feat(iwooos): mark wazuh reviewer post-enable readback

apps/api/src/services/iwooos_wazuh_manager_registry_reviewer_validation.py

@@ -284,7 +284,6 @@ def _require_boundaries(payload: dict[str, Any]) -> None:
     summary = _summary(payload)
     for key in (
         "manager_registry_accepted_count",
-        "post_enable_readback_passed_count",
         "runtime_gate_count",
         "host_write_authorized_count",
         "active_response_authorized_count",
@@ -299,7 +298,8 @@ def _require_boundaries(payload: dict[str, Any]) -> None:
     passed = _int(summary.get("reviewer_validation_passed_count"))
     failed = _int(summary.get("reviewer_validation_failed_count"))
     quarantined = _int(summary.get("reviewer_validation_quarantined_count"))
-    if any(value < 0 for value in (received, accepted, ready, passed, failed, quarantined)):
+    post_enable = _int(summary.get("post_enable_readback_passed_count"))
+    if any(value < 0 for value in (received, accepted, ready, passed, failed, quarantined, post_enable)):
         raise ValueError("Wazuh manager registry reviewer validation counters 不得為負數")
     if accepted > received:
         raise ValueError("owner_registry_export_accepted_count 不得大於 received_count")
@@ -307,6 +307,8 @@ def _require_boundaries(payload: dict[str, Any]) -> None:
         raise ValueError("reviewer_validation_ready_count 不得大於 received_count")
     if passed > accepted:
         raise ValueError("reviewer_validation_passed_count 不得大於 accepted_count")
+    if post_enable > passed:
+        raise ValueError("post_enable_readback_passed_count 不得大於 reviewer_validation_passed_count")
     if failed and passed:
         raise ValueError("reviewer_validation_failed_count 與 passed_count 不得同時為正")
     if quarantined and accepted:

apps/api/tests/test_iwooos_wazuh_manager_registry_reviewer_validation.py

@@ -83,19 +83,20 @@ def test_iwooos_wazuh_manager_registry_reviewer_validation_contract_has_passed_r
 
     assert payload["schema_version"] == "iwooos_wazuh_manager_registry_reviewer_validation_readback_v1"
     assert payload["source_schema_version"] == "wazuh_manager_registry_reviewer_validation_v1"
-    assert payload["status"] == "accepted_for_readonly_posture_only"
-    assert payload["mode"] == "committed_validation_passed_readback_no_runtime_no_secret_collection"
+    assert payload["status"] == "post_enable_iwooos_readback_passed_no_runtime_no_secret_collection"
+    assert payload["mode"] == "committed_post_enable_iwooos_readback_passed_no_runtime_no_secret_collection"
     assert payload["summary"]["expected_scope_alias_count"] == 6
     assert payload["summary"]["required_owner_field_count"] == 28
     assert payload["summary"]["per_host_required_field_count"] == 9
     assert payload["summary"]["reviewer_validation_check_count"] == 10
-    assert payload["summary"]["outcome_lane_count"] == 13
+    assert payload["summary"]["outcome_lane_count"] == 14
     assert payload["summary"]["evidence_slot_count"] == 6
     assert payload["summary"]["forbidden_payload_count"] == 27
     assert payload["summary"]["owner_registry_export_received_count"] == 1
     assert payload["summary"]["owner_registry_export_accepted_count"] == 1
     assert payload["summary"]["reviewer_validation_ready_count"] == 1
     assert payload["summary"]["reviewer_validation_passed_count"] == 1
+    assert payload["summary"]["post_enable_readback_passed_count"] == 1
     assert payload["summary"]["reviewer_validation_quarantined_count"] == 0
     assert payload["summary"]["manager_registry_accepted_count"] == 0
     assert payload["summary"]["runtime_gate_count"] == 0
@@ -115,7 +116,7 @@ def test_iwooos_wazuh_manager_registry_reviewer_validation_evidence_slots_are_ac
     assert all(item["received"] is True for item in payload["evidence_slots"])
     assert all(item["accepted"] is True for item in payload["evidence_slots"])
     assert all(item["quarantined"] is False for item in payload["evidence_slots"])
-    assert all(item["next_gate"] == "post_enable_iwooos_readback" for item in payload["evidence_slots"])
+    assert all(item["next_gate"] == "manager_registry_acceptance_evidence_review" for item in payload["evidence_slots"])
     assert "managed_core_node_a" in payload["expected_scope_aliases"]
     assert "manager_registry_agent_counts" in [item["slot_id"] for item in payload["evidence_slots"]]
 
@@ -129,6 +130,7 @@ def test_iwooos_wazuh_manager_registry_reviewer_validation_api_is_public_safe()
     assert data["summary"]["owner_registry_export_received_count"] == 1
     assert data["summary"]["owner_registry_export_accepted_count"] == 1
     assert data["summary"]["reviewer_validation_passed_count"] == 1
+    assert data["summary"]["post_enable_readback_passed_count"] == 1
     assert data["summary"]["manager_registry_accepted_count"] == 0
     assert data["summary"]["runtime_gate_count"] == 0
     assert len(data["reviewer_validation_checks"]) == 10
@@ -145,6 +147,10 @@ def test_iwooos_wazuh_manager_registry_reviewer_validation_api_is_public_safe()
         marker == "wazuh_manager_registry_reviewer_validation_passed_count=1"
         for marker in data["boundary_markers"]
     )
+    assert any(
+        marker == "wazuh_manager_registry_reviewer_validation_post_enable_readback_passed_count=1"
+        for marker in data["boundary_markers"]
+    )
     assert any(
         marker == "wazuh_manager_registry_reviewer_validation_manager_registry_accepted_count=0"
         for marker in data["boundary_markers"]
@@ -202,6 +208,7 @@ def test_iwooos_wazuh_manager_registry_owner_export_validation_api_does_not_pers
     assert readback["summary"]["owner_registry_export_received_count"] == 1
     assert readback["summary"]["owner_registry_export_accepted_count"] == 1
     assert readback["summary"]["reviewer_validation_passed_count"] == 1
+    assert readback["summary"]["post_enable_readback_passed_count"] == 1
     assert readback["summary"]["manager_registry_accepted_count"] == 0
     assert readback["summary"]["runtime_gate_count"] == 0
 

apps/web/messages/en.json

@@ -20872,6 +20872,10 @@
           "label": "Reviewer passed",
           "detail": "一筆脫敏 owner export refs 已通過 no-persist reviewer validation。"
         },
+        "postEnable": {
+          "label": "Post-enable",
+          "detail": "正式 API 與前台已讀回 reviewer passed；這不是 live Wazuh 查詢授權。"
+        },
         "received": {
           "label": "已收 export",
           "detail": "已收到一筆 owner-provided redacted registry export refs。"

apps/web/messages/zh-TW.json

@@ -20872,6 +20872,10 @@
           "label": "Reviewer passed",
           "detail": "一筆脫敏 owner export refs 已通過 no-persist reviewer validation。"
         },
+        "postEnable": {
+          "label": "Post-enable",
+          "detail": "正式 API 與前台已讀回 reviewer passed；這不是 live Wazuh 查詢授權。"
+        },
         "received": {
           "label": "已收 export",
           "detail": "已收到一筆 owner-provided redacted registry export refs。"

apps/web/src/app/[locale]/iwooos/page.tsx

@@ -2479,7 +2479,7 @@ const wazuhManagerRegistryReviewerValidationBoundaries = [
   'wazuh_manager_registry_reviewer_validation_required_owner_field_count=28',
   'wazuh_manager_registry_reviewer_validation_per_host_required_field_count=9',
   'wazuh_manager_registry_reviewer_validation_check_count=10',
-  'wazuh_manager_registry_reviewer_validation_outcome_lane_count=13',
+  'wazuh_manager_registry_reviewer_validation_outcome_lane_count=14',
   'wazuh_manager_registry_reviewer_validation_evidence_slot_count=6',
   'wazuh_manager_registry_reviewer_validation_forbidden_payload_count=27',
   'wazuh_manager_registry_reviewer_validation_owner_registry_export_received_count=1',
@@ -2487,7 +2487,7 @@ const wazuhManagerRegistryReviewerValidationBoundaries = [
   'wazuh_manager_registry_reviewer_validation_passed_count=1',
   'wazuh_manager_registry_reviewer_validation_quarantined_count=0',
   'wazuh_manager_registry_reviewer_validation_manager_registry_accepted_count=0',
-  'wazuh_manager_registry_reviewer_validation_post_enable_readback_passed_count=0',
+  'wazuh_manager_registry_reviewer_validation_post_enable_readback_passed_count=1',
   'wazuh_manager_registry_reviewer_validation_runtime_gate_count=0',
   'wazuh_api_live_query_authorized=false',
   'wazuh_agent_reenroll_authorized=false',
@@ -9822,6 +9822,12 @@ function IwoooSWazuhManagerRegistryReviewerValidationBoard() {
       icon: ClipboardCheck,
       tone: 'steady',
     },
+    {
+      key: 'postEnable',
+      value: summary ? String(summary.post_enable_readback_passed_count) : loading ? '...' : '1',
+      icon: SearchCheck,
+      tone: summary?.post_enable_readback_passed_count ? 'steady' : 'locked',
+    },
     {
       key: 'received',
       value: summary ? String(summary.owner_registry_export_received_count) : loading ? '...' : '1',