Add DetMir operational maturity harness

2026-07-01 07:34:43 +03:00
parent 2e1fe8618c
commit 121d66cfcf
12 changed files with 879 additions and 0 deletions
@@ -0,0 +1,58 @@
+# Эксплуатационная зрелость DetMir/AWatch-rus
+
+Дата актуализации: 2026-07-01.
+
+Этот контур добавляет автоматическую проверку эксплуатационной зрелости без
+нагрузки на production. Public CI запускает только offline checks: fixtures,
+локальный mock HTTP, статическую проверку конфигураций, ClickHouse DDL и
+контракт наблюдаемости. Live checks запускаются только вручную оператором с
+private access.
+
+## Что проверяется
+
+- Integration harness: локальный mock обслуживает ключевые endpoints
+  `/healthz`, `/readyz`, `/version`, Worktime management и Security Finding
+  Inbox shadow payload.
+- Fault injection: клиент должен быстро классифицировать `503`, timeout и
+  connection reset, не зависая сверх заданного бюджета.
+- API compatibility: DetMir Portal OpenAPI обязан сохранять ключевые paths,
+  schemas и runtime endpoints.
+- Config/migration validation: JSON/YAML examples, systemd units/timers и
+  ClickHouse init SQL проверяются на базовую пригодность и idempotency.
+- Bounded load: короткий локальный load smoke с concurrency и p95 budget,
+  без sizing claims.
+- Observability: обязательные health/version/readiness fields, diagnostic
+  headers и Prometheus metric names закреплены manifest/fixtures/source check.
+
+## Команды
+
+Offline PR/CI gate:
+
+```bash
+cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian
+node --check scripts/operational-maturity-check.mjs
+node scripts/operational-maturity-check.mjs --json
+```
+
+Live contract, только оператором и только если контур доступен:
+
+```bash
+cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian
+AWATCH_OPS_LIVE_URL=http://127.0.0.1:8720 \
+node scripts/operational-maturity-check.mjs --json --live
+```
+
+Live check не включает DLP, Loki или Velociraptor. Он только читает
+health/readiness/version/metrics endpoints и принимает controlled statuses
+`200` или `503`.
+
+## Governance
+
+Контракт расположен в `configs/operational-maturity-contract.json`.
+Fixture payloads лежат в `docs/fixtures/operational-maturity/`.
+CI workflow: `.github/workflows/operational-maturity.yml`.
+
+Правило изменений: если endpoint, metric, schema, systemd unit или ClickHouse
+migration меняется, сначала обновляется manifest/fixture, затем код. Удаление
+полей или paths считается breaking change, если нет отдельного operator-approved
+major contract change.
@@ -51,12 +51,16 @@ Repository-specific gate:
 ```bash
 cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian
 python3 scripts/public_secret_pattern_check.py
+node scripts/operational-maturity-check.mjs --json

 cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian/adk-rust
 export CARGO_TARGET_DIR=/home/igor/.cache/detmir-adk-rust-target
 cargo run -p quality-gate -- --root /mnt/usb_hdd2/Projects/ActivityWatch-Russian
 ```

+Подробности эксплуатационного maturity harness: [эксплуатационная зрелость
+DetMir/AWatch-rus](OPERATIONAL_MATURITY_RU.md).
+
 ## Browser smoke

 Browser smoke не заменяет API/CLI проверки. Он подтверждает, что операторский
@@ -0,0 +1,6 @@
+{
+  "status": "ok",
+  "service": "detmir-portal",
+  "schema_version": "pilot-v1",
+  "timestamp": "2026-07-01T00:00:00Z"
+}
@@ -0,0 +1,26 @@
+# HELP awatch_http_requests_total HTTP requests handled by AWatch-rus portal
+# TYPE awatch_http_requests_total counter
+awatch_http_requests_total{method="GET",route="/healthz",status="200",module="portal"} 1
+# HELP awatch_http_request_duration_seconds HTTP request duration in seconds
+# TYPE awatch_http_request_duration_seconds summary
+awatch_http_request_duration_seconds_sum{method="GET",route="/healthz",status="200",module="portal"} 0.001
+awatch_http_request_duration_seconds_count{method="GET",route="/healthz",status="200",module="portal"} 1
+# TYPE awatch_report_requests_total counter
+awatch_report_requests_total 1
+# TYPE awatch_report_cache_hits_total counter
+awatch_report_cache_hits_total 0
+# TYPE awatch_report_cache_misses_total counter
+awatch_report_cache_misses_total 1
+# TYPE awatch_report_cache_stale_hits_total counter
+awatch_report_cache_stale_hits_total 0
+# TYPE awatch_reports_generated_total counter
+awatch_reports_generated_total 1
+# TYPE awatch_ingestion_records_total counter
+awatch_ingestion_records_total 0
+# TYPE awatch_ingestion_rejected_total counter
+awatch_ingestion_rejected_total 0
+# TYPE awatch_role_denied_total counter
+awatch_role_denied_total 0
+# HELP awatch_readyz_status Portal readiness status, 1=ready, 0=not_ready
+# TYPE awatch_readyz_status gauge
+awatch_readyz_status 1
@@ -0,0 +1,26 @@
+{
+  "status": "ready",
+  "checks": {
+    "portal": {
+      "status": "ok",
+      "latency_ms": 1
+    },
+    "worktime_api": {
+      "status": "ok",
+      "stale": false
+    },
+    "clickhouse": {
+      "status": "ok",
+      "mode": "external"
+    },
+    "dlp_runtime": {
+      "status": "skipped",
+      "profile": "core_only",
+      "reason": "disabled_by_production_default"
+    },
+    "security_finding_inbox": {
+      "status": "ok",
+      "mode": "shadow"
+    }
+  }
+}
@@ -0,0 +1,10 @@
+{
+  "app_name": "AWatch-rus DetMir Portal",
+  "app_version": "0.1.0",
+  "schema_version": "pilot-v1",
+  "environment": "test",
+  "build": {
+    "profile": "ci",
+    "source": "fixture"
+  }
+}
@@ -0,0 +1,18 @@
+{
+  "mode": "shadow",
+  "auto_apply": false,
+  "workflow": ["decide", "plan", "approve", "apply", "verify"],
+  "findings": [
+    {
+      "id": "fixture-001",
+      "source": "hayabusa",
+      "severity": "medium",
+      "status": "new",
+      "containment": {
+        "recommended": true,
+        "approved": false,
+        "applied": false
+      }
+    }
+  ]
+}
@@ -0,0 +1,11 @@
+{
+  "status": "DEGRADED",
+  "stale": false,
+  "reason": "report_unavailable",
+  "report_cache_hit": false,
+  "report_stale_served": false,
+  "aw_query_duration_ms": 350,
+  "aw_query_timeout_count": 1,
+  "report_build_error_count": 1,
+  "users": []
+}
@@ -0,0 +1,17 @@
+{
+  "status": "OK",
+  "stale": false,
+  "reason": null,
+  "report_cache_hit": false,
+  "report_stale_served": false,
+  "aw_query_duration_ms": 42,
+  "aw_query_timeout_count": 0,
+  "report_build_error_count": 0,
+  "users": [
+    {
+      "user": "demo-user",
+      "active_seconds": 1800,
+      "apps_count": 3
+    }
+  ]
+}