feat(iwooos): add wazuh controlled apply preflight

apps/web/src/app/[locale]/iwooos/page.tsx

@@ -346,6 +346,7 @@ type RuntimeSecurityReadbackSummaryItem = {
     | 'wazuhRegistry'
     | 'wazuhLive'
     | 'metadataGate'
+    | 'controlledApplyPreflight'
     | 'ownerAccepted'
     | 'kaliRuntime'
     | 'runtimeGate'
@@ -8242,6 +8243,7 @@ const runtimeSecurityLaneStatusKeys = new Set<IwoooSRuntimeSecurityReadbackRespo
   'wazuh_live_route',
   'wazuh_live_metadata_gate',
   'wazuh_owner_evidence_preflight',
+  'wazuh_runtime_controlled_apply_preflight',
   'wazuh_dashboard_api',
   'kali_intake',
   'alert_readability',
@@ -8319,6 +8321,12 @@ function IwoooSRuntimeSecurityReadbackBoard() {
       icon: ClipboardCheck,
       tone: 'locked',
     },
+    {
+      key: 'controlledApplyPreflight',
+      value: summary ? String(summary.wazuh_runtime_apply_preflight_ready_count) : '...',
+      icon: ListChecks,
+      tone: summary && summary.wazuh_runtime_apply_preflight_ready_count > 0 ? 'steady' : 'locked',
+    },
     {
       key: 'ownerAccepted',
       value: summary ? `${summary.owner_response_accepted_count}/${summary.owner_response_received_count}` : '...',

apps/web/src/lib/api-client.ts

@@ -103,6 +103,7 @@ export interface IwoooSRuntimeSecurityReadbackLane {
     | 'wazuh_live_route'
     | 'wazuh_live_metadata_gate'
     | 'wazuh_owner_evidence_preflight'
+    | 'wazuh_runtime_controlled_apply_preflight'
     | 'wazuh_dashboard_api'
     | 'kali_intake'
     | 'alert_readability'
@@ -159,6 +160,16 @@ export interface IwoooSRuntimeSecurityReadbackResponse {
     wazuh_owner_evidence_received_count: number
     wazuh_owner_evidence_accepted_count: number
     wazuh_owner_evidence_runtime_gate_count: number
+    wazuh_runtime_apply_preflight_ready_count: number
+    wazuh_runtime_apply_target_selector_count: number
+    wazuh_runtime_apply_source_diff_count: number
+    wazuh_runtime_apply_check_mode_plan_count: number
+    wazuh_runtime_apply_dry_run_required_count: number
+    wazuh_runtime_apply_rollback_plan_count: number
+    wazuh_runtime_apply_post_apply_verifier_count: number
+    wazuh_runtime_apply_km_writeback_count: number
+    wazuh_runtime_apply_owner_review_ready_count: number
+    wazuh_runtime_apply_runtime_gate_count: number
     kali_active_scan_authorized_count: number
     kali_execute_authorized_count: number
     kali_finding_envelope_accepted_count: number
@@ -268,6 +279,69 @@ export interface IwoooSWazuhOwnerEvidencePreflightResponse {
   no_false_green_rules: string[]
 }
 
+export interface IwoooSWazuhRuntimeControlledApplyPreflightItem {
+  item_id:
+    | 'target_selector'
+    | 'source_of_truth_diff'
+    | 'check_mode_dry_run'
+    | 'rollback'
+    | 'post_apply_verifier'
+    | 'learning_writeback'
+  title: string
+  state_key: string
+  ready: boolean
+  required_fields: string[]
+  next_gate: string
+}
+
+export interface IwoooSWazuhRuntimeControlledApplyPreflightResponse {
+  schema_version: 'iwooos_wazuh_runtime_controlled_apply_preflight_readback_v1'
+  source_schema_version: 'wazuh_runtime_controlled_apply_preflight_v1'
+  status: string
+  mode: string
+  source_refs: string[]
+  controlled_apply_packet_validation_endpoint: string
+  controlled_apply_packet_validation_mode: string
+  summary: {
+    expected_scope_alias_count: number
+    target_selector_count: number
+    source_of_truth_diff_count: number
+    check_mode_plan_count: number
+    dry_run_required_count: number
+    rollback_plan_count: number
+    post_apply_verifier_count: number
+    km_playbook_writeback_count: number
+    maintenance_window_required_count: number
+    owner_review_ready_count: number
+    controlled_apply_preflight_ready_count: number
+    controlled_apply_packet_received_count: number
+    controlled_apply_packet_accepted_count: number
+    controlled_apply_packet_quarantined_count: number
+    controlled_apply_runtime_action_rejected_count: number
+    forbidden_payload_count: number
+    forbidden_action_count: number
+    runtime_gate_count: number
+    wazuh_api_live_query_authorized_count: number
+    wazuh_active_response_authorized_count: number
+    host_write_authorized_count: number
+    secret_value_collection_allowed_count: number
+  }
+  target_selectors: Array<{
+    node_alias: string
+    scope: string
+    selector_kind: string
+    runtime_write_allowed: boolean
+  }>
+  required_packet_fields: string[]
+  preflight_items: IwoooSWazuhRuntimeControlledApplyPreflightItem[]
+  outcome_lanes: string[]
+  forbidden_payloads: string[]
+  forbidden_actions: string[]
+  boundary_markers: string[]
+  boundaries: Record<string, boolean>
+  no_false_green_rules: string[]
+}
+
 export interface IwoooSWazuhManagedHostCoverageHost {
   node_id: string
   role: string
@@ -621,6 +695,11 @@ export const apiClient = {
     return handleResponse<IwoooSWazuhOwnerEvidencePreflightResponse>(res)
   },
 
+  async getIwoooSWazuhRuntimeControlledApplyPreflight() {
+    const res = await fetch(`${API_BASE_URL}/iwooos/wazuh-runtime-controlled-apply-preflight`, { cache: 'no-store' })
+    return handleResponse<IwoooSWazuhRuntimeControlledApplyPreflightResponse>(res)
+  },
+
   async getIwoooSWazuhManagedHostCoverage() {
     const res = await fetch(`${API_BASE_URL}/iwooos/wazuh-managed-host-coverage`, { cache: 'no-store' })
     return handleResponse<IwoooSWazuhManagedHostCoverageResponse>(res)