fix(security): classify Wazuh privilege blocker

apps/api/src/services/iwooos_wazuh_controlled_executor_runtime.py

@@ -26,6 +26,12 @@ SCHEMA_VERSION = "iwooos_wazuh_controlled_executor_runtime_readback_v1"
 CATALOG_ID = "ansible:wazuh-manager-posture-readback"
 INGRESS_CATALOG_ID = "ansible:wazuh-alertmanager-integration"
 WORK_ITEM_ID = "P0-03-WAZUH-MANAGER-POSTURE"
+_PRIVILEGED_CONVERGENCE_CAPABILITY_MISSING = (
+    "wazuh_privileged_convergence_capability_missing"
+)
+_PUBLIC_SAFE_CHECK_FAILURE_MARKERS = frozenset(
+    {_PRIVILEGED_CONVERGENCE_CAPABILITY_MISSING}
+)
 
 _LIVE_RUNTIME_SQL = """
     WITH latest_candidate AS (
@@ -60,6 +66,18 @@ _LIVE_RUNTIME_SQL = """
                 check_mode.output ->> 'timed_out',
                 check_mode.dry_run_result ->> 'timed_out'
             ) AS check_timed_out,
+            CASE
+                WHEN concat_ws(
+                    ' ',
+                    check_mode.error,
+                    check_mode.output ->> 'stdout_tail',
+                    check_mode.output ->> 'stderr_tail',
+                    check_mode.dry_run_result ->> 'stdout_tail',
+                    check_mode.dry_run_result ->> 'stderr_tail'
+                ) LIKE '%wazuh_privileged_convergence_capability_missing%'
+                THEN 'wazuh_privileged_convergence_capability_missing'
+                ELSE NULL
+            END AS check_failure_marker,
             check_mode.duration_ms AS check_duration_ms,
             check_mode.created_at AS check_created_at
         FROM automation_operation_log check_mode
@@ -485,6 +503,14 @@ def _next_action(
             else "internal_worker_enqueue_wazuh_manager_posture_candidate"
         )
     if check_failed:
+        if (
+            check_failure_class
+            == _PRIVILEGED_CONVERGENCE_CAPABILITY_MISSING
+        ):
+            return (
+                "queue_critical_break_glass_privileged_convergence_capability_"
+                "then_bounded_retry"
+            )
         return (
             "repair_and_enqueue_bounded_retry:"
             + (check_failure_class or "ansible_check_mode_failed")
@@ -507,6 +533,9 @@ def _next_action(
 def _check_failure_class(data: Mapping[str, Any]) -> str | None:
     if data.get("check_status") != "failed":
         return None
+    failure_marker = str(data.get("check_failure_marker") or "").strip()
+    if failure_marker in _PUBLIC_SAFE_CHECK_FAILURE_MARKERS:
+        return failure_marker
     if str(data.get("check_timed_out") or "").lower() == "true":
         return "ansible_check_mode_timeout"
     returncode = str(data.get("check_returncode") or "").strip()