Add dashboard integrity/watchdog console

Surface integrity and watchdog state in the read-only dashboard via a new
/api/integrity endpoint and integrity_report(): watchdog/heartbeat
verdict, FIM baseline and package-DB anchor freshness, pacman keyring and
SigLevel posture, and Sentinel's own self-integrity footprint. The
endpoint summarizes existing anchors and heartbeats only — it runs no live
FIM or package verification from the request path, keeping the dashboard
read-only.

Add the enodia.integrity.v1 schema (schemas.py + docs/SCHEMAS.md) with a
contract test, a new "Integrity" dashboard tab and summary metric, and
web tests for the report shape, schema contract, endpoint, and console
wiring. Docs updated; completes the v1.0 "dashboard to local console"
roadmap item.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/COMMAND_REFERENCE.md

@@ -333,13 +333,13 @@ HTTPS is mandatory. If `web_tls_cert` / `web_tls_key` are not configured,
 Sentinel creates a self-signed pair under `log_dir`; add a browser exception for
 that certificate or replace it with a private/local CA certificate.
 
-The console exposes incidents, alert snapshots, posture findings, event-rule
-metadata, event tail, and dry-run response plans. It remains read-only; response
-commands are displayed for review but not executed from the browser. Dashboard
-settings are local to the browser and include persistent themes: Console, Paper,
-Contrast, LGBTQ, Trans, Dracula, Solarized Dark, Solarized Light, and Twilight.
-The theme registry and core text/status contrast pairs are covered by the web
-test suite.
+The console exposes incidents, alert snapshots, posture findings,
+integrity/watchdog state, event-rule metadata, event tail, and dry-run response
+plans. It remains read-only; response commands are displayed for review but not
+executed from the browser. Dashboard settings are local to the browser and
+include persistent themes: Console, Paper, Contrast, LGBTQ, Trans, Dracula,
+Solarized Dark, Solarized Light, and Twilight. The theme registry and core
+text/status contrast pairs are covered by the web test suite.
 
 Expected use: `enodia-sentinel-web.service`.
 

docs/OPERATIONS.md

@@ -73,8 +73,9 @@ Expected healthy output:
   only ones you have consciously accepted (e.g. password auth on a host that
   needs it).
 
-The HTTPS dashboard shows the same posture findings under the Posture tab for
-quick remote review.
+The HTTPS dashboard shows the same posture findings under the Posture tab and
+summarizes FIM/package anchors plus heartbeat freshness under the Integrity tab
+for quick remote review.
 
 ## Alert Workflow
 

docs/ROADMAP.md

@@ -95,7 +95,7 @@ Purpose: define a stable single-host product.
 - ✅ Add documentation versioning and manpage-style command reference.
 - ✅ Harden packaging for Arch first, then document Debian/RPM install paths.
 - ✅ Add signed release artifacts and checksums.
-- Improve dashboard from alert browser to local console:
+- ✅ Improve dashboard from alert browser to local console:
   incidents, posture, integrity state, response plans, and watchdog status.
 - ✅ Add a local dashboard Settings menu with persistent themes for dark
   console, light evidence review, high-contrast operation, LGBTQ, Trans,

docs/SCHEMAS.md

@@ -90,6 +90,25 @@ Required fields:
 | `heartbeat_age` | number or null | Seconds since heartbeat, if present. |
 | `heartbeat_stale` | boolean | Whether heartbeat exceeds configured max age. |
 
+## `enodia.integrity.v1`
+
+Integrity/watchdog object returned by `/api/integrity`. This is a read-only
+summary of existing state; the dashboard endpoint does not run live FIM or
+package verification work.
+
+Required fields:
+
+| Field | Type | Meaning |
+|---|---|---|
+| `schema` | string | `enodia.integrity.v1`. |
+| `generated_at` | number | Unix timestamp when the report was built. |
+| `status` | string | Overall state: `ok`, `review`, or `critical`. |
+| `checks` | object | Compact per-check status map. |
+| `watchdog` | object | Daemon running state, heartbeat age, stale flag, max age, and verdict message. |
+| `anchors` | object | FIM baseline, package DB anchor, pacman keyring, and SigLevel summary. |
+| `sentinel_footprint` | object | Configured Sentinel self-integrity paths and present/missing counts. |
+| `read_only` | boolean | Always true for this dashboard API. |
+
 ## `enodia.response.plan.v1`
 
 Dry-run response plan from `respond plan <incident-id>`.

docs/SPECIFICATION.md

@@ -102,7 +102,7 @@ When a fresh alert survives cooldown, Sentinel writes:
 |---|---|
 | CLI | Run daemon, one-shot checks, baseline management, FIM checks, package DB checks, rootcheck, posture audit, incident review/export, triage, status/watchdog, and response planning. |
 | Logs | Durable local evidence under `/var/log/enodia-sentinel`. |
-| Dashboard | HTTPS-only read-only web view for status, incidents, timelines, alert browsing, posture findings, event-rule metadata, event tail, and response-plan previews. |
+| Dashboard | HTTPS-only read-only web view for status, incidents, timelines, alert browsing, posture findings, integrity/watchdog state, event-rule metadata, event tail, and response-plan previews. |
 | Push | ntfy, Pushover, and generic webhook notifications. |
 | Red-team harness | Safe drills for testing signatures and demos. |