feat(security): verify public tls asset health

apps/web/src/lib/__tests__/security-asset-control-plane.test.ts

@@ -29,6 +29,8 @@ function payload(): SecurityAssetControlPlanePayload {
       relationship_count: 40,
       package_digest_unpinned_count: 0,
       forbidden_github_supply_chain_asset_count: 0,
+      certificate_live_unverified_count: 0,
+      certificate_live_unhealthy_count: 0,
       automation_coverage_green_percent: 85,
       automation_coverage_unknown_count: 0,
       compliance_violation_count: 0,
@@ -113,6 +115,18 @@ function payload(): SecurityAssetControlPlanePayload {
       registry_api_called: false,
       github_api_used: false,
     },
+    certificate_inventory: {
+      certificate_asset_count: 10,
+      live_tls_verified_count: 10,
+      live_tls_evidenced_count: 10,
+      live_tls_healthy_count: 10,
+      live_tls_unverified_count: 0,
+      live_tls_unhealthy_count: 0,
+      live_tls_health_proven: true,
+      raw_certificate_path_returned: false,
+      certificate_material_read: false,
+      private_key_material_read: false,
+    },
     source_health: [
       { source_id: "asset_inventory", status: "ready", reason_code: null },
     ],
@@ -167,6 +181,15 @@ describe("security asset control plane projection", () => {
       },
     };
     expect(isSecurityAssetControlPlanePayload(unsafeSupplyChain)).toBe(false);
+
+    const unsafeCertificateInventory = {
+      ...safe,
+      certificate_inventory: {
+        ...safe.certificate_inventory,
+        private_key_material_read: true,
+      },
+    };
+    expect(isSecurityAssetControlPlanePayload(unsafeCertificateInventory)).toBe(false);
   });
 
   it("does not show healthy before same-run closure is proven", () => {
@@ -194,6 +217,20 @@ describe("security asset control plane projection", () => {
     expect(securityControlPlaneTone(value)).toBe("critical");
   });
 
+  it("keeps missing or unhealthy live TLS evidence critical", () => {
+    const value = payload();
+    value.ai_automation.same_run_closed_loop_proven = true;
+    expect(securityControlPlaneTone(value)).toBe("healthy");
+
+    value.certificate_inventory!.live_tls_healthy_count = 9;
+    value.certificate_inventory!.live_tls_unhealthy_count = 1;
+    value.certificate_inventory!.live_tls_health_proven = false;
+    expect(securityControlPlaneTone(value)).toBe("critical");
+
+    value.certificate_inventory = undefined;
+    expect(securityControlPlaneTone(value)).toBe("critical");
+  });
+
   it("keeps P0 work ahead of P1 regardless of API order", () => {
     const items = topSecurityControlPlaneWorkItems(payload(), 2);
     expect(items.map((item) => item.work_item_id)).toEqual([