From 208fbbe32a11a99a1a37569bc219124dd501863f Mon Sep 17 00:00:00 2001
From: ogt <ogt@awoooi.local>
Date: Sat, 11 Jul 2026 09:35:31 +0800
Subject: [PATCH] fix(iwooos): verify wazuh manager postconditions

---
 .../src/services/awooop_ansible_post_verifier.py | 14 ++++++++++++++
 ...t_iwooos_wazuh_controlled_executor_runtime.py | 16 ++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/apps/api/src/services/awooop_ansible_post_verifier.py b/apps/api/src/services/awooop_ansible_post_verifier.py
index 8da2a93ae..8887c144b 100644
--- a/apps/api/src/services/awooop_ansible_post_verifier.py
+++ b/apps/api/src/services/awooop_ansible_post_verifier.py
@@ -44,6 +44,20 @@ ProbeRunner = Callable[..., Awaitable[ReadOnlyProbeResult]]
 
 
 _POSTCONDITION_REGISTRY: dict[str, tuple[AssetPostcondition, ...]] = {
+    "ansible:wazuh-manager-posture-readback": (
+        AssetPostcondition(
+            "host_112_wazuh_manager_control_binary",
+            "security",
+            "host_112",
+            "test -f /var/ossec/bin/wazuh-control",
+        ),
+        AssetPostcondition(
+            "host_112_wazuh_manager_runtime",
+            "service",
+            "host_112",
+            "systemctl is-active --quiet wazuh-manager.service",
+        ),
+    ),
     "ansible:110-devops": (
         AssetPostcondition(
             "host_110_docker_runtime",
diff --git a/apps/api/tests/test_iwooos_wazuh_controlled_executor_runtime.py b/apps/api/tests/test_iwooos_wazuh_controlled_executor_runtime.py
index 7ec16b684..e2f9303a2 100644
--- a/apps/api/tests/test_iwooos_wazuh_controlled_executor_runtime.py
+++ b/apps/api/tests/test_iwooos_wazuh_controlled_executor_runtime.py
@@ -15,6 +15,7 @@ os.environ.setdefault("DATABASE_URL", "postgresql+asyncpg://test:test@localhost/
 from src.api.v1 import iwooos
 from src.api.v1.iwooos import router
 from src.services.awooop_ansible_audit_service import get_ansible_catalog_item
+from src.services.awooop_ansible_post_verifier import postconditions_for_catalog
 from src.services.iwooos_wazuh_controlled_executor_runtime import (
     build_iwooos_wazuh_controlled_executor_runtime_readback,
 )
@@ -122,6 +123,21 @@ def test_wazuh_posture_catalog_and_playbook_are_bounded_no_write() -> None:
     assert catalog["no_write_only"] is True
     assert catalog["inventory_hosts"] == ["host_112"]
 
+    postconditions = postconditions_for_catalog(
+        "ansible:wazuh-manager-posture-readback"
+    )
+    assert {condition.condition_id for condition in postconditions} == {
+        "host_112_wazuh_manager_control_binary",
+        "host_112_wazuh_manager_runtime",
+    }
+    assert {condition.inventory_host for condition in postconditions} == {
+        "host_112"
+    }
+    assert {condition.probe for condition in postconditions} == {
+        "test -f /var/ossec/bin/wazuh-control",
+        "systemctl is-active --quiet wazuh-manager.service",
+    }
+
     repo_root = Path(__file__).resolve().parents[3]
     source = (
         repo_root / "infra/ansible/playbooks/wazuh-manager-posture-readback.yml"