feat(iwooos): add wazuh runtime owner review readback

2026-06-28 11:28:31 +08:00
parent fde68fb843
commit 119267256a
9 changed files with 1462 additions and 7 deletions
--- a/apps/web/messages/en.json
+++ b/apps/web/messages/en.json
@@ -20429,8 +20429,8 @@
    },
    "runtimeSecurityReadback": {
      "eyebrow": "IwoooS Runtime 資安讀回",
-      "title": "十條 P0 資安線先接到同一張讀回板",
-      "subtitle": "這張板讀取後端彙整的只讀快照，並附上 Wazuh 正式只讀路由與 controlled apply preflight 的公開安全彙總讀回；它不保存原始 Wazuh 載荷、不啟動掃描、不送訊息、不改主機。",
+      "title": "十一條 P0 資安線先接到同一張讀回板",
+      "subtitle": "這張板讀取後端彙整的只讀快照，並附上 Wazuh 正式只讀路由、controlled apply preflight 與 owner-review readback 的公開安全彙總；它不保存原始 Wazuh 載荷、不啟動掃描、不送訊息、不改主機。",
      "statusLabel": "讀回狀態",
      "statusDetail": "讀回成功只代表 IwoooS 能看見目前的證據邊界；runtime 寫入、主動回應、掃描、重啟、Nginx reload、workflow 修改與機密操作仍全部關閉。",
      "laneStatusLabel": "目前狀態",
@@ -20449,6 +20449,7 @@
        "wazuh_live_metadata_gate": "等待即時中繼資料負責人回覆",
        "wazuh_owner_evidence_preflight": "負責人證據預檢已就緒，尚未授權執行期動作",
        "wazuh_runtime_controlled_apply_preflight": "受控執行預檢已就緒，執行期閘門仍關閉",
+        "wazuh_runtime_gate_owner_review": "owner-review packet 已接受為 review readiness，執行期閘門仍關閉",
        "wazuh_dashboard_api": "API 連線退化，禁止顯示綠燈",
        "kali_intake": "部分執行期健康已整合，仍待完整驗收",
        "alert_readability": "格式合約已就緒，尚未有實發收件證據",
@@ -20481,6 +20482,10 @@
          "label": "受控預檢",
          "detail": "target selector、diff、check-mode、rollback、verifier 與 writeback 已可審查；runtime 仍為 0。"
        },
+        "ownerReview": {
+          "label": "Owner review",
+          "detail": "review packet 已接受為 readback readiness；不代表 live query、active response 或 host write。"
+        },
        "ownerAccepted": {
          "label": "負責人驗收",
          "detail": "收到 / 接受都必須由正式 owner response 證明。"
@@ -20515,6 +20520,10 @@
          "title": "Wazuh 受控執行預檢",
          "body": "target selector、source-of-truth diff、check-mode / dry-run、rollback、post-apply verifier 與 KM / PlayBook writeback 已成為可審查 packet；它仍不查 live Wazuh、不開 active response、不寫主機。"
        },
+        "wazuh_runtime_gate_owner_review": {
+          "title": "Wazuh Runtime Gate Owner Review",
+          "body": "owner-review decision、target selector、diff、check-mode / dry-run evidence、rollback、verifier 與 writeback 已讀回；它只代表 review readiness，不查 live Wazuh、不開 active response、不寫主機。"
+        },
        "wazuh_dashboard_api": {
          "title": "Wazuh Dashboard API",
          "body": "API connection / API version 還要補 readback；index pattern 通過不能宣稱 Wazuh 全綠。"
--- a/apps/web/messages/zh-TW.json
+++ b/apps/web/messages/zh-TW.json
@@ -20429,8 +20429,8 @@
    },
    "runtimeSecurityReadback": {
      "eyebrow": "IwoooS Runtime 資安讀回",
-      "title": "十條 P0 資安線先接到同一張讀回板",
-      "subtitle": "這張板讀取後端彙整的只讀快照，並附上 Wazuh 正式只讀路由與 controlled apply preflight 的公開安全彙總讀回；它不保存原始 Wazuh 載荷、不啟動掃描、不送訊息、不改主機。",
+      "title": "十一條 P0 資安線先接到同一張讀回板",
+      "subtitle": "這張板讀取後端彙整的只讀快照，並附上 Wazuh 正式只讀路由、controlled apply preflight 與 owner-review readback 的公開安全彙總；它不保存原始 Wazuh 載荷、不啟動掃描、不送訊息、不改主機。",
      "statusLabel": "讀回狀態",
      "statusDetail": "讀回成功只代表 IwoooS 能看見目前的證據邊界；runtime 寫入、主動回應、掃描、重啟、Nginx reload、workflow 修改與機密操作仍全部關閉。",
      "laneStatusLabel": "目前狀態",
@@ -20449,6 +20449,7 @@
        "wazuh_live_metadata_gate": "等待即時中繼資料負責人回覆",
        "wazuh_owner_evidence_preflight": "負責人證據預檢已就緒，尚未授權執行期動作",
        "wazuh_runtime_controlled_apply_preflight": "受控執行預檢已就緒，執行期閘門仍關閉",
+        "wazuh_runtime_gate_owner_review": "owner-review packet 已接受為 review readiness，執行期閘門仍關閉",
        "wazuh_dashboard_api": "API 連線退化，禁止顯示綠燈",
        "kali_intake": "部分執行期健康已整合，仍待完整驗收",
        "alert_readability": "格式合約已就緒，尚未有實發收件證據",
@@ -20481,6 +20482,10 @@
          "label": "受控預檢",
          "detail": "target selector、diff、check-mode、rollback、verifier 與 writeback 已可審查；runtime 仍為 0。"
        },
+        "ownerReview": {
+          "label": "Owner review",
+          "detail": "review packet 已接受為 readback readiness；不代表 live query、active response 或 host write。"
+        },
        "ownerAccepted": {
          "label": "負責人驗收",
          "detail": "收到 / 接受都必須由正式 owner response 證明。"
@@ -20515,6 +20520,10 @@
          "title": "Wazuh 受控執行預檢",
          "body": "target selector、source-of-truth diff、check-mode / dry-run、rollback、post-apply verifier 與 KM / PlayBook writeback 已成為可審查 packet；它仍不查 live Wazuh、不開 active response、不寫主機。"
        },
+        "wazuh_runtime_gate_owner_review": {
+          "title": "Wazuh Runtime Gate Owner Review",
+          "body": "owner-review decision、target selector、diff、check-mode / dry-run evidence、rollback、verifier 與 writeback 已讀回；它只代表 review readiness，不查 live Wazuh、不開 active response、不寫主機。"
+        },
        "wazuh_dashboard_api": {
          "title": "Wazuh Dashboard API",
          "body": "API connection / API version 還要補 readback；index pattern 通過不能宣稱 Wazuh 全綠。"
--- a/apps/web/src/app/[locale]/iwooos/page.tsx
+++ b/apps/web/src/app/[locale]/iwooos/page.tsx
@@ -347,6 +347,7 @@ type RuntimeSecurityReadbackSummaryItem = {
    | 'wazuhLive'
    | 'metadataGate'
    | 'controlledApplyPreflight'
+    | 'ownerReview'
    | 'ownerAccepted'
    | 'kaliRuntime'
    | 'runtimeGate'
@@ -8244,6 +8245,7 @@ const runtimeSecurityLaneStatusKeys = new Set<IwoooSRuntimeSecurityReadbackRespo
  'wazuh_live_metadata_gate',
  'wazuh_owner_evidence_preflight',
  'wazuh_runtime_controlled_apply_preflight',
+  'wazuh_runtime_gate_owner_review',
  'wazuh_dashboard_api',
  'kali_intake',
  'alert_readability',
@@ -8327,6 +8329,12 @@ function IwoooSRuntimeSecurityReadbackBoard() {
      icon: ListChecks,
      tone: summary && summary.wazuh_runtime_apply_preflight_ready_count > 0 ? 'steady' : 'locked',
    },
+    {
+      key: 'ownerReview',
+      value: summary ? String(summary.wazuh_runtime_owner_review_packet_accepted_count) : '...',
+      icon: ClipboardCheck,
+      tone: summary && summary.wazuh_runtime_owner_review_packet_accepted_count > 0 ? 'steady' : 'locked',
+    },
    {
      key: 'ownerAccepted',
      value: summary ? `${summary.owner_response_accepted_count}/${summary.owner_response_received_count}` : '...',
--- a/apps/web/src/lib/api-client.ts
+++ b/apps/web/src/lib/api-client.ts
@@ -105,6 +105,7 @@ export interface IwoooSRuntimeSecurityReadbackLane {
    | 'wazuh_live_metadata_gate'
    | 'wazuh_owner_evidence_preflight'
    | 'wazuh_runtime_controlled_apply_preflight'
+    | 'wazuh_runtime_gate_owner_review'
    | 'wazuh_dashboard_api'
    | 'kali_intake'
    | 'alert_readability'
@@ -171,6 +172,17 @@ export interface IwoooSRuntimeSecurityReadbackResponse {
    wazuh_runtime_apply_km_writeback_count: number
    wazuh_runtime_apply_owner_review_ready_count: number
    wazuh_runtime_apply_runtime_gate_count: number
+    wazuh_runtime_owner_review_target_selector_count: number
+    wazuh_runtime_owner_review_source_diff_count: number
+    wazuh_runtime_owner_review_check_mode_plan_count: number
+    wazuh_runtime_owner_review_dry_run_evidence_count: number
+    wazuh_runtime_owner_review_rollback_plan_count: number
+    wazuh_runtime_owner_review_post_apply_verifier_count: number
+    wazuh_runtime_owner_review_km_writeback_count: number
+    wazuh_runtime_owner_review_packet_received_count: number
+    wazuh_runtime_owner_review_packet_review_ready_count: number
+    wazuh_runtime_owner_review_packet_accepted_count: number
+    wazuh_runtime_owner_review_runtime_gate_count: number
    kali_active_scan_authorized_count: number
    kali_execute_authorized_count: number
    kali_finding_envelope_accepted_count: number
@@ -343,6 +355,71 @@ export interface IwoooSWazuhRuntimeControlledApplyPreflightResponse {
  no_false_green_rules: string[]
 }

+export interface IwoooSWazuhRuntimeGateOwnerReviewItem {
+  item_id:
+    | 'owner_decision'
+    | 'target_selector'
+    | 'source_of_truth_diff'
+    | 'check_mode_dry_run'
+    | 'rollback_and_maintenance'
+    | 'post_apply_verifier'
+    | 'learning_writeback'
+  title: string
+  state_key: string
+  accepted: boolean
+  required_fields: string[]
+  next_gate: string
+}
+
+export interface IwoooSWazuhRuntimeGateOwnerReviewReadbackResponse {
+  schema_version: 'iwooos_wazuh_runtime_gate_owner_review_readback_v1'
+  source_schema_version: 'wazuh_runtime_gate_owner_review_readback_v1'
+  status: string
+  mode: string
+  source_refs: string[]
+  owner_review_packet_validation_endpoint: string
+  owner_review_packet_validation_mode: string
+  summary: {
+    expected_scope_alias_count: number
+    target_selector_count: number
+    source_of_truth_diff_count: number
+    check_mode_plan_count: number
+    dry_run_evidence_count: number
+    rollback_plan_count: number
+    post_apply_verifier_count: number
+    km_playbook_writeback_count: number
+    maintenance_window_review_count: number
+    owner_review_packet_received_count: number
+    owner_review_packet_review_ready_count: number
+    owner_review_packet_accepted_count: number
+    owner_review_packet_supplement_required_count: number
+    owner_review_packet_quarantined_count: number
+    owner_review_runtime_action_rejected_count: number
+    forbidden_payload_count: number
+    forbidden_action_count: number
+    runtime_gate_count: number
+    wazuh_api_live_query_authorized_count: number
+    wazuh_active_response_authorized_count: number
+    host_write_authorized_count: number
+    secret_value_collection_allowed_count: number
+  }
+  target_selectors: Array<{
+    node_alias: string
+    scope: string
+    selector_kind: string
+    runtime_write_allowed: boolean
+    owner_review_scope: string
+  }>
+  required_owner_review_fields: string[]
+  review_items: IwoooSWazuhRuntimeGateOwnerReviewItem[]
+  outcome_lanes: string[]
+  forbidden_payloads: string[]
+  forbidden_actions: string[]
+  boundary_markers: string[]
+  boundaries: Record<string, boolean>
+  no_false_green_rules: string[]
+}
+
 export interface IwoooSWazuhManagedHostCoverageHost {
  node_id: string
  role: string
@@ -701,6 +778,11 @@ export const apiClient = {
    return handleResponse<IwoooSWazuhRuntimeControlledApplyPreflightResponse>(res)
  },

+  async getIwoooSWazuhRuntimeGateOwnerReviewReadback() {
+    const res = await fetch(`${API_BASE_URL}/iwooos/wazuh-runtime-gate-owner-review-readback`, { cache: 'no-store' })
+    return handleResponse<IwoooSWazuhRuntimeGateOwnerReviewReadbackResponse>(res)
+  },
+
  async getIwoooSWazuhManagedHostCoverage() {
    const res = await fetch(`${API_BASE_URL}/iwooos/wazuh-managed-host-coverage`, { cache: 'no-store' })
    return handleResponse<IwoooSWazuhManagedHostCoverageResponse>(res)