feat(iwooos): surface runtime supply chain risk

apps/web/src/lib/__tests__/security-asset-control-plane.test.ts

@@ -27,6 +27,8 @@ function payload(): SecurityAssetControlPlanePayload {
       stale_asset_count: 0,
       orphan_asset_count: 0,
       relationship_count: 40,
+      package_digest_unpinned_count: 0,
+      forbidden_github_supply_chain_asset_count: 0,
       automation_coverage_green_percent: 85,
       automation_coverage_unknown_count: 0,
       compliance_violation_count: 0,
@@ -99,6 +101,18 @@ function payload(): SecurityAssetControlPlanePayload {
       accepted_ai_trace_count_24h: 2,
       immutable_external_audit_store_evidenced: false,
     },
+    supply_chain: {
+      package_asset_count: 12,
+      package_inventory_evidenced: true,
+      package_digest_pinned_count: 12,
+      package_digest_unpinned_count: 0,
+      forbidden_github_supply_chain_asset_count: 0,
+      github_freeze_compliant: true,
+      runtime_image_policy_compliant: true,
+      raw_image_identity_returned: false,
+      registry_api_called: false,
+      github_api_used: false,
+    },
     source_health: [
       { source_id: "asset_inventory", status: "ready", reason_code: null },
     ],
@@ -144,6 +158,15 @@ describe("security asset control plane projection", () => {
       boundaries: { ...safe.boundaries, raw_asset_identity_returned: true },
     };
     expect(isSecurityAssetControlPlanePayload(unsafe)).toBe(false);
+
+    const unsafeSupplyChain = {
+      ...safe,
+      supply_chain: {
+        ...safe.supply_chain,
+        raw_image_identity_returned: true,
+      },
+    };
+    expect(isSecurityAssetControlPlanePayload(unsafeSupplyChain)).toBe(false);
   });
 
   it("does not show healthy before same-run closure is proven", () => {
@@ -157,6 +180,20 @@ describe("security asset control plane projection", () => {
     expect(securityControlPlaneTone(value)).toBe("critical");
   });
 
+  it("keeps runtime image supply-chain gaps critical", () => {
+    const value = payload();
+    value.ai_automation.same_run_closed_loop_proven = true;
+    expect(securityControlPlaneTone(value)).toBe("healthy");
+
+    value.supply_chain!.package_digest_pinned_count = 0;
+    value.supply_chain!.package_digest_unpinned_count = 12;
+    value.supply_chain!.runtime_image_policy_compliant = false;
+    expect(securityControlPlaneTone(value)).toBe("critical");
+
+    value.supply_chain = undefined;
+    expect(securityControlPlaneTone(value)).toBe("critical");
+  });
+
   it("keeps P0 work ahead of P1 regardless of API order", () => {
     const items = topSecurityControlPlaneWorkItems(payload(), 2);
     expect(items.map((item) => item.work_item_id)).toEqual([