Harden DetMir DLP production runtime

- default DetMir DLP runtime to core_only/disabled with load-guard protection

- add fail-closed placeholder validation and runtime-scoped artifact checks

- document operator re-enable flow for light profile and guard rollback

- update prod docs, env examples, and Ansible DLP defaults

adk-rust/crates/detmir-portal/Cargo.toml

@@ -18,6 +18,7 @@ serde_json.workspace = true
 serde_yaml.workspace = true
 sha2.workspace = true
 tiny_http.workspace = true
+url.workspace = true
 
 [dev-dependencies]
 tempfile.workspace = true

adk-rust/crates/detmir-portal/src/production/limits.rs

@@ -11,6 +11,7 @@ use anyhow::{Result, anyhow};
 use chrono::NaiveDate;
 use serde_json::{Value, json};
 use tiny_http::StatusCode;
+use url::Url;
 
 use crate::{
     Cli, MAX_ALLOWED_PAGE_SIZE, MAX_ALLOWED_REPORT_DATE_RANGE_DAYS, MAX_ALLOWED_REQUEST_BODY_BYTES,
@@ -77,6 +78,11 @@ pub(crate) fn validate_portal_config(args: &Cli) -> Result<()> {
             "invalid config max_request_body_bytes: expected 1024..={MAX_ALLOWED_REQUEST_BODY_BYTES}"
         ));
     }
+    validate_runtime_url("worktime_url", &args.worktime_url)?;
+    validate_runtime_url("one_c_url", &args.one_c_url)?;
+    validate_probe_command("status_cmd", &args.status_cmd)?;
+    validate_probe_command("check_cmd", &args.check_cmd)?;
+    validate_probe_command("failed_units_cmd", &args.failed_units_cmd)?;
 
     // SECURITY: environment and module names can reach metrics/log labels.
     // Restrict them to short ASCII tokens to avoid label injection and runaway
@@ -112,6 +118,46 @@ pub(crate) fn validate_portal_config(args: &Cli) -> Result<()> {
     Ok(())
 }
 
+fn validate_runtime_url(name: &str, value: &str) -> Result<()> {
+    let url = Url::parse(value).map_err(|err| anyhow!("invalid config {name}: {err}"))?;
+    if !matches!(url.scheme(), "http" | "https") {
+        return Err(anyhow!("invalid config {name}: expected http or https URL"));
+    }
+    let Some(host) = url.host_str() else {
+        return Err(anyhow!("invalid config {name}: missing host"));
+    };
+    if is_placeholder_host(host) {
+        return Err(anyhow!(
+            "invalid config {name}: placeholder/documentation host is not allowed in production"
+        ));
+    }
+    Ok(())
+}
+
+fn is_placeholder_host(host: &str) -> bool {
+    let host = host.trim().to_ascii_lowercase();
+    host.is_empty()
+        || host == "host-example"
+        || host.ends_with(".example")
+        || host.starts_with("192.0.2.")
+        || host.starts_with("198.51.100.")
+        || host.starts_with("203.0.113.")
+}
+
+fn validate_probe_command(name: &str, command: &str) -> Result<()> {
+    let command = command.trim();
+    if command.is_empty() {
+        return Err(anyhow!("invalid config {name}: command is empty"));
+    }
+    let forbidden = ['\n', '\r', '\0', ';', '|', '&', '<', '>', '`'];
+    if command.contains("$(") || command.chars().any(|ch| forbidden.contains(&ch)) {
+        return Err(anyhow!(
+            "invalid config {name}: shell control operators are not allowed"
+        ));
+    }
+    Ok(())
+}
+
 fn is_safe_environment_name(value: &str) -> bool {
     let value = value.trim();
     !value.is_empty()
@@ -230,6 +276,7 @@ mod tests {
             slow_request_log_ms: DEFAULT_SLOW_REQUEST_LOG_MS,
             environment: "test".to_string(),
             enabled_modules: "executive,workforce,security,forensics,admin".to_string(),
+            dlp_module_enabled: true,
             state_dir: dir.join("state"),
             dlp_db_path: dir.join("dlp.sqlite"),
             evidence_root: dir.to_path_buf(),
@@ -293,6 +340,39 @@ mod tests {
         );
     }
 
+    #[test]
+    fn config_validation_rejects_placeholder_endpoints_and_shell_operators() {
+        let dir = tempfile::tempdir().unwrap();
+        let args = test_cli(dir.path());
+
+        let mut invalid = args.clone();
+        invalid.worktime_url = "http://192.0.2.13:5610".to_string();
+        assert!(
+            validate_portal_config(&invalid)
+                .unwrap_err()
+                .to_string()
+                .contains("placeholder")
+        );
+
+        let mut invalid = args.clone();
+        invalid.one_c_url = "http://198.51.100.2:8710".to_string();
+        assert!(
+            validate_portal_config(&invalid)
+                .unwrap_err()
+                .to_string()
+                .contains("placeholder")
+        );
+
+        let mut invalid = args.clone();
+        invalid.check_cmd = "detmir-check --json; curl http://127.0.0.1".to_string();
+        assert!(
+            validate_portal_config(&invalid)
+                .unwrap_err()
+                .to_string()
+                .contains("shell control")
+        );
+    }
+
     #[test]
     fn query_limits_reject_page_size_and_report_range() {
         let dir = tempfile::tempdir().unwrap();

adk-rust/crates/detmir-portal/src/production/metrics.rs

@@ -34,6 +34,10 @@ struct HttpMetricValue {
 #[derive(Clone, Debug, Default)]
 struct PortalMetrics {
     http: BTreeMap<HttpMetricKey, HttpMetricValue>,
+    report_requests_total: u64,
+    report_cache_hits_total: u64,
+    report_cache_misses_total: u64,
+    report_cache_stale_hits_total: u64,
     reports_generated_total: u64,
     ingestion_records_total: u64,
     ingestion_rejected_total: u64,
@@ -70,6 +74,32 @@ pub(crate) fn record_report_generated() {
     }
 }
 
+pub(crate) fn record_report_request() {
+    if let Ok(mut metrics) = portal_metrics().lock() {
+        metrics.report_requests_total = metrics.report_requests_total.saturating_add(1);
+    }
+}
+
+pub(crate) fn record_report_cache_hit() {
+    if let Ok(mut metrics) = portal_metrics().lock() {
+        metrics.report_cache_hits_total = metrics.report_cache_hits_total.saturating_add(1);
+    }
+}
+
+pub(crate) fn record_report_cache_stale_hit() {
+    if let Ok(mut metrics) = portal_metrics().lock() {
+        metrics.report_cache_hits_total = metrics.report_cache_hits_total.saturating_add(1);
+        metrics.report_cache_stale_hits_total =
+            metrics.report_cache_stale_hits_total.saturating_add(1);
+    }
+}
+
+pub(crate) fn record_report_cache_miss() {
+    if let Ok(mut metrics) = portal_metrics().lock() {
+        metrics.report_cache_misses_total = metrics.report_cache_misses_total.saturating_add(1);
+    }
+}
+
 pub(crate) fn record_ingestion_accepted() {
     if let Ok(mut metrics) = portal_metrics().lock() {
         metrics.ingestion_records_total = metrics.ingestion_records_total.saturating_add(1);
@@ -149,6 +179,26 @@ pub(crate) fn render_prometheus_metrics(args: &Cli) -> String {
         .ok();
     }
     for (name, help, value) in [
+        (
+            "awatch_report_requests_total",
+            "Report payload requests handled by the portal cache layer",
+            metrics.report_requests_total,
+        ),
+        (
+            "awatch_report_cache_hits_total",
+            "Report payload requests served from the in-process cache",
+            metrics.report_cache_hits_total,
+        ),
+        (
+            "awatch_report_cache_misses_total",
+            "Report payload requests that triggered report regeneration",
+            metrics.report_cache_misses_total,
+        ),
+        (
+            "awatch_report_cache_stale_hits_total",
+            "Report payload requests served from stale cache while refresh runs",
+            metrics.report_cache_stale_hits_total,
+        ),
         (
             "awatch_reports_generated_total",
             "Reports generated by the portal",

adk-rust/crates/detmir-portal/src/production/mod.rs

@@ -22,7 +22,8 @@ pub(crate) use limits::{is_limited_api_route, validate_api_query_limits, validat
 pub(crate) use logging::log_http_request;
 pub(crate) use metrics::{
     record_http_metric, record_ingestion_accepted, record_ingestion_rejected,
-    record_report_generated, render_prometheus_metrics,
+    record_report_cache_hit, record_report_cache_miss, record_report_cache_stale_hit,
+    record_report_generated, record_report_request, render_prometheus_metrics,
 };
 pub(crate) use readiness::build_readyz;
 pub(crate) use request_context::{http_request_metadata, mark_request_started};

adk-rust/crates/detmir-portal/src/snapshot_cache.rs

@@ -6,13 +6,20 @@
 
 use std::collections::BTreeMap;
 use std::sync::{Arc, Mutex};
+use std::thread;
 use std::time::{Duration, Instant};
 
 use crate::{Cli, HealthResponse, Snapshot, build_health, build_snapshot, now};
 
 const SNAPSHOT_CACHE_TTL: Duration = Duration::from_secs(120);
 
-pub(crate) type SnapshotCache = Arc<Mutex<Option<CachedSnapshot>>>;
+pub(crate) type SnapshotCache = Arc<Mutex<SnapshotCacheState>>;
+
+#[derive(Clone, Debug, Default)]
+pub(crate) struct SnapshotCacheState {
+    pub(crate) entry: Option<CachedSnapshot>,
+    pub(crate) refresh_in_progress: bool,
+}
 
 #[derive(Clone, Debug)]
 pub(crate) struct CachedSnapshot {
@@ -21,7 +28,7 @@ pub(crate) struct CachedSnapshot {
 }
 
 pub(crate) fn new_snapshot_cache() -> SnapshotCache {
-    Arc::new(Mutex::new(None))
+    Arc::new(Mutex::new(SnapshotCacheState::default()))
 }
 
 pub(crate) fn clone_snapshot_cache(cache: &SnapshotCache) -> SnapshotCache {
@@ -29,23 +36,76 @@ pub(crate) fn clone_snapshot_cache(cache: &SnapshotCache) -> SnapshotCache {
 }
 
 pub(crate) fn cached_snapshot(args: &Cli, cache: &SnapshotCache) -> Snapshot {
-    let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
-    if let Some(cached) = guard.as_ref() {
-        if cached.created.elapsed() <= SNAPSHOT_CACHE_TTL {
-            return cached.snapshot.clone();
+    {
+        let guard = cache.lock().expect("snapshot cache mutex poisoned");
+        if let Some(cached) = guard.entry.as_ref() {
+            if cached.created.elapsed() <= SNAPSHOT_CACHE_TTL {
+                return cached.snapshot.clone();
+            }
         }
     }
+
     let snapshot = build_snapshot(args);
-    *guard = Some(CachedSnapshot {
+    let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
+    guard.entry = Some(CachedSnapshot {
         created: Instant::now(),
         snapshot: snapshot.clone(),
     });
+    guard.refresh_in_progress = false;
     snapshot
 }
 
+pub(crate) fn cached_snapshot_or_refresh(args: &Cli, cache: &SnapshotCache) -> Option<Snapshot> {
+    let mut should_spawn = false;
+    let mut snapshot_to_return = None;
+    {
+        let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
+        if let Some(cached) = guard.entry.as_ref() {
+            let snapshot = cached.snapshot.clone();
+            if cached.created.elapsed() <= SNAPSHOT_CACHE_TTL {
+                return Some(snapshot);
+            }
+            if !guard.refresh_in_progress {
+                guard.refresh_in_progress = true;
+                should_spawn = true;
+            }
+            snapshot_to_return = Some(snapshot);
+        } else if !guard.refresh_in_progress {
+            guard.refresh_in_progress = true;
+            should_spawn = true;
+        }
+    }
+
+    if should_spawn {
+        spawn_snapshot_refresh(args.clone(), clone_snapshot_cache(cache));
+    }
+    snapshot_to_return
+}
+
+fn spawn_snapshot_refresh(args: Cli, cache: SnapshotCache) {
+    thread::spawn(move || {
+        let result =
+            std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| build_snapshot(&args)));
+        let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
+        match result {
+            Ok(snapshot) => {
+                guard.entry = Some(CachedSnapshot {
+                    created: Instant::now(),
+                    snapshot,
+                });
+            }
+            Err(_) => {
+                eprintln!("detmir-portal snapshot cache refresh panicked");
+            }
+        }
+        guard.refresh_in_progress = false;
+    });
+}
+
 pub(crate) fn build_fast_health(cache: &SnapshotCache) -> HealthResponse {
     match cache.try_lock() {
         Ok(guard) => guard
+            .entry
             .as_ref()
             .map(|cached| build_health(&cached.snapshot))
             .unwrap_or_else(lightweight_health),

adk-rust/crates/detmir-portal/src/workforce_kpi_explain.rs

@@ -549,6 +549,7 @@ mod tests {
         };
         Snapshot {
             generated_at_utc: "2026-06-07T10:00:00Z".to_string(),
+            dlp_module_enabled: true,
             detmir_status: SourceStatus {
                 ok: true,
                 status: "OK".to_string(),