fix(security): classify Wazuh privilege blocker

apps/web/messages/en.json

@@ -14226,6 +14226,7 @@
         "source": "Source",
         "packet": "Packet",
         "handoff": "Handoff",
+        "ingress": "Alertmanager integration",
         "runtime": "Manager posture",
         "ready": "ready",
         "waiting": "waiting",
@@ -14235,6 +14236,7 @@
       },
       "runtimeFailure": {
         "title": "Wazuh execution chain",
+        "privilegedCapabilityMissing": "The target lacks controlled privilege capability; writes remain stopped until a critical break-glass capability package is completed, then bounded retry may resume",
         "targetUnreachable": "Target trust failed; waiting for this release's bounded retry",
         "timeout": "Check mode timed out; waiting for this release's bounded retry",
         "checkFailed": "Check mode failed; waiting for this release's bounded retry",

apps/web/messages/zh-TW.json

@@ -14226,6 +14226,7 @@
         "source": "來源",
         "packet": "Packet",
         "handoff": "Handoff",
+        "ingress": "Alertmanager 整合",
         "runtime": "Manager posture",
         "ready": "ready",
         "waiting": "waiting",
@@ -14235,6 +14236,7 @@
       },
       "runtimeFailure": {
         "title": "Wazuh 執行鏈",
+        "privilegedCapabilityMissing": "主機端缺少受控提權能力；已停止寫入，需由 critical break-glass 能力包補齊後再進行受控重試",
         "targetUnreachable": "目標連線信任未通過，等待本版受控重試",
         "timeout": "check-mode 逾時，等待本版受控重試",
         "checkFailed": "check-mode 未通過，等待本版受控重試",

apps/web/src/app/[locale]/iwooos/page.tsx

@@ -16266,7 +16266,7 @@ function IwoooSManagerCockpit() {
   const registryComplete = managerRegistryAcceptedCount >= expectedHostScopeCount && expectedHostScopeCount > 0
   const runtimeLocked = runtimeGateCount === 0 && hostWriteAuthorizedCount === 0 && activeResponseAuthorizedCount === 0
   const statusKey = registryComplete && runtimeLocked ? 'registryAcceptedRuntimeClosed' : 'evidenceStillMissing'
-  const runtimeStatus = runtime?.status ?? 'blocked_waiting_owner_evidence_and_runtime_gates'
+  const runtimeStatus = runtime?.status ?? 'degraded_waiting_controlled_evidence_and_runtime_receipts'
   const metrics: IwoooSManagerCockpitMetric[] = [
     {
       key: 'visibility',
@@ -16700,18 +16700,21 @@ function IwoooSSecurityToolClosureBoard() {
   const dispatchEnabled = runtimeSummary?.executor_policy_enabled_count ?? summary.wazuh_controlled_executor_dispatch_enabled_count ?? 0
   const dispatchCandidate = runtimeSummary?.dispatch_candidate_count ?? 0
   const checkModeFailed = runtimeSummary?.check_mode_failed_count ?? 0
-  const runtimeFailureKey = runtimeData?.check_failure_class === 'ansible_target_unreachable'
-    ? 'targetUnreachable'
-    : runtimeData?.check_failure_class === 'ansible_check_mode_timeout'
-      ? 'timeout'
-      : runtimeData?.check_failure_class?.startsWith('ansible_check_mode_returncode_')
-        ? 'checkFailed'
-        : runtimeData?.check_failure_class
-          ? 'unclassified'
-          : null
+  const runtimeFailureKey = runtimeData?.check_failure_class === 'wazuh_privileged_convergence_capability_missing'
+    ? 'privilegedCapabilityMissing'
+    : runtimeData?.check_failure_class === 'ansible_target_unreachable'
+      ? 'targetUnreachable'
+      : runtimeData?.check_failure_class === 'ansible_check_mode_timeout'
+        ? 'timeout'
+        : runtimeData?.check_failure_class?.startsWith('ansible_check_mode_returncode_')
+          ? 'checkFailed'
+          : runtimeData?.check_failure_class
+            ? 'unclassified'
+            : null
   const runwayItems = [
     {
       key: 'source',
+      labelKey: 'source',
       icon: SearchCheck,
       value: primarySameRunRequired > 0 ? `${primarySameRunReady}/${primarySameRunRequired}` : '--',
       tone: primarySameRunReady > 0 ? 'warn' as const : 'locked' as const,
@@ -16719,6 +16722,7 @@ function IwoooSSecurityToolClosureBoard() {
     },
     {
       key: 'packet',
+      labelKey: 'packet',
       icon: FileCheck2,
       value: `${summary.wazuh_incident_response_closure_validator_available_count ?? 0}/1`,
       tone: (summary.wazuh_incident_response_closure_validator_available_count ?? 0) > 0 ? 'warn' as const : 'locked' as const,
@@ -16726,6 +16730,7 @@ function IwoooSSecurityToolClosureBoard() {
     },
     {
       key: 'handoff',
+      labelKey: 'handoff',
       icon: Route,
       value: `${primaryHandoffReady}/1`,
       tone: primaryHandoffReady > 0 ? 'warn' as const : 'locked' as const,
@@ -16733,6 +16738,9 @@ function IwoooSSecurityToolClosureBoard() {
     },
     {
       key: 'runtime',
+      labelKey: runtimeSummary?.selected_catalog_id === 'ansible:wazuh-alertmanager-integration'
+        ? 'ingress'
+        : 'runtime',
       icon: checkModeFailed > 0 ? ShieldAlert : ShieldCheck,
       value: `${runtimePresent}/${runtimeRequired}`,
       tone: runtimeClosed > 0 ? 'steady' as const : runtimePresent > 0 || checkModeFailed > 0 ? 'warn' as const : 'locked' as const,
@@ -16979,7 +16987,7 @@ function IwoooSSecurityToolClosureBoard() {
               >
                 <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', gap: 8 }}>
                   <span style={{ color: '#5f675f', fontSize: 10, fontWeight: 900, ...textWrap }}>
-                    {t(`runway.${item.key}` as never)}
+                    {t(`runway.${item.labelKey}` as never)}
                   </span>
                   <Icon size={15} color={toneColors[item.tone]} />
                 </div>

apps/web/src/lib/api-client.ts

@@ -896,12 +896,14 @@ export interface IwoooSWazuhControlledExecutorRuntimeReadbackResponse {
     same_run_correlation_required: boolean
   }
   summary: {
+    selected_catalog_id: string
     executor_policy_enabled_count: number
     dispatch_candidate_count: number
     check_mode_passed_count: number
     check_mode_failed_count: number
     runtime_execution_performed_count: number
     bounded_posture_execution_passed_count: number
+    bounded_ingress_convergence_passed_count: number
     independent_post_verifier_passed_count: number
     auto_repair_execution_receipt_count: number
     km_writeback_count: number