feat(detmir): add rust-first operations tooling

install-kit-awindows-20260427-211240/ansible/README.md

@@ -122,8 +122,9 @@ Playbook:
 - выгружает полный `windows/*` toolkit на целевой хост в InnoSetup-compatible каталог `C:\Program Files\AWatch-rus\windows`, включая DLP и `worktime-session-collector.ps1`;
 - если найден legacy config `C:\ProgramData\ActivityWatch-Phase2\deployment-config.json`, выполняет безопасную миграцию через `migrate-awatch-rus-paths.ps1`: backup, остановка задач, перенос данных, переписывание путей, пересоздание scheduled tasks и validation;
 - выполняет `deploy-ensemble.ps1` (deploy + hardening/recovery) с policy/rules из AWatch-rus toolkit;
-- после deploy принудительно запускает `ActivityWatch Recovery` и все `ActivityWatch Launch *` задачи;
-- включает (`Enable-ScheduledTask`) `ActivityWatch Recovery` и все `ActivityWatch Launch *` задачи перед запуском (иначе WebUI может показывать `Active time: 0s`);
+- после deploy принудительно запускает `ActivityWatch Recovery` и managed `ActivityWatch Launch *` задачи;
+- включает (`Enable-ScheduledTask`) `ActivityWatch Recovery` и managed `ActivityWatch Launch *` задачи перед запуском (иначе WebUI может показывать `Active time: 0s`);
+- оставляет `ActivityWatch Recovery` включённым даже при активном `AWatchRusCollectorGuard`: guard является основным контроллером, recovery остаётся fallback/bootstrap path;
 - выполняет API smoke-check bucket `aw-watcher-afk_<COMPUTERNAME>` и ожидает свежие события;
 - выполняет API smoke-check bucket `aw-watcher-window_<COMPUTERNAME>` и ожидает свежие события (по умолчанию включено);
 - запускает `validate-deployment.ps1`;

install-kit-awindows-20260427-211240/ansible/deploy_aw_windows.yml

@@ -50,7 +50,7 @@
     aw_windows_incident_artifacts_root: "{{ aw_windows_state_root }}\\incident-artifacts"
     aw_windows_forensics_root: "{{ aw_windows_state_root }}\\forensics\\evtx-exports"
     aw_windows_logon_marker_enabled: true
-    aw_windows_process_events_enabled: true
+    aw_windows_process_events_enabled: false
     aw_windows_skip_hardening: false
     aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
     aw_windows_policy_path: "{{ aw_windows_deploy_root }}\\windows\\dlp-policy.example.json"
@@ -58,6 +58,10 @@
     aw_windows_validation_local_dir: "/tmp/aw-rus-validation-{{ lookup('env','USER') | default('ansible', true) }}"
     aw_windows_launch_task_pattern: "ActivityWatch Launch *"
     aw_windows_recovery_task_name: "ActivityWatch Recovery"
+    aw_windows_collector_guard_enabled: true
+    aw_windows_collector_guard_mode: "enforce"
+    aw_windows_collector_guard_service_name: "AWatchRusCollectorGuard"
+    aw_windows_collector_guard_loop_seconds: 60
     aw_windows_force_task_restart: true
     aw_windows_api_smoke_check_enabled: true
     aw_windows_api_smoke_check_bucket: ""
@@ -181,6 +185,9 @@
         - deploy-domain-users.ps1
         - deploy-ensemble.ps1
         - hardening-recovery.ps1
+        - AWatchRusCollectorGuardService.cs
+        - aw-collector-guard.ps1
+        - install-collector-guard-service.ps1
         - rebuild-worktime-tasks.ps1
         - audit-cryptopro.ps1
         - validate-deployment.ps1
@@ -371,27 +378,50 @@
 
           Start-Sleep -Seconds 2
 
+          $modulePath = "{{ aw_windows_deploy_root }}\windows\ActivityWatch.Windows.Common.psm1"
+          Import-Module $modulePath -Force
+
           # Ensure tasks are enabled (some environments keep them disabled, causing "0s" in WebUI).
           try {
             Enable-ScheduledTask -TaskName "{{ aw_windows_recovery_task_name }}" -ErrorAction SilentlyContinue | Out-Null
           } catch {}
 
           $config = Get-Content -Raw -LiteralPath "{{ aw_windows_state_root }}\deployment-config.json" | ConvertFrom-Json
-          foreach ($taskDef in @($config.userTasks)) {
-            try { Enable-ScheduledTask -TaskName ([string]$taskDef.launchTaskName) -ErrorAction SilentlyContinue | Out-Null } catch {}
+          $configPaths = Get-ActivityWatchRecoveryConfigPaths -PrimaryConfigPath "{{ aw_windows_state_root }}\deployment-config.json"
+          $taskDefs = @(Get-ActivityWatchRecoveryTaskDefinitions -ConfigPaths $configPaths)
+          $sessionRecords = @(Get-ActivityWatchSessionRecords)
+
+          foreach ($taskDef in @($taskDefs)) {
+            try { Enable-ScheduledTask -TaskName ([string]$taskDef.taskName) -ErrorAction SilentlyContinue | Out-Null } catch {}
           }
 
           $recoveryTask = Get-ScheduledTask -TaskName "{{ aw_windows_recovery_task_name }}" -ErrorAction SilentlyContinue
           if ($recoveryTask -and $recoveryTask.State -notin @('Running', 'Queued')) {
             Start-ScheduledTask -TaskName "{{ aw_windows_recovery_task_name }}"
           }
-          foreach ($taskDef in @($config.userTasks)) {
-            $launchTask = Get-ScheduledTask -TaskName ([string]$taskDef.launchTaskName) -ErrorAction SilentlyContinue
+          foreach ($taskDef in @($taskDefs)) {
+            if (-not (Test-ActivityWatchUserHasManagedSession -UserId ([string]$taskDef.userId) -SessionRecords $sessionRecords -IncludeLive -IncludeDisconnected)) {
+              continue
+            }
+            $launchTask = Get-ScheduledTask -TaskName ([string]$taskDef.taskName) -ErrorAction SilentlyContinue
             if ($launchTask -and $launchTask.State -notin @('Running', 'Queued')) {
-              Start-ScheduledTask -TaskName ([string]$taskDef.launchTaskName) -ErrorAction SilentlyContinue
+              Start-ScheduledTask -TaskName ([string]$taskDef.taskName) -ErrorAction SilentlyContinue
             }
           }
 
+    - name: Установить session-aware AWatch-rus Collector Guard service
+      when: aw_windows_collector_guard_enabled | bool
+      ansible.windows.win_powershell:
+        script: |
+          $ErrorActionPreference = 'Stop'
+          $guardParams = @{
+            ConfigPath = "{{ aw_windows_state_root }}\deployment-config.json"
+            Mode = "{{ aw_windows_collector_guard_mode }}"
+            ServiceName = "{{ aw_windows_collector_guard_service_name }}"
+            LoopSeconds = {{ aw_windows_collector_guard_loop_seconds | int }}
+          }
+          & "{{ aw_windows_deploy_root }}\windows\install-collector-guard-service.ps1" @guardParams
+
     - name: Получить Windows hostname для AW smoke-check bucket
       when:
         - aw_windows_api_smoke_check_enabled | bool

install-kit-awindows-20260427-211240/ansible/group_vars/all.example.yml

@@ -32,6 +32,11 @@ aw_monitored_windows_hostname: "SHARKON2025"
 aw_rus_health_worktime_api_base: "http://127.0.0.1:5610"
 aw_rus_health_state_dir: "{{ aw_server_data_dir }}/health"
 aw_rus_health_validation_dir: "{{ aw_rus_health_state_dir }}/windows-validation"
+aw_browser_smoke_enabled: true
+aw_browser_smoke_engine: "chromium-cli"
+aw_legacy_db_merge_enabled: false
+aw_browser_smoke_timeout_ms: 20000
+aw_browser_smoke_render_timeout_ms: 15000
 aw_hayabusa_auto_case_enabled: true
 aw_hayabusa_auto_case_min_severity: "medium"
 aw_hayabusa_telegram_enabled: true
@@ -62,7 +67,7 @@ aw_worktime_from: "00:00"
 aw_worktime_to: "17:00"
 aw_worktime_start_of_day: "{{ aw_worktime_from }}"
 aw_server_always_active_pattern: "aw-watcher-window"
-aw_server_landingpage: "/activity/SHARKON2025/view/"
+aw_server_landingpage: "/#/activity/SHARKON2025/view/"
 aw_health_strict_fileops: 0
 
 aw_dlp_policy_engine_enabled: true

install-kit-awindows-20260427-211240/ansible/group_vars/windows.example.yml

@@ -50,7 +50,7 @@ aw_windows_evtx_channels:
   - Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
   - Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
 aw_windows_logon_marker_enabled: true
-aw_windows_process_events_enabled: true
+aw_windows_process_events_enabled: false
 aw_windows_skip_hardening: false
 
 aw_windows_rules_path: "{{ aw_windows_deploy_root }}\\windows\\web-category-rules.example.json"
@@ -60,6 +60,13 @@ aw_windows_validation_remote_path: "{{ aw_windows_state_root }}\\aw_validate_ans
 aw_windows_validation_local_dir: "/tmp/aw-rus-validation-{{ lookup('env','USER') | default('ansible', true) }}"
 aw_windows_fail_on_validation_error: true
 
+# Collector Guard supervises collectors, but ActivityWatch Recovery must stay enabled
+# as a fallback and as the launch-task bootstrap path for managed RDP sessions.
+aw_windows_collector_guard_enabled: true
+aw_windows_collector_guard_mode: "enforce"
+aw_windows_collector_guard_service_name: "AWatchRusCollectorGuard"
+aw_windows_collector_guard_loop_seconds: 60
+
 # Безопасная миграция текущего прода со старых путей в единый профиль AWatch-rus.
 aw_windows_migration_enabled: true
 aw_windows_legacy_install_root: "C:\\Program Files\\ActivityWatch-Phase2"