feat(security): verify public tls asset health

apps/web/src/components/iwooos/security-asset-control-plane-cockpit.tsx

@@ -6,6 +6,7 @@ import {
   Boxes,
   CheckCircle2,
   Database,
+  LockKeyhole,
   RefreshCw,
   Radar,
   ShieldAlert,
@@ -48,6 +49,11 @@ type Copy = {
   digestPinned: string;
   forbiddenSources: string;
   imagePolicy: string;
+  publicTls: string;
+  certificates: string;
+  tlsEvidence: string;
+  tlsHealthy: string;
+  tlsPolicy: string;
   compliant: string;
   repair: string;
   notEvidenced: string;
@@ -88,6 +94,11 @@ const COPY: Record<"zh" | "en", Copy> = {
     digestPinned: "Digest 鎖定",
     forbiddenSources: "禁用來源",
     imagePolicy: "映像政策",
+    publicTls: "Public TLS",
+    certificates: "憑證資產",
+    tlsEvidence: "Live 驗證",
+    tlsHealthy: "健康憑證",
+    tlsPolicy: "TLS 政策",
     compliant: "符合",
     repair: "需修復",
     notEvidenced: "未盤點",
@@ -126,6 +137,11 @@ const COPY: Record<"zh" | "en", Copy> = {
     digestPinned: "Digest pinned",
     forbiddenSources: "Forbidden sources",
     imagePolicy: "Image policy",
+    publicTls: "Public TLS",
+    certificates: "Certificates",
+    tlsEvidence: "Live evidence",
+    tlsHealthy: "Healthy certs",
+    tlsPolicy: "TLS policy",
     compliant: "PASS",
     repair: "REPAIR",
     notEvidenced: "NO DATA",
@@ -247,6 +263,69 @@ function TruthCell({
   );
 }
 
+function CertificateTruthStrip({
+  copy,
+  payload,
+}: {
+  copy: Copy;
+  payload: SecurityAssetControlPlanePayload | null;
+}) {
+  const certificate = payload?.certificate_inventory;
+  const assetCount = certificate?.certificate_asset_count ?? 0;
+  const evidencedCount =
+    certificate?.live_tls_evidenced_count ?? certificate?.live_tls_verified_count;
+  const healthyCount = certificate?.live_tls_healthy_count;
+  const healthProven = certificate?.live_tls_health_proven === true;
+
+  return (
+    <div className="border-t border-[#d8d3c7] bg-[#f6f4ee] px-3 py-2">
+      <div className="mb-1.5 flex items-center gap-1.5 text-[10px] font-semibold text-[#4f4d47]">
+        <LockKeyhole className="h-3.5 w-3.5" aria-hidden="true" />
+        {copy.publicTls}
+      </div>
+      <div
+        className="grid grid-cols-2 gap-px bg-[#d8d3c7] sm:grid-cols-4"
+        data-testid="security-public-tls-truth"
+      >
+        <TruthCell
+          label={copy.certificates}
+          value={certificate?.certificate_asset_count ?? "--"}
+          icon={LockKeyhole}
+          tone={assetCount > 0 ? "healthy" : "critical"}
+        />
+        <TruthCell
+          label={copy.tlsEvidence}
+          value={certificate ? `${evidencedCount ?? "--"}/${assetCount}` : "--"}
+          icon={Radar}
+          tone={
+            certificate && certificate.live_tls_unverified_count === 0
+              ? "healthy"
+              : "critical"
+          }
+        />
+        <TruthCell
+          label={copy.tlsHealthy}
+          value={certificate ? `${healthyCount ?? "--"}/${assetCount}` : "--"}
+          icon={ShieldCheck}
+          tone={healthProven ? "healthy" : "critical"}
+        />
+        <TruthCell
+          label={copy.tlsPolicy}
+          value={
+            !certificate
+              ? copy.notEvidenced
+              : healthProven
+                ? copy.compliant
+                : copy.repair
+          }
+          icon={healthProven ? ShieldCheck : TriangleAlert}
+          tone={healthProven ? "healthy" : "critical"}
+        />
+      </div>
+    </div>
+  );
+}
+
 function StageStrip({
   title,
   stages,
@@ -358,6 +437,8 @@ export function SecurityAssetControlPlaneCockpit({
         </button>
       </div>
 
+      <CertificateTruthStrip copy={copy} payload={payload} />
+
       <div className="grid grid-cols-2 gap-px bg-[#d8d3c7] sm:grid-cols-3 lg:grid-cols-6">
         <MetricCell
           label={copy.overall}