feat(iwooos): add wazuh controlled apply preflight

apps/web/messages/en.json

@@ -20429,8 +20429,8 @@
     },
     "runtimeSecurityReadback": {
       "eyebrow": "IwoooS Runtime 資安讀回",
-      "title": "九條 P0 資安線先接到同一張讀回板",
-      "subtitle": "這張板讀取後端彙整的只讀快照，並附上 Wazuh 正式只讀路由的公開安全彙總讀回；它不保存原始 Wazuh 載荷、不啟動掃描、不送訊息、不改主機。",
+      "title": "十條 P0 資安線先接到同一張讀回板",
+      "subtitle": "這張板讀取後端彙整的只讀快照，並附上 Wazuh 正式只讀路由與 controlled apply preflight 的公開安全彙總讀回；它不保存原始 Wazuh 載荷、不啟動掃描、不送訊息、不改主機。",
       "statusLabel": "讀回狀態",
       "statusDetail": "讀回成功只代表 IwoooS 能看見目前的證據邊界；runtime 寫入、主動回應、掃描、重啟、Nginx reload、workflow 修改與機密操作仍全部關閉。",
       "laneStatusLabel": "目前狀態",
@@ -20448,6 +20448,7 @@
         "wazuh_live_route": "正式只讀路由已關閉，等待 IwoooS Wazuh 負責人閘門",
         "wazuh_live_metadata_gate": "等待即時中繼資料負責人回覆",
         "wazuh_owner_evidence_preflight": "負責人證據預檢已就緒，尚未授權執行期動作",
+        "wazuh_runtime_controlled_apply_preflight": "受控執行預檢已就緒，執行期閘門仍關閉",
         "wazuh_dashboard_api": "API 連線退化，禁止顯示綠燈",
         "kali_intake": "部分執行期健康已整合，仍待完整驗收",
         "alert_readability": "格式合約已就緒，尚未有實發收件證據",
@@ -20476,6 +20477,10 @@
           "label": "中繼資料閘門",
           "detail": "即時中繼資料查詢仍需負責人、機密中繼資料、唯讀範圍與啟用後讀回。"
         },
+        "controlledApplyPreflight": {
+          "label": "受控預檢",
+          "detail": "target selector、diff、check-mode、rollback、verifier 與 writeback 已可審查；runtime 仍為 0。"
+        },
         "ownerAccepted": {
           "label": "負責人驗收",
           "detail": "收到 / 接受都必須由正式 owner response 證明。"
@@ -20506,6 +20511,10 @@
           "title": "Wazuh 負責人證據預檢",
           "body": "把 manager registry 脫敏封包、逐主機矩陣、Dashboard API 狀態、拒收敏感類型與負責人決策先變成可驗收格式；收件、接受與執行期仍為 0。"
         },
+        "wazuh_runtime_controlled_apply_preflight": {
+          "title": "Wazuh 受控執行預檢",
+          "body": "target selector、source-of-truth diff、check-mode / dry-run、rollback、post-apply verifier 與 KM / PlayBook writeback 已成為可審查 packet；它仍不查 live Wazuh、不開 active response、不寫主機。"
+        },
         "wazuh_dashboard_api": {
           "title": "Wazuh Dashboard API",
           "body": "API connection / API version 還要補 readback；index pattern 通過不能宣稱 Wazuh 全綠。"

apps/web/messages/zh-TW.json

@@ -20429,8 +20429,8 @@
     },
     "runtimeSecurityReadback": {
       "eyebrow": "IwoooS Runtime 資安讀回",
-      "title": "九條 P0 資安線先接到同一張讀回板",
-      "subtitle": "這張板讀取後端彙整的只讀快照，並附上 Wazuh 正式只讀路由的公開安全彙總讀回；它不保存原始 Wazuh 載荷、不啟動掃描、不送訊息、不改主機。",
+      "title": "十條 P0 資安線先接到同一張讀回板",
+      "subtitle": "這張板讀取後端彙整的只讀快照，並附上 Wazuh 正式只讀路由與 controlled apply preflight 的公開安全彙總讀回；它不保存原始 Wazuh 載荷、不啟動掃描、不送訊息、不改主機。",
       "statusLabel": "讀回狀態",
       "statusDetail": "讀回成功只代表 IwoooS 能看見目前的證據邊界；runtime 寫入、主動回應、掃描、重啟、Nginx reload、workflow 修改與機密操作仍全部關閉。",
       "laneStatusLabel": "目前狀態",
@@ -20448,6 +20448,7 @@
         "wazuh_live_route": "正式只讀路由已關閉，等待 IwoooS Wazuh 負責人閘門",
         "wazuh_live_metadata_gate": "等待即時中繼資料負責人回覆",
         "wazuh_owner_evidence_preflight": "負責人證據預檢已就緒，尚未授權執行期動作",
+        "wazuh_runtime_controlled_apply_preflight": "受控執行預檢已就緒，執行期閘門仍關閉",
         "wazuh_dashboard_api": "API 連線退化，禁止顯示綠燈",
         "kali_intake": "部分執行期健康已整合，仍待完整驗收",
         "alert_readability": "格式合約已就緒，尚未有實發收件證據",
@@ -20476,6 +20477,10 @@
           "label": "中繼資料閘門",
           "detail": "即時中繼資料查詢仍需負責人、機密中繼資料、唯讀範圍與啟用後讀回。"
         },
+        "controlledApplyPreflight": {
+          "label": "受控預檢",
+          "detail": "target selector、diff、check-mode、rollback、verifier 與 writeback 已可審查；runtime 仍為 0。"
+        },
         "ownerAccepted": {
           "label": "負責人驗收",
           "detail": "收到 / 接受都必須由正式 owner response 證明。"
@@ -20506,6 +20511,10 @@
           "title": "Wazuh 負責人證據預檢",
           "body": "把 manager registry 脫敏封包、逐主機矩陣、Dashboard API 狀態、拒收敏感類型與負責人決策先變成可驗收格式；收件、接受與執行期仍為 0。"
         },
+        "wazuh_runtime_controlled_apply_preflight": {
+          "title": "Wazuh 受控執行預檢",
+          "body": "target selector、source-of-truth diff、check-mode / dry-run、rollback、post-apply verifier 與 KM / PlayBook writeback 已成為可審查 packet；它仍不查 live Wazuh、不開 active response、不寫主機。"
+        },
         "wazuh_dashboard_api": {
           "title": "Wazuh Dashboard API",
           "body": "API connection / API version 還要補 readback；index pattern 通過不能宣稱 Wazuh 全綠。"

apps/web/src/app/[locale]/iwooos/page.tsx

@@ -346,6 +346,7 @@ type RuntimeSecurityReadbackSummaryItem = {
     | 'wazuhRegistry'
     | 'wazuhLive'
     | 'metadataGate'
+    | 'controlledApplyPreflight'
     | 'ownerAccepted'
     | 'kaliRuntime'
     | 'runtimeGate'
@@ -8242,6 +8243,7 @@ const runtimeSecurityLaneStatusKeys = new Set<IwoooSRuntimeSecurityReadbackRespo
   'wazuh_live_route',
   'wazuh_live_metadata_gate',
   'wazuh_owner_evidence_preflight',
+  'wazuh_runtime_controlled_apply_preflight',
   'wazuh_dashboard_api',
   'kali_intake',
   'alert_readability',
@@ -8319,6 +8321,12 @@ function IwoooSRuntimeSecurityReadbackBoard() {
       icon: ClipboardCheck,
       tone: 'locked',
     },
+    {
+      key: 'controlledApplyPreflight',
+      value: summary ? String(summary.wazuh_runtime_apply_preflight_ready_count) : '...',
+      icon: ListChecks,
+      tone: summary && summary.wazuh_runtime_apply_preflight_ready_count > 0 ? 'steady' : 'locked',
+    },
     {
       key: 'ownerAccepted',
       value: summary ? `${summary.owner_response_accepted_count}/${summary.owner_response_received_count}` : '...',

apps/web/src/lib/api-client.ts

@@ -103,6 +103,7 @@ export interface IwoooSRuntimeSecurityReadbackLane {
     | 'wazuh_live_route'
     | 'wazuh_live_metadata_gate'
     | 'wazuh_owner_evidence_preflight'
+    | 'wazuh_runtime_controlled_apply_preflight'
     | 'wazuh_dashboard_api'
     | 'kali_intake'
     | 'alert_readability'
@@ -159,6 +160,16 @@ export interface IwoooSRuntimeSecurityReadbackResponse {
     wazuh_owner_evidence_received_count: number
     wazuh_owner_evidence_accepted_count: number
     wazuh_owner_evidence_runtime_gate_count: number
+    wazuh_runtime_apply_preflight_ready_count: number
+    wazuh_runtime_apply_target_selector_count: number
+    wazuh_runtime_apply_source_diff_count: number
+    wazuh_runtime_apply_check_mode_plan_count: number
+    wazuh_runtime_apply_dry_run_required_count: number
+    wazuh_runtime_apply_rollback_plan_count: number
+    wazuh_runtime_apply_post_apply_verifier_count: number
+    wazuh_runtime_apply_km_writeback_count: number
+    wazuh_runtime_apply_owner_review_ready_count: number
+    wazuh_runtime_apply_runtime_gate_count: number
     kali_active_scan_authorized_count: number
     kali_execute_authorized_count: number
     kali_finding_envelope_accepted_count: number
@@ -268,6 +279,69 @@ export interface IwoooSWazuhOwnerEvidencePreflightResponse {
   no_false_green_rules: string[]
 }
 
+export interface IwoooSWazuhRuntimeControlledApplyPreflightItem {
+  item_id:
+    | 'target_selector'
+    | 'source_of_truth_diff'
+    | 'check_mode_dry_run'
+    | 'rollback'
+    | 'post_apply_verifier'
+    | 'learning_writeback'
+  title: string
+  state_key: string
+  ready: boolean
+  required_fields: string[]
+  next_gate: string
+}
+
+export interface IwoooSWazuhRuntimeControlledApplyPreflightResponse {
+  schema_version: 'iwooos_wazuh_runtime_controlled_apply_preflight_readback_v1'
+  source_schema_version: 'wazuh_runtime_controlled_apply_preflight_v1'
+  status: string
+  mode: string
+  source_refs: string[]
+  controlled_apply_packet_validation_endpoint: string
+  controlled_apply_packet_validation_mode: string
+  summary: {
+    expected_scope_alias_count: number
+    target_selector_count: number
+    source_of_truth_diff_count: number
+    check_mode_plan_count: number
+    dry_run_required_count: number
+    rollback_plan_count: number
+    post_apply_verifier_count: number
+    km_playbook_writeback_count: number
+    maintenance_window_required_count: number
+    owner_review_ready_count: number
+    controlled_apply_preflight_ready_count: number
+    controlled_apply_packet_received_count: number
+    controlled_apply_packet_accepted_count: number
+    controlled_apply_packet_quarantined_count: number
+    controlled_apply_runtime_action_rejected_count: number
+    forbidden_payload_count: number
+    forbidden_action_count: number
+    runtime_gate_count: number
+    wazuh_api_live_query_authorized_count: number
+    wazuh_active_response_authorized_count: number
+    host_write_authorized_count: number
+    secret_value_collection_allowed_count: number
+  }
+  target_selectors: Array<{
+    node_alias: string
+    scope: string
+    selector_kind: string
+    runtime_write_allowed: boolean
+  }>
+  required_packet_fields: string[]
+  preflight_items: IwoooSWazuhRuntimeControlledApplyPreflightItem[]
+  outcome_lanes: string[]
+  forbidden_payloads: string[]
+  forbidden_actions: string[]
+  boundary_markers: string[]
+  boundaries: Record<string, boolean>
+  no_false_green_rules: string[]
+}
+
 export interface IwoooSWazuhManagedHostCoverageHost {
   node_id: string
   role: string
@@ -621,6 +695,11 @@ export const apiClient = {
     return handleResponse<IwoooSWazuhOwnerEvidencePreflightResponse>(res)
   },
 
+  async getIwoooSWazuhRuntimeControlledApplyPreflight() {
+    const res = await fetch(`${API_BASE_URL}/iwooos/wazuh-runtime-controlled-apply-preflight`, { cache: 'no-store' })
+    return handleResponse<IwoooSWazuhRuntimeControlledApplyPreflightResponse>(res)
+  },
+
   async getIwoooSWazuhManagedHostCoverage() {
     const res = await fetch(`${API_BASE_URL}/iwooos/wazuh-managed-host-coverage`, { cache: 'no-store' })
     return handleResponse<IwoooSWazuhManagedHostCoverageResponse>(res)