fix(iwooos): keep security coverage and alert gates closed

apps/api/src/services/iwooos_security_control_coverage.py

@@ -53,7 +53,7 @@ def load_latest_iwooos_security_control_coverage(
 
     return {
         "schema_version": _SCHEMA_VERSION,
-        "status": "committed_scope_rollup_ready_runtime_control_blocked",
+        "status": "committed_scope_rollup_ready_runtime_control_closed",
         "mode": "committed_snapshot_rollup_only_no_live_runtime_query",
         "summary": summary,
         "domains": domains,

apps/api/src/services/telegram_gateway.py

@@ -481,7 +481,7 @@ def format_aiops_signal_alert_card(text: str) -> str:
             "",
             "<b>AI 自動化判讀</b>",
             f"├ Lane：<code>{html.escape(spec.lane)}</code>",
-            "├ Gate：<code>controlled_playbook_queue</code> / <code>runtime_write_gate=controlled</code>",
+            "├ Gate：<code>controlled_playbook_queue</code> / <code>runtime_write_gate=0</code>",
             f"└ 下一步：{html.escape(spec.next_step)}",
             "",
             "<b>Top evidence</b>",
@@ -745,7 +745,7 @@ def format_host_resource_alert_card(text: str) -> str:
             "",
             "<b>AI 自動化判讀</b>",
             f"├ Lane：<code>{html.escape(automation_lane)}</code>",
-            "├ Gate：<code>controlled_playbook_queue</code> / <code>runtime_write_gate=controlled</code>",
+            "├ Gate：<code>controlled_playbook_queue</code> / <code>runtime_write_gate=0</code>",
             f"└ 下一步：{html.escape(automation_next_step)}",
             "",
             "<b>Top evidence</b>",
@@ -2245,8 +2245,6 @@ def _ai_automation_alert_card_metadata(text: str) -> dict[str, object] | None:
         gates.append("controlled_playbook_queue")
     if "runtime_write_gate=0" in text:
         gates.append("runtime_write_gate=0")
-    if "runtime_write_gate=controlled" in text:
-        gates.append("runtime_write_gate=controlled")
 
     metadata: dict[str, object] = {
         "schema_version": "ai_automation_alert_card_mirror_v1",
@@ -2257,11 +2255,9 @@ def _ai_automation_alert_card_metadata(text: str) -> dict[str, object] | None:
         "gates": gates,
         "candidate_only": "candidate_only" in gates,
         "controlled_playbook_queue": "controlled_playbook_queue" in gates,
-        "runtime_write_gate_count": gates.count("runtime_write_gate=controlled"),
+        "runtime_write_gate_count": 0,
         "runtime_write_gate_state": (
-            "controlled"
-            if "runtime_write_gate=controlled" in gates
-            else "closed"
+            "closed"
             if "runtime_write_gate=0" in gates
             else "unknown"
         ),

apps/api/tests/test_iwooos_security_control_coverage.py

@@ -19,7 +19,7 @@ def test_iwooos_security_control_coverage_rolls_up_core_scopes() -> None:
     payload = load_latest_iwooos_security_control_coverage()
 
     assert payload["schema_version"] == "iwooos_security_control_coverage_v1"
-    assert payload["status"] == "committed_scope_rollup_ready_runtime_control_blocked"
+    assert payload["status"] == "committed_scope_rollup_ready_runtime_control_closed"
     assert payload["summary"]["source_snapshot_count"] == 8
     assert payload["summary"]["control_domain_count"] == 8
     assert payload["summary"]["visible_scope_unit_count"] == 160
@@ -76,5 +76,6 @@ def test_iwooos_security_control_coverage_api_is_public_safe() -> None:
     assert data["summary"]["visible_scope_unit_count"] == 160
     assert any(action["priority"] == "P0-01" for action in data["p0_next_actions"])
     assert "192.168.0." not in response.text
+    assert "runtime_control_blocked" not in response.text
     assert "工作視窗" not in response.text
     assert "批准！繼續" not in response.text

apps/api/tests/test_telegram_gateway_error_sanitizer.py

@@ -166,11 +166,11 @@ full_log=/var/ossec/logs/alerts/alerts.json Authorization: Bearer abcdefghijklmn
     assert card_metadata["target"] == "wazuh_dashboard_api"
     assert card_metadata["gates"] == [
         "controlled_playbook_queue",
-        "runtime_write_gate=controlled",
+        "runtime_write_gate=0",
     ]
     assert card_metadata["controlled_playbook_queue"] is True
-    assert card_metadata["runtime_write_gate_state"] == "controlled"
-    assert card_metadata["runtime_write_gate_count"] == 1
+    assert card_metadata["runtime_write_gate_state"] == "closed"
+    assert card_metadata["runtime_write_gate_count"] == 0
     assert card_metadata["delivery_receipt_readback_required"] is True
     assert envelope["source_refs"]["alert_ids"] == [
         "wazuh_dashboard_api_readback_degraded"

apps/api/tests/test_telegram_message_templates.py

@@ -80,7 +80,7 @@ root         364  181  0.7 3491396 494608 ?      Rl   05:56   0:18 /opt/hostedto
     assert "AI 自動化判讀" in result
     assert "runner_build_resource_pressure" in result
     assert "controlled_playbook_queue" in result
-    assert "runtime_write_gate=controlled" in result
+    assert "runtime_write_gate=0" in result
     assert "Top evidence" in result
     assert "PID 259" in result
     assert "Next.js build" in result
@@ -113,7 +113,7 @@ def test_orphan_browser_alert_becomes_runaway_process_event_packet() -> None:
     assert "check-mode" in result
     assert "受控 SIGTERM" in result
     assert "KM / PlayBook / Verifier" in result
-    assert "runtime_write_gate=controlled" in result
+    assert "runtime_write_gate=0" in result
     assert "allowlisted PlayBook" in result
     assert "受控 apply" in result
 
@@ -133,7 +133,7 @@ def test_ci_runner_load_alert_becomes_capacity_event_packet() -> None:
     assert "Gitea Actions run" in result
     assert "合法 CI" in result
     assert "不做 process remediation" in result
-    assert "runtime_write_gate=controlled" in result
+    assert "runtime_write_gate=0" in result
     assert "受控 cleanup" in result
 
 
@@ -153,7 +153,7 @@ syscheck integrity changed on /etc/nginx/sites-enabled/awoooi.conf
     assert "wazuh_intrusion_signal" in result
     assert "security_intrusion_triage" in result
     assert "controlled_playbook_queue" in result
-    assert "runtime_write_gate=controlled" in result
+    assert "runtime_write_gate=0" in result
     assert "Top evidence" in result
     assert "Timeline / KM / PlayBook" in result
     assert "不封鎖 IP" in result
@@ -180,7 +180,7 @@ full_log=/var/ossec/logs/alerts/alerts.json Authorization: Bearer abcdefghijklmn
     assert "wazuh_dashboard_api_readback_degraded" in result
     assert "siem_observability_readback_degraded" in result
     assert "controlled_playbook_queue" in result
-    assert "runtime_write_gate=controlled" in result
+    assert "runtime_write_gate=0" in result
     assert "manager registry 只讀計數" in result
     assert "no-false-green" in result
     assert "不重啟 Wazuh" in result
@@ -204,7 +204,7 @@ diff_url=https://internal.example.invalid/raw/live.conf
     assert "nginx_config_drift" in result
     assert "public_gateway_config_drift" in result
     assert "redacted live export" in result
-    assert "runtime_write_gate=controlled" in result
+    assert "runtime_write_gate=0" in result
     assert "不執行 nginx -t" in result
     assert "不 reload" in result
     assert "/etc/nginx" not in result
@@ -269,7 +269,7 @@ def test_aiops_signal_formatter_covers_non_host_alert_lanes(
     assert event_type in result
     assert lane in result
     assert "controlled_playbook_queue" in result
-    assert "runtime_write_gate=controlled" in result
+    assert "runtime_write_gate=0" in result
     assert "Top evidence" in result
     assert "禁止事項" in result
 
@@ -331,7 +331,7 @@ async def test_send_alert_notification_normalizes_aiops_signal_alert(monkeypatch
     assert payload["parse_mode"] == "HTML"
     assert "ai_automation_alert_card_v1" in payload["text"]
     assert "public_gateway_config_drift" in payload["text"]
-    assert "runtime_write_gate=controlled" in payload["text"]
+    assert "runtime_write_gate=0" in payload["text"]
     assert "/etc/nginx" not in payload["text"]
 
 
@@ -352,7 +352,7 @@ root         392  0.0  0.0 1096836 53400 ?       Ssl  06:27   0:00 /opt/hostedto
     assert "Prisma generate" in result
     assert "容器 root 進程：<code>3</code>" in result
     assert "套件來源" in result
-    assert "runtime_write_gate=controlled" in result
+    assert "runtime_write_gate=0" in result
     assert "root         365" not in result
     assert "checkpoint.prisma.io" not in result
     assert "node_modules" not in result
@@ -442,7 +442,7 @@ def test_send_request_payload_normalizer_blocks_direct_host_raw_dump() -> None:
     assert result["parse_mode"] == "HTML"
     assert "P1 主機資源壓力｜h110-gitea" in result["text"]
     assert "ai_automation_alert_card_v1" in result["text"]
-    assert "runtime_write_gate=controlled" in result["text"]
+    assert "runtime_write_gate=0" in result["text"]
     assert "root         311" not in result["text"]
     assert "checkpoint.prisma.io" not in result["text"]
     assert "/workspace/wooo" not in result["text"]

docs/LOGBOOK.md

@@ -7,9 +7,11 @@
 - 新增 `GET /api/v1/iwooos/security-control-coverage`；端點只讀 repo snapshot，不查 live host、不讀 secret、不連 Wazuh / Kali、不 SSH、不啟動掃描、不送 Telegram、不開 runtime gate。
 - 前台 `/zh-TW/iwooos` 新增 `IwoooS 資安納管覆蓋總表`，顯示 `visible_scope_unit_count=160`、`control_domain_count=8`、控制面可視 `71%`、runtime acceptance `0%`、owner accepted `0`、Wazuh manager registry accepted `0`。
 - 納管域包含：高價值資產與配置總帳、主機服務 / Docker / systemd、監控 / 告警 / 可觀測性、SSH / Firewall / WireGuard / NodePort / NetworkPolicy、AWOOOI runtime surfaces、Wazuh 主機納管、agent-bounty-protocol、AI Agent / Provider / 自動化資產。
+- 併同修復 `e7c368aa` 帶出的 Telegram 卡片 gate 語意：AI 事件卡仍可標 `controlled_playbook_queue`，但 runtime 寫入閘門必須明確顯示 `runtime_write_gate=0`，AwoooP mirror metadata 也固定為 `runtime_write_gate_state=closed`、`runtime_write_gate_count=0`，避免告警卡讓人誤判受控寫入已開門。
 
 **只讀驗證結果**：
 - `pytest apps/api/tests/test_iwooos_security_control_coverage.py apps/api/tests/test_iwooos_runtime_security_readback.py apps/api/tests/test_iwooos_wazuh_api.py -q`：`12 passed`。
+- `pytest apps/api/tests/test_iwooos_security_control_coverage.py apps/api/tests/test_iwooos_runtime_security_readback.py apps/api/tests/test_iwooos_wazuh_api.py apps/api/tests/test_auto_repair_service.py apps/api/tests/test_awooop_operator_timeline_labels.py apps/api/tests/test_awooop_truth_chain_service.py apps/api/tests/test_operator_outcome.py apps/api/tests/test_telegram_gateway_error_sanitizer.py apps/api/tests/test_telegram_message_templates.py -q`：`254 passed`。
 - `pnpm --dir apps/web typecheck`：通過。
 - `python3 -m json.tool apps/web/messages/zh-TW.json` / `apps/web/messages/en.json`：通過。
 - `python3.11 -m py_compile apps/api/src/api/v1/iwooos.py apps/api/src/services/iwooos_security_control_coverage.py apps/api/src/services/iwooos_runtime_security_readback.py apps/api/src/services/snapshot_paths.py`：通過。