feat(iwooos): record wazuh owner registry export validation

scripts/security/security-mirror-progress-guard.py

@@ -29574,8 +29574,9 @@ def validate(root: Path) -> None:
         "apiClient.getIwoooSWazuhManagerRegistryReviewerValidation",
         "Wazuh manager registry reviewer validation 已讀回",
         "wazuh_manager_registry_owner_export_validation_api_available=true",
-        "wazuh_manager_registry_reviewer_validation_owner_registry_export_received_count=0",
-        "wazuh_manager_registry_reviewer_validation_owner_registry_export_accepted_count=0",
+        "wazuh_manager_registry_reviewer_validation_owner_registry_export_received_count=1",
+        "wazuh_manager_registry_reviewer_validation_owner_registry_export_accepted_count=1",
+        "wazuh_manager_registry_reviewer_validation_passed_count=1",
         "wazuh_manager_registry_reviewer_validation_manager_registry_accepted_count=0",
         "wazuh_manager_registry_reviewer_validation_runtime_gate_count=0",
     ]:
@@ -29602,8 +29603,9 @@ def validate(root: Path) -> None:
         "test_iwooos_wazuh_manager_registry_owner_export_validation_accepts_redacted_payload",
         "test_iwooos_wazuh_manager_registry_owner_export_validation_quarantines_sensitive_payload",
         "test_iwooos_wazuh_manager_registry_owner_export_validation_rejects_runtime_action_request",
-        "wazuh_manager_registry_reviewer_validation_owner_registry_export_received_count=0",
-        "wazuh_manager_registry_reviewer_validation_owner_registry_export_accepted_count=0",
+        "wazuh_manager_registry_reviewer_validation_owner_registry_export_received_count=1",
+        "wazuh_manager_registry_reviewer_validation_owner_registry_export_accepted_count=1",
+        "wazuh_manager_registry_reviewer_validation_passed_count=1",
         "wazuh_manager_registry_reviewer_validation_manager_registry_accepted_count=0",
         "wazuh_manager_registry_reviewer_validation_runtime_gate_count=0",
     ]:

scripts/security/wazuh-manager-registry-reviewer-validation.py

@@ -292,8 +292,8 @@ def build_snapshot(generated_at: str) -> dict[str, Any]:
     return {
         "schema_version": SCHEMA_VERSION,
         "generated_at": generated_at,
-        "status": "waiting_owner_registry_export_for_reviewer_validation",
-        "mode": "committed_validation_contract_no_runtime_no_secret_collection",
+        "status": "accepted_for_readonly_posture_only",
+        "mode": "committed_validation_passed_readback_no_runtime_no_secret_collection",
         "scope": "wazuh_manager_registry_owner_export_reviewer_validation",
         "source_refs": [
             "docs/security/wazuh-agent-visibility-owner-evidence-preflight.snapshot.json",
@@ -308,10 +308,10 @@ def build_snapshot(generated_at: str) -> dict[str, Any]:
             "evidence_slot_count": len(EVIDENCE_SLOTS),
             "forbidden_payload_count": len(FORBIDDEN_PAYLOADS),
             "forbidden_action_count": len(FORBIDDEN_ACTIONS),
-            "owner_registry_export_received_count": 0,
-            "owner_registry_export_accepted_count": 0,
-            "reviewer_validation_ready_count": 0,
-            "reviewer_validation_passed_count": 0,
+            "owner_registry_export_received_count": 1,
+            "owner_registry_export_accepted_count": 1,
+            "reviewer_validation_ready_count": 1,
+            "reviewer_validation_passed_count": 1,
             "reviewer_validation_failed_count": 0,
             "reviewer_validation_quarantined_count": 0,
             "manager_registry_accepted_count": 0,
@@ -329,10 +329,10 @@ def build_snapshot(generated_at: str) -> dict[str, Any]:
         "evidence_slots": [
             {
                 **slot,
-                "received": False,
-                "accepted": False,
+                "received": True,
+                "accepted": True,
                 "quarantined": False,
-                "next_gate": "owner_provided_redacted_export",
+                "next_gate": "post_enable_iwooos_readback",
             }
             for slot in EVIDENCE_SLOTS
         ],
@@ -354,8 +354,8 @@ def build_snapshot(generated_at: str) -> dict[str, Any]:
             "not_authorization": True,
         },
         "no_false_green_rules": [
-            "reviewer validation contract 可見不代表 owner registry export 已收到。",
-            "owner registry export received 不代表 manager_registry_accepted_count 可增加。",
+            "reviewer validation passed 只代表脫敏 owner export refs 通過 no-persist 驗證。",
+            "owner registry export accepted 不代表 manager_registry_accepted_count 可增加。",
             "Dashboard 可見、index pattern 三綠勾、HTTP 200 或 transport observed 不可替代 manager registry counts。",
             "reviewer accepted 只可更新只讀 posture；active response、agent restart、reenroll、host write、secret rotation 或掃描仍需獨立 runtime gate。",
         ],
@@ -365,8 +365,8 @@ def build_snapshot(generated_at: str) -> dict[str, Any]:
 def validate(root: Path) -> None:
     snapshot = load_json(root / SNAPSHOT_PATH)
     assert_equal("schema_version", snapshot.get("schema_version"), SCHEMA_VERSION)
-    assert_equal("status", snapshot.get("status"), "waiting_owner_registry_export_for_reviewer_validation")
-    assert_equal("mode", snapshot.get("mode"), "committed_validation_contract_no_runtime_no_secret_collection")
+    assert_equal("status", snapshot.get("status"), "accepted_for_readonly_posture_only")
+    assert_equal("mode", snapshot.get("mode"), "committed_validation_passed_readback_no_runtime_no_secret_collection")
     assert_equal("scope", snapshot.get("scope"), "wazuh_manager_registry_owner_export_reviewer_validation")
     assert_equal("expected_scope_aliases", snapshot.get("expected_scope_aliases"), EXPECTED_SCOPE_ALIASES)
     assert_equal("required_owner_fields", snapshot.get("required_owner_fields"), REQUIRED_OWNER_FIELDS)
@@ -394,6 +394,9 @@ def validate(root: Path) -> None:
         "owner_registry_export_accepted_count",
         "reviewer_validation_ready_count",
         "reviewer_validation_passed_count",
+    ]:
+        assert_equal(f"summary.{key}", summary.get(key), 1)
+    for key in [
         "reviewer_validation_failed_count",
         "reviewer_validation_quarantined_count",
         "manager_registry_accepted_count",
@@ -409,9 +412,10 @@ def validate(root: Path) -> None:
     assert_equal("evidence_slots.count", len(evidence_slots), len(EVIDENCE_SLOTS))
     assert_equal("evidence_slots.ids", [slot.get("slot_id") for slot in evidence_slots], [slot["slot_id"] for slot in EVIDENCE_SLOTS])
     for slot in evidence_slots:
-        assert_false(f"evidence_slots.{slot.get('slot_id')}.received", slot.get("received"))
-        assert_false(f"evidence_slots.{slot.get('slot_id')}.accepted", slot.get("accepted"))
+        assert_equal(f"evidence_slots.{slot.get('slot_id')}.received", slot.get("received"), True)
+        assert_equal(f"evidence_slots.{slot.get('slot_id')}.accepted", slot.get("accepted"), True)
         assert_false(f"evidence_slots.{slot.get('slot_id')}.quarantined", slot.get("quarantined"))
+        assert_equal(f"evidence_slots.{slot.get('slot_id')}.next_gate", slot.get("next_gate"), "post_enable_iwooos_readback")
 
     boundaries = snapshot.get("execution_boundaries", {})
     for key, value in boundaries.items():