fix(wazuh): persist critical capability packets

apps/api/tests/test_iwooos_wazuh_controlled_executor_runtime.py

@@ -19,6 +19,14 @@ os.environ.setdefault("DATABASE_URL", "postgresql+asyncpg://test:test@localhost/
 from src.api.v1 import iwooos
 from src.api.v1.iwooos import router
 from src.services.awooop_ansible_audit_service import get_ansible_catalog_item
+from src.services.awooop_ansible_check_mode_service import (
+    AnsibleCheckModeClaim,
+    AnsibleRunResult,
+    _build_wazuh_break_glass_capability_packet,
+    _wazuh_privileged_convergence_capability_is_missing,
+    backfill_missing_wazuh_break_glass_capability_packets_once,
+    finalize_check_mode_claim,
+)
 from src.services.awooop_ansible_post_verifier import postconditions_for_catalog
 from src.services.iwooos_wazuh_controlled_executor_runtime import (
     build_iwooos_wazuh_controlled_executor_runtime_readback,
@@ -323,6 +331,94 @@ def test_wazuh_runtime_readback_projects_allowlisted_privilege_blocker() -> None
     )
     assert payload["boundaries"]["host_write_performed"] is False
     assert payload["boundaries"]["secret_value_collection_allowed"] is False
+    assert payload["summary"][
+        "critical_break_glass_capability_packet_count"
+    ] == 0
+    assert payload["critical_break_glass_capability_packet"] is None
+    assert "critical_break_glass_capability_packet_missing" in (
+        payload["active_blockers"]
+    )
+
+
+def test_wazuh_runtime_readback_projects_durable_break_glass_packet() -> None:
+    run_id = "00000000-0000-0000-0000-000000000314"
+    recurrence = _current_wazuh_source_recurrence(
+        "2026-07-15T05:59:58+08:00"
+    )
+    row = {
+        "candidate_op_id": run_id,
+        "automation_run_id": run_id,
+        "trace_id": run_id,
+        "run_id": run_id,
+        "candidate_project_id": "awoooi",
+        "work_item_id": "P0-03-WAZUH-ALERT-INGRESS",
+        "proposal_source": "iwooos_wazuh_alert_ingress_scheduler",
+        "run_namespace": "awoooi:iwooos:wazuh-alert-ingress",
+        "source_receipt_ref": "wazuh-alert:2026071500",
+        "candidate_source_recurrence": recurrence,
+        "candidate_source_recurrence_verified": True,
+        "catalog_id": "ansible:wazuh-alertmanager-integration",
+        "check_op_id": "00000000-0000-0000-0000-000000000313",
+        "check_status": "failed",
+        "check_returncode": "2",
+        "check_timed_out": "false",
+        "check_automation_run_id": run_id,
+        "check_trace_id": run_id,
+        "check_run_id": run_id,
+        "check_work_item_id": "P0-03-WAZUH-ALERT-INGRESS",
+        "check_source_recurrence": recurrence,
+        "check_failure_marker": (
+            "wazuh_privileged_convergence_capability_missing"
+        ),
+        "break_glass_packet_receipt_id": (
+            "00000000-0000-0000-0000-000000000315"
+        ),
+        "break_glass_packet_status": "pending",
+        "capability_packet_id": "IWZ-BG-0011223344556677",
+        "capability_automation_run_id": run_id,
+        "capability_trace_id": run_id,
+        "capability_run_id": run_id,
+        "capability_work_item_id": "P0-03-WAZUH-ALERT-INGRESS",
+        "capability_project_id": "awoooi",
+        "capability_run_namespace": "awoooi:iwooos:wazuh-alert-ingress",
+        "capability_proposal_source": (
+            "iwooos_wazuh_alert_ingress_scheduler"
+        ),
+        "capability_source_recurrence": recurrence,
+        "capability_type": "bounded_privileged_convergence",
+        "capability_risk_level": "critical",
+        "capability_policy_route": "critical_break_glass_queue",
+        "capability_queue_status": "queued",
+        "capability_execution_allowed": False,
+        "capability_granted": False,
+        "capability_packet_host_write_performed": False,
+        "stage_ids": [],
+    }
+
+    payload = build_iwooos_wazuh_controlled_executor_runtime_readback(
+        row,
+        executor_enabled=True,
+    )
+
+    assert payload["summary"][
+        "critical_break_glass_capability_packet_count"
+    ] == 1
+    assert payload["next_safe_action"] == (
+        "critical_break_glass_capability_packet_queued_waiting_"
+        "bounded_capability_verifier_then_retry"
+    )
+    packet = payload["critical_break_glass_capability_packet"]
+    assert packet["queue_status"] == "queued"
+    assert packet["execution_allowed"] is False
+    assert packet["capability_granted"] is False
+    assert packet["host_write_performed"] is False
+    assert packet["secret_value_exposed"] is False
+    assert "critical_break_glass_capability_packet_pending" in (
+        payload["active_blockers"]
+    )
+    assert payload["boundaries"][
+        "critical_break_glass_capability_packet_persisted"
+    ] is True
 
 
 def test_wazuh_runtime_readback_rejects_untrusted_failure_marker() -> None:
@@ -345,6 +441,184 @@ def test_wazuh_runtime_readback_rejects_untrusted_failure_marker() -> None:
     assert payload["boundaries"]["host_write_performed"] is False
 
 
+def test_wazuh_break_glass_packet_is_deterministic_and_public_safe() -> None:
+    kwargs = {
+        "check_op_id": "00000000-0000-0000-0000-000000000316",
+        "source_candidate_op_id": "00000000-0000-0000-0000-000000000317",
+        "incident_id": "IWZ-I-2026071512-TEST",
+        "catalog_id": "ansible:wazuh-alertmanager-integration",
+        "source_input": {
+            "automation_run_id": "00000000-0000-0000-0000-000000000317",
+            "trace_id": "trace-317",
+            "run_id": "run-317",
+            "work_item_id": "P0-03-WAZUH-ALERT-INGRESS",
+            "project_id": "awoooi",
+            "run_namespace": "awoooi:iwooos:wazuh-alert-ingress",
+            "proposal_source": "iwooos_wazuh_alert_ingress_scheduler",
+            "source_receipt_ref": "wazuh-alert:2026071500",
+            "source_recurrence": _current_wazuh_source_recurrence(
+                "2026-07-15T05:59:58+08:00"
+            ),
+            "unexpected_material": "must-not-be-projected",
+            "command_output": "must-not-be-projected",
+        },
+    }
+
+    packet_input, packet_output, dry_run = (
+        _build_wazuh_break_glass_capability_packet(**kwargs)
+    )
+    repeated_input, _, _ = _build_wazuh_break_glass_capability_packet(
+        **kwargs
+    )
+    serialized = json.dumps(
+        {"input": packet_input, "output": packet_output, "dry": dry_run}
+    )
+
+    assert packet_input["capability_packet_id"] == repeated_input[
+        "capability_packet_id"
+    ]
+    assert packet_input["risk_level"] == "critical"
+    assert packet_input["execution_allowed"] is False
+    assert packet_input["host_write_performed"] is False
+    assert packet_input["project_id"] == "awoooi"
+    assert packet_input["source_recurrence"]["verified"] is True
+    assert packet_output["queue_status"] == "queued"
+    assert dry_run["capability_granted"] is False
+    assert "must-not-be-projected" not in serialized
+    assert "command_output" not in serialized
+
+
+@pytest.mark.asyncio
+async def test_failed_wazuh_check_atomically_queues_deduplicated_packet(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    from src.services import awooop_ansible_check_mode_service as service
+
+    calls: list[tuple[str, dict[str, object]]] = []
+
+    class _Result:
+        def __init__(self, inserted: bool = False):
+            self.inserted = inserted
+
+        def scalar_one_or_none(self):
+            if self.inserted:
+                return "00000000-0000-0000-0000-000000000318"
+            return None
+
+    class _Db:
+        async def execute(self, statement, params):
+            sql = str(statement)
+            calls.append((sql, params))
+            return _Result(inserted="RETURNING op_id::text" in sql)
+
+    @asynccontextmanager
+    async def fake_db_context(project_id: str):
+        assert project_id == "awoooi"
+        yield _Db()
+
+    monkeypatch.setattr(service, "get_db_context", fake_db_context)
+    claim = AnsibleCheckModeClaim(
+        op_id="00000000-0000-0000-0000-000000000319",
+        source_candidate_op_id="00000000-0000-0000-0000-000000000320",
+        incident_id="IWZ-I-2026071512-TEST",
+        catalog_id="ansible:wazuh-alertmanager-integration",
+        playbook_path=(
+            "infra/ansible/playbooks/wazuh-alertmanager-integration.yml"
+        ),
+        apply_playbook_path=(
+            "infra/ansible/playbooks/wazuh-alertmanager-integration.yml"
+        ),
+        inventory_hosts=("host_112",),
+        risk_level="medium",
+        input_payload={
+            "automation_run_id": "00000000-0000-0000-0000-000000000320",
+            "trace_id": "trace-320",
+            "run_id": "run-320",
+            "work_item_id": "P0-03-WAZUH-ALERT-INGRESS",
+            "project_id": "awoooi",
+            "run_namespace": "awoooi:iwooos:wazuh-alert-ingress",
+            "proposal_source": "iwooos_wazuh_alert_ingress_scheduler",
+            "source_receipt_ref": "wazuh-alert:2026071500",
+            "source_recurrence": _current_wazuh_source_recurrence(
+                "2026-07-15T05:59:58+08:00"
+            ),
+        },
+    )
+    result = AnsibleRunResult(
+        returncode=2,
+        stdout="wazuh_privileged_convergence_capability_missing",
+        stderr="",
+        duration_ms=20,
+    )
+
+    assert _wazuh_privileged_convergence_capability_is_missing(claim, result)
+    await finalize_check_mode_claim(claim, result)
+
+    assert len(calls) == 2
+    insert_sql, insert_params = calls[1]
+    assert "ansible_break_glass_capability_work_item_queued" in insert_sql
+    assert "WHERE NOT EXISTS" in insert_sql
+    packet_input = json.loads(str(insert_params["input"]))
+    assert packet_input["work_item_id"] == "P0-03-WAZUH-ALERT-INGRESS"
+    assert packet_input["secret_value_exposed"] is False
+
+
+@pytest.mark.asyncio
+async def test_wazuh_break_glass_packet_backfill_closes_existing_gap(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    from src.services import awooop_ansible_check_mode_service as service
+
+    rows = [{
+        "check_op_id": "00000000-0000-0000-0000-000000000321",
+        "source_candidate_op_id": "00000000-0000-0000-0000-000000000322",
+        "incident_id": "IWZ-I-2026071512-TEST",
+        "automation_run_id": "00000000-0000-0000-0000-000000000322",
+        "trace_id": "trace-322",
+        "run_id": "run-322",
+        "work_item_id": "P0-03-WAZUH-ALERT-INGRESS",
+        "project_id": "awoooi",
+        "run_namespace": "awoooi:iwooos:wazuh-alert-ingress",
+        "proposal_source": "iwooos_wazuh_alert_ingress_scheduler",
+        "source_receipt_ref": "wazuh-alert:2026071500",
+        "source_recurrence": _current_wazuh_source_recurrence(
+            "2026-07-15T05:59:58+08:00"
+        ),
+    }]
+
+    class _Mappings:
+        def all(self):
+            return rows
+
+    class _Result:
+        def __init__(self, *, selected: bool = False):
+            self.selected = selected
+
+        def mappings(self):
+            return _Mappings() if self.selected else MagicMock()
+
+        def scalar_one_or_none(self):
+            if not self.selected:
+                return "00000000-0000-0000-0000-000000000323"
+            return None
+
+    class _Db:
+        async def execute(self, statement, _params=None):
+            sql = str(statement)
+            return _Result(selected="SELECT" in sql and "JOIN" in sql)
+
+    @asynccontextmanager
+    async def fake_db_context(project_id: str):
+        assert project_id == "awoooi"
+        yield _Db()
+
+    monkeypatch.setattr(service, "get_db_context", fake_db_context)
+
+    result = await backfill_missing_wazuh_break_glass_capability_packets_once()
+
+    assert result == {"scanned": 1, "written": 1, "error": None}
+
+
 def test_wazuh_posture_catalog_and_playbook_are_bounded_no_write() -> None:
     catalog = get_ansible_catalog_item("ansible:wazuh-manager-posture-readback")
     assert catalog is not None