feat(iwooos): surface Wazuh live route in runtime readback

docs/LOGBOOK.md

@@ -151,6 +151,42 @@
 
 **邊界**：本段只改前端全域 App Shell、Sidebar/Header 與 i18n；沒有改 AI runtime gate、Telegram send、告警路由、主機、Nginx、K8s、secret、DB、workflow 或自動修復授權。
 
+## 2026-06-26｜P0 Wazuh live route 進 Runtime 資安讀回：disabled / empty 不再藏在下方卡片
+
+**背景**：正式站 live readback 顯示 `GET /api/iwooos/wazuh` 與 `GET /api/v1/iwooos/wazuh` 目前皆為 `200 disabled_waiting_iwooos_wazuh_owner_gate`，代表 Wazuh 只讀 live metadata 尚未啟用；這不是 manager registry 恢復、不是 agent 全部納管，也不是 API connection 已修復。為避免 Wazuh 退化只藏在 IwoooS 頁面下方卡片，本段把正式 Wazuh 只讀路由的公開安全 aggregate 結果接進 Runtime 資安讀回總板。
+
+**完成**：
+- 新增 `apps/api/src/services/iwooos_wazuh_readonly_status.py`，把 Wazuh 只讀 metadata 邏輯從 API router 抽成可重用 service；仍只回 aggregate / redacted agent alias，不保存 raw Wazuh payload、不顯示 agent 原名、內網位址、token、password 或 secret。
+- `GET /api/iwooos/wazuh` 與 `GET /api/v1/iwooos/wazuh` 保持相容，改由 service 回傳相同 disabled / misconfigured / unavailable / empty / below expected / available 狀態。
+- `GET /api/v1/iwooos/runtime-security-readback` 新增 `wazuh_live_route` P0 lane 與 `wazuh_live_*` summary：正式路由 HTTP、唯讀查詢啟用數、agent total / active、registry empty、below expected、metadata available 與 degraded count 都會進 Runtime board。
+- `/zh-TW/iwooos` Runtime 資安讀回摘要新增 `Wazuh live`，將 `agent_total / status` 顯示在首屏板；disabled、misconfigured、empty、below expected 或 unavailable 都以警示色呈現，不能被 route 200 蓋過。
+- `scripts/security/wazuh-readonly-route-boundary-guard.py` 已從掃 2 個 route 擴充為掃 3 個 source：Next route、FastAPI route、新 Wazuh service；避免 service 內硬編 Wazuh URL、帳密、關 TLS、raw payload 或假 SOC 文案。
+- `IWOOOS-WAZUH-READONLY-API-RELEASE-HANDOFF.md` 已同步新 service、Runtime lane 與 `route=3` guard 結果。
+
+**本地驗證**：
+- `pytest apps/api/tests/test_iwooos_runtime_security_readback.py apps/api/tests/test_iwooos_wazuh_api.py -q`：`10 passed, 1 warning`。
+- IwoooS / Telegram / operator 關鍵子集：`255 passed, 2 warnings`。
+- `python3 scripts/security/wazuh-readonly-route-boundary-guard.py --root .`：`WAZUH_READONLY_ROUTE_BOUNDARY_GUARD_OK route=3 public_ui_files=1 forbidden=0 runtime_gate=0`。
+- `python3 scripts/security/security-mirror-progress-guard.py --root .`：`SECURITY_MIRROR_PROGRESS_GUARD_OK`。
+- `python3 scripts/security/source-control-owner-response-guard.py --root .`：`SOURCE_CONTROL_OWNER_RESPONSE_GUARD_OK`。
+- `python3 scripts/ops/doc-secrets-sanity-check.py docs/security docs/templates docs/LOGBOOK.md apps/web/messages apps/api/src/api/v1/iwooos.py apps/api/src/services/iwooos_runtime_security_readback.py apps/api/src/services/iwooos_wazuh_readonly_status.py apps/web/src/app/[locale]/iwooos/page.tsx apps/web/src/lib/api-client.ts scripts/security/wazuh-readonly-route-boundary-guard.py`：`DOC_SECRET_SANITY_OK scanned_files=274`。
+- `python3 -m json.tool apps/web/messages/zh-TW.json` / `apps/web/messages/en.json`：通過。
+- `python3 -m py_compile apps/api/src/api/v1/iwooos.py apps/api/src/services/iwooos_runtime_security_readback.py apps/api/src/services/iwooos_wazuh_readonly_status.py scripts/security/wazuh-readonly-route-boundary-guard.py`：通過。
+- `git diff --check`：通過。
+- 本地 FastAPI TestClient smoke：`/api/v1/iwooos/runtime-security-readback` 回 `200`、`p0_lane_count=7`、`wazuh_live_status=disabled_waiting_iwooos_wazuh_owner_gate`、`wazuh_live_route_degraded_count=1`、`wazuh_live_route` lane 存在，且未含 `192.168.0.`、`工作視窗`、`批准！繼續`、`My request for Codex`。
+- `pnpm --dir apps/web typecheck`：本臨時 worktree 缺 `apps/web/node_modules/typescript`，未能本地執行；需以 Gitea CD / production browser readback 補正式驗證。
+
+**完成度同步**：
+- 本階段 source-side 實作：`100%`。
+- Runtime 資安讀回納入 Wazuh live route：`0% -> 100%`。
+- Wazuh live metadata enable：仍 `0%`。
+- Wazuh manager registry accepted：仍 `0`。
+- IwoooS Runtime 資安讀回層：`94% -> 95%`。
+- IwoooS 整體資安推進保守維持：`65%`；不因 route 可見或 lane 接上而提高 runtime acceptance。
+- Runtime acceptance、owner accepted、active response、host write、Kali active scan、Telegram send、secret collection：仍全部 `0 / false`。
+
+**邊界**：本段沒有啟用 Wazuh live metadata env、沒有收集 Wazuh secret、沒有修 dashboard stored API、沒有重新註冊 agent、沒有重啟 Wazuh manager / dashboard、沒有 SSH 主機、沒有改 Nginx / Docker / firewall / K8s、沒有 active response、沒有 Kali scan、沒有 Telegram send、沒有 force push。下一個 P0 仍是 Wazuh live metadata owner gate、server-side secret metadata、readonly account scope、manager health ref、post-enable readback 與 manager registry 全量交叉驗收。
+
 ## 2026-06-26｜IwoooS controlled apply guard 收斂：資安讀回、防退化與正式站驗證完成
 
 **背景**：P2-414B 已把 AwoooP allowlisted low / medium / high 修復路徑改成 `controlled_apply`，但部分資安 guard 與文件仍停在舊的 `runtime_write_gate=0` / `candidate_only` / 高風險人工 Gate 語意，造成 CD guard 與最新產品方向衝突。本段只收斂 source / guard / readback / production verification，不碰主機、Wazuh live、Kali、Nginx、Docker、firewall、secret 或 Telegram send。

docs/security/IWOOOS-WAZUH-READONLY-API-RELEASE-HANDOFF.md

@@ -35,8 +35,11 @@
 變更範圍：
 
 - `apps/api/src/api/v1/iwooos.py`
+- `apps/api/src/services/iwooos_wazuh_readonly_status.py`
+- `apps/api/src/services/iwooos_runtime_security_readback.py`
 - `apps/api/src/main.py`
 - `apps/api/tests/test_iwooos_wazuh_api.py`
+- `apps/api/tests/test_iwooos_runtime_security_readback.py`
 - `scripts/security/wazuh-readonly-route-boundary-guard.py`
 - `scripts/security/wazuh-readonly-production-readback.py`
 - `scripts/security/wazuh-readonly-release-gate.py`
@@ -59,6 +62,8 @@
 
 - 新增 FastAPI `GET /api/iwooos/wazuh`。
 - 新增 FastAPI `GET /api/v1/iwooos/wazuh`。
+- 將 Wazuh 只讀 metadata 邏輯抽成 `iwooos_wazuh_readonly_status.py`，讓正式 route、Runtime 資安讀回與後續告警鏈共用同一份脫敏 aggregate 結果。
+- `GET /api/v1/iwooos/runtime-security-readback` 新增 `wazuh_live_route` P0 lane 與 `wazuh_live_*` summary；正式路由 disabled、misconfigured、registry empty、below expected 或 unavailable 都會在 Runtime board 顯示退化，不再只藏在下方卡片。
 - 預設回 `disabled_waiting_iwooos_wazuh_owner_gate`，避免 production 繼續用 404 表示未啟用。
 - live Wazuh 查詢仍需 `IWOOOS_WAZUH_READONLY_ENABLED=true` 與 server-side env：`WAZUH_API_BASE_URL`、`WAZUH_API_USERNAME`、`WAZUH_API_PASSWORD`。
 - 強制 Wazuh base URL 使用 HTTPS。
@@ -87,8 +92,8 @@ python3 scripts/security/wazuh-readonly-release-owner-request.py --root .
 python3 scripts/security/wazuh-readonly-release-owner-response-acceptance.py --root .
 python3 scripts/security/wazuh-readonly-live-metadata-env-gate.py --root .
 python3 scripts/security/security-mirror-progress-guard.py --root .
-python3 scripts/ops/doc-secrets-sanity-check.py docs apps/api/src/api/v1/iwooos.py apps/web/src/app/api/iwooos/wazuh/route.ts scripts/security/wazuh-readonly-route-boundary-guard.py scripts/security/wazuh-readonly-production-readback.py scripts/security/wazuh-readonly-release-gate.py scripts/security/wazuh-readonly-release-lane-preflight.py scripts/security/wazuh-readonly-release-owner-request.py scripts/security/wazuh-readonly-release-owner-response-acceptance.py scripts/security/wazuh-readonly-live-metadata-env-gate.py
-python3 -m py_compile apps/api/src/api/v1/iwooos.py scripts/security/wazuh-readonly-route-boundary-guard.py scripts/security/wazuh-readonly-production-readback.py scripts/security/wazuh-readonly-release-gate.py scripts/security/wazuh-readonly-release-lane-preflight.py scripts/security/wazuh-readonly-release-owner-request.py scripts/security/wazuh-readonly-release-owner-response-acceptance.py scripts/security/wazuh-readonly-live-metadata-env-gate.py scripts/security/security-mirror-progress-guard.py
+python3 scripts/ops/doc-secrets-sanity-check.py docs apps/api/src/api/v1/iwooos.py apps/api/src/services/iwooos_wazuh_readonly_status.py apps/api/src/services/iwooos_runtime_security_readback.py apps/web/src/app/api/iwooos/wazuh/route.ts scripts/security/wazuh-readonly-route-boundary-guard.py scripts/security/wazuh-readonly-production-readback.py scripts/security/wazuh-readonly-release-gate.py scripts/security/wazuh-readonly-release-lane-preflight.py scripts/security/wazuh-readonly-release-owner-request.py scripts/security/wazuh-readonly-release-owner-response-acceptance.py scripts/security/wazuh-readonly-live-metadata-env-gate.py
+python3 -m py_compile apps/api/src/api/v1/iwooos.py apps/api/src/services/iwooos_wazuh_readonly_status.py apps/api/src/services/iwooos_runtime_security_readback.py scripts/security/wazuh-readonly-route-boundary-guard.py scripts/security/wazuh-readonly-production-readback.py scripts/security/wazuh-readonly-release-gate.py scripts/security/wazuh-readonly-release-lane-preflight.py scripts/security/wazuh-readonly-release-owner-request.py scripts/security/wazuh-readonly-release-owner-response-acceptance.py scripts/security/wazuh-readonly-live-metadata-env-gate.py scripts/security/security-mirror-progress-guard.py
 git diff --check
 node -e "JSON.parse(require('fs').readFileSync('apps/web/messages/zh-TW.json','utf8')); JSON.parse(require('fs').readFileSync('apps/web/messages/en.json','utf8')); console.log('i18n json ok')"
 cmp -s apps/web/messages/zh-TW.json apps/web/messages/en.json
@@ -99,7 +104,7 @@ NEXT_PUBLIC_API_URL=https://awoooi.wooo.work NEXT_PRIVATE_BUILD_WORKER_COUNT=1 S
 驗證結果：
 
 - `pytest apps/api/tests/test_iwooos_wazuh_api.py`：`6 passed`。
-- `wazuh-readonly-route-boundary-guard`：`route=2 public_ui_files=1 forbidden=0 runtime_gate=0`。
+- `wazuh-readonly-route-boundary-guard`：`route=3 public_ui_files=1 forbidden=0 runtime_gate=0`。
 - `wazuh-readonly-release-gate`：`source=1 push=1 main=1 deploy=1 readback=1 runtime_gate=0`。
 - `wazuh-readonly-release-lane-preflight`：`ready=0 acks=0/6 evidence=0/6 runtime_gate=0`。
 - `wazuh-readonly-release-owner-request`：`drafts=1 sent=0 accepted=0 runtime_gate=0`。
@@ -130,7 +135,7 @@ git am /private/tmp/awoooi-iwooos-wazuh-boundary-release-patch-<timestamp>/*.pat
 乾淨套用 worktree 驗證結果：
 
 - `pytest apps/api/tests/test_iwooos_wazuh_api.py`：`6 passed`。
-- `python3 scripts/security/wazuh-readonly-route-boundary-guard.py --root .`：`WAZUH_READONLY_ROUTE_BOUNDARY_GUARD_OK route=2 public_ui_files=1 forbidden=0 runtime_gate=0`。
+- `python3 scripts/security/wazuh-readonly-route-boundary-guard.py --root .`：`WAZUH_READONLY_ROUTE_BOUNDARY_GUARD_OK route=3 public_ui_files=1 forbidden=0 runtime_gate=0`。
 - `python3 scripts/security/wazuh-readonly-release-gate.py --root .`：`WAZUH_READONLY_RELEASE_GATE_OK source=1 push=1 main=1 deploy=1 readback=1 runtime_gate=0`。
 - `python3 scripts/security/wazuh-readonly-release-lane-preflight.py --root .`：`WAZUH_READONLY_RELEASE_LANE_PREFLIGHT_OK ready=0 acks=0/6 evidence=0/6 runtime_gate=0`。
 - `python3 scripts/security/security-mirror-progress-guard.py --root .`：`SECURITY_MIRROR_PROGRESS_GUARD_OK`。