feat(iwooos): expose Wazuh owner evidence preflight

apps/web/src/lib/api-client.ts

@@ -102,6 +102,7 @@ export interface IwoooSRuntimeSecurityReadbackLane {
     | 'wazuh_registry'
     | 'wazuh_live_route'
     | 'wazuh_live_metadata_gate'
+    | 'wazuh_owner_evidence_preflight'
     | 'wazuh_dashboard_api'
     | 'kali_intake'
     | 'alert_readability'
@@ -148,6 +149,16 @@ export interface IwoooSRuntimeSecurityReadbackResponse {
     wazuh_live_metadata_gate_readonly_scope_accepted_count: number
     wazuh_live_metadata_gate_post_enable_readback_count: number
     wazuh_live_metadata_gate_live_query_authorized_count: number
+    wazuh_owner_evidence_required_field_count: number
+    wazuh_owner_evidence_reviewer_check_count: number
+    wazuh_owner_evidence_outcome_lane_count: number
+    wazuh_owner_evidence_forbidden_payload_count: number
+    wazuh_owner_evidence_expected_alias_count: number
+    wazuh_owner_evidence_registry_export_received_count: number
+    wazuh_owner_evidence_registry_export_accepted_count: number
+    wazuh_owner_evidence_received_count: number
+    wazuh_owner_evidence_accepted_count: number
+    wazuh_owner_evidence_runtime_gate_count: number
     kali_active_scan_authorized_count: number
     kali_execute_authorized_count: number
     kali_finding_envelope_accepted_count: number
@@ -210,6 +221,53 @@ export interface IwoooSWazuhLiveMetadataGateResponse {
   no_false_green_rules: string[]
 }
 
+export interface IwoooSWazuhOwnerEvidencePreflightItem {
+  item_id:
+    | 'scope_aliases'
+    | 'registry_counts'
+    | 'per_host_matrix'
+    | 'time_window'
+    | 'health_refs'
+    | 'redaction'
+    | 'owner_decision'
+    | 'runtime_boundary'
+  check: string
+  state_key: string
+  tone: IwoooSRuntimeSecurityReadbackTone
+  metrics: Record<string, number>
+}
+
+export interface IwoooSWazuhOwnerEvidencePreflightResponse {
+  schema_version: 'iwooos_wazuh_owner_evidence_preflight_readback_v1'
+  status: string
+  mode: string
+  source_refs: string[]
+  summary: {
+    required_field_count: number
+    reviewer_check_count: number
+    outcome_lane_count: number
+    forbidden_payload_count: number
+    expected_scope_alias_count: number
+    per_host_required_field_count: number
+    allowed_collection_method_count: number
+    registry_export_received_count: number
+    registry_export_accepted_count: number
+    owner_evidence_received_count: number
+    owner_evidence_accepted_count: number
+    owner_evidence_rejected_count: number
+    owner_evidence_quarantined_count: number
+    runtime_gate_count: number
+    wazuh_api_live_query_authorized_count: number
+    active_response_authorized_count: number
+    host_write_authorized_count: number
+    secret_value_collection_allowed_count: number
+  }
+  items: IwoooSWazuhOwnerEvidencePreflightItem[]
+  boundary_markers: string[]
+  boundaries: Record<string, boolean>
+  no_false_green_rules: string[]
+}
+
 export interface IwoooSSecurityControlCoverageDomain {
   domain_id:
     | 'high_value_asset_control'
@@ -320,6 +378,11 @@ export const apiClient = {
     return handleResponse<IwoooSWazuhLiveMetadataGateResponse>(res)
   },
 
+  async getIwoooSWazuhOwnerEvidencePreflight() {
+    const res = await fetch(`${API_BASE_URL}/iwooos/wazuh-owner-evidence-preflight`, { cache: 'no-store' })
+    return handleResponse<IwoooSWazuhOwnerEvidencePreflightResponse>(res)
+  },
+
   async getIwoooSSecurityControlCoverage() {
     const res = await fetch(`${API_BASE_URL}/iwooos/security-control-coverage`, { cache: 'no-store' })
     return handleResponse<IwoooSSecurityControlCoverageResponse>(res)