docs(proof): add operational evidence profile

2026-06-03 10:16:50 +03:00
parent 1aa35b1f8e
commit bf4e38f35e
3 changed files with 247 additions and 0 deletions
@@ -0,0 +1,98 @@
+-- Operational proof snapshot for DetMir/AWatch-rus.
+-- Output is aggregate-only: no users, company names, hosts, domains, paths,
+-- evidence content, tokens, passwords or raw incident payloads.
+
+SELECT
+    database,
+    count() AS tables_total,
+    sum(total_rows) AS rows_total,
+    formatReadableSize(sum(total_bytes)) AS compressed_size,
+    formatReadableSize(sum(total_bytes_uncompressed)) AS uncompressed_size
+FROM system.tables
+WHERE database = 'analytics_1c'
+  AND engine NOT IN ('View')
+GROUP BY database;
+
+SELECT
+    version() AS clickhouse_version,
+    uptime() AS uptime_seconds,
+    (SELECT count() FROM system.tables WHERE database = 'analytics_1c') AS analytics_objects,
+    formatReadableSize((
+        SELECT sum(total_bytes)
+        FROM system.tables
+        WHERE database = 'analytics_1c'
+          AND engine NOT IN ('View')
+    )) AS analytics_compressed_size;
+
+SELECT
+    count() AS queries_logged,
+    min(event_time) AS first_query,
+    max(event_time) AS last_query,
+    quantile(0.5)(query_duration_ms) AS p50_ms,
+    quantile(0.95)(query_duration_ms) AS p95_ms,
+    max(query_duration_ms) AS max_ms
+FROM system.query_log
+WHERE event_time >= now() - INTERVAL 7 DAY
+  AND type = 'QueryFinish'
+  AND current_database = 'analytics_1c';
+
+SELECT 'business_events' AS table_name, count() AS rows, min(ts) AS min_ts, max(ts) AS max_ts
+FROM analytics_1c.business_events
+UNION ALL
+SELECT 'document_change_events', count(), min(ts), max(ts)
+FROM analytics_1c.document_change_events
+UNION ALL
+SELECT 'detections', count(), min(ts), max(ts)
+FROM analytics_1c.detections
+UNION ALL
+SELECT 'cases', count(), min(opened_at), max(opened_at)
+FROM analytics_1c.cases
+UNION ALL
+SELECT 'company_health_signals', count(), min(generated_at), max(generated_at)
+FROM analytics_1c.company_health_signals
+UNION ALL
+SELECT 'company_forecasts', count(), min(generated_at), max(generated_at)
+FROM analytics_1c.company_forecasts
+ORDER BY table_name;
+
+SELECT
+    countDistinct(infobase) AS infobases,
+    countDistinct(user) AS users_in_reglog,
+    countDistinct(host) AS hosts_in_reglog,
+    count() AS reglog_events,
+    min(ts) AS min_ts,
+    max(ts) AS max_ts
+FROM analytics_1c.reglog_events;
+
+SELECT
+    countDistinct(infobase) AS infobases,
+    countDistinct(company_entity_key) AS company_entities,
+    countDistinct(document_id) AS documents,
+    countDistinct(user) AS users,
+    count() AS business_events,
+    min(ts) AS min_ts,
+    max(ts) AS max_ts
+FROM analytics_1c.business_events;
+
+SELECT
+    severity,
+    status,
+    count() AS detections
+FROM analytics_1c.detections
+GROUP BY severity, status
+ORDER BY detections DESC;
+
+SELECT
+    severity,
+    status,
+    count() AS cases
+FROM analytics_1c.cases
+GROUP BY severity, status
+ORDER BY cases DESC;
+
+SELECT
+    countDistinct(company_key) AS registry_companies,
+    countIf(key_contour = 1) AS key_contour_rows,
+    countDistinct(assignee_name) AS assignees,
+    max(ts) AS last_snapshot
+FROM analytics_1c.company_registry;