feat(iwooos): add wazuh runtime owner review readback

apps/web/src/app/[locale]/iwooos/page.tsx

@@ -347,6 +347,7 @@ type RuntimeSecurityReadbackSummaryItem = {
     | 'wazuhLive'
     | 'metadataGate'
     | 'controlledApplyPreflight'
+    | 'ownerReview'
     | 'ownerAccepted'
     | 'kaliRuntime'
     | 'runtimeGate'
@@ -8244,6 +8245,7 @@ const runtimeSecurityLaneStatusKeys = new Set<IwoooSRuntimeSecurityReadbackRespo
   'wazuh_live_metadata_gate',
   'wazuh_owner_evidence_preflight',
   'wazuh_runtime_controlled_apply_preflight',
+  'wazuh_runtime_gate_owner_review',
   'wazuh_dashboard_api',
   'kali_intake',
   'alert_readability',
@@ -8327,6 +8329,12 @@ function IwoooSRuntimeSecurityReadbackBoard() {
       icon: ListChecks,
       tone: summary && summary.wazuh_runtime_apply_preflight_ready_count > 0 ? 'steady' : 'locked',
     },
+    {
+      key: 'ownerReview',
+      value: summary ? String(summary.wazuh_runtime_owner_review_packet_accepted_count) : '...',
+      icon: ClipboardCheck,
+      tone: summary && summary.wazuh_runtime_owner_review_packet_accepted_count > 0 ? 'steady' : 'locked',
+    },
     {
       key: 'ownerAccepted',
       value: summary ? `${summary.owner_response_accepted_count}/${summary.owner_response_received_count}` : '...',

apps/web/src/lib/api-client.ts

@@ -105,6 +105,7 @@ export interface IwoooSRuntimeSecurityReadbackLane {
     | 'wazuh_live_metadata_gate'
     | 'wazuh_owner_evidence_preflight'
     | 'wazuh_runtime_controlled_apply_preflight'
+    | 'wazuh_runtime_gate_owner_review'
     | 'wazuh_dashboard_api'
     | 'kali_intake'
     | 'alert_readability'
@@ -171,6 +172,17 @@ export interface IwoooSRuntimeSecurityReadbackResponse {
     wazuh_runtime_apply_km_writeback_count: number
     wazuh_runtime_apply_owner_review_ready_count: number
     wazuh_runtime_apply_runtime_gate_count: number
+    wazuh_runtime_owner_review_target_selector_count: number
+    wazuh_runtime_owner_review_source_diff_count: number
+    wazuh_runtime_owner_review_check_mode_plan_count: number
+    wazuh_runtime_owner_review_dry_run_evidence_count: number
+    wazuh_runtime_owner_review_rollback_plan_count: number
+    wazuh_runtime_owner_review_post_apply_verifier_count: number
+    wazuh_runtime_owner_review_km_writeback_count: number
+    wazuh_runtime_owner_review_packet_received_count: number
+    wazuh_runtime_owner_review_packet_review_ready_count: number
+    wazuh_runtime_owner_review_packet_accepted_count: number
+    wazuh_runtime_owner_review_runtime_gate_count: number
     kali_active_scan_authorized_count: number
     kali_execute_authorized_count: number
     kali_finding_envelope_accepted_count: number
@@ -343,6 +355,71 @@ export interface IwoooSWazuhRuntimeControlledApplyPreflightResponse {
   no_false_green_rules: string[]
 }
 
+export interface IwoooSWazuhRuntimeGateOwnerReviewItem {
+  item_id:
+    | 'owner_decision'
+    | 'target_selector'
+    | 'source_of_truth_diff'
+    | 'check_mode_dry_run'
+    | 'rollback_and_maintenance'
+    | 'post_apply_verifier'
+    | 'learning_writeback'
+  title: string
+  state_key: string
+  accepted: boolean
+  required_fields: string[]
+  next_gate: string
+}
+
+export interface IwoooSWazuhRuntimeGateOwnerReviewReadbackResponse {
+  schema_version: 'iwooos_wazuh_runtime_gate_owner_review_readback_v1'
+  source_schema_version: 'wazuh_runtime_gate_owner_review_readback_v1'
+  status: string
+  mode: string
+  source_refs: string[]
+  owner_review_packet_validation_endpoint: string
+  owner_review_packet_validation_mode: string
+  summary: {
+    expected_scope_alias_count: number
+    target_selector_count: number
+    source_of_truth_diff_count: number
+    check_mode_plan_count: number
+    dry_run_evidence_count: number
+    rollback_plan_count: number
+    post_apply_verifier_count: number
+    km_playbook_writeback_count: number
+    maintenance_window_review_count: number
+    owner_review_packet_received_count: number
+    owner_review_packet_review_ready_count: number
+    owner_review_packet_accepted_count: number
+    owner_review_packet_supplement_required_count: number
+    owner_review_packet_quarantined_count: number
+    owner_review_runtime_action_rejected_count: number
+    forbidden_payload_count: number
+    forbidden_action_count: number
+    runtime_gate_count: number
+    wazuh_api_live_query_authorized_count: number
+    wazuh_active_response_authorized_count: number
+    host_write_authorized_count: number
+    secret_value_collection_allowed_count: number
+  }
+  target_selectors: Array<{
+    node_alias: string
+    scope: string
+    selector_kind: string
+    runtime_write_allowed: boolean
+    owner_review_scope: string
+  }>
+  required_owner_review_fields: string[]
+  review_items: IwoooSWazuhRuntimeGateOwnerReviewItem[]
+  outcome_lanes: string[]
+  forbidden_payloads: string[]
+  forbidden_actions: string[]
+  boundary_markers: string[]
+  boundaries: Record<string, boolean>
+  no_false_green_rules: string[]
+}
+
 export interface IwoooSWazuhManagedHostCoverageHost {
   node_id: string
   role: string
@@ -701,6 +778,11 @@ export const apiClient = {
     return handleResponse<IwoooSWazuhRuntimeControlledApplyPreflightResponse>(res)
   },
 
+  async getIwoooSWazuhRuntimeGateOwnerReviewReadback() {
+    const res = await fetch(`${API_BASE_URL}/iwooos/wazuh-runtime-gate-owner-review-readback`, { cache: 'no-store' })
+    return handleResponse<IwoooSWazuhRuntimeGateOwnerReviewReadbackResponse>(res)
+  },
+
   async getIwoooSWazuhManagedHostCoverage() {
     const res = await fetch(`${API_BASE_URL}/iwooos/wazuh-managed-host-coverage`, { cache: 'no-store' })
     return handleResponse<IwoooSWazuhManagedHostCoverageResponse>(res)