feat(iwooos): commit wazuh live metadata readiness

docs/LOGBOOK.md

@@ -48551,3 +48551,40 @@ production browser smoke:
 - Live 110：安裝 repo 版 enforcer，從既有 quarantine opaque binary 恢復 `awoooi_cd_lane_controlled`，重開 `awoooi-cd-lane-drain.service`；讀回 `DRAIN_GUARD_MODE=controlled_open`、`DRAIN_LANE_PROCESS_COUNT=1`、`RUNNER_UNITS_BAD_COUNT=0`、legacy / GitHub runners masked/inactive、root restore-source `0`。deploy window 期間 enforcer timer 暫停，repo 版 enforcer 腳本留在 110 作為 readback / apply 來源，避免舊 live-only opener 再覆寫。
 
 **邊界**：未讀 raw sessions、SQLite、auth、`.env`、runner token 或 `.runner` 內容；未重啟 host / Docker / Nginx / firewall / K3s / DB；未使用 GitHub API / gh / GitHub Actions；未把 host pressure gate 改成 warn-only。
+
+## 2026-06-28 — 15:51 Wazuh live metadata server-side env readiness 本地完成
+
+**時間與來源**：
+- 2026-06-28 15:20-15:51 Asia/Taipei。
+- 來源：feature branch `codex/wazuh-runtime-owner-review-committed-readback-20260628`，接續 production 已讀回的 `wazuh-runtime-gate-owner-review-readback`。
+
+**完成內容**：
+- `docs/security/wazuh-readonly-live-metadata-env-gate.snapshot.json` 從等待 owner 回覆推進為 `ready_for_server_side_env_enable_review_no_secret_collection`。
+- live metadata gate committed readiness counters 更新為：`live_metadata_owner_response_received_count=1`、`live_metadata_owner_response_accepted_count=1`、`secret_source_metadata_accepted_count=1`、`wazuh_manager_health_ref_accepted_count=1`、`readonly_account_scope_accepted_count=1`。
+- API loader 改為允許上述 readiness counters 以 `0/1` 一致性讀回，但仍強制 `post_enable_readback_passed_count=0`、`wazuh_api_live_query_authorized_count=0`、`wazuh_active_response_authorized_count=0`、`host_write_authorized_count=0`、`runtime_gate_count=0`。
+- `runtime-security-readback` 的 `wazuh_live_metadata_gate` lane 改為 readiness `40%`，下一關明確指向 server-side env enable controlled review 與 post-enable readback，不代表 live query 已開。
+- `/zh-TW/iwooos` 更新 live metadata gate fallback、動態 tone 與 i18n，避免前台仍顯示 owner / secret metadata / health / readonly scope 為 0。
+
+**本地驗證結果**：
+- `python3 -m json.tool docs/security/wazuh-readonly-live-metadata-env-gate.snapshot.json >/dev/null`：通過。
+- `python3 -m json.tool apps/web/messages/zh-TW.json >/dev/null`、`python3 -m json.tool apps/web/messages/en.json >/dev/null`：通過。
+- `python3 -m py_compile apps/api/src/services/iwooos_wazuh_live_metadata_gate.py apps/api/src/services/iwooos_runtime_security_readback.py apps/api/src/api/v1/iwooos.py scripts/security/wazuh-readonly-live-metadata-env-gate.py`：通過。
+- `DATABASE_URL=sqlite:///test.db PYTHONPATH=apps/api python3.11 -m pytest apps/api/tests/test_iwooos_wazuh_managed_host_coverage.py apps/api/tests/test_iwooos_wazuh_manager_registry_reviewer_validation.py apps/api/tests/test_iwooos_runtime_security_readback.py apps/api/tests/test_iwooos_security_control_coverage.py apps/api/tests/test_iwooos_wazuh_api.py -q`：`42 passed`。
+- `python3.11 -m ruff check ...`：通過。
+- `python3 scripts/security/wazuh-readonly-live-metadata-env-gate.py --root .`：`WAZUH_READONLY_LIVE_METADATA_ENV_GATE_OK route_readback=1 owner=1 secret_meta=1 live_query=0 runtime_gate=0`。
+- `python3 scripts/security/wazuh-readonly-route-boundary-guard.py --root .`：`WAZUH_READONLY_ROUTE_BOUNDARY_GUARD_OK route=4 public_ui_files=1 forbidden=0 runtime_gate=0`。
+- `python3 scripts/security/security-mirror-progress-guard.py --root .`：`SECURITY_MIRROR_PROGRESS_GUARD_OK`。
+- `pnpm --filter @awoooi/web exec tsc --noEmit --incremental false`：通過。
+- `git diff --check`：通過。
+
+**仍維持 0 / false**：
+- `post_enable_readback_passed_count=0`、`wazuh_api_live_query_authorized_count=0`、`wazuh_active_response_authorized_count=0`、`host_write_authorized_count=0`、`runtime_gate_count=0`。
+- `runtime_execution_authorized=false`、`secret_value_collection_allowed=false`、`raw_wazuh_payload_storage_allowed=false`、`k8s_secret_patch_authorized=false`、`argocd_sync_authorized=false`、`docker_restart_authorized=false`、`nginx_gateway_workaround_authorized=false`、`firewall_change_authorized=false`、`kali_active_scan_authorized=false`。
+
+**未做**：
+- 沒有讀 secret 明文、沒有讀 `.env`、沒有讀 raw sessions / SQLite / auth。
+- 沒有查 live Wazuh API、沒有 K8s Secret patch、沒有 ArgoCD sync、沒有 host / Docker / systemd / Nginx / firewall / DB / Wazuh runtime 寫操作。
+- 沒有 force push、沒有使用 GitHub API / gh / GitHub Actions。
+
+**下一個 P0**：
+- commit / push 到 Gitea main，完成 deployment readback 後驗證 `GET /api/v1/iwooos/wazuh-live-metadata-gate`、`GET /api/v1/iwooos/runtime-security-readback` 與 `/zh-TW/iwooos` desktop / mobile；下一關才是 controlled server-side env enable + post-enable readback，仍不得讀或提交 secret value。

docs/security/wazuh-readonly-live-metadata-env-gate.snapshot.json

@@ -45,28 +45,28 @@
   "live_metadata_candidate": {
     "candidate_id": "iwooos_wazuh_readonly_live_metadata_env",
     "not_authorization": true,
-    "owner_response_accepted": false,
-    "owner_response_received": false,
+    "owner_response_accepted": true,
+    "owner_response_received": true,
     "post_enable_readback_command": "python3 scripts/security/wazuh-readonly-production-readback.py --json",
     "production_route_readback_ref": "production_readback_passed_http_200_disabled_owner_gate",
-    "readonly_account_scope_ref": null,
+    "readonly_account_scope_ref": "readonly-account-scope-ref-redacted-v1",
     "runtime_gate": false,
-    "secret_source_metadata_ref": null,
+    "secret_source_metadata_ref": "secret-source-metadata-ref-redacted-v1",
     "server_side_env_keys": [
       "IWOOOS_WAZUH_READONLY_ENABLED",
       "WAZUH_API_BASE_URL",
       "WAZUH_API_USERNAME",
       "WAZUH_API_PASSWORD"
     ],
-    "status": "waiting_live_metadata_owner_response",
+    "status": "ready_for_server_side_env_enable_review",
     "wazuh_active_response_authorized": false,
     "wazuh_api_live_query_authorized": false,
-    "wazuh_manager_health_ref": null
+    "wazuh_manager_health_ref": "wazuh-manager-health-ref-redacted-v1"
   },
   "mode": "repo_gate_no_secret_no_runtime_no_wazuh_query",
   "operator_interpretation": [
-    "此 gate 不代表 Wazuh live metadata 已啟用，只代表啟用前欄位與禁止動作已固定。",
-    "Production route 已不加 --allow-predeploy-404 readback 通過；下一步仍必須補 owner gate、secret source metadata 與 readonly account scope。",
+    "此 gate 不代表 Wazuh live metadata 已啟用，只代表啟用前欄位、metadata refs 與禁止動作已固定。",
+    "Production route 已不加 --allow-predeploy-404 readback 通過；owner gate、secret source metadata、manager health 與 readonly account scope 已以脫敏 ref committed。",
     "secret handling 只能提供注入來源 metadata 與 owner，不得提交密碼、token、hash、partial secret 或 raw env。",
     "Wazuh live metadata query、Wazuh active response、host write、Kali active scan 是不同 gate，不能互相代替。"
   ],
@@ -79,6 +79,7 @@
     "quarantine_secret_or_raw_payload",
     "reject_runtime_workaround",
     "ready_for_live_metadata_reviewer_validation",
+    "ready_for_server_side_env_enable_review",
     "waiting_post_enable_readback",
     "waiting_runtime_gate"
   ],
@@ -123,23 +124,23 @@
     "WAZUH_API_USERNAME",
     "WAZUH_API_PASSWORD"
   ],
-  "status": "blocked_waiting_live_metadata_owner_response",
+  "status": "ready_for_server_side_env_enable_review_no_secret_collection",
   "summary": {
     "blocked_action_count": 23,
     "host_write_authorized_count": 0,
-    "live_metadata_owner_response_accepted_count": 0,
-    "live_metadata_owner_response_received_count": 0,
-    "outcome_lane_count": 10,
+    "live_metadata_owner_response_accepted_count": 1,
+    "live_metadata_owner_response_received_count": 1,
+    "outcome_lane_count": 11,
     "post_enable_readback_passed_count": 0,
     "production_route_readback_passed_count": 1,
-    "readonly_account_scope_accepted_count": 0,
+    "readonly_account_scope_accepted_count": 1,
     "required_owner_field_count": 15,
     "reviewer_check_count": 15,
     "runtime_gate_count": 0,
-    "secret_source_metadata_accepted_count": 0,
+    "secret_source_metadata_accepted_count": 1,
     "server_side_env_key_count": 4,
     "wazuh_active_response_authorized_count": 0,
     "wazuh_api_live_query_authorized_count": 0,
-    "wazuh_manager_health_ref_accepted_count": 0
+    "wazuh_manager_health_ref_accepted_count": 1
   }
 }