fix(iwooos): close Wazuh critical execution gate

apps/api/tests/test_iwooos_wazuh_controlled_executor_runtime.py

@@ -146,7 +146,7 @@ def test_wazuh_runtime_readback_closes_only_with_complete_same_run_receipts() ->
 
     assert (
         payload["schema_version"]
-        == "iwooos_wazuh_controlled_executor_runtime_readback_v2"
+        == "iwooos_wazuh_controlled_executor_runtime_readback_v3"
     )
     assert payload["status"] == "wazuh_manager_posture_same_run_runtime_closed"
     assert payload["summary"]["runtime_execution_performed_count"] == 1
@@ -430,8 +430,7 @@ def test_wazuh_runtime_readback_keeps_only_secret_reference_as_critical() -> Non
     assert payload["boundaries"]["critical_break_glass_required"] is True
     assert payload["boundaries"]["secret_value_collection_allowed"] is False
     assert payload["next_safe_action"] == (
-        "queue_high_risk_capability_repair_with_critical_secret_"
-        "reference_boundary"
+        "queue_critical_secret_reference_break_glass_packet"
     )
 
 
@@ -480,6 +479,9 @@ def test_wazuh_runtime_readback_projects_controlled_capability_packet() -> None:
             "iwooos_wazuh_alert_ingress_scheduler"
         ),
         "capability_source_recurrence": recurrence,
+        "capability_schema_version": (
+            "wazuh_controlled_privileged_capability_repair_v3"
+        ),
         "capability_type": "bounded_privileged_convergence",
         "capability_risk_level": "high",
         "capability_policy_route": (
@@ -490,7 +492,7 @@ def test_wazuh_runtime_readback_projects_controlled_capability_packet() -> None:
         "capability_windows99_dispatch_required": True,
         "capability_critical_secret_reference_required": False,
         "capability_expires_at": "2030-07-17T02:30:00+00:00",
-        "capability_execution_allowed": True,
+        "capability_execution_allowed": False,
         "capability_granted": False,
         "capability_packet_host_write_performed": False,
         "stage_ids": [],
@@ -510,7 +512,7 @@ def test_wazuh_runtime_readback_projects_controlled_capability_packet() -> None:
     )
     packet = payload["controlled_capability_repair_packet"]
     assert packet["queue_status"] == "queued"
-    assert packet["execution_allowed"] is True
+    assert packet["execution_allowed"] is False
     assert packet["controlled_apply_allowed"] is True
     assert packet["windows99_dispatch_required"] is True
     assert packet["capability_granted"] is False
@@ -523,6 +525,37 @@ def test_wazuh_runtime_readback_projects_controlled_capability_packet() -> None:
         "controlled_capability_repair_packet_persisted"
     ] is True
 
+    critical_row = {
+        **row,
+        "check_failure_marker": (
+            "wazuh_privileged_convergence_secret_reference_missing"
+        ),
+        "capability_risk_level": "critical",
+        "capability_policy_route": (
+            "critical_secret_reference_break_glass"
+        ),
+        "capability_controlled_apply_allowed": False,
+        "capability_critical_secret_reference_required": True,
+    }
+    critical = build_iwooos_wazuh_controlled_executor_runtime_readback(
+        critical_row,
+        executor_enabled=True,
+    )
+    critical_packet = critical["controlled_capability_repair_packet"]
+    assert critical_packet["risk_level"] == "critical"
+    assert critical_packet["policy_route"] == (
+        "critical_secret_reference_break_glass"
+    )
+    assert critical_packet["controlled_apply_allowed"] is False
+    assert critical_packet["execution_allowed"] is False
+    assert critical["next_safe_action"] == (
+        "provision_opaque_host112_secret_reference_then_"
+        "windows99_verify_and_requeue_same_run"
+    )
+    assert "wazuh_critical_secret_reference_provisioning_pending" in (
+        critical["active_blockers"]
+    )
+
     row["capability_expires_at"] = "2020-07-17T02:30:00+00:00"
     expired = build_iwooos_wazuh_controlled_executor_runtime_readback(
         row,
@@ -595,7 +628,7 @@ def test_wazuh_controlled_capability_packet_is_deterministic_and_public_safe() -
         "capability_packet_id"
     ]
     assert packet_input["risk_level"] == "high"
-    assert packet_input["execution_allowed"] is True
+    assert packet_input["execution_allowed"] is False
     assert packet_input["controlled_apply_allowed"] is True
     assert packet_input["windows99_dispatch_required"] is True
     assert packet_input["critical_secret_reference_required"] is False
@@ -610,6 +643,28 @@ def test_wazuh_controlled_capability_packet_is_deterministic_and_public_safe() -
     assert "must-not-be-projected" not in serialized
     assert "command_output" not in serialized
 
+    critical_input, critical_output, _ = (
+        _build_wazuh_controlled_capability_packet(
+            **{
+                **kwargs,
+                "failure_class": (
+                    "wazuh_privileged_convergence_secret_reference_missing"
+                ),
+            }
+        )
+    )
+    assert critical_input["risk_level"] == "critical"
+    assert critical_input["policy_route"] == (
+        "critical_secret_reference_break_glass"
+    )
+    assert critical_input["controlled_apply_allowed"] is False
+    assert critical_input["execution_allowed"] is False
+    assert critical_input["critical_secret_reference_required"] is True
+    assert critical_input["gate_lifecycle"]["risk_class"] == "critical"
+    assert "critical_secret_reference_provisioning_receipt" in (
+        critical_output["required_receipts"]
+    )
+
 
 @pytest.mark.asyncio
 async def test_failed_wazuh_check_atomically_queues_deduplicated_packet(
@@ -691,7 +746,7 @@ async def test_failed_wazuh_check_atomically_queues_deduplicated_packet(
         "ansible_controlled_capability_repair_queued"
     )
     assert packet_input["risk_level"] == "high"
-    assert packet_input["execution_allowed"] is True
+    assert packet_input["execution_allowed"] is False
     assert packet_input["secret_value_exposed"] is False
 
 
@@ -735,10 +790,20 @@ async def test_wazuh_controlled_capability_packet_backfill_closes_existing_gap(
                 return "00000000-0000-0000-0000-000000000323"
             return None
 
+    inserted_packets: list[dict[str, object]] = []
+
     class _Db:
-        async def execute(self, statement, _params=None):
+        async def execute(self, statement, params=None):
             sql = str(statement)
-            return _Result(selected="SELECT" in sql and "JOIN" in sql)
+            selected = "SELECT" in sql and "JOIN" in sql
+            if selected:
+                assert "packet.input ->> 'schema_version'" in sql
+                assert params["capability_packet_schema_version"] == (
+                    "wazuh_controlled_privileged_capability_repair_v3"
+                )
+            if "INSERT INTO automation_operation_log" in sql:
+                inserted_packets.append(json.loads(str(params["input"])))
+            return _Result(selected=selected)
 
     @asynccontextmanager
     async def fake_db_context(project_id: str):
@@ -750,6 +815,9 @@ async def test_wazuh_controlled_capability_packet_backfill_closes_existing_gap(
     result = await backfill_missing_wazuh_controlled_capability_packets_once()
 
     assert result == {"scanned": 1, "written": 1, "error": None}
+    assert inserted_packets[0]["schema_version"] == (
+        "wazuh_controlled_privileged_capability_repair_v3"
+    )
 
 
 def test_wazuh_posture_catalog_and_playbook_are_bounded_no_write() -> None:

apps/api/tests/test_wazuh_alertmanager_integration.py

@@ -544,8 +544,34 @@ async def test_wazuh_ingress_scheduler_records_one_high_risk_controlled_candidat
 
 
 @pytest.mark.asyncio
+@pytest.mark.parametrize(
+    (
+        "failure_class",
+        "expected_status",
+        "expected_controlled_apply_allowed",
+        "expected_blocker",
+    ),
+    [
+        (
+            "wazuh_privileged_convergence_capability_missing",
+            "controlled_privilege_capability_repair_already_queued",
+            True,
+            "wazuh_controlled_privilege_capability_repair_pending",
+        ),
+        (
+            "wazuh_privileged_convergence_secret_reference_missing",
+            "critical_secret_reference_break_glass_already_queued",
+            False,
+            "wazuh_critical_secret_reference_provisioning_pending",
+        ),
+    ],
+)
 async def test_wazuh_ingress_scheduler_does_not_repeat_failed_check_while_capability_repair_is_open(
     monkeypatch: pytest.MonkeyPatch,
+    failure_class: str,
+    expected_status: str,
+    expected_controlled_apply_allowed: bool,
+    expected_blocker: str,
 ) -> None:
     from src.jobs import awooop_ansible_candidate_backfill_job as job
 
@@ -565,6 +591,7 @@ async def test_wazuh_ingress_scheduler_does_not_repeat_failed_check_while_capabi
                 "latest_controlled_capability_packet_expires_at": (
                     "2026-07-15T06:29:59+08:00"
                 ),
+                "latest_controlled_capability_failure_class": failure_class,
                 "predecision_evidence_ready": True,
             }
 
@@ -611,14 +638,13 @@ async def test_wazuh_ingress_scheduler_does_not_repeat_failed_check_while_capabi
         ),
     )
 
-    assert result["status"] == (
-        "controlled_privilege_capability_repair_already_queued"
-    )
+    assert result["status"] == expected_status
     assert result["queued"] == 0
     assert result["retry_of_failed_check_mode"] is True
-    assert result["active_blockers"] == [
-        "wazuh_controlled_privilege_capability_repair_pending"
-    ]
+    assert result["controlled_apply_allowed"] is (
+        expected_controlled_apply_allowed
+    )
+    assert result["active_blockers"] == [expected_blocker]
     recorder.assert_not_awaited()
     collector.assert_not_awaited()
     verifier.assert_not_awaited()