fix(hayabusa): close phase17 live production validation

2026-05-21 16:02:23 +03:00
parent 1b77bd6a47
commit dc2240d635
3 changed files with 89 additions and 4 deletions
@@ -0,0 +1,51 @@
+# Phase 17 Summary: Production Validation
+
+## Result
+
+Phase 17 is closed.
+
+## What was proven live
+
+A real end-to-end forensic path was executed and closed on production infrastructure:
+
+1. Windows EVTX package was exported on `SHARKON2025`.
+2. The real zip package was transferred to `10.10.10.13`.
+3. `aw-hayabusa accept` and `aw-hayabusa process-inbox --mode incident` were run through the standard wrapper.
+4. Hayabusa generated a real report set with bounded traceability metadata.
+5. The result was linked back into AW-rus case management as bounded `forensics.hayabusa` metadata.
+
+## Live proof record
+
+- host: `SHARKON2025`
+- case id: `30`
+- intake id: `20260521T125653Z_SHARKON2025-phase17-rerun3`
+- package path: `/opt/hayabusa/archive/packages/SHARKON2025/20260521T125653Z_SHARKON2025-phase17-rerun3.zip`
+- sha256: `e86b9abbfc1d706ac706c6c8a89509ab17023344c50880641e9175f73f1198d4`
+- report dir: `/opt/hayabusa/reports/SHARKON2025/20260521T125654Z_incident_20260521T125653Z_SHARKON2025-phase17-rerun3`
+- report artifacts:
+  - `summary.html`
+  - `manifest.json`
+  - `run.log`
+  - `timeline.jsonl`
+  - `logon-summary-successful.csv`
+  - `logon-summary-failed.csv`
+
+## Production bugs found and fixed during validation
+
+- `aw-hayabusa` treated `unzip` warning return code `1` as a hard failure for Windows-created zip archives that use backslashes as path separators.
+- timeline modes were using the wrong Hayabusa config path; the wrapper must pass `rules/config`, not the rules root.
+
+Both issues were fixed in `aw-server/hayabusa/aw-hayabusa.sh` and retested live against the same package.
+
+## Why this closes the phase
+
+- the path is no longer theoretical or docs-only; it was proven on a real Windows export package
+- traceability from host to package to report directory is explicit
+- AW-rus case linkage now stores bounded forensic metadata exactly as designed
+- the remaining gaps are operational tuning items, not missing core implementation
+
+## Tuning backlog after the live run
+
+- keep at least one preserved sample EVTX zip for future regression reruns
+- consider a self-check in `aw-hayabusa doctor` for `rules/config` completeness
+- optionally persist a compact machine-readable proof manifest for future audits