fix(iwooos): verify wazuh manager postconditions

apps/api/src/services/awooop_ansible_post_verifier.py

@@ -44,6 +44,20 @@ ProbeRunner = Callable[..., Awaitable[ReadOnlyProbeResult]]
 
 
 _POSTCONDITION_REGISTRY: dict[str, tuple[AssetPostcondition, ...]] = {
+    "ansible:wazuh-manager-posture-readback": (
+        AssetPostcondition(
+            "host_112_wazuh_manager_control_binary",
+            "security",
+            "host_112",
+            "test -f /var/ossec/bin/wazuh-control",
+        ),
+        AssetPostcondition(
+            "host_112_wazuh_manager_runtime",
+            "service",
+            "host_112",
+            "systemctl is-active --quiet wazuh-manager.service",
+        ),
+    ),
     "ansible:110-devops": (
         AssetPostcondition(
             "host_110_docker_runtime",

apps/api/tests/test_iwooos_wazuh_controlled_executor_runtime.py

@@ -15,6 +15,7 @@ os.environ.setdefault("DATABASE_URL", "postgresql+asyncpg://test:test@localhost/
 from src.api.v1 import iwooos
 from src.api.v1.iwooos import router
 from src.services.awooop_ansible_audit_service import get_ansible_catalog_item
+from src.services.awooop_ansible_post_verifier import postconditions_for_catalog
 from src.services.iwooos_wazuh_controlled_executor_runtime import (
     build_iwooos_wazuh_controlled_executor_runtime_readback,
 )
@@ -122,6 +123,21 @@ def test_wazuh_posture_catalog_and_playbook_are_bounded_no_write() -> None:
     assert catalog["no_write_only"] is True
     assert catalog["inventory_hosts"] == ["host_112"]
 
+    postconditions = postconditions_for_catalog(
+        "ansible:wazuh-manager-posture-readback"
+    )
+    assert {condition.condition_id for condition in postconditions} == {
+        "host_112_wazuh_manager_control_binary",
+        "host_112_wazuh_manager_runtime",
+    }
+    assert {condition.inventory_host for condition in postconditions} == {
+        "host_112"
+    }
+    assert {condition.probe for condition in postconditions} == {
+        "test -f /var/ossec/bin/wazuh-control",
+        "systemctl is-active --quiet wazuh-manager.service",
+    }
+
     repo_root = Path(__file__).resolve().parents[3]
     source = (
         repo_root / "infra/ansible/playbooks/wazuh-manager-posture-readback.yml"