feat(iwooos): surface runtime supply chain risk

apps/web/src/components/iwooos/security-asset-control-plane-cockpit.tsx

@@ -43,6 +43,14 @@ type Copy = {
   audit: string;
   aiTrace: string;
   sources: string;
+  supplyChain: string;
+  runtimeImages: string;
+  digestPinned: string;
+  forbiddenSources: string;
+  imagePolicy: string;
+  compliant: string;
+  repair: string;
+  notEvidenced: string;
   latestScan: string;
   freshness: string;
   runAssets: string;
@@ -75,6 +83,14 @@ const COPY: Record<"zh" | "en", Copy> = {
     audit: "稽核軌跡",
     aiTrace: "AI 軌跡",
     sources: "資料源",
+    supplyChain: "Runtime 供應鏈",
+    runtimeImages: "Runtime 映像",
+    digestPinned: "Digest 鎖定",
+    forbiddenSources: "禁用來源",
+    imagePolicy: "映像政策",
+    compliant: "符合",
+    repair: "需修復",
+    notEvidenced: "未盤點",
     latestScan: "最新盤點",
     freshness: "新鮮度",
     runAssets: "本輪資產",
@@ -105,6 +121,14 @@ const COPY: Record<"zh" | "en", Copy> = {
     audit: "Audit trail",
     aiTrace: "AI trace",
     sources: "Sources",
+    supplyChain: "Runtime supply chain",
+    runtimeImages: "Runtime images",
+    digestPinned: "Digest pinned",
+    forbiddenSources: "Forbidden sources",
+    imagePolicy: "Image policy",
+    compliant: "PASS",
+    repair: "REPAIR",
+    notEvidenced: "NO DATA",
     latestScan: "Latest scan",
     freshness: "Freshness",
     runAssets: "Run assets",
@@ -178,14 +202,21 @@ function TruthCell({
   value,
   icon: Icon,
   tone = "neutral",
+  wideOnMobile = false,
 }: {
   label: string;
   value: string | number;
   icon: typeof ShieldCheck;
   tone?: "neutral" | "healthy" | "critical";
+  wideOnMobile?: boolean;
 }) {
   return (
-    <div className="flex min-w-0 items-center gap-2 bg-white px-3 py-2.5 last:col-span-2 sm:last:col-span-1">
+    <div
+      className={cn(
+        "flex min-w-0 items-center gap-2 bg-white px-3 py-2.5",
+        wideOnMobile && "last:col-span-2 sm:last:col-span-1"
+      )}
+    >
       <Icon
         className={cn(
           "h-3.5 w-3.5 shrink-0",
@@ -398,9 +429,81 @@ export function SecurityAssetControlPlaneCockpit({
           value={payload?.summary.stale_asset_count ?? "--"}
           icon={TriangleAlert}
           tone={(payload?.summary.stale_asset_count ?? 0) > 0 ? "critical" : "healthy"}
+          wideOnMobile
         />
       </div>
 
+      <div className="border-t border-[#d8d3c7] bg-[#f6f4ee] px-3 py-2">
+        <div className="mb-1.5 flex items-center gap-1.5 text-[10px] font-semibold text-[#4f4d47]">
+          <Boxes className="h-3.5 w-3.5" aria-hidden="true" />
+          {copy.supplyChain}
+        </div>
+        <div
+          className="grid grid-cols-2 gap-px bg-[#d8d3c7] sm:grid-cols-4"
+          data-testid="security-supply-chain-truth"
+        >
+          <TruthCell
+            label={copy.runtimeImages}
+            value={payload?.supply_chain?.package_asset_count ?? "--"}
+            icon={Boxes}
+            tone={
+              payload?.supply_chain?.package_inventory_evidenced
+                ? "healthy"
+                : "critical"
+            }
+          />
+          <TruthCell
+            label={copy.digestPinned}
+            value={
+              payload?.supply_chain
+                ? `${payload.supply_chain.package_digest_pinned_count}/${payload.supply_chain.package_asset_count}`
+                : "--"
+            }
+            icon={CheckCircle2}
+            tone={
+              payload?.supply_chain?.package_inventory_evidenced &&
+              payload.supply_chain.package_digest_unpinned_count === 0
+                ? "healthy"
+                : "critical"
+            }
+          />
+          <TruthCell
+            label={copy.forbiddenSources}
+            value={
+              payload?.supply_chain?.forbidden_github_supply_chain_asset_count ??
+              "--"
+            }
+            icon={ShieldAlert}
+            tone={
+              payload?.supply_chain?.package_inventory_evidenced &&
+              payload.supply_chain.forbidden_github_supply_chain_asset_count === 0
+                ? "healthy"
+                : "critical"
+            }
+          />
+          <TruthCell
+            label={copy.imagePolicy}
+            value={
+              !payload?.supply_chain?.package_inventory_evidenced
+                ? copy.notEvidenced
+                : payload.supply_chain.runtime_image_policy_compliant
+                  ? copy.compliant
+                  : copy.repair
+            }
+            icon={
+              payload?.supply_chain?.runtime_image_policy_compliant
+                ? ShieldCheck
+                : TriangleAlert
+            }
+            tone={
+              payload?.supply_chain?.runtime_image_policy_compliant
+                ? "healthy"
+                : "critical"
+            }
+          />
+        </div>
+      </div>
+
       {payload ? (
         <div className="grid gap-4 p-4 xl:grid-cols-[1.1fr_1.4fr]">
           <div className="min-w-0 space-y-4">