Merge remote-tracking branch 'gitea/main' into codex/delivery-workbench-release-20260626-ffsync

apps/web/src/lib/api-client.ts

@@ -101,6 +101,7 @@ export interface IwoooSRuntimeSecurityReadbackLane {
   lane_id:
     | 'wazuh_registry'
     | 'wazuh_live_route'
+    | 'wazuh_live_metadata_gate'
     | 'wazuh_dashboard_api'
     | 'kali_intake'
     | 'alert_readability'
@@ -141,6 +142,12 @@ export interface IwoooSRuntimeSecurityReadbackResponse {
     wazuh_live_below_expected_count: number
     wazuh_live_metadata_available_count: number
     wazuh_live_status: string
+    wazuh_live_metadata_gate_owner_accepted_count: number
+    wazuh_live_metadata_gate_secret_source_accepted_count: number
+    wazuh_live_metadata_gate_manager_health_accepted_count: number
+    wazuh_live_metadata_gate_readonly_scope_accepted_count: number
+    wazuh_live_metadata_gate_post_enable_readback_count: number
+    wazuh_live_metadata_gate_live_query_authorized_count: number
     kali_active_scan_authorized_count: number
     kali_execute_authorized_count: number
     kali_finding_envelope_accepted_count: number
@@ -154,6 +161,55 @@ export interface IwoooSRuntimeSecurityReadbackResponse {
   no_false_green_rules: string[]
 }
 
+export interface IwoooSWazuhLiveMetadataGateItem {
+  item_id:
+    | 'release_readback'
+    | 'server_env_owner'
+    | 'secret_metadata'
+    | 'manager_health'
+    | 'readonly_scope'
+    | 'post_enable_readback'
+  check: string
+  state_key: string
+  tone: IwoooSRuntimeSecurityReadbackTone
+  metrics: Record<string, number>
+}
+
+export interface IwoooSWazuhLiveMetadataGateResponse {
+  schema_version: 'iwooos_wazuh_live_metadata_gate_readback_v1'
+  status: string
+  mode: string
+  source_refs: string[]
+  summary: {
+    server_side_env_key_count: number
+    required_owner_field_count: number
+    reviewer_check_count: number
+    outcome_lane_count: number
+    blocked_action_count: number
+    production_route_readback_passed_count: number
+    live_metadata_owner_response_received_count: number
+    live_metadata_owner_response_accepted_count: number
+    secret_source_metadata_accepted_count: number
+    wazuh_manager_health_ref_accepted_count: number
+    readonly_account_scope_accepted_count: number
+    post_enable_readback_passed_count: number
+    wazuh_api_live_query_authorized_count: number
+    wazuh_active_response_authorized_count: number
+    host_write_authorized_count: number
+    runtime_gate_count: number
+    wazuh_live_route_http_status: number
+    wazuh_live_route_degraded_count: number
+    wazuh_live_readonly_api_enabled_count: number
+    wazuh_live_agent_total: number
+    wazuh_live_metadata_available_count: number
+    wazuh_live_status: string
+  }
+  items: IwoooSWazuhLiveMetadataGateItem[]
+  boundary_markers: string[]
+  boundaries: Record<string, boolean>
+  no_false_green_rules: string[]
+}
+
 export interface IwoooSSecurityControlCoverageDomain {
   domain_id:
     | 'high_value_asset_control'
@@ -259,6 +315,11 @@ export const apiClient = {
     return handleResponse<IwoooSRuntimeSecurityReadbackResponse>(res)
   },
 
+  async getIwoooSWazuhLiveMetadataGate() {
+    const res = await fetch(`${API_BASE_URL}/iwooos/wazuh-live-metadata-gate`, { cache: 'no-store' })
+    return handleResponse<IwoooSWazuhLiveMetadataGateResponse>(res)
+  },
+
   async getIwoooSSecurityControlCoverage() {
     const res = await fetch(`${API_BASE_URL}/iwooos/security-control-coverage`, { cache: 'no-store' })
     return handleResponse<IwoooSSecurityControlCoverageResponse>(res)