos_wazuh_runtime_controlled_apply_preflight,
 )
+from src.services.iwooos_wazuh_runtime_gate_owner_review_readback import (
+    load_latest_iwooos_wazuh_runtime_gate_owner_review_readback,
+)
 
 
 def _client() -> TestClient:
@@ -44,13 +47,44 @@ def _valid_runtime_controlled_apply_packet() -> dict[str, object]:
     }
 
 
+def _valid_runtime_gate_owner_review_packet() -> dict[str, object]:
+    return {
+        "owner_review_intent": "commit_runtime_gate_owner_review_readback_only",
+        "owner_reviewer_role": "iwooos-security-owner",
+        "owner_review_decision": "accept_controlled_apply_review_readiness_only",
+        "owner_review_decision_reason": "redacted owner-review packet accepts review readiness only; runtime gate remains closed",
+        "target_selector_aliases": [
+            "managed_core_node_a",
+            "managed_core_node_b",
+            "managed_core_node_c",
+            "managed_edge_node_a",
+            "managed_edge_node_b",
+            "managed_lab_node_a",
+        ],
+        "source_of_truth_diff_ref": "docs/security/wazuh-runtime-gate-owner-review-readback.snapshot.json#source-diff",
+        "check_mode_plan_ref": "playbooks/wazuh-controlled-apply-check-mode#redacted-plan",
+        "dry_run_evidence_ref": "evidence/iwooos/wazuh-runtime-owner-review-dry-run-redacted-v1",
+        "blast_radius_statement": "public aliases only; no live Wazuh query and no host write in this owner-review readback",
+        "maintenance_window_ref": "maintenance/iwooos-wazuh-low-traffic-window-redacted-v1",
+        "rollback_plan_ref": "playbooks/wazuh-controlled-apply-rollback#redacted-plan",
+        "rollback_owner": "iwooos-security-owner",
+        "post_apply_verifier_ref": "verifiers/iwooos-wazuh-post-apply-readback#public-safe",
+        "km_playbook_writeback_ref": "km/playbook-trust/wazuh-runtime-gate-owner-review-v1",
+        "followup_owner": "iwooos-security-reviewer",
+        "audit_receipt_ref": "audit/iwooos-wazuh-runtime-gate-owner-review-redacted-v1",
+        "runtime_boundary_ack": "runtime_gate_remains_closed",
+        "secret_boundary_ack": "no_secret_value_collected",
+        "live_wazuh_query_boundary_ack": "no_live_wazuh_query_performed",
+    }
+
+
 def test_iwooos_runtime_security_readback_preserves_zero_runtime_gates() -> None:
     payload = load_latest_iwooos_runtime_security_readback()
 
     assert payload["schema_version"] == "iwooos_runtime_security_readback_v1"
     assert payload["status"] == "blocked_waiting_owner_evidence_and_runtime_gates"
-    assert payload["summary"]["source_snapshot_count"] == 11
-    assert payload["summary"]["p0_lane_count"] == 10
+    assert payload["summary"]["source_snapshot_count"] == 12
+    assert payload["summary"]["p0_lane_count"] == 11
     assert payload["summary"]["runtime_gate_count"] == 0
     assert payload["summary"]["owner_response_received_count"] == 0
     assert payload["summary"]["owner_response_accepted_count"] == 0
@@ -101,6 +135,21 @@ def test_iwooos_runtime_security_readback_preserves_zero_runtime_gates() -> None
     assert payload["summary"]["wazuh_runtime_apply_km_writeback_count"] == 1
     assert payload["summary"]["wazuh_runtime_apply_owner_review_ready_count"] == 1
     assert payload["summary"]["wazuh_runtime_apply_runtime_gate_count"] == 0
+    assert payload["summary"]["wazuh_runtime_owner_review_target_selector_count"] == 6
+    assert payload["summary"]["wazuh_runtime_owner_review_source_diff_count"] == 1
+    assert payload["summary"]["wazuh_runtime_owner_review_check_mode_plan_count"] == 1
+    assert payload["summary"]["wazuh_runtime_owner_review_dry_run_evidence_count"] == 1
+    assert payload["summary"]["wazuh_runtime_owner_review_rollback_plan_count"] == 1
+    assert (
+        payload["summary"]["wazuh_runtime_owner_review_post_apply_verifier_count"] == 1
+    )
+    assert payload["summary"]["wazuh_runtime_owner_review_km_writeback_count"] == 1
+    assert payload["summary"]["wazuh_runtime_owner_review_packet_received_count"] == 1
+    assert (
+        payload["summary"]["wazuh_runtime_owner_review_packet_review_ready_count"] == 1
+    )
+    assert payload["summary"]["wazuh_runtime_owner_review_packet_accepted_count"] == 1
+    assert payload["summary"]["wazuh_runtime_owner_review_runtime_gate_count"] == 0
     assert payload["summary"]["kali_active_scan_authorized_count"] == 0
     assert payload["summary"]["kali_execute_authorized_count"] == 0
     assert payload["summary"]["alert_receipt_runtime_send_count"] == 0
@@ -120,6 +169,7 @@ def test_iwooos_runtime_security_readback_lanes_are_candidate_only() -> None:
         "wazuh_live_metadata_gate",
         "wazuh_owner_evidence_preflight",
         "wazuh_runtime_controlled_apply_preflight",
+        "wazuh_runtime_gate_owner_review",
         "wazuh_dashboard_api",
         "kali_intake",
         "alert_readability",
@@ -152,6 +202,15 @@ def test_iwooos_runtime_security_readback_lanes_are_candidate_only() -> None:
         or (lane["completion_percent"] == 45 and lane["metrics"]["runtime_gate"] == 0)
         for lane in payload["lanes"]
     )
+    assert all(
+        lane["lane_id"] != "wazuh_runtime_gate_owner_review"
+        or (
+            lane["completion_percent"] == 55
+            and lane["metrics"]["owner_review_accepted"] == 1
+            and lane["metrics"]["runtime_gate"] == 0
+        )
+        for lane in payload["lanes"]
+    )
 
 
 def test_iwooos_runtime_security_readback_api_is_public_safe(monkeypatch) -> None:
@@ -178,6 +237,8 @@ def test_iwooos_runtime_security_readback_api_is_public_safe(monkeypatch) -> Non
     assert data["summary"]["wazuh_owner_evidence_runtime_gate_count"] == 0
     assert data["summary"]["wazuh_runtime_apply_preflight_ready_count"] == 1
     assert data["summary"]["wazuh_runtime_apply_runtime_gate_count"] == 0
+    assert data["summary"]["wazuh_runtime_owner_review_packet_accepted_count"] == 1
+    assert data["summary"]["wazuh_runtime_owner_review_runtime_gate_count"] == 0
     assert data["boundaries"]["secret_value_collection_allowed"] is False
     assert "192.168.0." not in response.text
     assert "工作視窗" not in response.text
@@ -463,3 +524,151 @@ def test_iwooos_wazuh_runtime_controlled_apply_preflight_validator_rejects_runti
     assert data["runtime_action_rejected"] is True
     assert data["summary"]["controlled_apply_runtime_action_rejected_count"] == 1
     assert data["summary"]["runtime_gate_count"] == 0
+
+
+def test_iwooos_wazuh_runtime_gate_owner_review_readback_api_is_public_safe(
+    monkeypatch,
+) -> None:
+    monkeypatch.delenv("IWOOOS_WAZUH_READONLY_ENABLED", raising=False)
+    monkeypatch.delenv("WAZUH_API_BASE_URL", raising=False)
+    monkeypatch.delenv("WAZUH_API_USERNAME", raising=False)
+    monkeypatch.delenv("WAZUH_API_PASSWORD", raising=False)
+
+    payload = load_latest_iwooos_wazuh_runtime_gate_owner_review_readback()
+    assert (
+        payload["schema_version"]
+        == "iwooos_wazuh_runtime_gate_owner_review_readback_v1"
+    )
+    assert (
+        payload["status"]
+        == "runtime_gate_owner_review_packet_committed_no_runtime_action"
+    )
+    assert payload["summary"]["owner_review_packet_accepted_count"] == 1
+    assert payload["summary"]["target_selector_count"] == 6
+    assert payload["summary"]["runtime_gate_count"] == 0
+    assert payload["boundaries"]["runtime_execution_authorized"] is False
+
+    response = _client().get("/api/v1/iwooos/wazuh-runtime-gate-owner-review-readback")
+
+    assert response.status_code == 200
+    data = response.json()
+    assert (
+        data["schema_version"] == "iwooos_wazuh_runtime_gate_owner_review_readback_v1"
+    )
+    assert data["summary"]["owner_review_packet_received_count"] == 1
+    assert data["summary"]["owner_review_packet_review_ready_count"] == 1
+    assert data["summary"]["owner_review_packet_accepted_count"] == 1
+    assert data["summary"]["runtime_gate_count"] == 0
+    assert data["summary"]["wazuh_api_live_query_authorized_count"] == 0
+    assert data["summary"]["wazuh_active_response_authorized_count"] == 0
+    assert data["summary"]["host_write_authorized_count"] == 0
+    assert data["summary"]["secret_value_collection_allowed_count"] == 0
+    assert data["boundaries"]["payload_persisted"] is False
+    assert data["boundaries"]["wazuh_api_live_query_authorized"] is False
+    assert data["boundaries"]["wazuh_active_response_authorized"] is False
+    assert data["boundaries"]["host_write_authorized"] is False
+    assert data["boundaries"]["runtime_gate_open"] is False
+    assert data["boundaries"]["not_authorization"] is True
+    assert len(data["target_selectors"]) == 6
+    assert len(data["review_items"]) == 7
+    assert any(
+        marker == "wazuh_runtime_gate_owner_review_validation_api_available=true"
+        for marker in data["boundary_markers"]
+    )
+    assert "192.168.0." not in response.text
+    assert "工作視窗" not in response.text
+    assert "批准！繼續" not in response.text
+    assert "WAZUH_API_PASSWORD" not in response.text
+
+
+def test_iwooos_wazuh_runtime_gate_owner_review_validator_accepts_redacted_packet(
+    monkeypatch,
+) -> None:
+    monkeypatch.delenv("IWOOOS_WAZUH_READONLY_ENABLED", raising=False)
+    monkeypatch.delenv("WAZUH_API_BASE_URL", raising=False)
+    monkeypatch.delenv("WAZUH_API_USERNAME", raising=False)
+    monkeypatch.delenv("WAZUH_API_PASSWORD", raising=False)
+
+    client = _client()
+    before = client.get(
+        "/api/v1/iwooos/wazuh-runtime-gate-owner-review-readback"
+    ).json()
+    response = client.post(
+        "/api/v1/iwooos/wazuh-runtime-gate-owner-review-readback/validate-owner-review-packet",
+        json=_valid_runtime_gate_owner_review_packet(),
+    )
+    after = client.get("/api/v1/iwooos/wazuh-runtime-gate-owner-review-readback").json()
+
+    assert response.status_code == 200
+    data = response.json()
+    assert (
+        data["schema_version"]
+        == "iwooos_wazuh_runtime_gate_owner_review_packet_validation_result_v1"
+    )
+    assert data["status"] == "accepted_for_runtime_gate_owner_review_readback_only"
+    assert data["accepted_for_runtime_gate_owner_review_readback_only"] is True
+    assert data["summary"]["owner_review_packet_received_count"] == 1
+    assert data["summary"]["owner_review_packet_review_ready_count"] == 1
+    assert data["summary"]["owner_review_packet_accepted_count"] == 1
+    assert data["summary"]["runtime_gate_count"] == 0
+    assert data["summary"]["wazuh_api_live_query_authorized_count"] == 0
+    assert data["summary"]["wazuh_active_response_authorized_count"] == 0
+    assert data["summary"]["host_write_authorized_count"] == 0
+    assert data["summary"]["secret_value_collection_allowed_count"] == 0
+    assert data["boundaries"]["payload_persisted"] is False
+    assert data["boundaries"]["runtime_execution_authorized"] is False
+    assert data["boundaries"]["runtime_gate_open"] is False
+    assert before["summary"] == after["summary"]
+    assert "192.168.0." not in response.text
+    assert "工作視窗" not in response.text
+    assert "批准！繼續" not in response.text
+
+
+def test_iwooos_wazuh_runtime_gate_owner_review_validator_quarantines_sensitive_payload(
+    monkeypatch,
+) -> None:
+    monkeypatch.delenv("IWOOOS_WAZUH_READONLY_ENABLED", raising=False)
+    monkeypatch.delenv("WAZUH_API_BASE_URL", raising=False)
+    monkeypatch.delenv("WAZUH_API_USERNAME", raising=False)
+    monkeypatch.delenv("WAZUH_API_PASSWORD", raising=False)
+
+    packet = _valid_runtime_gate_owner_review_packet()
+    packet[
+        "redacted_evidence_ref"
+    ] = "redacted note includes 10.1.2.3 and Authorization: Bearer abcdefghijklmnop"
+    response = _client().post(
+        "/api/v1/iwooos/wazuh-runtime-gate-owner-review-readback/validate-owner-review-packet",
+        json=packet,
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "quarantine_sensitive_payload"
+    assert data["quarantined"] is True
+    assert data["summary"]["owner_review_packet_quarantined_count"] == 1
+    assert data["summary"]["runtime_gate_count"] == 0
+    assert "10.1.2.3" not in response.text
+    assert "Bearer abcdefghijklmnop" not in response.text
+
+
+def test_iwooos_wazuh_runtime_gate_owner_review_validator_rejects_runtime_action(
+    monkeypatch,
+) -> None:
+    monkeypatch.delenv("IWOOOS_WAZUH_READONLY_ENABLED", raising=False)
+    monkeypatch.delenv("WAZUH_API_BASE_URL", raising=False)
+    monkeypatch.delenv("WAZUH_API_USERNAME", raising=False)
+    monkeypatch.delenv("WAZUH_API_PASSWORD", raising=False)
+
+    packet = _valid_runtime_gate_owner_review_packet()
+    packet["wazuh_active_response"] = True
+    response = _client().post(
+        "/api/v1/iwooos/wazuh-runtime-gate-owner-review-readback/validate-owner-review-packet",
+        json=packet,
+    )
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["status"] == "reject_runtime_action_request"
+    assert data["runtime_action_rejected"] is True
+    assert data["summary"]["owner_review_runtime_action_rejected_count"] == 1
+    assert data["summary"]["runtime_gate_count"] == 0