feat(iwooos): expose Wazuh owner evidence preflight

apps/api/src/services/iwooos_runtime_security_readback.py

@@ -21,6 +21,7 @@ _SNAPSHOT_FILES = {
     "wazuh_coverage": "wazuh-managed-host-coverage-gate.snapshot.json",
     "wazuh_runtime": "wazuh-agent-visibility-runtime-gate.snapshot.json",
     "wazuh_live_metadata_gate": "wazuh-readonly-live-metadata-env-gate.snapshot.json",
+    "wazuh_owner_evidence_preflight": "wazuh-agent-visibility-owner-evidence-preflight.snapshot.json",
     "kali_status": "kali-integration-status.snapshot.json",
     "soc_control": "soc-siem-kali-wazuh-integration-control.snapshot.json",
     "alert_readability": "telegram-alert-readability-guard.snapshot.json",
@@ -33,6 +34,7 @@ _EXPECTED_SCHEMAS = {
     "wazuh_coverage": "wazuh_managed_host_coverage_gate_v1",
     "wazuh_runtime": "wazuh_agent_visibility_runtime_gate_v1",
     "wazuh_live_metadata_gate": "iwooos_wazuh_readonly_live_metadata_env_gate_v1",
+    "wazuh_owner_evidence_preflight": "wazuh_agent_visibility_owner_evidence_preflight_v1",
     "kali_status": "kali_integration_status_v1",
     "soc_control": "soc_siem_kali_wazuh_integration_control_v1",
     "alert_readability": "telegram_alert_readability_guard_v1",
@@ -73,6 +75,7 @@ def load_latest_iwooos_runtime_security_readback(
     owner_gap_summary = _summary(snapshots["owner_gap"])
     wazuh_summary = _summary(snapshots["wazuh_coverage"])
     live_metadata_gate_summary = _summary(snapshots["wazuh_live_metadata_gate"])
+    owner_evidence_preflight_summary = _summary(snapshots["wazuh_owner_evidence_preflight"])
     soc_summary = _summary(snapshots["soc_control"])
     alert_summary = _summary(snapshots["alert_readability"])
     dispatch_summary = _summary(snapshots["owner_dispatch"])
@@ -95,7 +98,7 @@ def load_latest_iwooos_runtime_security_readback(
         "source_refs": source_refs,
         "summary": {
             "source_snapshot_count": len(source_refs),
-            "p0_lane_count": 8,
+            "p0_lane_count": 9,
             "control_plane_visibility_percent": _average_percent(
                 soc_summary.get("coverage_percent_after_soc_integration_control"),
                 intrusion_summary.get("coverage_percent_after_prevention_control"),
@@ -139,6 +142,36 @@ def load_latest_iwooos_runtime_security_readback(
             "wazuh_live_metadata_gate_live_query_authorized_count": _int(
                 live_metadata_gate_summary.get("wazuh_api_live_query_authorized_count")
             ),
+            "wazuh_owner_evidence_required_field_count": _int(
+                owner_evidence_preflight_summary.get("required_field_count")
+            ),
+            "wazuh_owner_evidence_reviewer_check_count": _int(
+                owner_evidence_preflight_summary.get("reviewer_check_count")
+            ),
+            "wazuh_owner_evidence_outcome_lane_count": _int(
+                owner_evidence_preflight_summary.get("outcome_lane_count")
+            ),
+            "wazuh_owner_evidence_forbidden_payload_count": _int(
+                owner_evidence_preflight_summary.get("forbidden_payload_count")
+            ),
+            "wazuh_owner_evidence_expected_alias_count": _int(
+                owner_evidence_preflight_summary.get("expected_scope_alias_count")
+            ),
+            "wazuh_owner_evidence_registry_export_received_count": _int(
+                owner_evidence_preflight_summary.get("registry_export_received_count")
+            ),
+            "wazuh_owner_evidence_registry_export_accepted_count": _int(
+                owner_evidence_preflight_summary.get("registry_export_accepted_count")
+            ),
+            "wazuh_owner_evidence_received_count": _int(
+                owner_evidence_preflight_summary.get("owner_evidence_received_count")
+            ),
+            "wazuh_owner_evidence_accepted_count": _int(
+                owner_evidence_preflight_summary.get("owner_evidence_accepted_count")
+            ),
+            "wazuh_owner_evidence_runtime_gate_count": _int(
+                owner_evidence_preflight_summary.get("runtime_gate_count")
+            ),
             "kali_active_scan_authorized_count": _int(soc_summary.get("kali_active_scan_authorized_count")),
             "kali_execute_authorized_count": _int(soc_summary.get("kali_execute_authorized_count")),
             "kali_finding_envelope_accepted_count": _int(soc_summary.get("kali_finding_envelope_accepted_count")),
@@ -206,6 +239,30 @@ def load_latest_iwooos_runtime_security_readback(
                 },
                 ["docs/security/wazuh-readonly-live-metadata-env-gate.snapshot.json"],
             ),
+            _lane(
+                "wazuh_owner_evidence_preflight",
+                snapshots["wazuh_owner_evidence_preflight"].get(
+                    "status",
+                    "owner_evidence_preflight_ready_no_runtime_action",
+                ),
+                0,
+                "locked",
+                "補齊 manager registry 脫敏封包、逐主機矩陣、Dashboard API 狀態與負責人決策",
+                {
+                    "required_fields": owner_evidence_preflight_summary.get("required_field_count", 0),
+                    "reviewer_checks": owner_evidence_preflight_summary.get("reviewer_check_count", 0),
+                    "outcome_lanes": owner_evidence_preflight_summary.get("outcome_lane_count", 0),
+                    "forbidden_payloads": owner_evidence_preflight_summary.get("forbidden_payload_count", 0),
+                    "owner_received": owner_evidence_preflight_summary.get("owner_evidence_received_count", 0),
+                    "owner_accepted": owner_evidence_preflight_summary.get("owner_evidence_accepted_count", 0),
+                    "registry_export_accepted": owner_evidence_preflight_summary.get(
+                        "registry_export_accepted_count",
+                        0,
+                    ),
+                    "runtime_gate": owner_evidence_preflight_summary.get("runtime_gate_count", 0),
+                },
+                ["docs/security/wazuh-agent-visibility-owner-evidence-preflight.snapshot.json"],
+            ),
             _lane(
                 "wazuh_dashboard_api",
                 "degraded_api_connection_not_green",
@@ -303,6 +360,7 @@ def load_latest_iwooos_runtime_security_readback(
             "告警格式合約不代表通知已實發或已取得 receipt",
             "Wazuh 正式只讀路由 disabled 或退化時仍是 P0 紅燈",
             "Wazuh 即時中繼資料必須先通過負責人、機密中繼資料、唯讀範圍與啟用後讀回",
+            "Wazuh 負責人證據預檢 ready 不代表已收件、已接受或可啟用 active response",
         ],
     }
 
@@ -421,6 +479,9 @@ def _require_runtime_boundaries(snapshots: dict[str, dict[str, Any]]) -> None:
             "secret_value_collection_allowed_count",
             "wazuh_api_live_query_authorized_count",
             "wazuh_active_response_authorized_count",
+            "active_response_authorized_count",
+            "registry_export_accepted_count",
+            "owner_evidence_accepted_count",
             "post_enable_readback_passed_count",
         ):
             if key in summary and _int(summary.get(key)) != 0: