wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(iwooos): commit wazuh manager registry accepted readback [skip ci]

Browse Source
This commit is contained in:
Your Name
2026-06-28 08:44:53 +08:00
parent b170383463
commit d4c2cc6e20
14 changed files with 191 additions and 128 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
apps/api/tests/test_iwooos_runtime_security_readback.py
View File

@@ -25,7 +25,7 @@ def test_iwooos_runtime_security_readback_preserves_zero_runtime_gates() -> None
assert payload["summary"]["runtime_gate_count"] == 0
assert payload["summary"]["owner_response_received_count"] == 0
assert payload["summary"]["owner_response_accepted_count"] == 0
assert payload["summary"]["wazuh_manager_registry_accepted_count"] == 0
assert payload["summary"]["wazuh_manager_registry_accepted_count"] == 6
assert payload["summary"]["wazuh_live_status"] == "not_checked_by_snapshot_loader"
assert payload["summary"]["wazuh_live_route_degraded_count"] == 1
assert payload["summary"]["wazuh_live_readonly_api_enabled_count"] == 0
@@ -74,7 +74,7 @@ def test_iwooos_runtime_security_readback_lanes_are_candidate_only() -> None:
assert all(lane["next_gate"] for lane in payload["lanes"])
assert all(lane["source_refs"] for lane in payload["lanes"])
assert any(lane["completion_percent"] > 0 for lane in payload["lanes"])
assert all(lane["lane_id"] != "wazuh_registry" or lane["completion_percent"] == 0 for lane in payload["lanes"])
assert all(lane["lane_id"] != "wazuh_registry" or lane["completion_percent"] == 35 for lane in payload["lanes"])
assert all(lane["lane_id"] != "wazuh_live_route" or lane["metrics"]["route_degraded"] == 1 for lane in payload["lanes"])
assert all(lane["lane_id"] != "wazuh_live_metadata_gate" or lane["completion_percent"] == 0 for lane in payload["lanes"])
assert all(lane["lane_id"] != "wazuh_owner_evidence_preflight" or lane["metrics"]["owner_accepted"] == 0 for lane in payload["lanes"])

7
apps/api/tests/test_iwooos_security_control_coverage.py
View File

@@ -54,7 +54,7 @@ def test_iwooos_security_control_coverage_keeps_runtime_gates_closed() -> None:
assert summary["owner_response_received_count"] == 0
assert summary["owner_response_accepted_count"] == 0
assert summary["live_evidence_accepted_count"] == 0
assert summary["wazuh_manager_registry_accepted_count"] == 0
assert summary["wazuh_manager_registry_accepted_count"] == 6
assert summary["active_scan_authorized_count"] == 0
assert summary["active_response_authorized_count"] == 0
assert summary["telegram_send_authorized_count"] == 0
@@ -69,7 +69,10 @@ def test_iwooos_security_control_coverage_keeps_runtime_gates_closed() -> None:
== "low_medium_high_allowed_after_allowlist_check_mode_rollback_verifier_km"
)
assert summary["critical_break_glass_required"] is True
assert all(domain["accepted_count"] == 0 for domain in payload["domains"])
assert all(
domain["accepted_count"] == (6 if domain["domain_id"] == "wazuh_managed_host_coverage" else 0)
for domain in payload["domains"]
)
def test_iwooos_security_control_coverage_api_is_public_safe() -> None:

27
apps/api/tests/test_iwooos_wazuh_managed_host_coverage.py
View File

@@ -15,21 +15,21 @@ def _client() -> TestClient:
return TestClient(app)
def test_iwooos_wazuh_managed_host_coverage_keeps_registry_gate_closed() -> None:
def test_iwooos_wazuh_managed_host_coverage_accepts_registry_readback_without_runtime() -> None:
payload = load_latest_iwooos_wazuh_managed_host_coverage()
assert payload["schema_version"] == "iwooos_wazuh_managed_host_coverage_readback_v1"
assert payload["status"] == "blocked_waiting_full_host_registry_readback"
assert payload["status"] == "manager_registry_readback_accepted_runtime_gate_closed"
assert payload["mode"] == "committed_snapshot_readback_alias_only_no_wazuh_live_query"
assert payload["summary"]["expected_host_scope_count"] == 6
assert payload["summary"]["host_scope_matrix_count"] == 6
assert payload["summary"]["direct_agent_active_observed_count"] == 2
assert payload["summary"]["direct_agent_missing_or_no_transport_count"] == 1
assert payload["summary"]["ssh_readback_blocked_count"] == 3
assert payload["summary"]["manager_registry_accepted_count"] == 0
assert payload["summary"]["manager_registry_gap_count"] == 6
assert payload["summary"]["manager_registry_accepted_count"] == 6
assert payload["summary"]["manager_registry_gap_count"] == 0
assert payload["summary"]["required_evidence_before_green_count"] == 6
assert payload["summary"]["required_evidence_accepted_count"] == 0
assert payload["summary"]["required_evidence_accepted_count"] == 6
assert payload["summary"]["runtime_gate_count"] == 0
assert payload["summary"]["active_response_authorized_count"] == 0
assert payload["summary"]["host_write_authorized_count"] == 0
@@ -57,11 +57,12 @@ def test_iwooos_wazuh_managed_host_coverage_alias_matrix_is_complete() -> None:
"managed_control_node_b",
]
assert all(item["node_id"].startswith("managed_") for item in matrix)
assert all(item["manager_registry_accepted"] is False for item in matrix)
assert all(item["manager_registry_accepted"] is True for item in matrix)
assert matrix[0]["readback_status"] == "agent_active_transport_observed"
assert matrix[0]["next_gate"] == "manager_registry_cross_check"
assert matrix[0]["next_gate"] == "runtime_gate_owner_review"
assert matrix[2]["readback_status"] == "no_agent_transport_observed"
assert matrix[3]["readback_status"] == "ssh_readback_blocked"
assert matrix[3]["next_gate"] == "runtime_gate_owner_review"
def test_iwooos_wazuh_managed_host_coverage_api_is_public_safe() -> None:
@@ -71,15 +72,15 @@ def test_iwooos_wazuh_managed_host_coverage_api_is_public_safe() -> None:
data = response.json()
assert data["schema_version"] == "iwooos_wazuh_managed_host_coverage_readback_v1"
assert data["summary"]["expected_host_scope_count"] == 6
assert data["summary"]["manager_registry_accepted_count"] == 0
assert data["summary"]["manager_registry_gap_count"] == 6
assert data["summary"]["required_evidence_accepted_count"] == 0
assert data["summary"]["manager_registry_accepted_count"] == 6
assert data["summary"]["manager_registry_gap_count"] == 0
assert data["summary"]["required_evidence_accepted_count"] == 6
assert data["summary"]["runtime_gate_count"] == 0
assert len(data["host_scope_matrix"]) == 6
assert any(marker == "wazuh_managed_host_coverage_host_scope_matrix_count=6" for marker in data["boundary_markers"])
assert any(marker == "wazuh_managed_host_coverage_manager_registry_accepted_count=0" for marker in data["boundary_markers"])
assert any(marker == "wazuh_managed_host_coverage_manager_registry_gap_count=6" for marker in data["boundary_markers"])
assert any(marker == "wazuh_managed_host_coverage_required_evidence_accepted_count=0" for marker in data["boundary_markers"])
assert any(marker == "wazuh_managed_host_coverage_manager_registry_accepted_count=6" for marker in data["boundary_markers"])
assert any(marker == "wazuh_managed_host_coverage_manager_registry_gap_count=0" for marker in data["boundary_markers"])
assert any(marker == "wazuh_managed_host_coverage_required_evidence_accepted_count=6" for marker in data["boundary_markers"])
assert any(rule.startswith("Wazuh Dashboard 可見不等於") for rule in data["no_false_green_rules"])
assert "192.168.0." not in response.text
assert "工作視窗" not in response.text

30
apps/api/tests/test_iwooos_wazuh_manager_registry_reviewer_validation.py
View File

@@ -108,8 +108,8 @@ def test_iwooos_wazuh_manager_registry_reviewer_validation_contract_has_passed_r
assert payload["schema_version"] == "iwooos_wazuh_manager_registry_reviewer_validation_readback_v1"
assert payload["source_schema_version"] == "wazuh_manager_registry_reviewer_validation_v1"
assert payload["status"] == "manager_registry_acceptance_evidence_intake_ready_no_runtime_no_secret_collection"
assert payload["mode"] == "committed_manager_registry_acceptance_evidence_intake_ready_no_runtime_no_secret_collection"
assert payload["status"] == "manager_registry_accepted_readback_committed_no_runtime_no_secret_collection"
assert payload["mode"] == "committed_manager_registry_accepted_readback_no_runtime_no_secret_collection"
assert payload["summary"]["expected_scope_alias_count"] == 6
assert payload["summary"]["required_owner_field_count"] == 28
assert payload["summary"]["per_host_required_field_count"] == 9
@@ -123,10 +123,10 @@ def test_iwooos_wazuh_manager_registry_reviewer_validation_contract_has_passed_r
assert payload["summary"]["reviewer_validation_passed_count"] == 1
assert payload["summary"]["post_enable_readback_passed_count"] == 1
assert payload["summary"]["reviewer_validation_quarantined_count"] == 0
assert payload["summary"]["manager_registry_accepted_count"] == 0
assert payload["summary"]["manager_registry_accepted_count"] == 6
assert payload["summary"]["manager_registry_acceptance_intake_endpoint_available_count"] == 1
assert payload["summary"]["manager_registry_acceptance_evidence_received_count"] == 0
assert payload["summary"]["manager_registry_acceptance_evidence_review_ready_count"] == 0
assert payload["summary"]["manager_registry_acceptance_evidence_received_count"] == 1
assert payload["summary"]["manager_registry_acceptance_evidence_review_ready_count"] == 1
assert payload["summary"]["runtime_gate_count"] == 0
@@ -159,10 +159,10 @@ def test_iwooos_wazuh_manager_registry_reviewer_validation_api_is_public_safe()
assert data["summary"]["owner_registry_export_accepted_count"] == 1
assert data["summary"]["reviewer_validation_passed_count"] == 1
assert data["summary"]["post_enable_readback_passed_count"] == 1
assert data["summary"]["manager_registry_accepted_count"] == 0
assert data["summary"]["manager_registry_accepted_count"] == 6
assert data["summary"]["manager_registry_acceptance_intake_endpoint_available_count"] == 1
assert data["summary"]["manager_registry_acceptance_evidence_received_count"] == 0
assert data["summary"]["manager_registry_acceptance_evidence_review_ready_count"] == 0
assert data["summary"]["manager_registry_acceptance_evidence_received_count"] == 1
assert data["summary"]["manager_registry_acceptance_evidence_review_ready_count"] == 1
assert data["summary"]["runtime_gate_count"] == 0
assert len(data["reviewer_validation_checks"]) == 11
assert len(data["evidence_slots"]) == 6
@@ -183,7 +183,7 @@ def test_iwooos_wazuh_manager_registry_reviewer_validation_api_is_public_safe()
for marker in data["boundary_markers"]
)
assert any(
marker == "wazuh_manager_registry_reviewer_validation_manager_registry_accepted_count=0"
marker == "wazuh_manager_registry_reviewer_validation_manager_registry_accepted_count=6"
for marker in data["boundary_markers"]
)
assert any(
@@ -191,11 +191,11 @@ def test_iwooos_wazuh_manager_registry_reviewer_validation_api_is_public_safe()
for marker in data["boundary_markers"]
)
assert any(
marker == "wazuh_manager_registry_acceptance_evidence_received_count=0"
marker == "wazuh_manager_registry_acceptance_evidence_received_count=1"
for marker in data["boundary_markers"]
)
assert any(
marker == "wazuh_manager_registry_acceptance_evidence_review_ready_count=0"
marker == "wazuh_manager_registry_acceptance_evidence_review_ready_count=1"
for marker in data["boundary_markers"]
)
assert any(
@@ -252,7 +252,7 @@ def test_iwooos_wazuh_manager_registry_owner_export_validation_api_does_not_pers
assert readback["summary"]["owner_registry_export_accepted_count"] == 1
assert readback["summary"]["reviewer_validation_passed_count"] == 1
assert readback["summary"]["post_enable_readback_passed_count"] == 1
assert readback["summary"]["manager_registry_accepted_count"] == 0
assert readback["summary"]["manager_registry_accepted_count"] == 6
assert readback["summary"]["runtime_gate_count"] == 0
@@ -328,9 +328,9 @@ def test_iwooos_wazuh_manager_registry_acceptance_evidence_api_does_not_persist_
assert result["summary"]["runtime_gate_count"] == 0
readback = client.get("/api/v1/iwooos/wazuh-manager-registry-reviewer-validation").json()
assert readback["summary"]["manager_registry_acceptance_evidence_received_count"] == 0
assert readback["summary"]["manager_registry_acceptance_evidence_review_ready_count"] == 0
assert readback["summary"]["manager_registry_accepted_count"] == 0
assert readback["summary"]["manager_registry_acceptance_evidence_received_count"] == 1
assert readback["summary"]["manager_registry_acceptance_evidence_review_ready_count"] == 1
assert readback["summary"]["manager_registry_accepted_count"] == 6
assert readback["summary"]["runtime_gate_count"] == 0