Fix dlp health clippy warning

- default DetMir DLP runtime to core_only/disabled with load-guard protection

- add fail-closed placeholder validation and runtime-scoped artifact checks

- document operator re-enable flow for light profile and guard rollback

- update prod docs, env examples, and Ansible DLP defaults

README.md

@@ -198,11 +198,6 @@ Markdown-отчет собирает главный вывод, риски по
 extensions и future-направления без создания новых API или фиктивных
 collectors.
 
-Модульная схема комплекса с GitHub/Gitea-viewable Mermaid-графами:
-[docs/MODULE_ARCHITECTURE_GRAPH_RU.md](docs/MODULE_ARCHITECTURE_GRAPH_RU.md).
-Карта orchestration entrypoints:
-[docs/ORCHESTRATION_MAP_RU.md](docs/ORCHESTRATION_MAP_RU.md).
-
 ## Если дашборд пустой
 
 Обычно это значит одно из трех: выбран слишком узкий период времени, рабочий компьютер давно не присылал события или временно не обновилась витрина в Grafana. Начните с периода `Last 24 hours`, затем переходите к техническим разделам ниже.
@@ -364,8 +359,6 @@ collectors.
 - [Сторонние компоненты](THIRD_PARTY_COMPONENTS.md)
 - [Сторонние лицензии](THIRD_PARTY_LICENSES_RU.md)
 - [Архитектура](docs/ARCHITECTURE_RU.md)
-- [Модульная схема комплекса](docs/MODULE_ARCHITECTURE_GRAPH_RU.md)
-- [Карта оркестрации](docs/ORCHESTRATION_MAP_RU.md)
 - [Установка](docs/INSTALL_RU.md)
 - [Руководство администратора](docs/ADMIN_GUIDE_RU.md)
 - [Руководство оператора](docs/OPERATOR_GUIDE_RU.md)

adk-rust/Cargo.lock

@@ -561,6 +561,18 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
+[[package]]
+name = "containment-engine"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "chrono",
+ "clap",
+ "serde",
+ "serde_json",
+ "sha2",
+]
+
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -698,6 +710,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "clap",
+ "serde_json",
 ]
 
 [[package]]
@@ -739,6 +752,7 @@ dependencies = [
  "sha2",
  "tempfile",
  "tiny_http",
+ "url",
 ]
 
 [[package]]
@@ -1255,8 +1269,10 @@ dependencies = [
  "reqwest",
  "serde",
  "serde_json",
+ "sha2",
  "tempfile",
  "urlencoding",
+ "zip 2.4.2",
 ]
 
 [[package]]
@@ -2120,6 +2136,21 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "security-finding-inbox"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "chrono",
+ "clap",
+ "hayabusa-tools",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "sha2",
+ "tempfile",
+]
+
 [[package]]
 name = "semver"
 version = "1.0.28"

adk-rust/crates/aw-rus-healthd/src/main.rs

@@ -6,7 +6,7 @@ use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
 use std::time::{Duration, Instant};
 
-use anyhow::{Context, Result};
+use anyhow::{Context, Result, anyhow};
 use chrono::{DateTime, Duration as ChronoDuration, SecondsFormat, Utc};
 use clap::Parser;
 use detmir_core::{exit_codes, parse_utc_rfc3339};
@@ -25,10 +25,10 @@ struct Cli {
     #[arg(long, default_value = "http://127.0.0.1:5610")]
     worktime_api: String,
 
-    #[arg(long, default_value = "198.51.100.18")]
+    #[arg(long, default_value = "")]
     rdp_host: String,
 
-    #[arg(long, default_value = "HOST-EXAMPLE")]
+    #[arg(long, default_value = "")]
     rdp_hostname: String,
 
     #[arg(long, default_value = "/var/lib/activitywatch/health")]
@@ -61,6 +61,9 @@ struct Cli {
     #[arg(long, default_value_t = 3.0)]
     tcp_timeout_seconds: f64,
 
+    #[arg(long, default_value_t = true)]
+    rdp_tcp_required: bool,
+
     #[arg(long)]
     json: bool,
 }
@@ -129,6 +132,10 @@ impl Cli {
                 self.tcp_timeout_seconds,
             );
         }
+        if !cli_arg_present("--rdp-tcp-required") {
+            self.rdp_tcp_required =
+                env_bool_default("AW_RUS_HEALTH_RDP_TCP_REQUIRED", self.rdp_tcp_required);
+        }
         self
     }
 }
@@ -221,9 +228,42 @@ fn env_f64(name: &str, fallback: f64) -> f64 {
 }
 
 fn env_bool(name: &str) -> bool {
+    env_bool_default(name, false)
+}
+
+fn env_bool_default(name: &str, fallback: bool) -> bool {
     env_string(name)
-        .map(|value| matches!(value.to_ascii_lowercase().as_str(), "1" | "true" | "yes"))
-        .unwrap_or(false)
+        .map(|value| match value.to_ascii_lowercase().as_str() {
+            "1" | "true" | "yes" | "on" => true,
+            "0" | "false" | "no" | "off" => false,
+            _ => fallback,
+        })
+        .unwrap_or(fallback)
+}
+
+fn validate_cli_config(cli: &Cli) -> Result<()> {
+    validate_prod_host("rdp_host", &cli.rdp_host)?;
+    validate_prod_host("rdp_hostname", &cli.rdp_hostname)?;
+    Ok(())
+}
+
+fn validate_prod_host(name: &str, value: &str) -> Result<()> {
+    let value = value.trim();
+    if value.is_empty() {
+        return Err(anyhow!("invalid config {name}: value is empty"));
+    }
+    let lowered = value.to_ascii_lowercase();
+    if lowered == "host-example"
+        || lowered.ends_with(".example")
+        || lowered.starts_with("192.0.2.")
+        || lowered.starts_with("198.51.100.")
+        || lowered.starts_with("203.0.113.")
+    {
+        return Err(anyhow!(
+            "invalid config {name}: placeholder/documentation host is not allowed"
+        ));
+    }
+    Ok(())
 }
 
 fn load_env_file(path: &Path) {
@@ -681,6 +721,16 @@ fn normalize_aw_api_base(aw_server: &str) -> String {
     }
 }
 
+fn tcp_check_status(ok: bool, required: bool) -> &'static str {
+    if ok {
+        "ok"
+    } else if required {
+        "fail"
+    } else {
+        "warn"
+    }
+}
+
 fn validation_check(report: &mut ReportBuilder, validation_dir: &Path, max_age_seconds: i64) {
     let Some(path) = latest_validation_report(validation_dir) else {
         report.add(
@@ -812,15 +862,18 @@ fn run(cli: &Cli) -> Result<HealthReport> {
 
     for (port, label) in [(5985_u16, "winrm"), (3389_u16, "rdp")] {
         let (ok, message) = tcp_connect(&cli.rdp_host, port, cli.tcp_timeout_seconds);
+        let status = tcp_check_status(ok, cli.rdp_tcp_required);
         report.add(
             format!("tcp:{label}"),
-            if ok { "ok" } else { "fail" },
+            status,
             if ok {
                 message
-            } else {
+            } else if cli.rdp_tcp_required {
                 format!("unreachable: {message}")
+            } else {
+                format!("optional unreachable: {message}")
             },
-            json!({"host": cli.rdp_host, "port": port}),
+            json!({"host": cli.rdp_host, "port": port, "required": cli.rdp_tcp_required}),
         );
     }
 
@@ -949,6 +1002,7 @@ fn run(cli: &Cli) -> Result<HealthReport> {
 
 fn main() -> Result<()> {
     let cli = Cli::parse().apply_env();
+    validate_cli_config(&cli)?;
     let report = run(&cli)?;
     let json_text = serde_json::to_string_pretty(&report)? + "\n";
     let text = render_text(&report) + "\n";
@@ -1029,4 +1083,20 @@ mod tests {
             "http://127.0.0.1:5600/api/0"
         );
     }
+
+    #[test]
+    fn optional_rdp_tcp_downgrades_unreachable_to_warn() {
+        assert_eq!(tcp_check_status(false, true), "fail");
+        assert_eq!(tcp_check_status(false, false), "warn");
+        assert_eq!(tcp_check_status(true, false), "ok");
+    }
+
+    #[test]
+    fn healthd_rejects_placeholder_hosts() {
+        assert!(validate_prod_host("rdp_host", "192.168.100.19").is_ok());
+        assert!(validate_prod_host("rdp_hostname", "SHARKON2025").is_ok());
+        assert!(validate_prod_host("rdp_host", "198.51.100.18").is_err());
+        assert!(validate_prod_host("rdp_hostname", "HOST-EXAMPLE").is_err());
+        assert!(validate_prod_host("rdp_host", "").is_err());
+    }
 }

adk-rust/crates/check-aw-data/src/main.rs

@@ -43,6 +43,9 @@ struct Cli {
 
     #[arg(long, default_value_t = false)]
     no_color: bool,
+
+    #[arg(long, default_value_t = true)]
+    dlp_enabled: bool,
 }
 
 #[derive(Debug, Clone)]
@@ -109,7 +112,12 @@ fn main() {
 }
 
 fn run() -> Result<i32> {
-    let cli = Cli::parse();
+    let mut cli = Cli::parse();
+    if let Some(value) =
+        env_nonempty("AW_DLP_ENABLED").or_else(|| env_nonempty("DETMIR_DLP_ENABLED"))
+    {
+        cli.dlp_enabled = parse_env_flag(&value);
+    }
     let server = cli
         .server
         .or_else(|| env_nonempty("AW_CHECK_SERVER"))
@@ -172,7 +180,11 @@ fn run() -> Result<i32> {
         "---------------------------------------------", "--------", "----------------------"
     );
 
-    for bucket in BUCKETS {
+    for bucket in BUCKETS
+        .iter()
+        .copied()
+        .filter(|bucket| cli.dlp_enabled || !bucket.starts_with("aw-dlp-"))
+    {
         let bucket_full = format!("{bucket}_{host}");
         let event = bucket_event(
             &server,
@@ -190,6 +202,15 @@ fn run() -> Result<i32> {
             render_status(&colors, status)
         );
     }
+    if !cli.dlp_enabled {
+        println!(
+            "{:<45} {:<8} {:<22} {}",
+            "aw-dlp-*",
+            "-",
+            "disabled",
+            colors.paint(colors.cyan, "SKIPPED")
+        );
+    }
 
     println!();
     println!("--- CORS Check ---");
@@ -493,6 +514,13 @@ fn env_nonempty(name: &str) -> Option<String> {
         .filter(|value| !value.is_empty())
 }
 
+fn parse_env_flag(value: &str) -> bool {
+    matches!(
+        value.trim().to_ascii_lowercase().as_str(),
+        "1" | "true" | "yes" | "on"
+    )
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

adk-rust/crates/detmir-auto/src/main.rs

@@ -1,6 +1,7 @@
 use std::fs::{self, File, OpenOptions};
 use std::io::Write;
 use std::os::unix::fs::symlink;
+use std::os::unix::process::CommandExt;
 use std::path::{Path, PathBuf};
 use std::process::{Command, Output, Stdio};
 use std::time::{Duration, SystemTime};
@@ -198,6 +199,7 @@ fn run_to_file(
 
     let mut child = Command::new(command)
         .args(args)
+        .process_group(0)
         .stdout(Stdio::from(stdout))
         .stderr(Stdio::from(stderr))
         .spawn()
@@ -209,7 +211,7 @@ fn run_to_file(
             break status.code().unwrap_or(1);
         }
         if started.elapsed() >= timeout {
-            let _ = child.kill();
+            terminate_process_group(child.id());
             let _ = child.wait();
             let mut stderr = OpenOptions::new().append(true).open(&stderr_path)?;
             writeln!(
@@ -234,6 +236,17 @@ fn run_to_file(
     Ok(rc)
 }
 
+fn terminate_process_group(child_pid: u32) {
+    let process_group = format!("-{child_pid}");
+    let _ = Command::new("/bin/kill")
+        .args(["-TERM", "--", &process_group])
+        .status();
+    std::thread::sleep(Duration::from_secs(2));
+    let _ = Command::new("/bin/kill")
+        .args(["-KILL", "--", &process_group])
+        .status();
+}
+
 fn read_rc(path: &Path) -> i32 {
     fs::read_to_string(path)
         .ok()
@@ -411,6 +424,7 @@ fn write_report(
 fn run_report_command(polli_bin: &str, bundle: File, timeout: Duration) -> Result<Output> {
     let mut child = Command::new(polli_bin)
         .args(["--model", "text.daily", "--max-tokens", "900"])
+        .process_group(0)
         .stdin(Stdio::from(bundle))
         .stdout(Stdio::piped())
         .stderr(Stdio::piped())
@@ -425,7 +439,7 @@ fn run_report_command(polli_bin: &str, bundle: File, timeout: Duration) -> Resul
                 .with_context(|| format!("failed to collect {polli_bin} output"));
         }
         if started.elapsed() >= timeout {
-            let _ = child.kill();
+            terminate_process_group(child.id());
             let _ = child.wait();
             anyhow::bail!(
                 "Pollinations report timed out after {} seconds",

adk-rust/crates/detmir-check/src/main.rs

@@ -1,5 +1,6 @@
 use std::io::Read;
 use std::net::{SocketAddr, TcpStream};
+use std::os::unix::process::CommandExt;
 use std::process::{Command, Stdio};
 use std::time::{Duration, Instant};
 
@@ -89,9 +90,15 @@ struct Cli {
     #[arg(long, default_value_t = 45)]
     dlp_timeout_seconds: u64,
 
+    #[arg(long, default_value_t = 150)]
+    overall_timeout_seconds: u64,
+
     #[arg(long, default_value_t = false)]
     disable_dlp_health_check: bool,
 
+    #[arg(long, default_value_t = true)]
+    dlp_enabled: bool,
+
     #[arg(long, default_value_t = false)]
     disable_portal_check: bool,
 }
@@ -193,8 +200,8 @@ fn parse_env_flag(value: &str) -> bool {
     )
 }
 
-fn bucket_specs(hostname: &str) -> Vec<BucketSpec> {
-    vec![
+fn bucket_specs(hostname: &str, dlp_enabled: bool) -> Vec<BucketSpec> {
+    let mut specs = vec![
         BucketSpec {
             label: "AFK watcher",
             bucket: format!("aw-watcher-afk_{hostname}"),
@@ -219,31 +226,36 @@ fn bucket_specs(hostname: &str) -> Vec<BucketSpec> {
             max_age_seconds: None,
             mode: BucketMode::EventDriven,
         },
-        BucketSpec {
-            label: "DLP signals",
-            bucket: format!("aw-dlp-endpoint-signals_{hostname}"),
-            max_age_seconds: Some(10 * 60),
-            mode: BucketMode::InteractiveFresh,
-        },
-        BucketSpec {
-            label: "DLP incidents",
-            bucket: format!("aw-dlp-incidents_{hostname}"),
-            max_age_seconds: None,
-            mode: BucketMode::EventDriven,
-        },
-        BucketSpec {
-            label: "DLP review",
-            bucket: format!("aw-dlp-review_{hostname}"),
-            max_age_seconds: None,
-            mode: BucketMode::EventDriven,
-        },
-        BucketSpec {
-            label: "DLP rules",
-            bucket: format!("aw-dlp-rules_{hostname}"),
-            max_age_seconds: None,
-            mode: BucketMode::EventDriven,
-        },
-    ]
+    ];
+    if dlp_enabled {
+        specs.extend([
+            BucketSpec {
+                label: "DLP signals",
+                bucket: format!("aw-dlp-endpoint-signals_{hostname}"),
+                max_age_seconds: Some(10 * 60),
+                mode: BucketMode::InteractiveFresh,
+            },
+            BucketSpec {
+                label: "DLP incidents",
+                bucket: format!("aw-dlp-incidents_{hostname}"),
+                max_age_seconds: None,
+                mode: BucketMode::EventDriven,
+            },
+            BucketSpec {
+                label: "DLP review",
+                bucket: format!("aw-dlp-review_{hostname}"),
+                max_age_seconds: None,
+                mode: BucketMode::EventDriven,
+            },
+            BucketSpec {
+                label: "DLP rules",
+                bucket: format!("aw-dlp-rules_{hostname}"),
+                max_age_seconds: None,
+                mode: BucketMode::EventDriven,
+            },
+        ]);
+    }
+    specs
 }
 
 fn build_headers(items: &[(&str, &str)]) -> Result<HeaderMap> {
@@ -387,7 +399,20 @@ fn service_checks(args: &Cli) -> Vec<ServiceCheck> {
     if security_events_clickhouse_enabled(args) {
         checks.push(clickhouse_security_events_check(args));
     }
-    if !args.disable_dlp_health_check {
+    if !args.dlp_enabled {
+        checks.push(ServiceCheck {
+            name: "aw-dlp-mode".to_string(),
+            required: false,
+            ok: true,
+            url: None,
+            payload: Some(serde_json::json!({
+                "mode": "disabled",
+                "reason": "DETMIR_DLP_ENABLED=false",
+                "checks_skipped": ["DLP health command", "DLP buckets"]
+            })),
+            error: None,
+        });
+    } else if !args.disable_dlp_health_check {
         checks.push(dlp_health_check(args));
     }
     checks
@@ -500,6 +525,7 @@ fn run_shell_command_timeout(command: &str, timeout: Duration) -> Result<Command
     let mut child = Command::new("/bin/sh")
         .arg("-lc")
         .arg(command)
+        .process_group(0)
         .stdout(Stdio::piped())
         .stderr(Stdio::piped())
         .spawn()
@@ -510,7 +536,7 @@ fn run_shell_command_timeout(command: &str, timeout: Duration) -> Result<Command
             return read_command_output(child, status.code(), false);
         }
         if started.elapsed() >= timeout {
-            let _ = child.kill();
+            terminate_process_group(child.id());
             let _ = child.wait();
             return read_command_output(child, None, true);
         }
@@ -518,6 +544,17 @@ fn run_shell_command_timeout(command: &str, timeout: Duration) -> Result<Command
     }
 }
 
+fn terminate_process_group(child_pid: u32) {
+    let process_group = format!("-{child_pid}");
+    let _ = Command::new("/bin/kill")
+        .args(["-TERM", "--", &process_group])
+        .status();
+    std::thread::sleep(Duration::from_secs(2));
+    let _ = Command::new("/bin/kill")
+        .args(["-KILL", "--", &process_group])
+        .status();
+}
+
 fn read_command_output(
     mut child: std::process::Child,
     code: Option<i32>,
@@ -796,7 +833,7 @@ fn bucket_health(args: &Cli) -> Result<Vec<BucketCheck>> {
     let interactive_required = interactive_required(&client, &args.hostname, now);
     let mut out = Vec::new();
 
-    for spec in bucket_specs(&args.hostname) {
+    for spec in bucket_specs(&args.hostname, args.dlp_enabled) {
         if matches!(spec.mode, BucketMode::EventDriven) {
             out.push(BucketCheck {
                 label: spec.label.to_string(),
@@ -993,6 +1030,19 @@ fn render_text(report: &CheckReport) -> String {
 
 fn main() -> Result<()> {
     let mut args = Cli::parse();
+    args.service_timeout_seconds = env_u64(
+        "DETMIR_SERVICE_TIMEOUT_SECONDS",
+        args.service_timeout_seconds,
+    );
+    args.bucket_timeout_seconds =
+        env_u64("DETMIR_BUCKET_TIMEOUT_SECONDS", args.bucket_timeout_seconds);
+    args.tcp_timeout_seconds = env_f64("DETMIR_TCP_TIMEOUT_SECONDS", args.tcp_timeout_seconds);
+    args.dlp_timeout_seconds = env_u64("DETMIR_DLP_TIMEOUT_SECONDS", args.dlp_timeout_seconds);
+    args.overall_timeout_seconds = env_u64(
+        "DETMIR_CHECK_OVERALL_TIMEOUT_SECONDS",
+        args.overall_timeout_seconds,
+    );
+    start_overall_timeout_watchdog(args.overall_timeout_seconds);
     args.aw_api = env_or_default("DETMIR_AW_API", &args.aw_api);
     args.worktime_url = env_or_default("DETMIR_WORKTIME_URL", &args.worktime_url);
     args.one_c_url = env_or_default("DETMIR_ONE_C_URL", &args.one_c_url);
@@ -1011,6 +1061,12 @@ fn main() -> Result<()> {
     if env_flag_enabled("DETMIR_DISABLE_DLP_HEALTH_CHECK") {
         args.disable_dlp_health_check = true;
     }
+    if let Some(value) = std::env::var("DETMIR_DLP_ENABLED")
+        .ok()
+        .filter(|value| !value.is_empty())
+    {
+        args.dlp_enabled = parse_env_flag(&value);
+    }
     if env_flag_enabled("DETMIR_DISABLE_PORTAL_CHECK") {
         args.disable_portal_check = true;
     }
@@ -1028,6 +1084,31 @@ fn main() -> Result<()> {
     });
 }
 
+fn env_u64(name: &str, fallback: u64) -> u64 {
+    std::env::var(name)
+        .ok()
+        .and_then(|value| value.parse().ok())
+        .unwrap_or(fallback)
+}
+
+fn env_f64(name: &str, fallback: f64) -> f64 {
+    std::env::var(name)
+        .ok()
+        .and_then(|value| value.parse().ok())
+        .unwrap_or(fallback)
+}
+
+fn start_overall_timeout_watchdog(seconds: u64) {
+    if seconds == 0 {
+        return;
+    }
+    std::thread::spawn(move || {
+        std::thread::sleep(Duration::from_secs(seconds));
+        eprintln!("detmir-check timed out after {seconds} seconds");
+        std::process::exit(124);
+    });
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -1095,6 +1176,28 @@ mod tests {
         assert!(!parse_env_flag("false"));
     }
 
+    #[test]
+    fn dlp_disabled_removes_dlp_bucket_specs() {
+        let enabled = bucket_specs("HOST-EXAMPLE", true);
+        assert!(
+            enabled
+                .iter()
+                .any(|spec| spec.bucket.starts_with("aw-dlp-"))
+        );
+
+        let disabled = bucket_specs("HOST-EXAMPLE", false);
+        assert!(
+            disabled
+                .iter()
+                .all(|spec| !spec.bucket.starts_with("aw-dlp-"))
+        );
+        assert!(
+            disabled
+                .iter()
+                .any(|spec| spec.bucket.starts_with("aw-worktime-sessions_"))
+        );
+    }
+
     #[test]
     fn clickhouse_database_identifier_rejects_injection() {
         assert_eq!(

adk-rust/crates/detmir-dlp/Cargo.toml

@@ -9,3 +9,4 @@ publish.workspace = true
 [dependencies]
 anyhow.workspace = true
 clap.workspace = true
+serde_json.workspace = true

adk-rust/crates/detmir-dlp/src/main.rs

@@ -1,5 +1,6 @@
 use std::io::{self, Write};
-use std::process::Command;
+use std::process::{Command, Stdio};
+use std::time::{Duration, Instant};
 
 use anyhow::{Context, Result};
 use clap::Parser;
@@ -19,8 +20,14 @@ struct Cli {
     #[arg(long, default_value_t = 10)]
     connect_timeout_seconds: u64,
 
+    #[arg(long, default_value_t = 90)]
+    timeout_seconds: u64,
+
     #[arg(long, default_value = DEFAULT_REMOTE_COMMAND)]
     remote_command: String,
+
+    #[arg(long, default_value_t = true)]
+    enabled: bool,
 }
 
 impl Cli {
@@ -31,6 +38,8 @@ impl Cli {
         );
         self.remote_command = env_first(&["DETMIR_DLP_REMOTE_COMMAND"], &self.remote_command);
         self.ssh_bin = env_first(&["DETMIR_SSH_BIN"], &self.ssh_bin);
+        self.timeout_seconds = env_u64("DETMIR_DLP_TIMEOUT_SECONDS", self.timeout_seconds);
+        self.enabled = env_bool("DETMIR_DLP_ENABLED", self.enabled);
         self
     }
 }
@@ -42,6 +51,25 @@ fn env_first(names: &[&str], fallback: &str) -> String {
         .unwrap_or_else(|| fallback.to_string())
 }
 
+fn env_u64(name: &str, fallback: u64) -> u64 {
+    std::env::var(name)
+        .ok()
+        .and_then(|value| value.parse().ok())
+        .unwrap_or(fallback)
+}
+
+fn env_bool(name: &str, fallback: bool) -> bool {
+    std::env::var(name)
+        .ok()
+        .map(|value| {
+            matches!(
+                value.trim().to_ascii_lowercase().as_str(),
+                "1" | "true" | "yes" | "on"
+            )
+        })
+        .unwrap_or(fallback)
+}
+
 fn ssh_args(cli: &Cli) -> Vec<String> {
     vec![
         "-o".to_string(),
@@ -56,22 +84,76 @@ fn ssh_args(cli: &Cli) -> Vec<String> {
 }
 
 fn run(cli: Cli) -> Result<i32> {
+    if !cli.enabled {
+        println!(
+            "{}",
+            serde_json::to_string_pretty(&serde_json::json!({
+                "ok": true,
+                "counts": {"ok": 1, "warn": 0, "fail": 0},
+                "results": [{
+                    "name": "dlp:mode",
+                    "status": "ok",
+                    "summary": "DLP health check disabled by DETMIR_DLP_ENABLED=false",
+                    "details": {
+                        "mode": "disabled",
+                        "load_reduction": ["aw-dlp health ssh probe skipped"]
+                    }
+                }]
+            }))?
+        );
+        return Ok(0);
+    }
+
     let args = ssh_args(&cli);
-    let output = Command::new(&cli.ssh_bin)
+    let mut child = Command::new(&cli.ssh_bin)
         .args(&args)
-        .output()
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .spawn()
         .with_context(|| format!("failed to execute {}", cli.ssh_bin))?;
 
+    let started = Instant::now();
+    let mut timed_out = false;
+    loop {
+        if child.try_wait()?.is_some() {
+            break;
+        }
+        if started.elapsed() >= Duration::from_secs(cli.timeout_seconds) {
+            timed_out = true;
+            terminate_child(&mut child);
+            break;
+        }
+        std::thread::sleep(Duration::from_millis(100));
+    }
+
+    let output = child
+        .wait_with_output()
+        .context("failed to collect SSH output")?;
     io::stdout()
         .write_all(&output.stdout)
         .context("failed to write DLP stdout")?;
     io::stderr()
         .write_all(&output.stderr)
         .context("failed to write DLP stderr")?;
+    if timed_out {
+        writeln!(
+            io::stderr(),
+            "detmir-dlp timed out after {} seconds",
+            cli.timeout_seconds
+        )
+        .context("failed to write timeout message")?;
+        return Ok(124);
+    }
 
     Ok(output.status.code().unwrap_or(1))
 }
 
+fn terminate_child(child: &mut std::process::Child) {
+    let _ = child.kill();
+    std::thread::sleep(Duration::from_secs(2));
+    let _ = child.kill();
+}
+
 fn main() -> Result<()> {
     let cli = Cli::parse().apply_env();
     let code = run(cli)?;
@@ -88,7 +170,9 @@ mod tests {
             ssh_bin: "ssh".to_string(),
             ssh_target: DEFAULT_SSH_TARGET.to_string(),
             connect_timeout_seconds: 10,
+            timeout_seconds: 90,
             remote_command: DEFAULT_REMOTE_COMMAND.to_string(),
+            enabled: true,
         };
         assert_eq!(
             ssh_args(&cli),

adk-rust/crates/detmir-portal/Cargo.toml

@@ -18,6 +18,7 @@ serde_json.workspace = true
 serde_yaml.workspace = true
 sha2.workspace = true
 tiny_http.workspace = true
+url.workspace = true
 
 [dev-dependencies]
 tempfile.workspace = true

adk-rust/crates/detmir-portal/src/production/limits.rs

@@ -11,6 +11,7 @@ use anyhow::{Result, anyhow};
 use chrono::NaiveDate;
 use serde_json::{Value, json};
 use tiny_http::StatusCode;
+use url::Url;
 
 use crate::{
     Cli, MAX_ALLOWED_PAGE_SIZE, MAX_ALLOWED_REPORT_DATE_RANGE_DAYS, MAX_ALLOWED_REQUEST_BODY_BYTES,
@@ -77,6 +78,11 @@ pub(crate) fn validate_portal_config(args: &Cli) -> Result<()> {
             "invalid config max_request_body_bytes: expected 1024..={MAX_ALLOWED_REQUEST_BODY_BYTES}"
         ));
     }
+    validate_runtime_url("worktime_url", &args.worktime_url)?;
+    validate_runtime_url("one_c_url", &args.one_c_url)?;
+    validate_probe_command("status_cmd", &args.status_cmd)?;
+    validate_probe_command("check_cmd", &args.check_cmd)?;
+    validate_probe_command("failed_units_cmd", &args.failed_units_cmd)?;
 
     // SECURITY: environment and module names can reach metrics/log labels.
     // Restrict them to short ASCII tokens to avoid label injection and runaway
@@ -112,6 +118,46 @@ pub(crate) fn validate_portal_config(args: &Cli) -> Result<()> {
     Ok(())
 }
 
+fn validate_runtime_url(name: &str, value: &str) -> Result<()> {
+    let url = Url::parse(value).map_err(|err| anyhow!("invalid config {name}: {err}"))?;
+    if !matches!(url.scheme(), "http" | "https") {
+        return Err(anyhow!("invalid config {name}: expected http or https URL"));
+    }
+    let Some(host) = url.host_str() else {
+        return Err(anyhow!("invalid config {name}: missing host"));
+    };
+    if is_placeholder_host(host) {
+        return Err(anyhow!(
+            "invalid config {name}: placeholder/documentation host is not allowed in production"
+        ));
+    }
+    Ok(())
+}
+
+fn is_placeholder_host(host: &str) -> bool {
+    let host = host.trim().to_ascii_lowercase();
+    host.is_empty()
+        || host == "host-example"
+        || host.ends_with(".example")
+        || host.starts_with("192.0.2.")
+        || host.starts_with("198.51.100.")
+        || host.starts_with("203.0.113.")
+}
+
+fn validate_probe_command(name: &str, command: &str) -> Result<()> {
+    let command = command.trim();
+    if command.is_empty() {
+        return Err(anyhow!("invalid config {name}: command is empty"));
+    }
+    let forbidden = ['\n', '\r', '\0', ';', '|', '&', '<', '>', '`'];
+    if command.contains("$(") || command.chars().any(|ch| forbidden.contains(&ch)) {
+        return Err(anyhow!(
+            "invalid config {name}: shell control operators are not allowed"
+        ));
+    }
+    Ok(())
+}
+
 fn is_safe_environment_name(value: &str) -> bool {
     let value = value.trim();
     !value.is_empty()
@@ -230,6 +276,7 @@ mod tests {
             slow_request_log_ms: DEFAULT_SLOW_REQUEST_LOG_MS,
             environment: "test".to_string(),
             enabled_modules: "executive,workforce,security,forensics,admin".to_string(),
+            dlp_module_enabled: true,
             state_dir: dir.join("state"),
             dlp_db_path: dir.join("dlp.sqlite"),
             evidence_root: dir.to_path_buf(),
@@ -293,6 +340,39 @@ mod tests {
         );
     }
 
+    #[test]
+    fn config_validation_rejects_placeholder_endpoints_and_shell_operators() {
+        let dir = tempfile::tempdir().unwrap();
+        let args = test_cli(dir.path());
+
+        let mut invalid = args.clone();
+        invalid.worktime_url = "http://192.0.2.13:5610".to_string();
+        assert!(
+            validate_portal_config(&invalid)
+                .unwrap_err()
+                .to_string()
+                .contains("placeholder")
+        );
+
+        let mut invalid = args.clone();
+        invalid.one_c_url = "http://198.51.100.2:8710".to_string();
+        assert!(
+            validate_portal_config(&invalid)
+                .unwrap_err()
+                .to_string()
+                .contains("placeholder")
+        );
+
+        let mut invalid = args.clone();
+        invalid.check_cmd = "detmir-check --json; curl http://127.0.0.1".to_string();
+        assert!(
+            validate_portal_config(&invalid)
+                .unwrap_err()
+                .to_string()
+                .contains("shell control")
+        );
+    }
+
     #[test]
     fn query_limits_reject_page_size_and_report_range() {
         let dir = tempfile::tempdir().unwrap();

adk-rust/crates/detmir-portal/src/production/metrics.rs

@@ -34,6 +34,10 @@ struct HttpMetricValue {
 #[derive(Clone, Debug, Default)]
 struct PortalMetrics {
     http: BTreeMap<HttpMetricKey, HttpMetricValue>,
+    report_requests_total: u64,
+    report_cache_hits_total: u64,
+    report_cache_misses_total: u64,
+    report_cache_stale_hits_total: u64,
     reports_generated_total: u64,
     ingestion_records_total: u64,
     ingestion_rejected_total: u64,
@@ -70,6 +74,32 @@ pub(crate) fn record_report_generated() {
     }
 }
 
+pub(crate) fn record_report_request() {
+    if let Ok(mut metrics) = portal_metrics().lock() {
+        metrics.report_requests_total = metrics.report_requests_total.saturating_add(1);
+    }
+}
+
+pub(crate) fn record_report_cache_hit() {
+    if let Ok(mut metrics) = portal_metrics().lock() {
+        metrics.report_cache_hits_total = metrics.report_cache_hits_total.saturating_add(1);
+    }
+}
+
+pub(crate) fn record_report_cache_stale_hit() {
+    if let Ok(mut metrics) = portal_metrics().lock() {
+        metrics.report_cache_hits_total = metrics.report_cache_hits_total.saturating_add(1);
+        metrics.report_cache_stale_hits_total =
+            metrics.report_cache_stale_hits_total.saturating_add(1);
+    }
+}
+
+pub(crate) fn record_report_cache_miss() {
+    if let Ok(mut metrics) = portal_metrics().lock() {
+        metrics.report_cache_misses_total = metrics.report_cache_misses_total.saturating_add(1);
+    }
+}
+
 pub(crate) fn record_ingestion_accepted() {
     if let Ok(mut metrics) = portal_metrics().lock() {
         metrics.ingestion_records_total = metrics.ingestion_records_total.saturating_add(1);
@@ -149,6 +179,26 @@ pub(crate) fn render_prometheus_metrics(args: &Cli) -> String {
         .ok();
     }
     for (name, help, value) in [
+        (
+            "awatch_report_requests_total",
+            "Report payload requests handled by the portal cache layer",
+            metrics.report_requests_total,
+        ),
+        (
+            "awatch_report_cache_hits_total",
+            "Report payload requests served from the in-process cache",
+            metrics.report_cache_hits_total,
+        ),
+        (
+            "awatch_report_cache_misses_total",
+            "Report payload requests that triggered report regeneration",
+            metrics.report_cache_misses_total,
+        ),
+        (
+            "awatch_report_cache_stale_hits_total",
+            "Report payload requests served from stale cache while refresh runs",
+            metrics.report_cache_stale_hits_total,
+        ),
         (
             "awatch_reports_generated_total",
             "Reports generated by the portal",

adk-rust/crates/detmir-portal/src/production/mod.rs

@@ -22,7 +22,8 @@ pub(crate) use limits::{is_limited_api_route, validate_api_query_limits, validat
 pub(crate) use logging::log_http_request;
 pub(crate) use metrics::{
     record_http_metric, record_ingestion_accepted, record_ingestion_rejected,
-    record_report_generated, render_prometheus_metrics,
+    record_report_cache_hit, record_report_cache_miss, record_report_cache_stale_hit,
+    record_report_generated, record_report_request, render_prometheus_metrics,
 };
 pub(crate) use readiness::build_readyz;
 pub(crate) use request_context::{http_request_metadata, mark_request_started};

adk-rust/crates/detmir-portal/src/snapshot_cache.rs

@@ -6,13 +6,20 @@
 
 use std::collections::BTreeMap;
 use std::sync::{Arc, Mutex};
+use std::thread;
 use std::time::{Duration, Instant};
 
 use crate::{Cli, HealthResponse, Snapshot, build_health, build_snapshot, now};
 
 const SNAPSHOT_CACHE_TTL: Duration = Duration::from_secs(120);
 
-pub(crate) type SnapshotCache = Arc<Mutex<Option<CachedSnapshot>>>;
+pub(crate) type SnapshotCache = Arc<Mutex<SnapshotCacheState>>;
+
+#[derive(Clone, Debug, Default)]
+pub(crate) struct SnapshotCacheState {
+    pub(crate) entry: Option<CachedSnapshot>,
+    pub(crate) refresh_in_progress: bool,
+}
 
 #[derive(Clone, Debug)]
 pub(crate) struct CachedSnapshot {
@@ -21,7 +28,7 @@ pub(crate) struct CachedSnapshot {
 }
 
 pub(crate) fn new_snapshot_cache() -> SnapshotCache {
-    Arc::new(Mutex::new(None))
+    Arc::new(Mutex::new(SnapshotCacheState::default()))
 }
 
 pub(crate) fn clone_snapshot_cache(cache: &SnapshotCache) -> SnapshotCache {
@@ -29,23 +36,76 @@ pub(crate) fn clone_snapshot_cache(cache: &SnapshotCache) -> SnapshotCache {
 }
 
 pub(crate) fn cached_snapshot(args: &Cli, cache: &SnapshotCache) -> Snapshot {
-    let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
-    if let Some(cached) = guard.as_ref() {
-        if cached.created.elapsed() <= SNAPSHOT_CACHE_TTL {
-            return cached.snapshot.clone();
+    {
+        let guard = cache.lock().expect("snapshot cache mutex poisoned");
+        if let Some(cached) = guard.entry.as_ref() {
+            if cached.created.elapsed() <= SNAPSHOT_CACHE_TTL {
+                return cached.snapshot.clone();
+            }
         }
     }
+
     let snapshot = build_snapshot(args);
-    *guard = Some(CachedSnapshot {
+    let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
+    guard.entry = Some(CachedSnapshot {
         created: Instant::now(),
         snapshot: snapshot.clone(),
     });
+    guard.refresh_in_progress = false;
     snapshot
 }
 
+pub(crate) fn cached_snapshot_or_refresh(args: &Cli, cache: &SnapshotCache) -> Option<Snapshot> {
+    let mut should_spawn = false;
+    let mut snapshot_to_return = None;
+    {
+        let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
+        if let Some(cached) = guard.entry.as_ref() {
+            let snapshot = cached.snapshot.clone();
+            if cached.created.elapsed() <= SNAPSHOT_CACHE_TTL {
+                return Some(snapshot);
+            }
+            if !guard.refresh_in_progress {
+                guard.refresh_in_progress = true;
+                should_spawn = true;
+            }
+            snapshot_to_return = Some(snapshot);
+        } else if !guard.refresh_in_progress {
+            guard.refresh_in_progress = true;
+            should_spawn = true;
+        }
+    }
+
+    if should_spawn {
+        spawn_snapshot_refresh(args.clone(), clone_snapshot_cache(cache));
+    }
+    snapshot_to_return
+}
+
+fn spawn_snapshot_refresh(args: Cli, cache: SnapshotCache) {
+    thread::spawn(move || {
+        let result =
+            std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| build_snapshot(&args)));
+        let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
+        match result {
+            Ok(snapshot) => {
+                guard.entry = Some(CachedSnapshot {
+                    created: Instant::now(),
+                    snapshot,
+                });
+            }
+            Err(_) => {
+                eprintln!("detmir-portal snapshot cache refresh panicked");
+            }
+        }
+        guard.refresh_in_progress = false;
+    });
+}
+
 pub(crate) fn build_fast_health(cache: &SnapshotCache) -> HealthResponse {
     match cache.try_lock() {
         Ok(guard) => guard
+            .entry
             .as_ref()
             .map(|cached| build_health(&cached.snapshot))
             .unwrap_or_else(lightweight_health),

adk-rust/crates/detmir-portal/src/workforce_kpi_explain.rs

@@ -549,6 +549,7 @@ mod tests {
         };
         Snapshot {
             generated_at_utc: "2026-06-07T10:00:00Z".to_string(),
+            dlp_module_enabled: true,
             detmir_status: SourceStatus {
                 ok: true,
                 status: "OK".to_string(),

adk-rust/crates/detmir-readiness/src/main.rs

@@ -18,7 +18,9 @@ const DEFAULT_AW_ENV_FILE: &str = "/etc/activitywatch/aw-server.env";
 const DEFAULT_GRAFANA_ENV_FILE: &str = "/etc/detmir-grafana-check.env";
 const DEFAULT_GRAFANA_URL: &str = "http://127.0.0.1:3000";
 const DEFAULT_GRAFANA_DATASOURCE_UID: &str = "influxdb_aw";
-const DEFAULT_SYSTEMD_SERVICES: &str = "activitywatch-server,aw-worktime-api,aw-worktime-influx-exporter.timer,aw-dlp-influx-exporter.timer";
+const DEFAULT_SYSTEMD_SERVICES: &str =
+    "activitywatch-server,aw-worktime-api,aw-worktime-influx-exporter.timer";
+const DEFAULT_DLP_SYSTEMD_SERVICES: &str = "aw-dlp-influx-exporter.timer";
 const DEFAULT_RETENTION_DAYS: i64 = 30;
 
 #[derive(Debug, Parser)]
@@ -218,14 +220,26 @@ fn run(cli: &Cli) -> Result<Report> {
     let mut checks = Vec::new();
     let worktime = influx_config(&aw_env, "AW_WORKTIME_INFLUX");
     let dlp = influx_config(&aw_env, "AW_DLP_INFLUX");
+    let dlp_enabled = env_bool(&aw_env, "AW_DLP_ENABLED", true);
 
     checks.push(check_influx_env(&worktime, cli.allow_disabled_influx));
-    checks.push(check_influx_env(&dlp, cli.allow_disabled_influx));
+    if dlp_enabled {
+        checks.push(check_influx_env(&dlp, cli.allow_disabled_influx));
+    } else {
+        checks.push(warn(
+            "env:AW_DLP_INFLUX",
+            "DLP Influx runtime disabled by AW_DLP_ENABLED=false",
+            json!({"enabled": false, "mode": "disabled"}),
+        ));
+    }
 
     if cli.skip_systemd {
         checks.push(warn("systemd", "systemd checks skipped", json!({})));
     } else {
-        checks.extend(check_systemd_services(&cli.systemd_services));
+        checks.extend(check_systemd_services(&systemd_services_for_mode(
+            &cli.systemd_services,
+            dlp_enabled,
+        )));
     }
 
     if cli.skip_influx_write {
@@ -236,7 +250,15 @@ fn run(cli: &Cli) -> Result<Report> {
         ));
     } else {
         checks.push(check_influx_write(&client, "worktime", &worktime));
-        checks.push(check_influx_write(&client, "dlp", &dlp));
+        if dlp_enabled {
+            checks.push(check_influx_write(&client, "dlp", &dlp));
+        } else {
+            checks.push(warn(
+                "influx:write:dlp",
+                "DLP write probe skipped because DLP is disabled",
+                json!({"enabled": false, "mode": "disabled"}),
+            ));
+        }
     }
 
     if cli.skip_grafana {
@@ -270,7 +292,7 @@ fn run(cli: &Cli) -> Result<Report> {
         git_commit: cli.git_commit.clone(),
         counts,
         checks,
-        limitations: build_limitations(cli),
+        limitations: build_limitations(cli, dlp_enabled),
     })
 }
 
@@ -338,6 +360,20 @@ fn split_csv(value: &str) -> Vec<String> {
         .collect()
 }
 
+fn systemd_services_for_mode(csv: &str, dlp_enabled: bool) -> String {
+    let mut services = split_csv(csv);
+    if dlp_enabled {
+        for service in split_csv(DEFAULT_DLP_SYSTEMD_SERVICES) {
+            if !services.iter().any(|item| item == &service) {
+                services.push(service);
+            }
+        }
+    } else {
+        services.retain(|service| !service.contains("dlp"));
+    }
+    services.into_iter().collect::<Vec<_>>().join(",")
+}
+
 fn hostname() -> String {
     Command::new("hostname")
         .output()
@@ -348,7 +384,7 @@ fn hostname() -> String {
         .unwrap_or_else(|| "unknown".to_string())
 }
 
-fn build_limitations(cli: &Cli) -> Vec<String> {
+fn build_limitations(cli: &Cli, dlp_enabled: bool) -> Vec<String> {
     let mut limitations = Vec::new();
     limitations.push(
         "Проверка подтверждает состояние runtime на момент формирования акта и не заменяет аудит конфигурации, нагрузочное тестирование или приемочные испытания заказчика.".to_string(),
@@ -377,6 +413,11 @@ fn build_limitations(cli: &Cli) -> Vec<String> {
                 .to_string(),
         );
     }
+    if !dlp_enabled {
+        limitations.push(
+            "DLP runtime отключен штатно через AW_DLP_ENABLED=false; readiness не считает DLP services/timers и DLP Influx write обязательными.".to_string(),
+        );
+    }
     limitations
 }
 

adk-rust/crates/dlp-health-check/src/main.rs

@@ -62,6 +62,21 @@ struct Cli {
 
     #[arg(long)]
     json: bool,
+
+    #[arg(long, default_value_t = 120)]
+    overall_timeout_seconds: u64,
+
+    #[arg(long, default_value = "full")]
+    profile: String,
+
+    #[arg(long, default_value_t = true)]
+    enabled: bool,
+
+    #[arg(long, default_value = "operator_disabled")]
+    disabled_reason: String,
+
+    #[arg(long, default_value = "")]
+    disabled_since: String,
 }
 
 impl Cli {
@@ -129,6 +144,28 @@ impl Cli {
         if !cli_arg_present("--profiles") {
             self.profiles = env_string("AW_DLP_COMPLIANCE_PROFILES").unwrap_or(self.profiles);
         }
+        if !cli_arg_present("--overall-timeout-seconds") {
+            self.overall_timeout_seconds = env_u64(
+                "AW_DLP_HEALTH_OVERALL_TIMEOUT_SECONDS",
+                self.overall_timeout_seconds,
+            );
+        }
+        if !cli_arg_present("--profile") {
+            self.profile = env_string("AW_DLP_PROFILE")
+                .or_else(|| env_string("DETMIR_PORTAL_DLP_PROFILE"))
+                .unwrap_or(self.profile);
+        }
+        if !cli_arg_present("--enabled") {
+            self.enabled = env_bool_default("AW_DLP_ENABLED", self.enabled);
+        }
+        if !cli_arg_present("--disabled-reason") {
+            self.disabled_reason =
+                env_string("AW_DLP_DISABLED_REASON").unwrap_or(self.disabled_reason);
+        }
+        if !cli_arg_present("--disabled-since") {
+            self.disabled_since =
+                env_string("AW_DLP_DISABLED_SINCE").unwrap_or(self.disabled_since);
+        }
         self
     }
 }
@@ -1270,8 +1307,66 @@ fn check_compliance_reports(
     }
 }
 
+fn normalized_profile(profile: &str) -> String {
+    match profile.trim().to_ascii_lowercase().as_str() {
+        "disabled" | "off" => "core_only".to_string(),
+        "core-only" | "core_only" => "core_only".to_string(),
+        "light" | "lite" => "light".to_string(),
+        "on-demand" | "on_demand" => "on_demand".to_string(),
+        "enabled" | "on" | "full" => "full".to_string(),
+        "" => "full".to_string(),
+        other => other.to_string(),
+    }
+}
+
+fn profile_is_disabled(profile: &str) -> bool {
+    matches!(normalized_profile(profile).as_str(), "core_only")
+}
+
+fn profile_checks_heavy_services(profile: &str) -> bool {
+    matches!(normalized_profile(profile).as_str(), "full" | "on_demand")
+}
+
 fn build_report(cli: &Cli, client: &Client) -> HealthReport {
     let mut report = HealthReport::default();
+    let profile = normalized_profile(&cli.profile);
+    if !cli.enabled || profile_is_disabled(&profile) {
+        report.add(
+            "dlp:mode",
+            "ok",
+            "DLP runtime disabled by production profile",
+            json!({
+                "mode": "disabled",
+                "profile": profile,
+                "reason": &cli.disabled_reason,
+                "disabled_since": empty_string_as_null(&cli.disabled_since),
+                "checks_skipped": [
+                    "policy API",
+                    "case API",
+                    "DLP systemd units",
+                    "DLP ActivityWatch buckets",
+                    "DLP compliance reports"
+                ],
+                "load_reduction": [
+                    "no DLP bucket freshness reads",
+                    "no DLP case/policy HTTP checks",
+                    "no DLP compliance filesystem scan"
+                ]
+            }),
+        );
+        return report;
+    }
+    report.add(
+        "dlp:mode",
+        "ok",
+        format!("DLP runtime profile {profile}"),
+        json!({
+            "mode": if profile == "light" { "light" } else { "enabled" },
+            "profile": profile,
+            "heavy_services_checked": profile_checks_heavy_services(&cli.profile)
+        }),
+    );
+
     let aw_api_base = format!("{}/api/0", cli.aw_server.trim_end_matches('/'));
     let counter_state_path = cli.state_dir.join("dlp-health-check-counters.json");
     let mut counter_state = load_counter_state(&counter_state_path);
@@ -1282,38 +1377,70 @@ fn build_report(cli: &Cli, client: &Client) -> HealthReport {
         "http:aw",
         &format!("{aw_api_base}/info"),
     );
-    check_http_endpoint(
-        &mut report,
-        client,
-        "http:policy",
-        &format!("{}/healthz", cli.policy_server.trim_end_matches('/')),
-    );
-    check_http_endpoint(
-        &mut report,
-        client,
-        "http:cases",
-        &format!("{}/health", cli.case_server.trim_end_matches('/')),
-    );
+    if profile_checks_heavy_services(&cli.profile) {
+        check_http_endpoint(
+            &mut report,
+            client,
+            "http:policy",
+            &format!("{}/healthz", cli.policy_server.trim_end_matches('/')),
+        );
+        check_http_endpoint(
+            &mut report,
+            client,
+            "http:cases",
+            &format!("{}/health", cli.case_server.trim_end_matches('/')),
+        );
+    } else {
+        report.add(
+            "http:heavy-dlp",
+            "ok",
+            "heavy DLP policy/case HTTP checks skipped for lightweight profile",
+            json!({
+                "profile": profile,
+                "skipped": ["policy API", "case API"]
+            }),
+        );
+    }
 
-    for unit in [
-        "activitywatch-server",
-        "aw-dlp-policy-engine.service",
-        "aw-dlp-case-management.service",
-        "aw-worktime-api.service",
-    ] {
+    for unit in ["activitywatch-server", "aw-worktime-api.service"] {
         check_systemd_unit(&mut report, unit, "service");
     }
-    for unit in [
-        "aw-dlp-report-scheduler.timer",
-        "aw-dlp-syslog-forwarder.timer",
-        "aw-dlp-webhook-sender.timer",
-        "aw-dlp-cef-exporter.timer",
-        "activitywatch-dlp-aggregator.timer",
-        "aw-dlp-ioc-refresh.timer",
-        "aw-worktime-ui-bridge.timer",
-    ] {
-        check_systemd_unit(&mut report, unit, "timer");
+    if profile_checks_heavy_services(&cli.profile) {
+        for unit in [
+            "aw-dlp-policy-engine.service",
+            "aw-dlp-case-management.service",
+        ] {
+            check_systemd_unit(&mut report, unit, "service");
+        }
+        for unit in [
+            "aw-dlp-report-scheduler.timer",
+            "aw-dlp-syslog-forwarder.timer",
+            "aw-dlp-webhook-sender.timer",
+            "aw-dlp-cef-exporter.timer",
+            "activitywatch-dlp-aggregator.timer",
+            "aw-dlp-ioc-refresh.timer",
+        ] {
+            check_systemd_unit(&mut report, unit, "timer");
+        }
+    } else {
+        report.add(
+            "systemd:heavy-dlp",
+            "ok",
+            "heavy DLP systemd checks skipped for lightweight profile",
+            json!({
+                "profile": profile,
+                "skipped": [
+                    "aw-dlp-policy-engine.service",
+                    "aw-dlp-case-management.service",
+                    "aw-dlp-report-scheduler.timer",
+                    "aw-dlp-syslog-forwarder.timer",
+                    "aw-dlp-webhook-sender.timer",
+                    "aw-dlp-cef-exporter.timer"
+                ]
+            }),
+        );
     }
+    check_systemd_unit(&mut report, "aw-worktime-ui-bridge.timer", "timer");
 
     match http_json(client, &format!("{aw_api_base}/buckets"), 15, 2) {
         Ok(Value::Object(map)) => {
@@ -1462,6 +1589,12 @@ fn env_i64(name: &str, default: i64) -> i64 {
         .unwrap_or(default)
 }
 
+fn env_u64(name: &str, default: u64) -> u64 {
+    env_string(name)
+        .and_then(|value| value.parse::<u64>().ok())
+        .unwrap_or(default)
+}
+
 fn env_bool(name: &str) -> bool {
     env_string(name)
         .map(|value| {
@@ -1473,8 +1606,39 @@ fn env_bool(name: &str) -> bool {
         .unwrap_or(false)
 }
 
+fn env_bool_default(name: &str, default: bool) -> bool {
+    env_string(name)
+        .map(|value| {
+            matches!(
+                value.to_ascii_lowercase().as_str(),
+                "1" | "true" | "yes" | "on"
+            )
+        })
+        .unwrap_or(default)
+}
+
+fn empty_string_as_null(value: &str) -> Value {
+    if value.trim().is_empty() {
+        Value::Null
+    } else {
+        json!(value)
+    }
+}
+
+fn start_overall_timeout_watchdog(seconds: u64) {
+    if seconds == 0 {
+        return;
+    }
+    std::thread::spawn(move || {
+        sleep(Duration::from_secs(seconds));
+        eprintln!("dlp-health-check timed out after {seconds} seconds");
+        std::process::exit(124);
+    });
+}
+
 fn main() -> Result<()> {
     let cli = Cli::parse().apply_env();
+    start_overall_timeout_watchdog(cli.overall_timeout_seconds);
     let client = Client::builder()
         .no_proxy()
         .build()
@@ -1547,4 +1711,22 @@ mod tests {
         assert_eq!(payload.counts.warn, 1);
         assert_eq!(payload.counts.fail, 0);
     }
+
+    #[test]
+    fn dlp_profile_normalization_matches_runtime_control_names() {
+        assert_eq!(normalized_profile("disabled"), "core_only");
+        assert_eq!(normalized_profile("core-only"), "core_only");
+        assert_eq!(normalized_profile("light"), "light");
+        assert_eq!(normalized_profile("lite"), "light");
+        assert_eq!(normalized_profile("on-demand"), "on_demand");
+        assert_eq!(normalized_profile("enabled"), "full");
+    }
+
+    #[test]
+    fn light_profile_does_not_require_heavy_services() {
+        assert!(!profile_checks_heavy_services("light"));
+        assert!(!profile_checks_heavy_services("core_only"));
+        assert!(profile_checks_heavy_services("on_demand"));
+        assert!(profile_checks_heavy_services("full"));
+    }
 }

adk-rust/crates/worktime-api/src/main.rs

@@ -77,6 +77,7 @@ struct Config {
     management_history_retention_days: i64,
     true_active_evidence_window_seconds: i64,
     true_active_max_event_seconds: i64,
+    dlp_evidence_enabled: bool,
     offset: FixedOffset,
 }
 
@@ -227,6 +228,14 @@ fn threshold_to_pct(value: f64) -> f64 {
     }
 }
 
+fn overload_threshold_to_pct(value: f64) -> f64 {
+    if (0.0..=3.0).contains(&value) {
+        value * 100.0
+    } else {
+        value
+    }
+}
+
 fn parse_hhmm(value: &str) -> Option<NaiveTime> {
     NaiveTime::parse_from_str(value.trim(), "%H:%M").ok()
 }
@@ -262,7 +271,7 @@ fn load_config() -> Config {
         }
         if let Some(value) = policy.overload_threshold {
             manager_overload_coverage_pct =
-                threshold_to_pct(value).round().clamp(1.0, 300.0) as i64;
+                overload_threshold_to_pct(value).round().clamp(100.0, 300.0) as i64;
         }
         if let Some(value) = policy.drop_threshold_pct {
             manager_trend_delta_pct = threshold_to_pct(value).clamp(1.0, 100.0);
@@ -371,6 +380,10 @@ fn load_config() -> Config {
         .max(30),
         true_active_max_event_seconds: env_i64("AW_WORKTIME_TRUE_ACTIVE_MAX_EVENT_SECONDS", 600)
             .max(30),
+        dlp_evidence_enabled: env_bool(
+            "AW_WORKTIME_DLP_EVIDENCE_ENABLED",
+            env_bool("AW_DLP_ENABLED", true),
+        ),
         offset: FixedOffset::east_opt(3 * 3600).expect("valid Moscow offset"),
     }
 }
@@ -1010,13 +1023,7 @@ impl App {
             }
         };
         let mut evidence = HashMap::new();
-        for bucket in [
-            format!("aw-file-operations_{host}"),
-            format!("aw-dlp-endpoint-signals_{host}"),
-            format!("aw-watcher-web-chrome_{host}"),
-            format!("aw-watcher-web-edge_{host}"),
-            format!("aw-detmir-web-category_{host}"),
-        ] {
+        for bucket in evidence_bucket_ids(&self.config, host) {
             evidence.insert(
                 bucket.clone(),
                 self.fetch_bucket_events(&bucket, Some(bounds.0), Some(bounds.1)),
@@ -1156,6 +1163,19 @@ fn sanitize_bucket_for_log(bucket_id: &str) -> String {
     bucket_id.to_string()
 }
 
+fn evidence_bucket_ids(config: &Config, host: &str) -> Vec<String> {
+    let mut buckets = vec![format!("aw-file-operations_{host}")];
+    if config.dlp_evidence_enabled {
+        buckets.push(format!("aw-dlp-endpoint-signals_{host}"));
+    }
+    buckets.extend([
+        format!("aw-watcher-web-chrome_{host}"),
+        format!("aw-watcher-web-edge_{host}"),
+        format!("aw-detmir-web-category_{host}"),
+    ]);
+    buckets
+}
+
 fn sanitize_error_for_log(value: &str) -> String {
     static IP_RE: OnceLock<Regex> = OnceLock::new();
     static BUCKET_HOST_RE: OnceLock<Regex> = OnceLock::new();
@@ -1605,6 +1625,156 @@ fn interval_overlap_seconds(
     (total, first, last)
 }
 
+#[derive(Clone, Copy)]
+struct EmployeeOperationsInput {
+    expected_seconds: i64,
+    low_seconds: i64,
+    target_seconds: i64,
+    overload_seconds: i64,
+    work_secs: i64,
+    calendar_secs: i64,
+    work_first: Option<DateTime<Utc>>,
+    work_last: Option<DateTime<Utc>>,
+    is_today: bool,
+    late_start: DateTime<FixedOffset>,
+    early_finish: DateTime<FixedOffset>,
+    samples_count: i64,
+    active_samples: i64,
+    sessions_count: i64,
+}
+
+fn build_employee_operations_status(config: &Config, input: EmployeeOperationsInput) -> Value {
+    let workday_idle_seconds = (input.expected_seconds - input.work_secs).max(0);
+    let off_hours_seconds = (input.calendar_secs - input.work_secs).max(0);
+    let coverage = if input.expected_seconds > 0 {
+        clamp_pct(input.work_secs as f64 / input.expected_seconds as f64 * 100.0)
+    } else {
+        0.0
+    };
+    let load_status = if input.expected_seconds <= 0 {
+        "insufficient_data"
+    } else if input.sessions_count <= 0 || input.samples_count <= 0 {
+        "no_data"
+    } else if input.work_secs <= 0 {
+        "no_activity"
+    } else if input.work_secs < input.low_seconds {
+        "underloaded"
+    } else if input.work_secs >= input.overload_seconds {
+        "overloaded"
+    } else if input.work_secs < input.target_seconds {
+        "below_target"
+    } else {
+        "normal"
+    };
+    let idle_status = if input.expected_seconds <= 0 {
+        "not_applicable"
+    } else if input.sessions_count <= 0 || input.samples_count <= 0 {
+        "unknown"
+    } else if input.work_secs <= 0 {
+        "full_workday_idle_or_absent"
+    } else if workday_idle_seconds >= config.manager_off_hours_threshold_seconds {
+        "idle_detected"
+    } else {
+        "no_significant_idle"
+    };
+    let mut discipline_flags = Vec::new();
+    if off_hours_seconds >= config.manager_off_hours_threshold_seconds {
+        discipline_flags.push("off_hours");
+    }
+    if input
+        .work_first
+        .is_some_and(|dt| dt.with_timezone(&config.offset) > input.late_start)
+    {
+        discipline_flags.push("late_start");
+    }
+    if !input.is_today
+        && input
+            .work_last
+            .is_some_and(|dt| dt.with_timezone(&config.offset) < input.early_finish)
+    {
+        discipline_flags.push("early_finish");
+    }
+    let discipline_status = match discipline_flags.as_slice() {
+        [] => "ok",
+        [single] => single,
+        _ => "multiple_flags",
+    };
+    let mut confidence_reasons = Vec::new();
+    if input.sessions_count <= 0 {
+        confidence_reasons.push("missing_session_samples");
+    }
+    if input.samples_count <= 0 {
+        confidence_reasons.push("missing_worktime_samples");
+    } else if input.samples_count < 3 {
+        confidence_reasons.push("few_worktime_samples");
+    } else {
+        confidence_reasons.push("worktime_samples_present");
+    }
+    if input.active_samples <= 0 {
+        confidence_reasons.push("missing_active_samples");
+    } else {
+        confidence_reasons.push("active_samples_present");
+    }
+    if input.expected_seconds <= 0 {
+        confidence_reasons.push("workday_window_not_started_or_empty");
+    }
+    let data_confidence =
+        if input.expected_seconds <= 0 || input.sessions_count <= 0 || input.samples_count <= 0 {
+            "low"
+        } else if input.samples_count < 3 || input.active_samples <= 0 {
+            "medium"
+        } else {
+            "high"
+        };
+    let recommended_action = match (data_confidence, load_status, discipline_status, idle_status) {
+        ("low", _, _, _) => {
+            "Сначала проверить свежесть источников и наличие сессии; вывод по сотруднику не использовать как дисциплинарный."
+        }
+        (_, "overloaded", _, _) => {
+            "Проверить переработку, перераспределение задач и риск аврального процесса."
+        }
+        (_, "underloaded" | "below_target" | "no_activity", _, _) => {
+            "Проверить фактическую загрузку, задачи, доступ к рабочим системам и отсутствие сбоя сбора."
+        }
+        (_, _, "off_hours" | "late_start" | "early_finish" | "multiple_flags", _) => {
+            "Проверить согласование рабочего графика и причину отклонения от процесса."
+        }
+        (_, _, _, "idle_detected" | "full_workday_idle_or_absent") => {
+            "Проверить простой: отсутствие задач, ожидание внешнего процесса или техническую проблему."
+        }
+        _ => "Наблюдать; отклонений, требующих немедленного действия, не выявлено.",
+    };
+    json!({
+        "load_status": load_status,
+        "idle_status": idle_status,
+        "discipline_status": discipline_status,
+        "discipline_flags": discipline_flags,
+        "data_confidence": data_confidence,
+        "confidence_reasons": confidence_reasons,
+        "workday_idle_seconds": workday_idle_seconds,
+        "workday_idle_hhmm": hhmm(workday_idle_seconds),
+        "off_hours_seconds": off_hours_seconds,
+        "off_hours_hhmm": hhmm(off_hours_seconds),
+        "coverage_pct": coverage,
+        "evidence": {
+            "expected_hhmm": hhmm(input.expected_seconds),
+            "workday_active_hhmm": hhmm(input.work_secs),
+            "calendar_active_hhmm": hhmm(input.calendar_secs),
+            "sessions_count": input.sessions_count,
+            "samples_count": input.samples_count,
+            "active_samples": input.active_samples,
+            "first_workday_activity_local": input.work_first.map(|dt| dt.with_timezone(&config.offset).to_rfc3339()).unwrap_or_default(),
+            "last_workday_activity_local": input.work_last.map(|dt| dt.with_timezone(&config.offset).to_rfc3339()).unwrap_or_default()
+        },
+        "guardrail": if data_confidence == "low" {
+            "low_confidence_not_for_discipline"
+        } else {
+            "evidence_backed_manual_review_only"
+        },
+        "recommended_action": recommended_action,
+    })
+}
+
 impl App {
     fn build_management_payload(
         &self,
@@ -1634,6 +1804,7 @@ impl App {
         };
         let target_seconds = expected_seconds * self.config.manager_target_coverage_pct / 100;
         let low_seconds = expected_seconds * self.config.manager_low_coverage_pct / 100;
+        let overload_seconds = expected_seconds * self.config.manager_overload_coverage_pct / 100;
         let late_start =
             work_start_local + TimeDelta::minutes(self.config.manager_late_start_grace_minutes);
         let early_finish =
@@ -1706,6 +1877,37 @@ impl App {
                 .map(|dt| dt.with_timezone(&self.config.offset))
                 .map(|dt| dt.to_rfc3339())
                 .unwrap_or_default();
+            let samples_count = row
+                .get("samples_count")
+                .and_then(Value::as_i64)
+                .unwrap_or(0);
+            let active_samples = row
+                .get("active_samples")
+                .and_then(Value::as_i64)
+                .unwrap_or(0);
+            let sessions_count = row
+                .get("sessions_count")
+                .and_then(Value::as_i64)
+                .unwrap_or(0);
+            let operations = build_employee_operations_status(
+                &self.config,
+                EmployeeOperationsInput {
+                    expected_seconds,
+                    low_seconds,
+                    target_seconds,
+                    overload_seconds,
+                    work_secs,
+                    calendar_secs,
+                    work_first,
+                    work_last,
+                    is_today,
+                    late_start,
+                    early_finish,
+                    samples_count,
+                    active_samples,
+                    sessions_count,
+                },
+            );
             let mut public = row.as_object().cloned().unwrap_or_default();
             public.remove("_intervals");
             public.insert("user".into(), json!(alias.display_name));
@@ -1719,8 +1921,52 @@ impl App {
             public.insert("calendar_active_hhmm".into(), json!(hhmm(calendar_secs)));
             public.insert("workday_active_seconds".into(), json!(work_secs));
             public.insert("workday_active_hhmm".into(), json!(hhmm(work_secs)));
+            public.insert(
+                "workday_idle_seconds".into(),
+                json!((expected_seconds - work_secs).max(0)),
+            );
+            public.insert(
+                "workday_idle_hhmm".into(),
+                json!(hhmm((expected_seconds - work_secs).max(0))),
+            );
             public.insert("coverage_pct".into(), json!(coverage));
             public.insert("status".into(), json!(status));
+            public.insert(
+                "load_status".into(),
+                operations
+                    .get("load_status")
+                    .cloned()
+                    .unwrap_or_else(|| json!("unknown")),
+            );
+            public.insert(
+                "idle_status".into(),
+                operations
+                    .get("idle_status")
+                    .cloned()
+                    .unwrap_or_else(|| json!("unknown")),
+            );
+            public.insert(
+                "discipline_status".into(),
+                operations
+                    .get("discipline_status")
+                    .cloned()
+                    .unwrap_or_else(|| json!("unknown")),
+            );
+            public.insert(
+                "data_confidence".into(),
+                operations
+                    .get("data_confidence")
+                    .cloned()
+                    .unwrap_or_else(|| json!("low")),
+            );
+            public.insert(
+                "operations_recommended_action".into(),
+                operations
+                    .get("recommended_action")
+                    .cloned()
+                    .unwrap_or_else(|| json!("Проверить первичные источники.")),
+            );
+            public.insert("operations".into(), operations.clone());
             public.insert("first_activity_local".into(), json!(first_local));
             public.insert("last_activity_local".into(), json!(last_local));
             public.insert(
@@ -1739,6 +1985,10 @@ impl App {
                 "manager_owner": public.get("manager_owner").cloned().unwrap_or(json!("")),
                 "department": public.get("department").cloned().unwrap_or(json!("")),
                 "role": public.get("role").cloned().unwrap_or(json!("")),
+                "load_status": public.get("load_status").cloned().unwrap_or(json!("unknown")),
+                "idle_status": public.get("idle_status").cloned().unwrap_or(json!("unknown")),
+                "discipline_status": public.get("discipline_status").cloned().unwrap_or(json!("unknown")),
+                "data_confidence": public.get("data_confidence").cloned().unwrap_or(json!("low")),
             });
             let owner = public
                 .get("manager_owner")
@@ -1763,6 +2013,9 @@ impl App {
                 } else if expected_seconds > 0 && work_secs < target_seconds {
                     actions.push(action("target_gap_review", "medium", &owner, "24h", &format!("У сотрудника {display} активное время в рабочем окне {} ниже управленческого целевого порога {}%.", hhmm(work_secs), self.config.manager_target_coverage_pct), &format!("Уточнить причину отклонения по сотруднику {display} и подтвердить план работ."), &canonical, evidence.clone()));
                 }
+                if expected_seconds > 0 && work_secs >= overload_seconds {
+                    actions.push(action("overload_review", "high", &owner, "24h", &format!("У сотрудника {display} активное время в рабочем окне {} выше порога перегруза {}%.", hhmm(work_secs), self.config.manager_overload_coverage_pct), &format!("Проверить переработку сотрудника {display}, распределение задач и риск аврального процесса."), &canonical, evidence.clone()));
+                }
                 if work_first.is_some_and(|dt| dt.with_timezone(&self.config.offset) > late_start) {
                     actions.push(action("late_start_review", "medium", &owner, "24h", &format!("У сотрудника {display} первая активность в рабочем окне зафиксирована поздно."), &format!("Проверить причину позднего старта сотрудника {display} и подтвердить, что это не проблема доступа или дисциплины."), &canonical, evidence.clone()));
                 }
@@ -1810,6 +2063,37 @@ impl App {
             )
         });
         let summary = summarize_management_rows(&roster, &actions, expected_seconds);
+        let workforce_operations = json!({
+            "status": summary.pointer("/workforce_operations/status").cloned().unwrap_or_else(|| json!("LOW_CONFIDENCE")),
+            "summary": summary.pointer("/workforce_operations").cloned().unwrap_or_else(|| json!({})),
+            "rows": roster.iter().map(|row| {
+                json!({
+                    "user": row.get("user").cloned().unwrap_or(json!("")),
+                    "manager_owner": row.get("manager_owner").cloned().unwrap_or(json!("")),
+                    "department": row.get("department").cloned().unwrap_or(json!("")),
+                    "role": row.get("role").cloned().unwrap_or(json!("")),
+                    "load_status": row.get("load_status").cloned().unwrap_or(json!("unknown")),
+                    "idle_status": row.get("idle_status").cloned().unwrap_or(json!("unknown")),
+                    "discipline_status": row.get("discipline_status").cloned().unwrap_or(json!("unknown")),
+                    "data_confidence": row.get("data_confidence").cloned().unwrap_or(json!("low")),
+                    "coverage_pct": row.get("coverage_pct").cloned().unwrap_or(json!(0.0)),
+                    "workday_active_hhmm": row.get("workday_active_hhmm").cloned().unwrap_or(json!("00:00")),
+                    "workday_idle_hhmm": row.get("workday_idle_hhmm").cloned().unwrap_or(json!("00:00")),
+                    "recommended_action": row.get("operations_recommended_action").cloned().unwrap_or(json!("Проверить первичные источники."))
+                })
+            }).collect::<Vec<_>>(),
+            "model": {
+                "type": "rule_based",
+                "ml": false,
+                "llm": false,
+                "version": "workforce-operations-v1"
+            },
+            "guardrails": [
+                "Строки low confidence требуют проверки источников до персонального вывода",
+                "Отсутствие данных не считается простоем",
+                "Все статусы предназначены только для ручного операционного разбора"
+            ]
+        });
         let owner_rollups = build_rollups(&roster, &actions, "manager_owner");
         let department_rollups = build_rollups(&roster, &actions, "department");
         let owner_roster = owner_rollups.clone();
@@ -1865,8 +2149,10 @@ impl App {
                 "expected_hhmm_per_user": hhmm(expected_seconds),
                 "target_coverage_pct": self.config.manager_target_coverage_pct,
                 "low_coverage_pct": self.config.manager_low_coverage_pct,
+                "overload_coverage_pct": self.config.manager_overload_coverage_pct,
             },
             "summary": summary,
+            "workforce_operations": workforce_operations,
             "actions": actions,
             "rows": roster,
             "sources": sources,
@@ -2329,6 +2615,7 @@ fn summarize_management_rows(rows: &[Value], actions: &[Value], expected_seconds
             .and_then(Value::as_i64)
             .unwrap_or(0)
     });
+    let operations_summary = summarize_operations(rows);
     json!({
         "users_count": users_count,
         "active_users": active_users,
@@ -2349,6 +2636,85 @@ fn summarize_management_rows(rows: &[Value], actions: &[Value], expected_seconds
         "last_activity": rows.iter().filter_map(|r| r.get("workday_last_activity_local").and_then(Value::as_str)).filter(|s| !s.is_empty()).max().unwrap_or(""),
         "top_user": top.and_then(|r| r.get("user")).and_then(Value::as_str).unwrap_or(""),
         "top_user_active_hhmm": top.and_then(|r| r.get("workday_active_hhmm")).and_then(Value::as_str).unwrap_or("00:00"),
+        "workforce_operations": operations_summary,
+    })
+}
+
+fn row_str<'a>(row: &'a Value, key: &str) -> &'a str {
+    row.get(key).and_then(Value::as_str).unwrap_or("")
+}
+
+fn count_rows_by(rows: &[Value], key: &str, expected: &[&str]) -> i64 {
+    rows.iter()
+        .filter(|row| expected.contains(&row_str(row, key)))
+        .count() as i64
+}
+
+fn summarize_operations(rows: &[Value]) -> Value {
+    let users_count = rows.len() as i64;
+    let low_confidence_users = count_rows_by(rows, "data_confidence", &["low"]);
+    let medium_confidence_users = count_rows_by(rows, "data_confidence", &["medium"]);
+    let high_confidence_users = count_rows_by(rows, "data_confidence", &["high"]);
+    let unknown_or_no_data_users = count_rows_by(
+        rows,
+        "load_status",
+        &["no_data", "insufficient_data", "no_activity"],
+    );
+    let underloaded_users = count_rows_by(rows, "load_status", &["underloaded", "below_target"]);
+    let normal_users = count_rows_by(rows, "load_status", &["normal"]);
+    let overloaded_users = count_rows_by(rows, "load_status", &["overloaded"]);
+    let idle_users = count_rows_by(
+        rows,
+        "idle_status",
+        &["idle_detected", "full_workday_idle_or_absent"],
+    );
+    let discipline_review_users = rows
+        .iter()
+        .filter(|row| !matches!(row_str(row, "discipline_status"), "" | "ok"))
+        .count() as i64;
+    let action_required_users = rows
+        .iter()
+        .filter(|row| {
+            !matches!(row_str(row, "load_status"), "normal" | "")
+                || !matches!(row_str(row, "discipline_status"), "ok" | "")
+                || matches!(
+                    row_str(row, "idle_status"),
+                    "idle_detected" | "full_workday_idle_or_absent"
+                )
+                || row_str(row, "data_confidence") == "low"
+        })
+        .count() as i64;
+    let status = if users_count == 0 || low_confidence_users == users_count {
+        "LOW_CONFIDENCE"
+    } else if overloaded_users > 0 || discipline_review_users > 0 || idle_users > 0 {
+        "ATTENTION"
+    } else if underloaded_users > 0 || unknown_or_no_data_users > 0 || medium_confidence_users > 0 {
+        "WATCH"
+    } else {
+        "OK"
+    };
+    json!({
+        "status": status,
+        "users_count": users_count,
+        "action_required_users": action_required_users,
+        "load": {
+            "unknown_or_no_data_users": unknown_or_no_data_users,
+            "underloaded_users": underloaded_users,
+            "normal_users": normal_users,
+            "overloaded_users": overloaded_users
+        },
+        "idle": {
+            "idle_users": idle_users
+        },
+        "discipline": {
+            "review_users": discipline_review_users
+        },
+        "confidence": {
+            "low_users": low_confidence_users,
+            "medium_users": medium_confidence_users,
+            "high_users": high_confidence_users
+        },
+        "guardrail": "Строки low confidence требуют проверки источников до персонального вывода"
     })
 }
 
@@ -2369,6 +2735,11 @@ fn build_rollups(rows: &[Value], actions: &[Value], field: &str) -> Vec<Value> {
                 "active_users",
                 "inactive_users",
                 "below_target_users",
+                "underloaded_users",
+                "overloaded_users",
+                "idle_users",
+                "discipline_review_users",
+                "low_confidence_users",
                 "workday_total_active_seconds",
                 "actions_count",
                 "critical_actions_count",
@@ -2390,6 +2761,24 @@ fn build_rollups(rows: &[Value], actions: &[Value], field: &str) -> Vec<Value> {
         if row.get("status").and_then(Value::as_str) == Some("below_target") {
             inc(group, "below_target_users", 1);
         }
+        if matches!(row_str(row, "load_status"), "underloaded" | "below_target") {
+            inc(group, "underloaded_users", 1);
+        }
+        if row_str(row, "load_status") == "overloaded" {
+            inc(group, "overloaded_users", 1);
+        }
+        if matches!(
+            row_str(row, "idle_status"),
+            "idle_detected" | "full_workday_idle_or_absent"
+        ) {
+            inc(group, "idle_users", 1);
+        }
+        if !matches!(row_str(row, "discipline_status"), "" | "ok") {
+            inc(group, "discipline_review_users", 1);
+        }
+        if row_str(row, "data_confidence") == "low" {
+            inc(group, "low_confidence_users", 1);
+        }
         inc(
             group,
             "workday_total_active_seconds",
@@ -3350,9 +3739,9 @@ fn render_management_html(payload: &Value) -> String {
             .collect()
     };
     let user_rows = if rows.is_empty() {
-        "<tr><td colspan='8'>Нет сотрудников в выборке.</td></tr>".to_string()
+        "<tr><td colspan='12'>Нет сотрудников в выборке.</td></tr>".to_string()
     } else {
-        rows.iter().map(|r| format!("<tr><td>{}</td><td>{}</td><td>{}</td><td>{}</td><td class='good'>{}</td><td>{}%</td><td>{}</td><td>{}</td></tr>", esc(r["user"].as_str().unwrap_or("")), esc(r["manager_owner"].as_str().unwrap_or("")), esc(r["department"].as_str().unwrap_or("")), esc(r["status"].as_str().unwrap_or("")), esc(r["workday_active_hhmm"].as_str().unwrap_or("")), r["coverage_pct"].as_f64().unwrap_or(0.0), esc(r["workday_first_activity_local"].as_str().unwrap_or("")), esc(r["workday_last_activity_local"].as_str().unwrap_or("")))).collect()
+        rows.iter().map(|r| format!("<tr><td>{}</td><td>{}</td><td>{}</td><td>{}</td><td class='good'>{}</td><td>{}</td><td>{}%</td><td>{}</td><td>{}</td><td>{}</td><td>{}</td><td>{}</td></tr>", esc(r["user"].as_str().unwrap_or("")), esc(r["manager_owner"].as_str().unwrap_or("")), esc(r["department"].as_str().unwrap_or("")), esc(r["status"].as_str().unwrap_or("")), esc(r["workday_active_hhmm"].as_str().unwrap_or("")), esc(r["workday_idle_hhmm"].as_str().unwrap_or("00:00")), r["coverage_pct"].as_f64().unwrap_or(0.0), esc(r["load_status"].as_str().unwrap_or("unknown")), esc(r["idle_status"].as_str().unwrap_or("unknown")), esc(r["discipline_status"].as_str().unwrap_or("unknown")), esc(r["data_confidence"].as_str().unwrap_or("low")), esc(r["operations_recommended_action"].as_str().unwrap_or("")))).collect()
     };
     let source_rows = sources
         .iter()
@@ -3369,7 +3758,7 @@ fn render_management_html(payload: &Value) -> String {
         })
         .collect::<String>();
     format!(
-        r#"<!doctype html><html lang="ru"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>AW-rus Управленческий отчёт по работе в RDP</title><style>{}</style></head><body><main><section class="hero"><h1>AW-rus Управленческий отчёт по работе в RDP</h1><p>{} · {} · {}</p><h2>Что делать сегодня</h2><p>{}</p><nav><a href="/reports/worktime/management?format=json&host={}">JSON</a><a href="/reports/worktime/management?format=csv&host={}">CSV</a><a href="/reports/worktime/today?format=html&host={}">Классический отчёт</a><a href="/reports/worktime/management?format=html&host={}">Сбросить</a></nav></section><section><h2>Очередь действий руководителя</h2><table><tbody>{}</tbody></table></section><section><h2>Сотрудники</h2><table><tbody>{}</tbody></table></section><section><h2>Тренд за период</h2><p>Тренд за {} дней</p></section><section><h2>По ответственным</h2><pre>{}</pre></section><section><h2>Ответственные и эскалация</h2><pre>{}</pre></section><section><h2>По подразделениям</h2><pre>{}</pre></section><section><h2>Свежесть источников данных</h2><table><tbody>{}</tbody></table></section><p>Фильтр: {}</p></main></body></html>"#,
+        r#"<!doctype html><html lang="ru"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>AW-rus Управленческий отчёт по работе в RDP</title><style>{}</style></head><body><main><section class="hero"><h1>AW-rus Управленческий отчёт по работе в RDP</h1><p>{} · {} · {}</p><h2>Что делать сегодня</h2><p>{}</p><nav><a href="/reports/worktime/management?format=json&host={}">JSON</a><a href="/reports/worktime/management?format=csv&host={}">CSV</a><a href="/reports/worktime/today?format=html&host={}">Классический отчёт</a><a href="/reports/worktime/management?format=html&host={}">Сбросить</a></nav></section><section><h2>Очередь действий руководителя</h2><table><tbody>{}</tbody></table></section><section><h2>Рабочая активность сотрудников</h2><p>Статусы загрузки, простоя, дисциплины процесса и достоверности. Low confidence означает: сначала проверить источники, не делать персональный вывод.</p><table><thead><tr><th>Сотрудник</th><th>Ответственный</th><th>Подразделение</th><th>Статус</th><th>Активно</th><th>Простой</th><th>Coverage</th><th>Загрузка</th><th>Простой</th><th>Дисциплина</th><th>Confidence</th><th>Действие</th></tr></thead><tbody>{}</tbody></table></section><section><h2>Тренд за период</h2><p>Тренд за {} дней</p></section><section><h2>По ответственным</h2><pre>{}</pre></section><section><h2>Ответственные и эскалация</h2><pre>{}</pre></section><section><h2>По подразделениям</h2><pre>{}</pre></section><section><h2>Свежесть источников данных</h2><table><tbody>{}</tbody></table></section><p>Фильтр: {}</p></main></body></html>"#,
         base_css(),
         esc(payload["host"].as_str().unwrap_or("")),
         esc(payload["report_date"].as_str().unwrap_or("")),
@@ -3639,6 +4028,36 @@ mod tests {
         );
     }
 
+    #[test]
+    fn dlp_evidence_bucket_is_optional_for_true_active_hot_path() {
+        let mut cfg = test_config();
+        cfg.dlp_evidence_enabled = false;
+        let buckets = evidence_bucket_ids(&cfg, "SHARKON2025");
+        assert!(
+            buckets
+                .iter()
+                .any(|bucket| bucket == "aw-file-operations_SHARKON2025")
+        );
+        assert!(
+            buckets
+                .iter()
+                .any(|bucket| bucket == "aw-watcher-web-chrome_SHARKON2025")
+        );
+        assert!(
+            !buckets
+                .iter()
+                .any(|bucket| bucket == "aw-dlp-endpoint-signals_SHARKON2025")
+        );
+
+        cfg.dlp_evidence_enabled = true;
+        let buckets = evidence_bucket_ids(&cfg, "SHARKON2025");
+        assert!(
+            buckets
+                .iter()
+                .any(|bucket| bucket == "aw-dlp-endpoint-signals_SHARKON2025")
+        );
+    }
+
     #[test]
     fn management_insights_detect_falling_portfolio_trend() {
         let cfg = test_config();
@@ -3758,6 +4177,85 @@ mod tests {
         assert_eq!(rollups[0]["actions_count"], 1);
     }
 
+    #[test]
+    fn employee_operations_detects_overload_and_off_hours() {
+        let cfg = test_config();
+        let report_date = NaiveDate::from_ymd_opt(2026, 5, 14).unwrap();
+        let (work_start, work_end, expected_seconds) = workday_bounds(&cfg, report_date);
+        let input = EmployeeOperationsInput {
+            expected_seconds,
+            low_seconds: expected_seconds * cfg.manager_low_coverage_pct / 100,
+            target_seconds: expected_seconds * cfg.manager_target_coverage_pct / 100,
+            overload_seconds: expected_seconds * cfg.manager_overload_coverage_pct / 100,
+            work_secs: expected_seconds * 2,
+            calendar_secs: expected_seconds * 2 + 3600,
+            work_first: Some(work_start.with_timezone(&Utc)),
+            work_last: Some(work_end.with_timezone(&Utc)),
+            is_today: false,
+            late_start: work_start + TimeDelta::minutes(cfg.manager_late_start_grace_minutes),
+            early_finish: work_end - TimeDelta::minutes(cfg.manager_early_finish_grace_minutes),
+            samples_count: 20,
+            active_samples: 18,
+            sessions_count: 1,
+        };
+        let status = build_employee_operations_status(&cfg, input);
+        assert_eq!(status["load_status"], "overloaded");
+        assert_eq!(status["discipline_status"], "off_hours");
+        assert_eq!(status["data_confidence"], "high");
+        assert_eq!(status["guardrail"], "evidence_backed_manual_review_only");
+    }
+
+    #[test]
+    fn employee_operations_low_confidence_blocks_personnel_conclusion() {
+        let cfg = test_config();
+        let report_date = NaiveDate::from_ymd_opt(2026, 5, 14).unwrap();
+        let (work_start, work_end, expected_seconds) = workday_bounds(&cfg, report_date);
+        let input = EmployeeOperationsInput {
+            expected_seconds,
+            low_seconds: expected_seconds * cfg.manager_low_coverage_pct / 100,
+            target_seconds: expected_seconds * cfg.manager_target_coverage_pct / 100,
+            overload_seconds: expected_seconds * cfg.manager_overload_coverage_pct / 100,
+            work_secs: 0,
+            calendar_secs: 0,
+            work_first: None,
+            work_last: None,
+            is_today: false,
+            late_start: work_start + TimeDelta::minutes(cfg.manager_late_start_grace_minutes),
+            early_finish: work_end - TimeDelta::minutes(cfg.manager_early_finish_grace_minutes),
+            samples_count: 0,
+            active_samples: 0,
+            sessions_count: 0,
+        };
+        let status = build_employee_operations_status(&cfg, input);
+        assert_eq!(status["load_status"], "no_data");
+        assert_eq!(status["idle_status"], "unknown");
+        assert_eq!(status["data_confidence"], "low");
+        assert_eq!(status["guardrail"], "low_confidence_not_for_discipline");
+        assert!(
+            status["recommended_action"]
+                .as_str()
+                .unwrap()
+                .contains("не использовать как дисциплинарный")
+        );
+    }
+
+    #[test]
+    fn operations_summary_counts_attention_groups() {
+        let rows = vec![
+            json!({"load_status":"overloaded","idle_status":"no_significant_idle","discipline_status":"ok","data_confidence":"high"}),
+            json!({"load_status":"underloaded","idle_status":"idle_detected","discipline_status":"late_start","data_confidence":"medium"}),
+            json!({"load_status":"no_data","idle_status":"unknown","discipline_status":"ok","data_confidence":"low"}),
+        ];
+        let summary = summarize_operations(&rows);
+        assert_eq!(summary["status"], "ATTENTION");
+        assert_eq!(summary["load"]["overloaded_users"], 1);
+        assert_eq!(summary["load"]["underloaded_users"], 1);
+        assert_eq!(summary["idle"]["idle_users"], 1);
+        assert_eq!(summary["discipline"]["review_users"], 1);
+        assert_eq!(summary["confidence"]["low_users"], 1);
+        assert_eq!(summary["action_required_users"], 3);
+    }
+
     #[test]
     fn stale_legacy_rdp_sources_are_covered_by_fresh_rust_sources() {
         assert!(legacy_rdp_covered_by_rust_sources(
@@ -3888,14 +4386,17 @@ mod tests {
     #[test]
     fn interpretation_policy_accepts_fraction_thresholds() {
         let policy: InterpretationPolicy = serde_json::from_value(json!({
-            "overload_threshold": 0.92,
+            "overload_threshold": 1.15,
             "underload_threshold": 0.45,
             "drop_threshold_pct": 20,
             "night_work_after": "20:00",
             "weekend_work": true
         }))
         .unwrap();
-        assert_eq!(threshold_to_pct(policy.overload_threshold.unwrap()), 92.0);
+        assert_eq!(
+            overload_threshold_to_pct(policy.overload_threshold.unwrap()).round(),
+            115.0
+        );
         assert_eq!(threshold_to_pct(policy.underload_threshold.unwrap()), 45.0);
         assert_eq!(threshold_to_pct(policy.drop_threshold_pct.unwrap()), 20.0);
         assert_eq!(

adk-rust/crates/worktime-autoheal/src/main.rs

@@ -275,10 +275,20 @@ impl AwClient {
     ) -> Result<()> {
         for chunk in events.chunks(chunk_size.max(1)) {
             let path = format!("/api/0/buckets/{bucket_id}/events");
-            self.request_json(Method::POST, &path, Some(json!(chunk)), false)?;
+            self.request_status(Method::POST, &path, Some(json!(chunk)))?;
         }
         Ok(())
     }
+
+    fn request_status(&self, method: Method, path: &str, payload: Option<Value>) -> Result<()> {
+        let response = self.send_retry(method, path, payload)?;
+        let status = response.status();
+        if status.is_success() {
+            Ok(())
+        } else {
+            Err(anyhow!("ActivityWatch {path} returned HTTP {status}"))
+        }
+    }
 }
 
 fn log(message: &str) {

ansible/README.md

@@ -7,13 +7,6 @@
 - централизованное развёртывание Windows/RDP collector'ов по WinRM;
 - развёртывание внешнего pfSense poller'а на Debian/Ubuntu utility VM.
 
-Актуальная карта связи playbooks, scripts, systemd timers, Windows Scheduled
-Tasks и модулей комплекса ведётся в
-[`docs/ORCHESTRATION_MAP_RU.md`](../docs/ORCHESTRATION_MAP_RU.md). При
-добавлении или переименовании orchestration entrypoint обновляйте карту и
-проверяйте её через `bash scripts/check_orchestration_map.sh` из корня
-репозитория.
-
 ## Файлы
 
 - `ansible/deploy_aw_server.yml` — основной playbook для уже существующего Debian/CT host.

ansible/deploy_aw_server.yml

@@ -19,6 +19,22 @@
     aw_db_vacuum_timer_enabled: false
 
   tasks:
+    - name: Refuse inconsistent DLP resource profile
+      ansible.builtin.assert:
+        that:
+          - aw_dlp_profile | default('core_only') in ['core_only', 'light', 'on_demand', 'full']
+          - (aw_dlp_profile | default('core_only') == 'core_only') or (aw_dlp_enabled | default(false) | bool)
+          - (aw_dlp_enabled | default(false) | bool) or not (
+              aw_dlp_influx_enabled | default(false) | bool
+              or aw_dlp_ioc_enabled | default(false) | bool
+              or aw_dlp_policy_engine_enabled | default(false) | bool
+              or aw_dlp_content_analysis_enabled | default(false) | bool
+              or aw_dlp_integrations_enabled | default(false) | bool
+              or aw_dlp_case_management_enabled | default(false) | bool
+              or aw_dlp_compliance_enabled | default(false) | bool
+            )
+        fail_msg: "Inconsistent DLP profile: keep aw_dlp_enabled=false with all DLP component flags false, or explicitly choose aw_dlp_enabled=true and aw_dlp_profile=light|on_demand|full."
+
     - name: Установить базовые пакеты
       ansible.builtin.apt:
         name:
@@ -78,6 +94,7 @@
         - "{{ aw_server_data_dir }}/backups"
         - "{{ aw_server_data_dir }}/slo"
         - "{{ aw_server_data_dir }}/browser-smoke"
+        - "{{ aw_security_finding_executor_work_dir | default(aw_server_data_dir ~ '/security-finding-executor') }}"
         - "{{ aw_rus_health_state_dir }}"
         - "{{ aw_rus_health_validation_dir }}"
         - "{{ aw_server_log_dir }}"
@@ -108,6 +125,7 @@
         - "{{ aw_server_data_dir }}/backups"
         - "{{ aw_server_data_dir }}/slo"
         - "{{ aw_server_data_dir }}/browser-smoke"
+        - "{{ aw_security_finding_executor_work_dir | default(aw_server_data_dir ~ '/security-finding-executor') }}"
         - "{{ aw_rus_health_state_dir }}"
         - "{{ aw_rus_health_validation_dir }}"
         - "{{ aw_server_log_dir }}"
@@ -713,7 +731,9 @@
               - aw_effective_dlp_influx_token | length > 0
               - (aw_effective_dlp_influx_token | string | lower | regex_search('^(change_me|changeme|replace-me|replace_me|token|secret|password|api_key|influx_token|write_token|your_.*|<.*>)$')) is none
             fail_msg: "aw_dlp_influx_enabled=true, но token пуст и в локальном env, и в текущем /etc/activitywatch/aw-server.env. Exporter будет падать и Grafana не получит DLP-ряды."
-          when: aw_dlp_influx_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_influx_enabled | default(false) | bool
 
         - name: Проверить destination для AW worktime Influx exporter
           ansible.builtin.assert:
@@ -745,7 +765,9 @@
               - (aw_dlp_influx_hosts | default('') | string | length) > 0
               - "'WINDOWS_USER_EXAMPLE' not in (aw_dlp_influx_hosts | default('') | string)"
             fail_msg: "aw_dlp_influx_enabled=true, но URL/org/bucket/hosts похожи на public example/TEST-NET значения. Задайте live значения в private inventory/env, не в public repo."
-          when: aw_dlp_influx_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_influx_enabled | default(false) | bool
 
         - name: Записать /etc/activitywatch/aw-server.env перед хотфиксами
           ansible.builtin.copy:
@@ -764,7 +786,7 @@
               AW_SERVER_GROUP={{ aw_server_group }}
               AW_WORKTIME_REPORT_BASE={{ aw_worktime_report_base }}
               AW_WORKTIME_TZ={{ aw_worktime_timezone }}
-              AW_WORKTIME_HOST={{ aw_effective_worktime_host | default(aw_effective_monitored_windows_hostname | default('SHARKON2025')) }}
+              AW_WORKTIME_HOST={{ aw_effective_worktime_host | default(aw_effective_monitored_windows_hostname | default('HOST-EXAMPLE')) }}
               AW_WORKTIME_EVENTS_LIMIT={{ aw_worktime_events_limit | default(5000) }}
               AW_WORKTIME_AW_HTTP_TIMEOUT_SECONDS={{ aw_worktime_aw_http_timeout_seconds | default(6) }}
               AW_WORKTIME_EVENTS_CACHE_TTL_SECONDS={{ aw_worktime_events_cache_ttl_seconds | default(300) }}
@@ -787,7 +809,7 @@
               AW_WORKTIME_INFLUX_URL={{ aw_worktime_influx_url | default('') }}
               AW_WORKTIME_INFLUX_ORG={{ aw_worktime_influx_org | default('proxmox') }}
               AW_WORKTIME_INFLUX_BUCKET={{ aw_worktime_influx_bucket | default('aw_metrics') }}
-              AW_WORKTIME_INFLUX_HOSTS={{ aw_worktime_influx_hosts | default('SHARKON2025') }}
+              AW_WORKTIME_INFLUX_HOSTS={{ aw_worktime_influx_hosts | default(aw_effective_monitored_windows_hostname | default('HOST-EXAMPLE')) }}
               AW_WORKTIME_INFLUX_DAYS={{ aw_worktime_influx_days | default('today,yesterday') }}
               AW_WORKTIME_INFLUX_TOKEN={{ aw_effective_worktime_influx_token | default('') }}
               AW_WORKTIME_MANAGEMENT_HISTORY_DIR={{ aw_worktime_management_history_dir | default(aw_server_data_dir ~ '/worktime-management-history') }}
@@ -798,11 +820,28 @@
               AW_WORKTIME_MANAGER_TREND_DELTA_PCT={{ aw_worktime_manager_trend_delta_pct | default(10) }}
               AW_WORKTIME_MANAGER_OFF_HOURS_THRESHOLD_SECONDS={{ aw_worktime_manager_off_hours_threshold_seconds | default(1800) }}
               AW_WORKTIME_MANAGER_INTERPRETATION_POLICY={{ aw_worktime_interpretation_policy_path | default('/etc/activitywatch/worktime-interpretation-policy.json') }}
-              AW_DLP_INFLUX_ENABLED={{ 'true' if (aw_dlp_influx_enabled | default(false) | bool) else 'false' }}
+              AW_DLP_ENABLED={{ 'true' if (aw_dlp_enabled | default(false) | bool) else 'false' }}
+              AW_DLP_PROFILE={{ aw_dlp_profile | default('core_only') }}
+              AW_DLP_DISABLED_REASON={{ aw_dlp_disabled_reason | default('') }}
+              AW_DLP_DISABLED_SINCE={{ aw_dlp_disabled_since | default('') }}
+              AW_DLP_GUARD_ENABLED={{ 'true' if (aw_dlp_light_guard_enabled | default(true) | bool) else 'false' }}
+              AW_DLP_GUARD_STATE_DIR={{ aw_dlp_light_guard_state_dir | default(aw_server_data_dir ~ '/health') }}
+              AW_DLP_GUARD_LOAD_RATIO={{ aw_dlp_light_guard_load_ratio | default('1.50') }}
+              AW_DLP_GUARD_MEM_AVAILABLE_PCT_MIN={{ aw_dlp_light_guard_mem_available_pct_min | default('15') }}
+              AW_DLP_GUARD_IOWAIT_PCT_MAX={{ aw_dlp_light_guard_iowait_pct_max | default('20') }}
+              AW_DLP_GUARD_STRIKES_REQUIRED={{ aw_dlp_light_guard_strikes_required | default(3) }}
+              AW_DLP_CONTROL_BIN=/usr/local/bin/detmir-dlp-runtime-control
+              AW_CONTAINMENT_ENABLED={{ 'true' if (aw_containment_enabled | default(false) | bool) else 'false' }}
+              AW_CONTAINMENT_MODE={{ aw_containment_mode | default('shadow') }}
+              AW_CONTAINMENT_POLICY={{ aw_containment_policy_path | default('/etc/activitywatch/containment-policy.json') }}
+              AW_CONTAINMENT_DEFAULT_TTL_MINUTES={{ aw_containment_default_ttl_minutes | default(60) }}
+              AW_CONTAINMENT_REQUIRE_ADMIN_CHANNEL_CHECK={{ 'true' if (aw_containment_require_admin_channel_check | default(true) | bool) else 'false' }}
+              AW_CONTAINMENT_ALLOW_AUTO_FOR_SERVERS={{ 'true' if (aw_containment_allow_auto_for_servers | default(false) | bool) else 'false' }}
+              AW_DLP_INFLUX_ENABLED={{ 'true' if ((aw_dlp_enabled | default(false) | bool) and (aw_dlp_influx_enabled | default(false) | bool)) else 'false' }}
               AW_DLP_INFLUX_URL={{ aw_dlp_influx_url | default('') }}
               AW_DLP_INFLUX_ORG={{ aw_dlp_influx_org | default('proxmox') }}
               AW_DLP_INFLUX_BUCKET={{ aw_dlp_influx_bucket | default('aw_metrics') }}
-              AW_DLP_INFLUX_HOSTS={{ aw_dlp_influx_hosts | default('SHARKON2025') }}
+              AW_DLP_INFLUX_HOSTS={{ aw_dlp_influx_hosts | default(aw_effective_monitored_windows_hostname | default('HOST-EXAMPLE')) }}
               AW_DLP_INFLUX_LOOKBACK_DAYS={{ aw_dlp_influx_lookback_days | default(30) }}
               AW_DLP_INFLUX_EVENT_LIMIT={{ aw_dlp_influx_event_limit | default(2000) }}
               AW_DLP_INFLUX_TOKEN={{ aw_effective_dlp_influx_token | default('') }}
@@ -820,6 +859,7 @@
               AW_RUS_HEALTH_SESSION_EVENTS_MAX_AGE_SECONDS={{ aw_rus_health_session_events_max_age_seconds | default(86400) }}
               AW_RUS_HEALTH_GUARD_MAX_AGE_SECONDS={{ aw_rus_health_guard_max_age_seconds | default(300) }}
               AW_RUS_HEALTH_GUARD_REQUIRED={{ 1 if (aw_rus_health_guard_required | default(true) | bool) else 0 }}
+              AW_RUS_HEALTH_RDP_TCP_REQUIRED={{ 'true' if (aw_rus_health_rdp_tcp_required | default(true) | bool) else 'false' }}
               AW_RUS_SLO_STATE_DIR={{ aw_server_data_dir }}/slo
               AW_RUS_SLO_AW_BASE=http://127.0.0.1:5600
               AW_RUS_SLO_WORKTIME_BASE={{ aw_rus_health_worktime_api_base | default('http://127.0.0.1:5610') }}
@@ -837,6 +877,104 @@
               AW_HAYABUSA_TELEGRAM_MIN_SEVERITY={{ aw_hayabusa_telegram_min_severity | default('high') }}
               AW_HAYABUSA_TELEGRAM_BOT_TOKEN={{ aw_hayabusa_telegram_bot_token | default('') }}
               AW_HAYABUSA_TELEGRAM_CHAT_IDS={{ aw_hayabusa_telegram_chat_ids | default('') }}
+              AW_SECURITY_FINDING_INBOX_ENABLED={{ 'true' if (aw_security_finding_inbox_enabled | default(false) | bool) else 'false' }}
+              AW_SECURITY_FINDING_INBOX_REQUIRED={{ 'true' if (aw_security_finding_inbox_required | default(false) | bool) else 'false' }}
+              AW_SECURITY_FINDING_INBOX_BIN={{ aw_security_finding_inbox_bin | default('/usr/local/bin/security-finding-inbox') }}
+              AW_SECURITY_FINDING_INBOX_MIN_SEVERITY={{ aw_security_finding_inbox_min_severity | default('medium') }}
+              AW_SECURITY_FINDING_EXECUTOR_WORK_DIR={{ aw_security_finding_executor_work_dir | default(aw_server_data_dir ~ '/security-finding-executor') }}
+              AW_SECURITY_FINDING_EXECUTOR_LOCK={{ aw_security_finding_executor_lock | default('/var/lock/aw-security-finding-executor.lock') }}
+              AW_CONTAINMENT_ENGINE_BIN={{ aw_containment_engine_bin | default('/usr/local/bin/containment-engine') }}
+              AW_CONTAINMENT_MANAGEMENT_ALLOWLIST={{ aw_containment_management_allowlist | default('') }}
+              AW_CONTAINMENT_BLOCKED_REMOTE_ADDRESSES={{ aw_containment_blocked_remote_addresses | default('') }}
+
+        - name: Установить runtime control для optional DLP контура
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/scripts/detmir_dlp_runtime_control.sh"
+            dest: /usr/local/bin/detmir-dlp-runtime-control
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: Установить load guard для lightweight DLP контура
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/scripts/detmir_dlp_load_guard.sh"
+            dest: /usr/local/bin/detmir-dlp-load-guard
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: Установить systemd unit DLP load guard
+          ansible.builtin.copy:
+            dest: /etc/systemd/system/detmir-dlp-load-guard.service
+            owner: root
+            group: root
+            mode: "0644"
+            content: |
+              [Unit]
+              Description=DetMir lightweight DLP load guard
+              After=activitywatch-server.service
+
+              [Service]
+              Type=oneshot
+              EnvironmentFile=-/etc/activitywatch/aw-server.env
+              ExecStart=/usr/local/bin/detmir-dlp-load-guard
+              Nice=10
+              IOSchedulingClass=best-effort
+              IOSchedulingPriority=7
+              TimeoutStartSec=45
+
+        - name: Установить systemd timer DLP load guard
+          ansible.builtin.copy:
+            dest: /etc/systemd/system/detmir-dlp-load-guard.timer
+            owner: root
+            group: root
+            mode: "0644"
+            content: |
+              [Unit]
+              Description=Run DetMir lightweight DLP load guard
+
+              [Timer]
+              OnBootSec=3min
+              OnUnitActiveSec=1min
+              AccuracySec=30s
+              Persistent=false
+
+              [Install]
+              WantedBy=timers.target
+
+        - name: Включить DLP load guard timer
+          ansible.builtin.systemd:
+            name: detmir-dlp-load-guard.timer
+            enabled: true
+            state: started
+            daemon_reload: true
+          when: aw_dlp_light_guard_enabled | default(true) | bool
+
+        - name: Отключить DLP load guard timer, если guard явно выключен
+          ansible.builtin.systemd:
+            name: detmir-dlp-load-guard.timer
+            enabled: false
+            state: stopped
+            daemon_reload: true
+          failed_when: false
+          when: not (aw_dlp_light_guard_enabled | default(true) | bool)
+
+        - name: Создать каталог containment policy
+          ansible.builtin.file:
+            path: "{{ (aw_containment_policy_path | default('/etc/activitywatch/containment-policy.json')) | dirname }}"
+            state: directory
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: Установить default containment policy, если live policy отсутствует
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/configs/containment-policy.example.json"
+            dest: "{{ aw_containment_policy_path | default('/etc/activitywatch/containment-policy.json') }}"
+            owner: root
+            group: root
+            mode: "0644"
+            force: false
 
         - name: Создать каталог DLP policy engine
           ansible.builtin.file:
@@ -845,7 +983,9 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when: aw_dlp_policy_engine_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_policy_engine_enabled | default(false) | bool
 
         - name: Установить systemd unit DLP policy engine
           ansible.builtin.copy:
@@ -854,7 +994,9 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_policy_engine_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_policy_engine_enabled | default(false) | bool
 
         - name: Проверить локальный Rust DLP policy engine
           ansible.builtin.stat:
@@ -889,7 +1031,7 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when: aw_dlp_content_analysis_enabled | default(true) | bool
+          when: aw_dlp_content_analysis_enabled | default(false) | bool
 
         - name: Скопировать файлы DLP content analysis
           ansible.builtin.copy:
@@ -898,7 +1040,7 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0644"
-          when: aw_dlp_content_analysis_enabled | default(true) | bool
+          when: aw_dlp_content_analysis_enabled | default(false) | bool
 
         - name: Установить wrapper запуска DLP content analysis через virtualenv
           ansible.builtin.copy:
@@ -907,7 +1049,7 @@
             owner: root
             group: root
             mode: "0755"
-          when: aw_dlp_content_analysis_enabled | default(true) | bool
+          when: aw_dlp_content_analysis_enabled | default(false) | bool
 
         - name: Проверить локальный Rust DLP content analyzer
           ansible.builtin.stat:
@@ -915,7 +1057,7 @@
           delegate_to: localhost
           register: dlp_content_analyzer_rust_binary
           become: false
-          when: aw_dlp_content_analysis_enabled | default(true) | bool
+          when: aw_dlp_content_analysis_enabled | default(false) | bool
 
         - name: Установить Rust DLP content analyzer
           ansible.builtin.copy:
@@ -925,7 +1067,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_content_analysis_enabled | default(true) | bool
+            - aw_dlp_content_analysis_enabled | default(false) | bool
             - dlp_content_analyzer_rust_binary.stat.exists | default(false)
 
         - name: Создать virtualenv DLP content analysis
@@ -933,13 +1075,13 @@
             cmd: python3 -m venv /opt/activitywatch/dlp-content-analysis/.venv
           args:
             creates: /opt/activitywatch/dlp-content-analysis/.venv/bin/python
-          when: aw_dlp_content_analysis_enabled | default(true) | bool
+          when: aw_dlp_content_analysis_enabled | default(false) | bool
 
         - name: Установить зависимости DLP content analysis
           ansible.builtin.pip:
             requirements: /opt/activitywatch/dlp-content-analysis/requirements.txt
             virtualenv: /opt/activitywatch/dlp-content-analysis/.venv
-          when: aw_dlp_content_analysis_enabled | default(true) | bool
+          when: aw_dlp_content_analysis_enabled | default(false) | bool
 
         - name: Создать каталог DLP integrations
           ansible.builtin.file:
@@ -948,7 +1090,9 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Скопировать файлы DLP integrations
           ansible.builtin.copy:
@@ -961,7 +1105,9 @@
             - cef-config.yaml
             - syslog-forwarder-config.yaml
             - webhook-config.yaml
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Создать state каталог DLP integrations
           ansible.builtin.file:
@@ -970,7 +1116,9 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить systemd unit CEF exporter
           ansible.builtin.copy:
@@ -979,7 +1127,9 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить systemd timer CEF exporter
           ansible.builtin.copy:
@@ -988,7 +1138,9 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Проверить локальный Rust CEF exporter
           ansible.builtin.stat:
@@ -996,14 +1148,16 @@
           delegate_to: localhost
           register: dlp_cef_exporter_rust_binary
           become: false
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Требовать Rust CEF exporter artifact
           ansible.builtin.assert:
             that:
               - dlp_cef_exporter_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-cef-exporter"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить Rust CEF exporter
           ansible.builtin.copy:
@@ -1013,7 +1167,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_integrations_enabled | default(true) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
             - dlp_cef_exporter_rust_binary.stat.exists | default(false)
 
         - name: Установить systemd unit syslog forwarder
@@ -1023,7 +1177,7 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить systemd timer syslog forwarder
           ansible.builtin.copy:
@@ -1032,7 +1186,7 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Проверить локальный Rust syslog forwarder
           ansible.builtin.stat:
@@ -1040,14 +1194,14 @@
           delegate_to: localhost
           register: dlp_syslog_forwarder_rust_binary
           become: false
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Требовать Rust syslog forwarder artifact
           ansible.builtin.assert:
             that:
               - dlp_syslog_forwarder_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-syslog-forwarder"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить Rust syslog forwarder
           ansible.builtin.copy:
@@ -1057,7 +1211,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_integrations_enabled | default(true) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
             - dlp_syslog_forwarder_rust_binary.stat.exists | default(false)
 
         - name: Установить systemd unit webhook sender
@@ -1067,7 +1221,7 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить systemd timer webhook sender
           ansible.builtin.copy:
@@ -1076,7 +1230,7 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Проверить локальный Rust webhook sender
           ansible.builtin.stat:
@@ -1084,14 +1238,14 @@
           delegate_to: localhost
           register: dlp_webhook_sender_rust_binary
           become: false
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Требовать Rust webhook sender artifact
           ansible.builtin.assert:
             that:
               - dlp_webhook_sender_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-webhook-sender"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить Rust webhook sender
           ansible.builtin.copy:
@@ -1101,7 +1255,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_integrations_enabled | default(true) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
             - dlp_webhook_sender_rust_binary.stat.exists | default(false)
 
         - name: Создать каталог DLP case management
@@ -1111,7 +1265,9 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when: aw_dlp_case_management_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_case_management_enabled | default(false) | bool
 
         - name: Установить systemd unit DLP case management
           ansible.builtin.copy:
@@ -1120,7 +1276,9 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_case_management_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_case_management_enabled | default(false) | bool
 
         - name: Проверить локальный Rust DLP case management
           ansible.builtin.stat:
@@ -1128,14 +1286,14 @@
           delegate_to: localhost
           register: aw_dlp_case_management_rust_binary
           become: false
-          when: aw_dlp_case_management_enabled | default(true) | bool
+          when: aw_dlp_case_management_enabled | default(false) | bool
 
         - name: Требовать Rust DLP case management artifact
           ansible.builtin.assert:
             that:
               - aw_dlp_case_management_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-case-management"
-          when: aw_dlp_case_management_enabled | default(true) | bool
+          when: aw_dlp_case_management_enabled | default(false) | bool
 
         - name: Установить Rust DLP case management
           ansible.builtin.copy:
@@ -1145,7 +1303,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_case_management_enabled | default(true) | bool
+            - aw_dlp_case_management_enabled | default(false) | bool
             - aw_dlp_case_management_rust_binary.stat.exists | default(false)
 
         - name: Создать каталоги DLP compliance
@@ -1159,7 +1317,9 @@
             - /opt/activitywatch/dlp-compliance
             - /opt/activitywatch/dlp-compliance/templates
             - "{{ aw_dlp_compliance_report_dir }}"
-          when: aw_dlp_compliance_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_compliance_enabled | default(false) | bool
 
         - name: Скопировать файлы DLP compliance
           ansible.builtin.copy:
@@ -1173,7 +1333,9 @@
             - { src: "templates/pci-dss-report.html", dest: "/opt/activitywatch/dlp-compliance/templates/pci-dss-report.html", mode: "0644" }
             - { src: "report-scheduler.service", dest: "/etc/systemd/system/aw-dlp-report-scheduler.service", mode: "0644" }
             - { src: "report-scheduler.timer", dest: "/etc/systemd/system/aw-dlp-report-scheduler.timer", mode: "0644" }
-          when: aw_dlp_compliance_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_compliance_enabled | default(false) | bool
 
         - name: Проверить локальный Rust DLP compliance
           ansible.builtin.stat:
@@ -1181,14 +1343,18 @@
           delegate_to: localhost
           register: aw_dlp_compliance_rust_binary
           become: false
-          when: aw_dlp_compliance_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_compliance_enabled | default(false) | bool
 
         - name: Требовать Rust DLP compliance artifact
           ansible.builtin.assert:
             that:
               - aw_dlp_compliance_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-compliance"
-          when: aw_dlp_compliance_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_compliance_enabled | default(false) | bool
 
         - name: Установить Rust DLP compliance
           ansible.builtin.copy:
@@ -1198,7 +1364,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_compliance_enabled | default(true) | bool
+            - aw_dlp_compliance_enabled | default(false) | bool
             - aw_dlp_compliance_rust_binary.stat.exists | default(false)
 
         - name: Проверить локальный Rust dlp-admin-cli
@@ -1437,6 +1603,47 @@
             mode: "0755"
           when: dlp_health_check_rust_binary.stat.exists | default(false)
 
+        - name: Проверить локальный Rust containment-engine
+          ansible.builtin.stat:
+            path: "{{ aw_rust_release_dir }}/containment-engine"
+          delegate_to: localhost
+          register: containment_engine_rust_binary
+          become: false
+
+        - name: Установить Rust containment-engine
+          ansible.builtin.copy:
+            src: "{{ aw_rust_release_dir }}/containment-engine"
+            dest: /usr/local/bin/containment-engine
+            owner: root
+            group: root
+            mode: "0755"
+          when: containment_engine_rust_binary.stat.exists | default(false)
+
+        - name: Проверить локальный Rust security-finding-inbox
+          ansible.builtin.stat:
+            path: "{{ aw_rust_release_dir }}/security-finding-inbox"
+          delegate_to: localhost
+          register: security_finding_inbox_rust_binary
+          become: false
+
+        - name: Установить Rust security-finding-inbox
+          ansible.builtin.copy:
+            src: "{{ aw_rust_release_dir }}/security-finding-inbox"
+            dest: /usr/local/bin/security-finding-inbox
+            owner: root
+            group: root
+            mode: "0755"
+          when: security_finding_inbox_rust_binary.stat.exists | default(false)
+
+        - name: Установить systemd unit Security Finding Inbox executor
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/ops/systemd/aw-security-finding-executor.service"
+            dest: /etc/systemd/system/aw-security-finding-executor.service
+            owner: root
+            group: root
+            mode: "0644"
+          notify: Перезагрузить systemd
+
         - name: Проверить локальный Rust AW-RUS healthd
           ansible.builtin.stat:
             path: "{{ aw_rust_release_dir }}/aw-rus-healthd"
@@ -1644,7 +1851,9 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_influx_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_influx_enabled | default(false) | bool
 
         - name: Проверить локальный Rust AW DLP Influx exporter
           ansible.builtin.stat:
@@ -1652,14 +1861,18 @@
           delegate_to: localhost
           register: aw_dlp_influx_exporter_rust_binary
           become: false
-          when: aw_dlp_influx_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_influx_enabled | default(false) | bool
 
         - name: Требовать Rust AW DLP Influx exporter artifact
           ansible.builtin.assert:
             that:
               - aw_dlp_influx_exporter_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-influx-exporter"
-          when: aw_dlp_influx_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_influx_enabled | default(false) | bool
 
         - name: Установить Rust AW DLP Influx exporter
           ansible.builtin.copy:
@@ -1679,7 +1892,9 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_influx_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_influx_enabled | default(false) | bool
 
         - name: Проверить локальный Rust DetMir readiness checker
           ansible.builtin.stat:
@@ -1831,42 +2046,42 @@
             name: aw-dlp-cef-exporter.timer
             enabled: true
             state: restarted
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Включить и перезапустить timer syslog forwarder
           ansible.builtin.systemd:
             name: aw-dlp-syslog-forwarder.timer
             enabled: true
             state: restarted
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Включить и перезапустить timer webhook sender
           ansible.builtin.systemd:
             name: aw-dlp-webhook-sender.timer
             enabled: true
             state: restarted
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Включить и перезапустить DLP case management
           ansible.builtin.systemd:
             name: aw-dlp-case-management.service
             enabled: true
             state: restarted
-          when: aw_dlp_case_management_enabled | default(true) | bool
+          when: aw_dlp_case_management_enabled | default(false) | bool
 
         - name: Включить и перезапустить timer DLP compliance report
           ansible.builtin.systemd:
             name: aw-dlp-report-scheduler.timer
             enabled: true
             state: restarted
-          when: aw_dlp_compliance_enabled | default(true) | bool
+          when: aw_dlp_compliance_enabled | default(false) | bool
 
         - name: Выполнить разовый прогон DLP compliance report
           ansible.builtin.systemd:
             name: aw-dlp-report-scheduler.service
             state: started
           failed_when: false
-          when: aw_dlp_compliance_enabled | default(true) | bool
+          when: aw_dlp_compliance_enabled | default(false) | bool
 
         - name: Включить и перезапустить AW worktime API
           ansible.builtin.systemd:
@@ -2233,6 +2448,11 @@
             mode: "0755"
           when: dlp_aggregator_rust_binary.stat.exists | default(false)
 
+        - name: Удалить stale drop-in, переопределяющий lightweight DLP aggregator
+          ansible.builtin.file:
+            path: /etc/systemd/system/activitywatch-dlp-aggregator.service.d/20-rust-switch.conf
+            state: absent
+
         - name: Установить systemd unit для агрегатора
           ansible.builtin.copy:
             dest: /etc/systemd/system/activitywatch-dlp-aggregator.service
@@ -2241,7 +2461,7 @@
             mode: "0644"
             content: |
               [Unit]
-              Description=ActivityWatch DLP Event Aggregator
+              Description=ActivityWatch Lightweight DLP Event Aggregator
               After=activitywatch-server.service
 
               [Service]
@@ -2251,7 +2471,18 @@
               ExecStart=/usr/local/bin/dlp-aggregator-rust \
                 --aw-url http://127.0.0.1:{{ aw_server_port }}/api/0 \
                 --sqlite-path {{ aw_server_data_dir }}/dlp_warehouse.sqlite \
-                --state-path {{ aw_server_data_dir }}/dlp-aggregator-state.json
+                --state-path {{ aw_server_data_dir }}/dlp-aggregator-state.json \
+                --bucket-prefixes {{ aw_dlp_aggregator_bucket_prefixes | default('aw-file-operations_,aw-dlp-incidents_') }} \
+                --lookback-hours {{ aw_dlp_aggregator_lookback_hours | default(2) }} \
+                --overlap-seconds {{ aw_dlp_aggregator_overlap_seconds | default(60) }} \
+                --limit {{ aw_dlp_aggregator_limit | default(500) }} \
+                --timeout {{ aw_dlp_aggregator_timeout_seconds | default(8) }}
+              Nice=10
+              IOSchedulingClass=best-effort
+              IOSchedulingPriority=7
+              CPUQuota={{ aw_dlp_aggregator_cpu_quota | default('10%') }}
+              MemoryMax={{ aw_dlp_aggregator_memory_max | default('256M') }}
+              TimeoutStartSec={{ (aw_dlp_aggregator_timeout_seconds | default(8) | int) + 15 }}
 
               [Install]
               WantedBy=multi-user.target
@@ -2261,10 +2492,10 @@
             dest: /etc/systemd/system/activitywatch-dlp-aggregator.timer
             content: |
               [Unit]
-              Description=Run ActivityWatch DLP Aggregator every 5 minutes
+              Description=Run ActivityWatch Lightweight DLP Aggregator
 
               [Timer]
-              OnCalendar=*:3/10:10
+              OnCalendar={{ aw_dlp_aggregator_on_calendar | default('*:3/15:10') }}
               AccuracySec=30s
               RandomizedDelaySec=30s
               Persistent=false
@@ -2278,9 +2509,14 @@
             enabled: true
             state: started
             daemon_reload: true
+      when:
+        - aw_dlp_enabled | default(false) | bool
+        - aw_dlp_light_collector_enabled | default(false) | bool
 
     - name: Настроить IOC enrichment из Hayabusa Sigma
-      when: aw_dlp_ioc_enabled | default(false) | bool
+      when:
+        - aw_dlp_enabled | default(false) | bool
+        - aw_dlp_ioc_enabled | default(false) | bool
       block:
         - name: Создать каталог IOC enrichment
           ansible.builtin.file:

ansible/deploy_detmir_portal.yml

@@ -15,8 +15,16 @@
     detmir_portal_workforce_policy_path: "/etc/detmir-portal-workforce-policy.json"
     detmir_portal_ueba_policy_path: "/etc/detmir-portal-ueba-policy.yaml"
     detmir_portal_readiness_bundle_dir: "{{ detmir_portal_readiness_bundle_dir_override | default('/var/lib/activitywatch/health/readiness-bundle', true) }}"
+    detmir_portal_dlp_module_enabled: "{{ detmir_portal_dlp_module_enabled_override | default(false) }}"
 
   tasks:
+    - name: Refuse inconsistent DetMir portal DLP profile
+      ansible.builtin.assert:
+        that:
+          - detmir_portal_dlp_profile | default('core_only') in ['core_only', 'light', 'on_demand', 'full']
+          - (detmir_portal_dlp_profile | default('core_only') != 'core_only') or not (detmir_portal_dlp_module_enabled | bool)
+        fail_msg: "Inconsistent DetMir portal DLP profile: core_only must keep DETMIR_PORTAL_DLP_MODULE_ENABLED=false."
+
     - name: Check local detmir-portal binary
       ansible.builtin.stat:
         path: "{{ aw_rust_release_dir }}/detmir-portal"
@@ -54,6 +62,8 @@
           DETMIR_PORTAL_UEBA_POLICY_PATH={{ detmir_portal_ueba_policy_path }}
           DETMIR_PORTAL_TIMEOUT_SECONDS=25
           DETMIR_PORTAL_STATE_DIR=/var/lib/detmir-portal
+          DETMIR_PORTAL_DLP_MODULE_ENABLED={{ detmir_portal_dlp_module_enabled | bool | ternary('true', 'false') }}
+          DETMIR_PORTAL_DLP_PROFILE={{ detmir_portal_dlp_profile | default('core_only') }}
           DETMIR_PORTAL_DLP_DB_PATH=/var/lib/activitywatch/dlp_warehouse.sqlite
           DETMIR_PORTAL_EVIDENCE_ROOT=/var/lib/detmir-portal/evidence
           DETMIR_PORTAL_READINESS_BUNDLE_DIR={{ detmir_portal_readiness_bundle_dir }}
@@ -65,6 +75,65 @@
           CLICKHOUSE_USER={{ detmir_clickhouse_user | default('default') }}
           CLICKHOUSE_PASSWORD={{ detmir_clickhouse_password | default('') }}
 
+    - name: Install lightweight DLP warehouse sync helper
+      ansible.builtin.copy:
+        src: "{{ aw_repo_root }}/scripts/detmir_dlp_warehouse_sync.sh"
+        dest: /usr/local/bin/detmir-dlp-warehouse-sync
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Install lightweight DLP warehouse sync service
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/detmir-dlp-warehouse-sync.service
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Unit]
+          Description=Sync lightweight DetMir DLP SQLite warehouse for portal
+          After=network-online.target
+          Wants=network-online.target
+
+          [Service]
+          Type=oneshot
+          Environment=AW_DLP_WAREHOUSE_SOURCE_HOST={{ detmir_portal_dlp_warehouse_source_host | default('igor@10.10.10.13') }}
+          Environment=AW_DLP_WAREHOUSE_SOURCE_PATH={{ detmir_portal_dlp_warehouse_source_path | default('/var/lib/activitywatch/dlp_warehouse.sqlite') }}
+          Environment=AW_DLP_WAREHOUSE_DEST_PATH={{ detmir_portal_dlp_warehouse_dest_path | default('/var/lib/activitywatch/dlp_warehouse.sqlite') }}
+          Environment=AW_DLP_WAREHOUSE_SYNC_STATE_DIR={{ detmir_portal_dlp_warehouse_sync_state_dir | default('/var/lib/activitywatch/health') }}
+          ExecStart=/usr/local/bin/detmir-dlp-warehouse-sync
+          Nice=10
+          IOSchedulingClass=best-effort
+          IOSchedulingPriority=7
+          TimeoutStartSec=60
+
+    - name: Install lightweight DLP warehouse sync timer
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/detmir-dlp-warehouse-sync.timer
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Unit]
+          Description=Run lightweight DetMir DLP SQLite warehouse sync
+
+          [Timer]
+          OnBootSec=4min
+          OnUnitActiveSec={{ detmir_portal_dlp_warehouse_sync_interval | default('2min') }}
+          AccuracySec=30s
+          Persistent=false
+
+          [Install]
+          WantedBy=timers.target
+
+    - name: Enable lightweight DLP warehouse sync timer
+      ansible.builtin.systemd:
+        name: detmir-dlp-warehouse-sync.timer
+        enabled: true
+        state: started
+        daemon_reload: true
+      when: detmir_portal_dlp_module_enabled | bool
+
     - name: Preserve local ClickHouse security-events settings when available
       ansible.builtin.shell: |
         set -euo pipefail
@@ -117,7 +186,9 @@
         state: absent
       loop:
         - /etc/systemd/system/detmir-portal.service.d/20-timeouts.conf
+        - /etc/systemd/system/detmir-portal.service.d/20-prod-timeout.conf
         - /etc/systemd/system/detmir-portal.service.d/30-warm-cache.conf
+        - /etc/systemd/system/detmir-portal.service.d/30-prewarm-after-start.conf
       register: detmir_portal_stale_overrides
 
     - name: Install initial workforce policy when absent
@@ -174,6 +245,11 @@
           WantedBy=multi-user.target
       register: detmir_portal_service_unit
 
+    - name: Remove stale detmir-portal timeout override
+      ansible.builtin.file:
+        path: /etc/systemd/system/detmir-portal.service.d/10-detmir-check-env.conf
+        state: absent
+
     - name: Reload systemd
       ansible.builtin.systemd:
         daemon_reload: true

ansible/group_vars/all.yml

@@ -33,7 +33,10 @@ aw_worktime_manager_trend_min_points: 3
 aw_worktime_manager_trend_delta_pct: 10
 aw_worktime_manager_off_hours_threshold_seconds: 1800
 aw_worktime_interpretation_policy_path: "/etc/activitywatch/worktime-interpretation-policy.json"
-aw_dlp_influx_enabled: true
+aw_dlp_profile: "core_only"
+detmir_portal_dlp_profile: "light"
+detmir_portal_dlp_module_enabled_override: true
+aw_dlp_influx_enabled: false
 aw_dlp_influx_url: "http://192.0.2.10:8086"
 aw_dlp_influx_org: "proxmox"
 aw_dlp_influx_bucket: "aw_metrics"
@@ -47,6 +50,7 @@ aw_worktime_host: "{{ aw_monitored_windows_hostname }}"
 aw_rus_health_worktime_api_base: "http://127.0.0.1:5610"
 aw_rus_health_state_dir: "{{ aw_server_data_dir }}/health"
 aw_rus_health_validation_dir: "{{ aw_rus_health_state_dir }}/windows-validation"
+aw_rus_health_rdp_tcp_required: false
 aw_hayabusa_auto_case_enabled: true
 aw_hayabusa_auto_case_min_severity: "medium"
 aw_hayabusa_telegram_enabled: true
@@ -65,22 +69,46 @@ aw_server_cors_origins:
 
 aw_apply_worktime_settings: true
 
-aw_dlp_ioc_enabled: true
+aw_dlp_ioc_enabled: false
+aw_dlp_enabled: false
+aw_dlp_disabled_reason: ""
+aw_dlp_disabled_since: ""
+aw_dlp_light_collector_enabled: false
+aw_dlp_light_guard_enabled: true
+aw_dlp_light_guard_load_ratio: "1.50"
+aw_dlp_light_guard_mem_available_pct_min: "15"
+aw_dlp_light_guard_iowait_pct_max: "20"
+aw_dlp_light_guard_strikes_required: 3
+aw_dlp_light_guard_state_dir: "{{ aw_server_data_dir }}/health"
+aw_dlp_aggregator_bucket_prefixes: "aw-file-operations_,aw-dlp-incidents_"
+aw_dlp_aggregator_limit: 500
+aw_dlp_aggregator_lookback_hours: 2
+aw_dlp_aggregator_overlap_seconds: 60
+aw_dlp_aggregator_timeout_seconds: 8
+aw_dlp_aggregator_on_calendar: "*:3/15:10"
+aw_dlp_aggregator_cpu_quota: "10%"
+aw_dlp_aggregator_memory_max: "256M"
+aw_containment_enabled: false
+aw_containment_mode: "shadow"
+aw_containment_policy_path: "/etc/activitywatch/containment-policy.json"
+aw_containment_default_ttl_minutes: 60
+aw_containment_require_admin_channel_check: true
+aw_containment_allow_auto_for_servers: false
 aw_dlp_ioc_workdir: "/opt/activitywatch/dlp-ioc"
 aw_dlp_ioc_rules_zip_url: "https://github.com/Yamato-Security/hayabusa-rules/archive/refs/heads/main.zip"
 aw_dlp_ioc_refresh_on_boot_sec: "5min"
 aw_dlp_ioc_refresh_interval: "6h"
-aw_dlp_policy_engine_enabled: true
+aw_dlp_policy_engine_enabled: false
 aw_dlp_policy_engine_bind_host: "0.0.0.0"
 aw_dlp_policy_engine_port: 5601
 aw_dlp_policy_engine_db_path: "{{ aw_server_data_dir }}/dlp-policy-engine.sqlite"
-aw_dlp_content_analysis_enabled: true
-aw_dlp_integrations_enabled: true
-aw_dlp_case_management_enabled: true
+aw_dlp_content_analysis_enabled: false
+aw_dlp_integrations_enabled: false
+aw_dlp_case_management_enabled: false
 aw_dlp_case_bind_host: "0.0.0.0"
 aw_dlp_case_port: 5602
 aw_dlp_case_db_path: "/opt/activitywatch/dlp-case-management/cases.db"
-aw_dlp_compliance_enabled: true
+aw_dlp_compliance_enabled: false
 aw_dlp_compliance_report_dir: "/opt/activitywatch/dlp-compliance/reports"
 aw_dlp_compliance_template_path: "/opt/activitywatch/dlp-compliance/templates/152-fz-report.html"
 aw_server_post_deploy_health_check_enabled: true

aw-server/aw-server.env.example

@@ -16,7 +16,7 @@ AW_SERVER_GROUP=activitywatch
 AW_SERVER_PUBLIC_HOST=aw-server
 AW_WORKTIME_REPORT_BASE=http://aw-server:5610
 AW_WORKTIME_TZ=Europe/Moscow
-AW_WORKTIME_HOST=SHARKON2025
+AW_WORKTIME_HOST=HOST-EXAMPLE
 AW_WORKTIME_EVENTS_LIMIT=5000
 AW_WORKTIME_AW_HTTP_TIMEOUT_SECONDS=6
 AW_WORKTIME_EVENTS_CACHE_TTL_SECONDS=300
@@ -33,6 +33,16 @@ AW_WORKTIME_MANAGEMENT_WARM_URL=http://127.0.0.1:5610/reports/worktime/managemen
 AW_WORKTIME_MANAGEMENT_WARM_TIMEOUT_SECONDS=70
 
 # DLP IOC Configuration
+AW_DLP_ENABLED=false
+AW_DLP_PROFILE=core_only
+AW_DLP_DISABLED_REASON=detmir_prod_resource_guardrail
+AW_DLP_DISABLED_SINCE=
+AW_CONTAINMENT_ENABLED=false
+AW_CONTAINMENT_MODE=shadow
+AW_CONTAINMENT_POLICY=/etc/activitywatch/containment-policy.json
+AW_CONTAINMENT_DEFAULT_TTL_MINUTES=60
+AW_CONTAINMENT_REQUIRE_ADMIN_CHANNEL_CHECK=true
+AW_CONTAINMENT_ALLOW_AUTO_FOR_SERVERS=false
 AW_DLP_IOC_DIR=/opt/activitywatch/dlp-ioc/output
 
 # DLP Policy Engine Configuration
@@ -50,22 +60,24 @@ AW_HEALTH_CHECK_ENABLED=true
 AW_HEALTH_CHECK_INTERVAL=60
 AW_EXPECT_START_OF_DAY=00:00
 AW_EXPECT_ALWAYS_ACTIVE_PATTERN=aw-watcher-window
-AW_EXPECT_LANDINGPAGE=/#/activity/SHARKON2025/view/
+AW_EXPECT_LANDINGPAGE=/#/activity/HOST-EXAMPLE/view/
 AW_HEALTH_STRICT_FILEOPS=0
 AW_MONITORED_WINDOWS_HOST=<WINDOWS_HOST>
-AW_MONITORED_WINDOWS_HOSTNAME=SHARKON2025
+AW_MONITORED_WINDOWS_HOSTNAME=HOST-EXAMPLE
 AW_RUS_HEALTH_WORKTIME_API=http://127.0.0.1:5610
 AW_RUS_HEALTH_STATE_DIR=/var/lib/activitywatch/health
 AW_RUS_HEALTH_VALIDATION_DIR=/var/lib/activitywatch/health/windows-validation
 AW_RUS_HEALTH_SESSION_EVENTS_MAX_AGE_SECONDS=86400
 AW_RUS_HEALTH_GUARD_MAX_AGE_SECONDS=300
 AW_RUS_HEALTH_GUARD_REQUIRED=1
+AW_RUS_HEALTH_RDP_TCP_REQUIRED=true
+AW_RUS_HEALTH_WRAPPER_TIMEOUT_SECONDS=90
 AW_RUS_SLO_AW_BASE=http://127.0.0.1:5600
 AW_RUS_SLO_WORKTIME_BASE=http://127.0.0.1:5610
 AW_RUS_SLO_TARGET_PERCENT=99.97
 AW_BROWSER_SMOKE_AW_BASE=http://127.0.0.1:5600
 AW_BROWSER_SMOKE_WORKTIME_BASE=http://127.0.0.1:5610
-AW_BROWSER_SMOKE_HOST=SHARKON2025
+AW_BROWSER_SMOKE_HOST=HOST-EXAMPLE
 AW_BROWSER_SMOKE_OUTPUT_DIR=/var/lib/activitywatch/browser-smoke
 AW_BROWSER_SMOKE_KEEP_RUNS=24
 AW_BROWSER_SMOKE_ENGINE=chromium-cli
@@ -79,6 +91,15 @@ AW_HAYABUSA_TELEGRAM_ENABLED=true
 AW_HAYABUSA_TELEGRAM_MIN_SEVERITY=high
 AW_HAYABUSA_TELEGRAM_BOT_TOKEN=
 AW_HAYABUSA_TELEGRAM_CHAT_IDS=
+AW_SECURITY_FINDING_INBOX_ENABLED=false
+AW_SECURITY_FINDING_INBOX_REQUIRED=false
+AW_SECURITY_FINDING_INBOX_BIN=/usr/local/bin/security-finding-inbox
+AW_SECURITY_FINDING_INBOX_MIN_SEVERITY=medium
+AW_SECURITY_FINDING_EXECUTOR_WORK_DIR=/var/lib/activitywatch/security-finding-executor
+AW_SECURITY_FINDING_EXECUTOR_LOCK=/var/lock/aw-security-finding-executor.lock
+AW_CONTAINMENT_ENGINE_BIN=/usr/local/bin/containment-engine
+AW_CONTAINMENT_MANAGEMENT_ALLOWLIST=
+AW_CONTAINMENT_BLOCKED_REMOTE_ADDRESSES=
 
 # Integration Test Configuration
 AW_INTEGRATION_TEST_ENABLED=false

configs/worktime-interpretation-policy.example.json

@@ -1,5 +1,5 @@
 {
-  "overload_threshold": 0.92,
+  "overload_threshold": 1.15,
   "underload_threshold": 0.45,
   "drop_threshold_pct": 20,
   "night_work_after": "20:00",

docs/CONTOUR_CHECK_MATRIX_RU.md

@@ -55,6 +55,21 @@ Live endpoints, hostnames, tokens and passwords must be supplied through
 `/etc/detmir/detmir-check.env` (systemd units) or another private environment
 file outside the public repository.
 
+Production note checked on 2026-06-24:
+
+- `DETMIR_PORTAL_URL` must point to the local DetMir portal listener,
+  currently `http://127.0.0.1:8720`, for server-side health checks. If it is
+  omitted, `detmir-check` falls back to the public HTTPS gateway and protected
+  `/readyz`, `/version` and `/metrics` can correctly return `401`, producing a
+  false operational failure.
+- `DETMIR_GATEWAY_HOST=127.0.0.1` is used with the local listener so the Host
+  header does not accidentally select the public protected gateway path.
+- Cold `/api/reports` builds can take more than 60 seconds on the live contour
+  when cache is empty or concurrent checks are active. The production
+  `detmir-portal-prewarm.service` therefore uses `curl --max-time 180` and
+  `TimeoutStartSec=210`. Shorter 45-60 second limits caused false failed
+  systemd states while the portal eventually returned HTTP 200.
+
 ## Текущий планировщик Proxmox, проверено 2026-06-21
 
 На Proxmox уже присутствуют следующие регулярные проверки:
@@ -75,10 +90,10 @@ file outside the public repository.
 Наблюдение: отдельный ежедневный полный gate по всей матрице AWatch-rus
 отсутствует. Его роль должен закрыть `awatch-contour-daily-check.timer`.
 
-Наблюдение: последняя проверка `detmir-portal-prewarm.service` на момент осмотра
-имела `Result=exit-code` и `ExecMainStatus=28`. Это не надо маскировать:
-канонический check должен показывать такой сбой как fail/warn в зависимости от
-политики эксплуатации.
+Историческое наблюдение 2026-06-24: `detmir-portal-prewarm.service` был найден
+в failed state из-за устаревшего `curl --max-time 60` для холодной сборки
+`/api/reports`. В текущей ветке это оформлено как отдельный prewarm/resilience
+пакет, а не как обязательная часть DLP production hot path.
 
 ## Матрица требований и проверок
 
@@ -91,14 +106,36 @@ file outside the public repository.
 | Portal hardening | `/healthz`, `/readyz`, `/version`, `/metrics` | `detmir-check` | да | да |
 | Windows/RDP | TCP 5985 и 22 | `detmir-check` | да | да |
 | ActivityWatch buckets | AFK/window/worktime/session events | `detmir-check` | да | да |
-| AWatch DLP buckets | endpoint signals/incidents/review/rules | `detmir-check` | да | да |
-| AWatch DLP health | remote `dlp-health-check --json` через `detmir-dlp` | `detmir-check` | да | да |
+| AWatch DLP buckets | endpoint signals/incidents/review/rules, только если DLP включен | `detmir-check` | условно | условно |
+| AWatch DLP health | disabled/core_only должен быть SKIPPED/WARN, `light/full` проверяются через `detmir-dlp` | `detmir-check` | да | да |
 | Grafana evidence | свежий JSON артефакт Grafana check | `detmir-check` | да | да |
 | Security events backend | ClickHouse events, если включено | `detmir-check` | да | да |
 | Portal contract | role/API smoke | `scripts/awatch-production-hardening-smoke.mjs` | нет | да |
 | Pilot contract | demo/API smoke | `scripts/detmir-pilot-demo-smoke.mjs` | нет | да |
 | Registry/readiness docs | registry readiness check | `scripts/registry_readiness_check.sh` | опционально | да |
 
+## Timeout/fail-closed параметры live contour
+
+После ручного live-прогона 2026-06-24 production
+`/etc/detmir/detmir-check.env` должен содержать bounded timeouts, соответствующие
+фактической latency AW datastore:
+
+```env
+DETMIR_SERVICE_TIMEOUT_SECONDS=35
+DETMIR_BUCKET_TIMEOUT_SECONDS=35
+DETMIR_DLP_TIMEOUT_SECONDS=120
+DETMIR_CHECK_OVERALL_TIMEOUT_SECONDS=300
+```
+
+Назначение:
+
+- не считать bucket `DEAD` только из-за штатной 15-30 секундной latency
+  большого SQLite datastore;
+- не оставлять `detmir-check`, `detmir-dlp`, `ssh` и remote
+  `dlp-health-check` хвосты при timeout;
+- сохранять красный non-zero результат при реальной недоступности, но
+  завершать проверку bounded.
+
 ## Fail-closed политика
 
 Ежедневный check должен завершаться non-zero, если падает обязательная область:
@@ -108,7 +145,9 @@ file outside the public repository.
 - Gateway/Portal health;
 - RDP/Windows reachability;
 - свежесть обязательных bucket streams;
-- AWatch DLP health;
+- AWatch DLP health только если DLP runtime включен; при штатном
+  `AW_DLP_ENABLED=false`/`core_only` disabled-state не является отказом
+  Workforce/Worktime core;
 - Grafana evidence freshness.
 
 Event-driven buckets не должны считаться stale только из-за отсутствия новых

docs/DETMIR_CURRENT_STATE_RU.md

@@ -26,19 +26,38 @@ logical host id остаётся `SHARKON2025`. Подробный post-restore
   `653b22b0fbf29a22f7de42ade7b689490b1de16fa07e785e4e0efd3078e7a3bc`.
 - Бэкап предыдущего binary на сервере:
   `/usr/local/bin/detmir-portal.bak.20260625T045640Z`.
-- Runtime mode после phase 1 deploy:
-  `DETMIR_PORTAL_DLP_MODULE_ENABLED=false`.
+- Runtime mode после 2026-06-30 prod hardening:
+  server-side DLP runtime зафиксирован в `core_only/disabled`.
+  Portal DLP UI/API module может оставаться включённым для чтения исторического
+  SQLite/evidence-среза, но это не означает запуск DLP collectors/exporters.
 - Server-side optional DLP runtime control:
   `AW_DLP_ENABLED=false|true` и `DETMIR_DLP_ENABLED=false|true`.
+- Current resource profile: `AW_DLP_ENABLED=false`,
+  `AW_DLP_PROFILE=core_only`; возврат в `light` выполняется только вручную
+  после проверки нагрузки.
 - Runtime control/statistics script:
   `scripts/detmir_dlp_runtime_control.sh` / live
   `/usr/local/bin/detmir-dlp-runtime-control`.
-- Live DLP runtime state after 2026-06-25 controlled disable:
-  `AW_DLP_ENABLED=false`, `AW_DLP_INFLUX_ENABLED=false`;
-  active/enabled DLP units: `0/0`.
+- DLP runtime state after 2026-06-30 prod hardening:
+  `AW_DLP_ENABLED=false`, `AW_DLP_PROFILE=core_only`,
+  `AW_DLP_INFLUX_ENABLED=false`; optional DLP units should be
+  `inactive/disabled`. `detmir-dlp-load-guard.timer` remains enabled and active
+  as protection for any later operator re-enable.
 - Reason: DLP runtime materially increases Proxmox VM/LXC, InfluxDB, Grafana,
-  ClickHouse and AW server load. In production DetMir it is currently kept
-  disabled, but remains a documented optional module that can be enabled later.
+  ClickHouse and AW server load. In production DetMir the safe default is
+  `core_only`; `light` is a reconnectable profile, not the automatic default.
+- Auto-disable guard:
+  `scripts/detmir_dlp_load_guard.sh` / live
+  `/usr/local/bin/detmir-dlp-load-guard`. При перегрузе переводит DLP в
+  `core_only` через runtime-control и пишет evidence в
+  `/var/lib/activitywatch/health/dlp-light-guard-state.json`.
+- DLP warehouse sync для портала:
+  `scripts/detmir_dlp_warehouse_sync.sh` / live
+  `/usr/local/bin/detmir-dlp-warehouse-sync`. Доставляет локальный SQLite
+  snapshot на portal host для UEBA/DLP views без heavy DLP hot path.
+- Loki CT is intentionally excluded from the current DetMir production resource
+  profile. It must not be returned by routine deploy/recovery while the goal is
+  to keep Proxmox VM/LXC load low.
 - Health после деплоя: `/healthz` возвращал `status=ok`.
 - Readiness после деплоя: `/readyz` возвращал `status=ready`.
 
@@ -84,9 +103,11 @@ logical host id остаётся `SHARKON2025`. Подробный post-restore
 - DLP evidence, screenshots, endpoint signals, case review и forensics
   enrichment требуют больше CPU/IO/сетевых операций, чем Workforce core.
 
-Вывод: DLP/evidence/forensics enrichment уже вынесен из обязательного hot path
-phase 1 через `DETMIR_PORTAL_DLP_MODULE_ENABLED=false`, но полная оптимизация
-тяжелого snapshot/prewarm остается отдельной инженерной задачей.
+Вывод: DLP/evidence/forensics enrichment вынесен из обязательного hot path.
+Phase 1 делал это через `DETMIR_PORTAL_DLP_MODULE_ENABLED=false`; текущий
+lightweight-профиль оставляет DLP-status/UEBA-сигналы включенными без тяжелого
+evidence/case/exporter path. Полная оптимизация тяжелого snapshot/prewarm
+остается отдельной инженерной задачей.
 
 ## Целевая граница после переработки
 
@@ -154,23 +175,45 @@ AW_DLP_ENABLED=true|false
 DETMIR_DLP_ENABLED=true|false
 ```
 
-Default остается `true`, чтобы существующее поведение не менялось без явного
-решения администратора. Для ускоренного Workforce/operator режима допускается
-`DETMIR_PORTAL_DLP_MODULE_ENABLED=false`; в этом режиме портал:
+DetMir production default после 2026-06-30 hardening:
+`AW_DLP_ENABLED=false` / `AW_DLP_PROFILE=core_only`. Portal DLP module may stay
+enabled for historical/security views, but server-side DLP collectors/exporters
+remain off. В этом режиме портал:
 
 - не читает DLP incident/case/review/audit файлы в основном report/operator
   path;
-- отключает security-events backend внутри snapshot, не меняя сохраненные
-  ClickHouse credentials;
-- возвращает disabled-state для DLP evidence API;
-- не считает отсутствие DLP ошибкой Workforce core.
+- использует только уже имеющийся лёгкий DLP-срез для UEBA и статуса;
+- не включает evidence/case/exporters/Loki/Influx-heavy path;
+- не считает отсутствие heavy DLP ошибкой Workforce core.
 
-Ansible-параметр поставки:
+Ansible-параметр поставки для старого disabled-профиля:
 
 ```yaml
 detmir_portal_dlp_module_enabled_override: false
 ```
 
+Для текущего safe production профиля:
+
+```yaml
+detmir_portal_dlp_module_enabled_override: true
+aw_dlp_profile: "core_only"
+aw_dlp_enabled: false
+aw_dlp_influx_enabled: false
+aw_dlp_light_collector_enabled: false
+aw_dlp_light_guard_enabled: true
+```
+
+Возврат в `light` выполняется только после resource check:
+
+```bash
+sudo AW_DLP_DISABLED_REASON=operator_reenable_after_resource_check \
+  /usr/local/bin/detmir-dlp-runtime-control set-profile light
+sudo sed -i \
+  -e 's/^AW_DLP_ENABLED=.*/AW_DLP_ENABLED=true/' \
+  -e 's/^AW_DLP_PROFILE=.*/AW_DLP_PROFILE=light/' \
+  /etc/activitywatch/aw-server.env
+```
+
 Отдельный `detmir-portal-evidence` сервис не отключается этим флагом и остается
 самостоятельным контуром evidence/API при наличии отдельной конфигурации.
 
@@ -189,6 +232,7 @@ Hayabusa/Velociraptor boundary:
 Server-side optional DLP runtime описан отдельно:
 
 - [DLP_OPTIONAL_RUNTIME_RU.md](DLP_OPTIONAL_RUNTIME_RU.md).
+- [DLP_RESOURCE_PROFILES_RU.md](DLP_RESOURCE_PROFILES_RU.md).
 
 При `AW_DLP_ENABLED=false`:
 
@@ -197,10 +241,27 @@ Server-side optional DLP runtime описан отдельно:
 - `detmir-check`, `check-aw-full` и `check-aw-data` не считают DLP buckets
   обязательными;
 - `detmir-readiness` не требует DLP Influx write и DLP systemd units;
+- DLP profile changes use
+  `/usr/local/bin/detmir-dlp-runtime-control set-profile <profile>` and keep a
+  rollback snapshot for `/usr/local/bin/detmir-dlp-runtime-control rollback`;
 - перед отключением и после отключения собираются JSON-срезы в
   `/var/lib/activitywatch/health/dlp-runtime-history/`, latest-срез остается в
   `/var/lib/activitywatch/health/dlp-runtime-state.json`.
 
+При `AW_DLP_PROFILE=light`:
+
+- `activitywatch-dlp-aggregator.timer` собирает только ограниченный набор DLP
+  events в локальный SQLite warehouse;
+- `detmir-dlp-warehouse-sync.timer` доставляет этот warehouse на portal host
+  атомарным snapshot;
+- UEBA может учитывать `dlp_warn`/`dlp_fail` без запуска Loki/Influx-heavy path;
+- `detmir-dlp-load-guard.timer` автоматически переводит профиль в `core_only`
+  при превышении порогов load/RAM/iowait;
+- тяжёлые DLP units (`aw-dlp-influx-exporter`, report/syslog/webhook/CEF,
+  policy engine, case management, evidence API) должны оставаться выключенными.
+- если `detmir-dlp-load-guard.timer` видит повторный перегруз, он автоматически
+  возвращает DLP runtime в `core_only`.
+
 Live disable evidence 2026-06-25:
 
 - `dlp-health-check` returned `ok=true`, `dlp:mode=disabled`;
@@ -307,6 +368,7 @@ curl -sS --max-time 5 http://10.10.10.2:8720/healthz
 - Не удалять DLP collectors и warehouse ради ускорения портала.
 - Не включать heavy DLP или Velociraptor server runtime автоматически при
   обычном deploy без ресурсного решения.
+- Не включать Loki CT автоматически при обычном deploy/recovery DetMir.
 - Не менять UI/API несовместимо: новые поля должны быть additive.
 - Не заявлять completed DLP decoupling до live deploy и browser/API smoke.
 - Не позиционировать AWatch-rus как сертифицированную DLP/SIEM/EDR/СЗИ.

docs/DLP_OPTIONAL_RUNTIME_RU.md

@@ -1,14 +1,37 @@
 # Optional DLP runtime for DetMir
 
-Цель: DLP-контур должен отключаться управляемо, без ложных аварий в health/readiness и без автоматического подъема heavy-пайплайна, когда задача контура - снизить нагрузку на InfluxDB, Grafana и ClickHouse.
+Цель: DLP-контур должен оставаться подключаемым, но production default для
+DetMir сейчас `core_only/disabled`. Возврат в лёгкий режим выполняется вручную
+после resource check; при перегрузе guard снова переводит DLP в `core_only`.
+
+Ресурсные профили и rollback-процедура описаны отдельно:
+[DLP_RESOURCE_PROFILES_RU.md](DLP_RESOURCE_PROFILES_RU.md).
 
 ## Что отключается
 
+Текущий production-профиль DetMir после 2026-06-30 prod hardening -
+`core_only/disabled`:
+
+- `AW_DLP_ENABLED=false`;
+- `AW_DLP_PROFILE=core_only`;
+- `AW_DLP_INFLUX_ENABLED=false`;
+- optional DLP timers/services inactive/disabled;
+- `detmir-dlp-load-guard.timer` остаётся enabled/active как защита на случай
+  последующего operator re-enable;
+- heavy DLP units, Influx exporter, evidence/case/report/integration units и
+  Loki остаются выключенными.
+
+Автоотключение выполняет `detmir-dlp-load-guard`: при превышении порогов
+load/RAM/iowait он переводит DLP в `core_only` через
+`detmir-dlp-runtime-control set-profile core_only`. После стабилизации контур
+возвращается вручную командой `set-profile light`.
+
 Штатный runtime off включает:
 
 - `AW_DLP_ENABLED=false` на AW server;
 - `DETMIR_DLP_ENABLED=false` в управляющем DetMir contour check;
-- `DETMIR_PORTAL_DLP_MODULE_ENABLED=false` для portal UI/API DLP-модуля;
+- portal UI/API DLP-модуль может оставаться включённым для исторического
+  SQLite/evidence-среза; это не запускает server-side DLP runtime;
 - остановку DLP timers/services:
   - `aw-dlp-influx-exporter.timer`;
   - `activitywatch-dlp-aggregator.timer`;
@@ -137,10 +160,31 @@ AW_DLP_ENABLED=false check-aw-full
 
 ## Возврат DLP
 
+Для DetMir предпочтительно возвращать не весь DLP сразу, а лёгкий профиль.
+Перед этим проверить load/RAM/iowait на Proxmox/AW/Influx/Grafana/ClickHouse.
+
 ```bash
-sudo sed -i 's/^AW_DLP_ENABLED=.*/AW_DLP_ENABLED=true/' /etc/activitywatch/aw-server.env
-sudo /usr/local/bin/detmir-dlp-runtime-control enable
-sudo systemctl restart aw-worktime-api.service || true
+sudo AW_DLP_DISABLED_REASON=operator_reenable_after_resource_check \
+  /usr/local/bin/detmir-dlp-runtime-control set-profile light
+sudo sed -i \
+  -e 's/^AW_DLP_ENABLED=.*/AW_DLP_ENABLED=true/' \
+  -e 's/^AW_DLP_PROFILE=.*/AW_DLP_PROFILE=light/' \
+  -e 's/^AW_DLP_INFLUX_ENABLED=.*/AW_DLP_INFLUX_ENABLED=false/' \
+  /etc/activitywatch/aw-server.env
+```
+
+Если профиль ухудшил состояние контура:
+
+```bash
+sudo /usr/local/bin/detmir-dlp-runtime-control rollback
+```
+
+`on_demand` и `full` включаются только вручную после отдельного resource
+preflight:
+
+```bash
+sudo /usr/local/bin/detmir-dlp-runtime-control set-profile on_demand
+sudo /usr/local/bin/detmir-dlp-runtime-control set-profile full
 ```
 
 Для portal:
@@ -187,13 +231,27 @@ production DetMir без отдельного ресурсного решени
 В inventory/group vars:
 
 ```yaml
+aw_dlp_profile: "core_only"
 aw_dlp_enabled: false
-aw_dlp_disabled_reason: "operator_disabled_to_reduce_influx_grafana_clickhouse_load"
-aw_dlp_disabled_since: "2026-06-25"
-detmir_portal_dlp_module_enabled_override: false
+aw_dlp_influx_enabled: false
+aw_dlp_light_collector_enabled: false
+aw_dlp_light_guard_enabled: true
+detmir_portal_dlp_module_enabled_override: true
 ```
 
-При `aw_dlp_enabled: false` playbook пишет `AW_DLP_ENABLED=false`, не включает DLP service/timer runtime и не должен возвращать DLP Influx exporter/aggregator в active state.
+Для временного operator re-enable в `light`:
+
+```yaml
+aw_dlp_profile: "light"
+aw_dlp_enabled: true
+aw_dlp_influx_enabled: false
+aw_dlp_light_collector_enabled: true
+aw_dlp_light_guard_enabled: true
+```
+
+При `aw_dlp_profile: light` playbook включает только лёгкий агрегатор, IOC
+refresh и load guard. DLP Influx exporter, report/syslog/webhook/CEF,
+policy/case/evidence и Loki не должны возвращаться в active state.
 
 ## Ограничения
 

docs/DLP_RESOURCE_PROFILES_RU.md

@@ -0,0 +1,196 @@
+# DLP resource profiles for DetMir
+
+Дата фиксации: 2026-06-30.
+
+Цель: сохранить стабильный Workforce/AW hot path на малом DetMir Proxmox
+контуре и оставить DLP подключаемым модулем. Loki CT в текущем production
+resource profile отключен намеренно и не является обязательной зависимостью
+AWatch-rus.
+
+## Профили
+
+### `core_only`
+
+Production default и аварийный/экономный профиль для DetMir.
+
+- DLP runtime: выключен.
+- DLP Influx exporter: выключен.
+- DLP aggregators/report/syslog/webhook/CEF/case/evidence units: выключены.
+- Loki/Promtail: выключены.
+- Workforce, Worktime, ActivityWatch, ClickHouse 1C, Grafana core,
+  Hayabusa/Security Finding Inbox: работают независимо от DLP.
+
+Назначение: безопасное состояние при перегрузе CPU/RAM/IOPS или при ручном
+отключении DLP.
+
+### `light`
+
+Операторский re-enable профиль для DetMir после проверки ресурсов: лёгкий DLP
+режим без Loki и без Influx-heavy path.
+
+- Разрешены `activitywatch-dlp-aggregator.timer` и
+  `aw-dlp-ioc-refresh.timer`.
+- `dlp-aggregator-rust` собирает ограниченный срез из bucket-ов
+  `aw-file-operations_` и `aw-dlp-incidents_` в локальный
+  `dlp_warehouse.sqlite` для последующей UEBA-корреляции.
+- `detmir-dlp-warehouse-sync.timer` доставляет SQLite warehouse на portal host
+  через атомарный snapshot, чтобы DetMir Portal/UEBA читали локальный файл, а
+  не блокировали AW server hot path.
+- Для агрегатора заданы короткий lookback, малый event limit, timeout,
+  `CPUQuota` и `MemoryMax`.
+- Evidence, screenshots, case management и exporters остаются выключенными.
+- InfluxDB/Grafana/Loki не участвуют в hot path лёгкого DLP.
+- Используется для ежедневной эксплуатации, когда нужны DLP-сигналы для UEBA,
+  но нельзя нагружать Proxmox/Influx/Grafana/ClickHouse.
+
+### `on_demand`
+
+Временный режим для конкретного инцидента или окна проверки.
+
+- Разрешены IOC refresh, policy engine, case management и evidence API.
+- Influx exporter, CEF/syslog/webhook/report scheduler и aggregator остаются
+  выключенными, если администратор отдельно не выбрал `full`.
+- После окна проверки профиль должен быть возвращён в `core_only`.
+
+### `full`
+
+Только вручную, только после resource preflight.
+
+- Может включать DLP Influx exporter, aggregator, reports, integrations,
+  policy/case и evidence.
+- На DetMir не является штатным production режимом.
+- Запрещено включать автоматически при обычном deploy/recovery.
+
+## Управление
+
+На AW server:
+
+```bash
+sudo /usr/local/bin/detmir-dlp-runtime-control status
+sudo /usr/local/bin/detmir-dlp-runtime-control set-profile core_only
+sudo /usr/local/bin/detmir-dlp-runtime-control set-profile light
+sudo /usr/local/bin/detmir-dlp-runtime-control set-profile on_demand
+sudo /usr/local/bin/detmir-dlp-runtime-control set-profile full
+sudo /usr/local/bin/detmir-dlp-load-guard
+```
+
+Перед каждым `set-profile` скрипт сохраняет rollback-снимок active/enabled
+состояния DLP units:
+
+```text
+/var/lib/activitywatch/health/dlp-runtime-rollback.state
+```
+
+Откат к предыдущему состоянию:
+
+```bash
+sudo /usr/local/bin/detmir-dlp-runtime-control rollback
+```
+
+Важно: rollback восстанавливает только systemd active/enabled состояния DLP
+units. Он не меняет retention, не удаляет данные и не включает Loki CT.
+
+## Автоотключение при перегрузе
+
+`detmir-dlp-load-guard.timer` запускает
+`/usr/local/bin/detmir-dlp-load-guard`. Guard читает `/proc/loadavg`,
+`/proc/meminfo` и `/proc/stat`; если load, свободная память или iowait выходят
+за пороги несколько запусков подряд (`AW_DLP_GUARD_STRIKES_REQUIRED`, default
+`3`), а DLP units активны, он переводит DLP в `core_only` через:
+
+```bash
+AW_DLP_DISABLED_REASON=auto_disabled_by_dlp_load_guard:<reason> \
+  /usr/local/bin/detmir-dlp-runtime-control set-profile core_only
+```
+
+State и история пишутся в:
+
+```text
+/var/lib/activitywatch/health/dlp-light-guard-state.json
+/var/lib/activitywatch/health/dlp-light-guard-history/
+```
+
+Единичный IO/load spike фиксируется как `observe_overload`, но DLP не
+отключается до достижения порога подряд. Guard не перезапускает
+ActivityWatch/портал, не меняет маршруты, не трогает ClickHouse/Grafana и не
+включает Loki. Возврат из `core_only` в `light` делает администратор после
+стабилизации контура и проверки Proxmox/AW/Influx/Grafana/ClickHouse load. Если
+перегруз повторится, guard снова переведёт профиль в `core_only`.
+
+## Доставка DLP warehouse на портал
+
+Portal читает DLP-срез из локального
+`/var/lib/activitywatch/dlp_warehouse.sqlite`. На разнесённом контуре DetMir
+этот файл создаётся на AW server, поэтому используется лёгкий sync:
+
+```bash
+sudo systemctl start detmir-dlp-warehouse-sync.service
+sudo systemctl status detmir-dlp-warehouse-sync.timer
+sudo jq . /var/lib/activitywatch/health/dlp-warehouse-sync-state.json
+```
+
+Sync делает SQLite backup на AW server и атомарно заменяет локальный файл на
+portal host. Он не запускает DLP evidence/case/exporters и не включает Loki.
+
+## Ansible defaults
+
+Для DetMir production defaults должны оставаться экономными и
+самозащищающимися:
+
+```yaml
+aw_dlp_profile: "core_only"
+aw_dlp_enabled: false
+aw_dlp_influx_enabled: false
+aw_dlp_light_collector_enabled: false
+aw_dlp_light_guard_enabled: true
+detmir_portal_dlp_profile: "core_only"
+detmir_portal_dlp_module_enabled_override: true
+```
+
+Для временного возврата в лёгкий профиль:
+
+```yaml
+aw_dlp_profile: "light"
+aw_dlp_enabled: true
+aw_dlp_influx_enabled: false
+aw_dlp_light_collector_enabled: true
+aw_dlp_light_guard_enabled: true
+detmir_portal_dlp_profile: "light"
+detmir_portal_dlp_module_enabled_override: true
+```
+
+Все тяжёлые DLP component flags должны быть `false`, пока администратор явно не
+выбрал `on_demand` или `full`.
+
+## Resource preflight перед `full`
+
+Перед временным включением `full` проверить:
+
+- Proxmox host load и steal/wait;
+- свободную RAM и swap pressure;
+- IOPS/latency storage;
+- ClickHouse health и backlog ingest;
+- InfluxDB/Grafana health, если они участвуют в выбранном профиле;
+- ActivityWatch `/healthz`, Worktime API и portal latency;
+- отсутствие старого Loki CT в autostart.
+
+Если любой core-сервис деградирует, DLP возвращается в `core_only`.
+
+## Проверка
+
+```bash
+DETMIR_RESILIENCE_EXPECT_DLP_PROFILE=light \
+DETMIR_RESILIENCE_EXPECT_LOKI_OFF=1 \
+scripts/detmir_resilience_check.sh --repo
+```
+
+Live check на сервере в `light` должен показывать inactive для heavy DLP units
+и Loki units. В `core_only` inactive должны быть все optional DLP units.
+
+## Запрещённые утверждения
+
+- Не заявлять, что AWatch-rus заменяет DLP/SIEM/EDR.
+- Не заявлять, что Loki обязателен для DetMir production.
+- Не заявлять DLP health OK, если DLP выключен.
+- Не запускать автоматическое блокирование рабочих станций без approve/apply
+  workflow.

docs/MODULE_ARCHITECTURE_GRAPH_RU.md

@@ -1,287 +0,0 @@
-# AWatch-rus / DetMir: модульная схема комплекса
-
-Статус: операторская архитектурная карта для просмотра прямо в GitHub/Gitea.
-
-Документ описывает, как связаны основные модули AWatch-rus / DetMir, где
-проходят данные и где администратор видит результат. Диаграммы выполнены в
-Mermaid: GitHub и Gitea отображают их непосредственно на странице Markdown.
-
-## 1. Границы и честные утверждения
-
-- AWatch-rus / DetMir не заявляется как сертифицированная СЗИ, DLP, SIEM, EDR
-  или XDR.
-- GitHub Actions и GitHub issues используются как публичная инженерная
-  видимость и mirror validation, а не как evidence российского release-контура.
-- Основной российский контур поставки и контроля: private Gitea плюс
-  планируемый российский build-runner.
-- Текущий production-профиль DetMir держит тяжелый DLP runtime отключенным для
-  снижения нагрузки на Proxmox, InfluxDB, Grafana, ClickHouse и AW server.
-  DLP-модуль не удален и может быть подключен отдельно после решения оператора.
-- Hayabusa/Sigma и Velociraptor используются как слой findings/forensics. Они не
-  входят в горячий путь расчета рабочего времени и не должны запускать
-  блокировку рабочих станций без явного approval.
-
-## 2. Карта модулей верхнего уровня
-
-```mermaid
-flowchart LR
-  subgraph endpoints["Рабочие места и RDP"]
-    RDP["RDP host<br/>192.168.100.19<br/>logical host SHARKON2025"]
-    WinCollectors["Windows collectors<br/>window, AFK, browser, worktime"]
-    File1C["File1C upload task<br/>каждые 15 минут"]
-    OptionalDlpEndpoint["Optional DLP endpoint sync<br/>обычно disabled"]
-  end
-
-  subgraph awserver["AW server 10.10.10.13"]
-    AwServer["ActivityWatch server<br/>порт 5600"]
-    AwBuckets["AW buckets<br/>SQLite datastore"]
-    WorktimeApi["aw-worktime-api<br/>порт 5610"]
-    InfluxExporter["worktime Influx exporter"]
-    Healthd["aw-rus-healthd<br/>readiness and checks"]
-  end
-
-  subgraph analytics["Analytics and dashboards"]
-    Influx["InfluxDB<br/>10.10.10.10:8086"]
-    Grafana["Grafana<br/>10.10.10.11:3000"]
-    ClickHouse["ClickHouse<br/>10.10.10.2:8123"]
-    Portal["DetMir portal and gateway<br/>10.10.10.2:8720<br/>/portal"]
-  end
-
-  subgraph security["Security findings and containment"]
-    Hayabusa["Hayabusa / Sigma<br/>EVTX and rule findings"]
-    Velociraptor["Velociraptor<br/>offline collector or explicit server mode"]
-    Inbox["Security Finding Inbox<br/>ClickHouse-backed"]
-    Executor["Containment executor<br/>plan / apply / verify / rollback"]
-  end
-
-  subgraph governance["Governance and delivery"]
-    GitHub["GitHub public mirror<br/>PR checks and ruleset"]
-    Gitea["Russian Gitea<br/>primary private contour"]
-    BuildRunner["Russian build-runner<br/>planned registry evidence"]
-  end
-
-  RDP --> WinCollectors
-  WinCollectors --> AwServer
-  AwServer --> AwBuckets
-  AwBuckets --> WorktimeApi
-  WorktimeApi --> Portal
-  WorktimeApi --> InfluxExporter
-  InfluxExporter --> Influx
-  Influx --> Grafana
-  Grafana --> Portal
-  File1C --> ClickHouse
-  ClickHouse --> Portal
-  ClickHouse --> Grafana
-  Healthd --> Portal
-
-  Hayabusa --> Inbox
-  Velociraptor --> Inbox
-  OptionalDlpEndpoint -. optional .-> Inbox
-  Inbox --> Portal
-  Portal --> Executor
-  Executor --> Inbox
-
-  GitHub --> Gitea
-  Gitea --> BuildRunner
-```
-
-## 3. Основные модули
-
-| Модуль | Где работает | Что делает | Куда пишет/отдает |
-|---|---|---|---|
-| Windows collectors | RDP/Windows hosts | Собирают окна, AFK, браузерные домены, рабочие сессии | ActivityWatch API |
-| ActivityWatch server | `10.10.10.13:5600` | Принимает события и хранит buckets | SQLite datastore, HTTP API |
-| Worktime API | `10.10.10.13:5610` | Строит отчеты рабочего времени и management-срез | Portal, Influx exporter |
-| Influx exporter | AW server | Перекладывает рабочие метрики во временные ряды | InfluxDB |
-| InfluxDB | `10.10.10.10:8086` | Хранит time-series для Grafana | Grafana |
-| Grafana | `10.10.10.11:3000` | Показывает dashboards по активности, дисциплине и состоянию | Администратор, portal links |
-| DetMir portal | `10.10.10.2:8720/portal` | Единая витрина: статус, workforce, security inbox, ссылки | Browser UI/API |
-| ClickHouse File1C | `10.10.10.2:8123` | Хранит 1C/file telemetry и security findings | Portal, Grafana, manager API |
-| Security Finding Inbox | ClickHouse + Rust CLI/API | Нормализует подозрительные станции и workflow | Portal, executor, audit |
-| Hayabusa/Sigma | AW server / security host | Разбирает Windows EVTX и Sigma-compatible findings | Inbox |
-| Velociraptor | Optional mode | Собирает endpoint forensics/artifacts | Inbox/importers |
-| DLP runtime | Optional mode | Тяжелый evidence/DLP слой, в production сейчас disabled | Inbox/AW/ClickHouse when enabled |
-| Containment executor | Отдельный процесс | Выполняет только approved plan/apply/verify/rollback | Workflow events в ClickHouse |
-| readiness/healthd | AW server and gateway | Проверяет живость сервисов, freshness, деградации | Portal/status/logs |
-
-## 4. Горячий путь рабочего времени
-
-Этот путь должен оставаться быстрым и независимым от тяжелых security-модулей.
-DLP, Velociraptor и Hayabusa не должны тормозить расчет рабочих отчетов.
-
-```mermaid
-flowchart LR
-  Session["RDP user session"] --> Collectors["Collectors<br/>window / AFK / browser / worktime"]
-  Collectors --> AwHttp["ActivityWatch HTTP API"]
-  AwHttp --> Buckets["AW buckets<br/>host suffix SHARKON2025"]
-  Buckets --> Worktime["aw-worktime-api"]
-  Worktime --> Cache["stale-safe report cache"]
-  Worktime --> PortalWorkforce["Portal<br/>workforce view"]
-  Worktime --> Exporter["Influx exporter"]
-  Exporter --> Influx["InfluxDB"]
-  Influx --> Grafana["Grafana dashboards"]
-  Grafana --> Admin["Администратор<br/>проверяет графики"]
-```
-
-Ключевой принцип: физическое имя или IP RDP-сервера может измениться, но
-логический host id для buckets и витрин остается стабильным, пока оператор
-явно не проводит миграцию идентификаторов.
-
-## 5. Отбор и категоризация ресурсов
-
-Браузерные события идут в общий поток ActivityWatch, затем интерпретируются
-политикой рабочих/нерабочих ресурсов. Категории должны храниться как
-управляемая конфигурация, а не как зашитые в код одиночные домены.
-
-```mermaid
-flowchart TD
-  BrowserEvent["Browser event<br/>URL/domain/title"] --> Normalizer["Domain normalizer"]
-  Normalizer --> CategoryRules["Category rules<br/>work / non-work / neutral / unknown"]
-  CategoryRules --> WorktimeApi["Worktime API scoring"]
-  WorktimeApi --> Portal["Portal recommendations"]
-  WorktimeApi --> Grafana["Grafana panels"]
-  CategoryRules --> AdminConfig["Admin-owned config<br/>review and update"]
-```
-
-Администратор должен видеть не только итоговые минуты, но и объяснение:
-какой домен, какая категория, сколько времени, почему это считается рабочим
-или нерабочим.
-
-## 6. ClickHouse / File1C / управленческая аналитика
-
-```mermaid
-flowchart LR
-  FileSource["RDP/Windows File1C telemetry"] --> UploadTask["Windows scheduled task<br/>File1C Upload"]
-  UploadTask --> Landing["ClickHouse landing directory"]
-  Landing --> Ingest["aw-1c-ingest-rust<br/>systemd timer"]
-  Ingest --> CHRaw["ClickHouse raw tables"]
-  CHRaw --> CHViews["Materialized views<br/>manager and workforce slices"]
-  CHViews --> Portal1C["Portal / 1C manager brief"]
-  CHViews --> Grafana1C["Grafana 1C dashboards"]
-  Ingest --> Health["ClickHouse health timers"]
-  Health --> PortalStatus["Portal status"]
-```
-
-Этот контур нужен для управленческой аналитики и файловых/1C-срезов. Он не
-заменяет ActivityWatch hot path и не должен блокировать портал при временной
-деградации ClickHouse.
-
-## 7. Security Finding Inbox и управляемое containment
-
-```mermaid
-flowchart LR
-  HayabusaFindings["Hayabusa/Sigma findings"] --> Adapter["Finding adapters"]
-  VelociraptorFindings["Velociraptor exports"] --> Adapter
-  ManualFinding["Manual operator finding"] --> Adapter
-  OptionalDlp["Optional DLP evidence<br/>disabled by default"] -.-> Adapter
-  Adapter --> Inbox["Security Finding Inbox<br/>ClickHouse"]
-  Inbox --> Suspicious["Portal page<br/>Подозрительные станции"]
-  Suspicious --> Decide["decide"]
-  Decide --> Plan["plan"]
-  Plan --> Approve["approve<br/>human gate"]
-  Approve --> Apply["executor apply"]
-  Apply --> Verify["verify"]
-  Verify --> Closed["workflow event<br/>closed or escalated"]
-  Verify --> Rollback["rollback<br/>when verification fails"]
-  Rollback --> Inbox
-  Closed --> Inbox
-```
-
-```mermaid
-stateDiagram-v2
-  [*] --> FindingReceived
-  FindingReceived --> Planned: decide and plan
-  Planned --> ApprovalRequired: action is risky
-  ApprovalRequired --> Applied: approved
-  ApprovalRequired --> Rejected: rejected
-  Applied --> Verified: verify passed
-  Applied --> RollbackRequired: verify failed
-  RollbackRequired --> RolledBack: rollback completed
-  Verified --> Closed
-  Rejected --> Closed
-  RolledBack --> Escalated
-```
-
-Запрет: findings не должны автоматически блокировать рабочую станцию. Исполнение
-возможно только после явного approval и через отдельный executor, который
-пишет результат обратно в workflow-аудит.
-
-## 8. Операционный контроль и recovery
-
-```mermaid
-flowchart TD
-  DailyCheck["daily / weekly contour checks"] --> Healthd["aw-rus-healthd"]
-  Orchestration["Ansible and scripts<br/>deploy / validate / support"] --> DailyCheck
-  Healthd --> AwCheck["AW server and bucket freshness"]
-  Healthd --> WorktimeCheck["Worktime API health"]
-  Healthd --> ClickHouseCheck["ClickHouse health"]
-  Healthd --> GrafanaCheck["Grafana dashboard smoke"]
-  AwCheck --> Status["Portal status"]
-  WorktimeCheck --> Status
-  ClickHouseCheck --> Status
-  GrafanaCheck --> Status
-  Status --> Operator["Operator decision<br/>restart, repair, or escalate"]
-  Operator --> Runbooks["Docs and runbooks"]
-```
-
-Важное разделение: routine checks не должны автоматически включать тяжелый DLP
-runtime и не должны менять сетевые маршруты. Любое изменение маршрутизации,
-firewall или containment выполняется как отдельное управляемое действие.
-
-## 9. Governance, GitHub и Gitea
-
-```mermaid
-flowchart LR
-  DevBranch["Feature/docs branch"] --> PR["GitHub PR<br/>public mirror validation"]
-  PR --> Checks["Required checks<br/>rust, docs, security, smoke"]
-  Checks --> Review["CODEOWNERS review"]
-  Review --> Main["main branch"]
-  Main --> Gitea["Russian Gitea mirror<br/>primary private contour"]
-  Gitea --> Runner["Russian build-runner<br/>planned release evidence"]
-  PR -. not registry evidence .-> Note["Public transparency only"]
-```
-
-GitHub полезен для публичной проверяемости: PR, issues, checks, branch ruleset.
-Но для российского реестрового release evidence нужен отдельный российский
-контур сборки и хранения артефактов.
-
-## 10. Оркестрация и поддержание актуальности
-
-Оркестрационные entrypoints отдельно зафиксированы в
-[docs/ORCHESTRATION_MAP_RU.md](ORCHESTRATION_MAP_RU.md). Этот документ
-связывает архитектурные модули с Ansible playbooks, systemd timers, Windows
-Scheduled Tasks и read-only check scripts.
-
-В репозитории есть guard:
-
-```bash
-bash scripts/check_orchestration_map.sh
-```
-
-Он не ходит в production и не меняет runtime. Его задача - проверить, что
-карта оркестрации ссылается на реальные playbooks/scripts и содержит
-обязательные safety-маркеры: DLP optional mode, Hayabusa/Velociraptor boundary,
-approval gate для containment и разделение GitHub/Gitea release контуров.
-
-## 11. Где смотреть руками
-
-| Что проверить | Где смотреть |
-|---|---|
-| Единый портал DetMir | `/portal` на gateway |
-| Рабочая активность и рекомендации | Portal workforce pages, Worktime API |
-| Графики по сотрудникам и приложениям | Grafana dashboards `detmir-aw-main`, `detmir-rdp-user-activity` и связанные panels |
-| Состояние AW buckets | ActivityWatch API и readiness/status в portal |
-| 1C/File analytics | Portal 1C manager views, ClickHouse dashboards |
-| Подозрительные станции | Portal security view / Security Finding Inbox |
-| Hayabusa/Velociraptor findings | Inbox import status, security dashboards, runbooks |
-| Runtime checks | `aw-rus-healthd`, contour check scripts, portal status |
-| Код и evidence процесса | GitHub PR/issues, private Gitea mirror |
-
-## 12. Связанные документы
-
-- [docs/ARCHITECTURE_RU.md](ARCHITECTURE_RU.md)
-- [docs/UNIFIED_OPERATING_MODEL_RU.md](UNIFIED_OPERATING_MODEL_RU.md)
-- [docs/ORCHESTRATION_MAP_RU.md](ORCHESTRATION_MAP_RU.md)
-- [docs/GRAFANA_DASHBOARDS_RU.md](GRAFANA_DASHBOARDS_RU.md)
-- [docs/DLP_OPTIONAL_RUNTIME_RU.md](DLP_OPTIONAL_RUNTIME_RU.md)
-- [docs/PRODUCTION_READINESS_RU.md](PRODUCTION_READINESS_RU.md)

docs/OPERATIONS_RUNBOOK_WORKTIME_RU.md

@@ -7,6 +7,20 @@ ClickHouse не является обязательной зависимость
 перезапускайте ClickHouse для восстановления отчетов рабочего времени, если нет
 отдельного подтвержденного отказа ClickHouse.
 
+## Stable host id
+
+Worktime reports используют stable logical host id, а не обязательно текущее
+Windows `COMPUTERNAME`. Для DetMir production текущий logical id:
+
+```text
+SHARKON2025
+```
+
+При переименовании RDP-сервера не меняйте `awHostname` автоматически. Сначала
+обновите Windows account domain для задач, затем проверьте, что collectors
+продолжают писать в bucket-и `*_SHARKON2025`. Подробный порядок:
+`docs/WINDOWS_LOGICAL_HOST_ID_RU.md`.
+
 ## Симптомы перегруза
 
 - `/portal/api/reports?role=executive` открывается медленно или отвечает
@@ -226,6 +240,153 @@ curl -sS --max-time 8 http://<PORTAL_HOST>/portal/api/health | jq
 curl -sS --max-time 12 "http://<PORTAL_HOST>/portal/api/reports?role=executive" | jq '.status'
 ```
 
+## Production repair: AW SQLite hot path, 2026-06-30
+
+Симптомы:
+
+- `activitywatch-server` отвечает `503` на bucket API;
+- журнал содержит `poisoned lock` / `database is locked`;
+- `aw-worktime-api` уходит в bounded `DEGRADED`;
+- `/buckets/aw-worktime-sessions_<HOST>/events?limit=...` тайм-аутится даже
+  при малом лимите;
+- RDP browser/category collector пишет `bucket create failed` или timeout.
+
+Порядок безопасного восстановления:
+
+1. Остановить RDP guard и процессы `aw-windows-telemetry`, чтобы не продолжать
+   штурмовать AW API.
+2. Остановить `aw-worktime-*` timers/services и другие локальные потребители AW
+   API.
+3. Перезапустить `activitywatch-server` отдельно и проверить `/api/0/info`.
+4. Если bucket metadata отвечает, но `/events` медленный, проверить SQLite plan:
+
+```sql
+EXPLAIN QUERY PLAN
+SELECT id,starttime,endtime,data
+FROM events
+WHERE bucketrow=(SELECT id FROM buckets WHERE name='aw-worktime-sessions_<HOST>')
+ORDER BY starttime DESC
+LIMIT 100;
+```
+
+Если план строит `TEMP B-TREE FOR ORDER BY`, нужен составной индекс:
+
+```sql
+CREATE INDEX IF NOT EXISTS events_bucketrow_starttime_desc_index
+ON events(bucketrow, starttime DESC);
+ANALYZE;
+PRAGMA optimize;
+PRAGMA integrity_check;
+```
+
+Индекс добавлять только в controlled window:
+
+- остановить `activitywatch-server`;
+- сделать rollback backup SQLite DB;
+- создать индекс;
+- проверить `PRAGMA integrity_check = ok`;
+- запустить `activitywatch-server`;
+- проверить, что `/events?limit=100` больше не тайм-аутится.
+
+Production DetMir repair 2026-06-30:
+
+- оставлены две свежие ежедневные SQLite VACUUM backup-копии, старые backup-и
+  ротированы для освобождения места;
+- создан rollback backup:
+  `/var/lib/activitywatch/backups/db/aw-sqlite-before-hotpath-index-20260630T035032Z.db`;
+- добавлен индекс `events_bucketrow_starttime_desc_index`;
+- `ROCKET_WORKERS=8` добавлен в `/etc/activitywatch/aw-server.env`;
+- для `aw-worktime-api.service` добавлен stabilization drop-in:
+  `AW_WORKTIME_EVENTS_LIMIT=100`,
+  `AW_WORKTIME_AW_HTTP_TIMEOUT_SECONDS=25`,
+  `AW_WORKTIME_EVENTS_CACHE_TTL_SECONDS=600`,
+  `AW_WORKTIME_REPORT_STALE_TTL_SECONDS=7200`.
+
+После ремонта проверить:
+
+```bash
+curl -sS --max-time 10 http://127.0.0.1:5600/api/0/info
+curl -sS --max-time 15 \
+  'http://127.0.0.1:5600/api/0/buckets/aw-worktime-sessions_SHARKON2025/events?limit=100'
+curl -sS --max-time 15 \
+  'http://127.0.0.1:5610/reports/worktime/today?format=json' | jq '{rows:(.rows|length),degraded,runtime}'
+```
+
+Также проверить отсутствие новых `poisoned lock` после финального старта:
+
+```bash
+journalctl -u activitywatch-server --since '<FINAL_START_TIME>' --no-pager |
+  grep -E 'poisoned lock|Taking datastore lock failed|database is locked'
+```
+
+## Crash/readiness test after AW repair
+
+Цель: проверить, что контур выдерживает restart и короткую параллельную
+нагрузку, а проверки не путают `systemctl active` с готовым API.
+
+Порядок:
+
+1. Зафиксировать baseline:
+
+```bash
+./check-aw-full.sh
+```
+
+2. На AW server проверить readiness, hot-path и Worktime API:
+
+```bash
+AW_API=http://127.0.0.1:5600 \
+AW_WORKTIME_API=http://127.0.0.1:5610 \
+AW_LOGICAL_HOST_ID=SHARKON2025 \
+scripts/detmir_resilience_check.sh --live
+```
+
+Если скрипт запускается с ноутбука, live-mode нужно выполнять на самом
+AW-сервере через SSH/Ansible, потому что он проверяет local systemd и SQLite.
+
+3. Controlled restart:
+
+```bash
+systemctl restart aw-worktime-api
+curl -sS --max-time 12 \
+  'http://127.0.0.1:5610/reports/worktime/today?format=json&host=SHARKON2025&allow_stale=1' |
+  jq '{rows:(.rows|length),degraded}'
+
+systemctl restart activitywatch-server
+# Не считать "active" готовностью: дождаться HTTP readiness.
+timeout 90 bash -c 'until curl -fsS --max-time 8 http://127.0.0.1:5600/api/0/info >/dev/null; do sleep 2; done'
+curl -sS --max-time 15 \
+  'http://127.0.0.1:5600/api/0/buckets/aw-worktime-sessions_SHARKON2025/events?limit=100' >/dev/null
+```
+
+4. Проверить, что после рестарта нет новых lock/503:
+
+```bash
+journalctl -u activitywatch-server --since '<RESTART_TIME>' --no-pager |
+  grep -E 'poisoned lock|Taking datastore lock failed|database is locked|503'
+```
+
+5. Проверить RDP guard restart отдельно:
+
+```powershell
+Restart-Service AWatchRusCollectorGuard -Force
+Start-Sleep -Seconds 75
+Get-Service AWatchRusCollectorGuard
+Get-Process aw-windows-telemetry -ErrorAction SilentlyContinue | Measure-Object
+```
+
+Ожидаемый результат для DetMir после ремонта 2026-06-30:
+
+- `check-aw-full.sh`: `FRESH=8`, `STALE=0`, `DEAD=0`;
+- `/events?limit=100` отвечает за bounded time и использует
+  `events_bucketrow_starttime_desc_index`;
+- `aw-rus-healthd.service` завершается `status=0/SUCCESS`;
+- server-side TCP до RDP может быть `warn`, если
+  `AW_RUS_HEALTH_RDP_TCP_REQUIRED=false`, но bucket freshness и WinRM/SSH
+  через admin path должны оставаться зелёными;
+- optional DLP/Loki heavy runtime units должны быть inactive в экономном
+  production profile.
+
 ## Rollback
 
 Rollback нужен, если после обновления бинарника или env-настроек:

docs/ORCHESTRATION_MAP_RU.md

@@ -1,131 +0,0 @@
-# AWatch-rus / DetMir: карта оркестрации
-
-Статус: актуальная карта deploy/check orchestration для просмотра в
-GitHub/Gitea.
-
-Документ фиксирует, какие playbooks, systemd units и scripts управляют
-модулями комплекса. Это не инструкция выполнять production deploy без окна
-работ: большинство playbooks меняют сервисы, scheduled tasks или dashboards.
-
-## 1. Общий порядок оркестрации
-
-```mermaid
-flowchart TD
-  Inventory["inventory.ini<br/>group_vars/*.yml<br/>private env vars"] --> Full["install_full_stack.yml"]
-  Full --> Server["deploy_aw_server.yml<br/>AW server and Rust services"]
-  Full --> Windows["deploy_aw_windows.yml<br/>RDP/Windows collectors"]
-  Full --> Gateway["deploy_proxmox_web_gateway.yml<br/>operator gateway"]
-  Full --> Grafana["deploy_grafana_dashboards.yml<br/>Grafana dashboards"]
-  Full --> Checks["deploy_grafana_check.yml<br/>dashboard/data freshness check"]
-
-  Server --> Portal["deploy_detmir_portal.yml<br/>portal and evidence API"]
-  Server --> Worktime["worktime API<br/>Influx exporter<br/>healthd"]
-  Windows --> Tasks["Windows Scheduled Tasks<br/>Launch / Recovery / File1C / Hayabusa"]
-  Gateway --> PublicEntry["/portal and /d/... routes"]
-  Grafana --> Dashboards["detmir dashboards"]
-
-  Checks --> Contour["run_awatch_contour_check.sh"]
-  Contour --> Daily["awatch-contour-daily-check.timer"]
-  Contour --> Weekly["awatch-contour-weekly-check.timer"]
-```
-
-## 2. Оркестрационные entrypoints
-
-| Зона | Entrypoint | Тип действия | Что поддерживает |
-|---|---|---|---|
-| Полный контур | `ansible/install_full_stack.yml` | deploy orchestrator | Последовательный запуск основных playbooks по группам inventory |
-| AW server | `ansible/deploy_aw_server.yml` | deploy | ActivityWatch server, Rust binaries, server-side units |
-| Windows/RDP | `ansible/deploy_aw_windows.yml` | deploy | Collectors, guard service, recovery task, File1C/Hayabusa scheduled tasks |
-| Post-validate Windows | `ansible/post_validate_aw_windows.yml` | validation | Read-only-ish validation after Windows rollout |
-| DetMir portal | `ansible/deploy_detmir_portal.yml` | deploy | Portal, evidence API, portal env, systemd services |
-| Gateway | `ansible/deploy_proxmox_web_gateway.yml` | deploy | Nginx gateway, `/portal`, Grafana routes, operator index |
-| Grafana dashboards | `ansible/deploy_grafana_dashboards.yml` | deploy | Version-controlled dashboards import |
-| Grafana checker | `ansible/deploy_grafana_check.yml` | deploy/check | Dashboard and datasource health checks |
-| File1C analytics | `ansible/deploy_file_1c_analytics.yml` | deploy | ClickHouse/File1C analytics server side |
-| File1C Windows upload | `ansible/deploy_file_1c_windows_telemetry.yml` | deploy | Windows scheduled upload task |
-| Optional DLP evidence | `ansible/deploy_dlp_evidence_sync.yml` | opt-in deploy | Evidence sync task only when DLP is explicitly enabled |
-| pfSense poller | `ansible/deploy_aw_pfsense_poller.yml` | optional deploy | Network telemetry helper, outside workforce hot path |
-| Daily/weekly checks | `scripts/run_awatch_contour_check.sh` | read-only check | Contour health bundle and optional smoke checks |
-| Daily check timer | `ops/systemd/awatch-contour-daily-check.timer` | systemd timer | Scheduled daily run of contour check |
-| Weekly check timer | `ops/systemd/awatch-contour-weekly-check.timer` | systemd timer | Scheduled weekly run of contour check |
-| Support bundle | `scripts/detmir-support-daily.sh` and related scripts | read-only/support | Operator diagnostics and support artifacts |
-| Orchestration guard | `scripts/check_orchestration_map.sh` | repository check | Ensures this map references live playbooks/scripts |
-
-## 3. Runtime boundaries
-
-```mermaid
-flowchart LR
-  Deploy["Deploy orchestration<br/>Ansible"] --> Runtime["Runtime services<br/>systemd and Windows tasks"]
-  Runtime --> Check["Read-only checks<br/>detmir-check, contour check, smoke"]
-  Check --> Evidence["Logs and summaries<br/>operator review"]
-
-  OptionalDlp["Optional DLP runtime"] -. explicit operator decision .-> Runtime
-  Hayabusa["Hayabusa upload task"] --> Findings["Security findings import"]
-  Velociraptor["Velociraptor mode"] -. disabled/offline/server explicit .-> Findings
-  Findings --> Portal["Portal security view"]
-  Portal -. approval required .-> Executor["Separate executor<br/>plan/apply/verify/rollback"]
-```
-
-Правила:
-
-- routine deploy/recovery не должен сам включать тяжелый DLP runtime;
-- Hayabusa/Velociraptor findings не являются заменой SIEM/DLP/EDR;
-- блокировка рабочих станций возможна только через отдельный executor и явное
-  approval;
-- GitHub CI остается public mirror validation, а не registry release evidence;
-- Gitea и российский build-runner остаются основным release/evidence контуром.
-
-## 4. Windows/RDP task orchestration
-
-```mermaid
-flowchart TD
-  DeployWin["deploy_aw_windows.yml"] --> Toolkit["C:\\Program Files\\AWatch-rus\\windows"]
-  Toolkit --> Ensemble["deploy-ensemble.ps1"]
-  Ensemble --> Recovery["ActivityWatch Recovery<br/>Scheduled Task"]
-  Ensemble --> Launch["ActivityWatch Launch [HOST_user]<br/>per-user tasks"]
-  Ensemble --> Guard["AWatchRusCollectorGuard<br/>Windows service"]
-  Ensemble --> File1C["ActivityWatch File1C Upload<br/>Scheduled Task"]
-  Ensemble --> Hayabusa["ActivityWatch Hayabusa Upload<br/>Scheduled Task"]
-
-  Guard --> Worktime["worktime-session collector"]
-  Launch --> AFK["aw-watcher-afk"]
-  Launch --> Window["aw-watcher-window"]
-  Launch --> Browser["browser category collector"]
-  File1C --> ClickHouse["ClickHouse landing"]
-  Hayabusa --> AWServer["AW server Hayabusa drop"]
-```
-
-Production DetMir использует стабильный logical host id `SHARKON2025` для
-bucket-ов и витрин. Смена физического имени/IP RDP-сервера не должна
-автоматически менять bucket suffix или Grafana variables.
-
-## 5. Read-only checks and quality gates
-
-| Проверка | Команда | Назначение |
-|---|---|---|
-| Orchestration map check | `bash scripts/check_orchestration_map.sh` | Проверяет, что карта оркестрации ссылается на реальные entrypoints |
-| Repository quality gate | `bash scripts/quality-gate.sh` | Включает orchestration map check, shell/node/pwsh/ansible guards |
-| Secret scan | `python3 scripts/public_secret_pattern_check.py` | Не допускает публичные секреты |
-| Contour check | `bash scripts/run_awatch_contour_check.sh` | Read-only production contour check через env вне репозитория |
-| Browser smoke | `scripts/aw-webui-browser-smoke.sh` | Проверяет operator/browser surface |
-| Portal contract sync | `node scripts/check_portal_contract_sync.mjs` | Проверяет согласованность portal API/static contracts |
-
-## 6. Что не делаем автоматически
-
-- Не запускаем `deploy_dlp_full_stack.yml` как часть routine checks.
-- Не включаем DLP timers/services без отдельного решения оператора.
-- Не стартуем Velociraptor server/client contour автоматически на малом
-  production Proxmox.
-- Не меняем маршрутизацию, firewall или workstation containment из checks.
-- Не публикуем credentials, tokens, passwords или customer identifiers в Git.
-
-## 7. Связанные документы
-
-- [MODULE_ARCHITECTURE_GRAPH_RU.md](MODULE_ARCHITECTURE_GRAPH_RU.md)
-- [ARCHITECTURE_RU.md](ARCHITECTURE_RU.md)
-- [UNIFIED_OPERATING_MODEL_RU.md](UNIFIED_OPERATING_MODEL_RU.md)
-- [DLP_OPTIONAL_RUNTIME_RU.md](DLP_OPTIONAL_RUNTIME_RU.md)
-- [PRODUCTION_READINESS_RU.md](PRODUCTION_READINESS_RU.md)
-- [OPERATIONS_VALIDATION_RUNBOOK_RU.md](OPERATIONS_VALIDATION_RUNBOOK_RU.md)
-- [GRAFANA_DASHBOARDS_RU.md](GRAFANA_DASHBOARDS_RU.md)
-- [../ansible/README.md](../ansible/README.md)

docs/PRODUCTION_READINESS_RU.md

@@ -47,6 +47,8 @@ bounded payload/query limits и role-gate smoke.
 | `--slow-request-log-ms` | `AWATCH_PORTAL_SLOW_REQUEST_LOG_MS` | Порог медленного запроса для логов |
 | `--environment` | `AWATCH_PORTAL_ENVIRONMENT` | Безопасное имя окружения |
 | `--enabled-modules` | `AWATCH_PORTAL_ENABLED_MODULES` | Разрешенные модули портала |
+| `--dlp-module-enabled` | `DETMIR_PORTAL_DLP_MODULE_ENABLED` | Включает DLP/security status для портала; может оставаться `true` для исторического SQLite/evidence-среза без запуска server-side DLP runtime |
+| DLP resource profile | `AW_DLP_PROFILE`, `DETMIR_PORTAL_DLP_PROFILE` | Для DetMir production default `core_only`; `light` включается оператором после resource check |
 
 Ограничения применяются к тяжелым API:
 
@@ -66,6 +68,21 @@ bounded payload/query limits и role-gate smoke.
   возвращает `400`;
 - слишком большое тело запроса возвращает `413`;
 - role gate возвращает `403`.
+- при `DETMIR_PORTAL_DLP_MODULE_ENABLED=true` и `AW_DLP_PROFILE=core_only`
+  портал может показывать исторический DLP/security status без запуска
+  collectors/exporters.
+- при `DETMIR_PORTAL_DLP_MODULE_ENABLED=true` и `AW_DLP_PROFILE=light`
+  Workforce core, `/healthz`, `/readyz`, `/api/reports` и `/api/operator`
+  должны оставаться доступными без тяжелого DLP/case/evidence чтения.
+- при `AW_DLP_ENABLED=false` и `DETMIR_DLP_ENABLED=false` server-side
+  DLP health/readiness/checks должны возвращать контролируемый disabled-state,
+  а не пытаться поднять DLP Influx/exporter/aggregator/case runtime.
+  Runbook: [DLP_OPTIONAL_RUNTIME_RU.md](DLP_OPTIONAL_RUNTIME_RU.md).
+- при `AW_DLP_PROFILE=light` активны только lightweight collector/IOC/guard;
+  Loki/DLP heavy runtime должен оставаться inactive. При перегрузе
+  `detmir-dlp-load-guard` переводит DLP в `core_only`; возврат выполняется
+  только через profile switch и rollback, см.
+  [DLP_RESOURCE_PROFILES_RU.md](DLP_RESOURCE_PROFILES_RU.md).
 
 ### Request ID, logs и metrics
 

docs/PROJECT_STATUS_RU.md

@@ -66,23 +66,25 @@ backup, registry-readiness документации, плана российск
   `653b22b0fbf29a22f7de42ade7b689490b1de16fa07e785e4e0efd3078e7a3bc`.
 - DetMir portal cold-start UI hang: mitigated. During cold/prewarm state the UI
   now shows `STALE / Первичный срез прогревается`, not endless loading.
-- DetMir DLP hot-path boundary: phase 1 deployed on the portal service with
-  `DETMIR_PORTAL_DLP_MODULE_ENABLED=false`.
+- DetMir DLP hot-path boundary: phase 1 deployed; current production runtime
+  uses `AW_DLP_ENABLED=false`, `AW_DLP_PROFILE=core_only`. The portal DLP module
+  may stay enabled for historical/security views, but server-side DLP
+  collectors/exporters are off.
 - DetMir optional DLP runtime controls: implemented in code/docs through
   `AW_DLP_ENABLED`, `DETMIR_DLP_ENABLED`,
   `scripts/detmir_dlp_runtime_control.sh` and
-  `docs/DLP_OPTIONAL_RUNTIME_RU.md`.
-- DetMir optional DLP runtime live state: disabled on 2026-06-25 to reduce
-  InfluxDB/Grafana/ClickHouse/AW server load. Evidence:
-  `dlp-health-check=dlp:mode disabled`, `detmir-dlp=dlp:mode disabled`,
-  active/enabled DLP units `0/0`, history snapshots under
-  `/var/lib/activitywatch/health/dlp-runtime-history/`.
-- DetMir DLP contour status: disabled for the current production resource
-  profile, not removed. It remains a documented optional module and must only be
-  re-enabled after explicit operator decision and Proxmox/InfluxDB/Grafana/
-  ClickHouse capacity check.
-- DetMir DLP buckets in manual full check: `SKIPPED` under
-  `AW_DLP_ENABLED=false`, not reported as dead.
+  `docs/DLP_OPTIONAL_RUNTIME_RU.md`. Resource profiles
+  `core_only|light|on_demand|full` and rollback are documented in
+  `docs/DLP_RESOURCE_PROFILES_RU.md`.
+- DetMir optional DLP runtime state: 2026-06-25 controlled disable evidence is
+  retained; 2026-06-30 prod hardening keeps production in `core_only` by
+  default. `light` can be re-enabled by operator command after
+  Proxmox/InfluxDB/Grafana/ClickHouse capacity check.
+- DetMir DLP contour status: server-side DLP collection is currently disabled;
+  heavy DLP remains optional and must only be enabled after explicit operator
+  decision and resource check.
+- DetMir DLP auto-disable guard: `detmir-dlp-load-guard` records load/RAM/iowait
+  state and switches DLP to `core_only` if thresholds are exceeded.
 - DetMir RDP collector freshness after 2026-06-29 restore: physical RDP target
   is `192.168.100.19`, stable AW logical host id remains `SHARKON2025`.
   Buckets are fresh/inactive as expected, collector guard quarantine was reset,
@@ -112,6 +114,9 @@ backup, registry-readiness документации, плана российск
   resource usage. Proxmox LXC `202 loki-logs` is stopped, active config has
   `onboot: 0`, and smoke checks skip Loki by default unless
   `AW_SMOKE_LOKI_ENABLED=1` is set.
+- DetMir DLP rollback guard: `detmir-dlp-runtime-control set-profile` stores
+  the previous DLP systemd active/enabled state and `rollback` restores it.
+  Rollback does not start Loki CT.
 - DetMir restore baseline 2026-06-29:
   `docs/DETMIR_RESTORE_BASELINE_2026-06-29_RU.md`.
 - DetMir API smoke after phase 1: `/healthz` and `/readyz` OK;
@@ -197,9 +202,9 @@ backup, registry-readiness документации, плана российск
 - External peer review remains pending.
 - Community adoption remains low until external contributors, public reviews
   and sustained third-party activity appear.
-- DetMir DLP runtime disable is complete for the current live contour; deeper
-  long-term DLP product modularization and retention/cleanup policy remain
-  separate future work.
+- DetMir lightweight DLP profile is implemented in repo defaults/scripts/docs;
+  heavy DLP modularization and retention/cleanup policy remain separate future
+  work.
 - DetMir RDP collector/session recovery after 2026-06-29 restore is verified by
   live smoke: `check-aw-full` reports `FRESH=8 STALE=0 DEAD=0`.
 

docs/WORKFORCE_OPERATIONS_MODEL_RU.md

@@ -0,0 +1,239 @@
+# Workforce Operations Model
+
+Статус: implemented in Worktime API and DetMir portal.
+
+Модель отвечает на главный управленческий вопрос AWatch-rus Workforce:
+рабочая активность сотрудников, загрузка, простои, перегруз и дисциплина
+рабочего процесса. Это rule-based слой операционного контроля. Он не является
+HR-оценкой, не использует ML/LLM и не выполняет автоматических санкций.
+
+## Где смотреть
+
+Основные точки:
+
+- Worktime API:
+  `GET /reports/worktime/management?format=json`;
+- Worktime HTML:
+  `GET /reports/worktime/management?format=html`;
+- DetMir portal:
+  `/api/reports`, блок `workforce_operations`;
+- UI портала:
+  роли `Руководитель` и вкладка `Отчеты`, блок `Операционная загрузка`.
+
+## Источники
+
+Модель использует только подтвержденные рабочие источники:
+
+- ActivityWatch worktime rows;
+- bucket рабочих сессий RDP;
+- интервалы активности в рабочем окне;
+- configured owner/department aliases;
+- freshness/coverage metadata, которые уже возвращает Worktime API.
+
+Отсутствие данных не считается простоем. При пропусках источников строка
+получает `data_confidence=low` и guardrail
+`low_confidence_not_for_discipline`.
+
+## Runtime-настройки
+
+Основной файл политики:
+
+- пример: `configs/worktime-interpretation-policy.example.json`;
+- runtime: `/etc/activitywatch/worktime-interpretation-policy.json`;
+- env path: `AW_WORKTIME_MANAGER_INTERPRETATION_POLICY`.
+
+Поля policy:
+
+| Поле | Смысл | Рекомендуемое значение |
+| --- | --- | --- |
+| `underload_threshold` | порог недогруза от рабочего окна | `0.35..0.45` |
+| `overload_threshold` | порог перегруза от рабочего окна | `1.10..1.25` |
+| `drop_threshold_pct` | порог просадки тренда | `10..25` |
+| `night_work_after` | начало вечернего/ночного отклонения | `20:00` |
+| `weekend_work` | учитывать выходные отклонения | `true` |
+| `min_trend_points` | минимум daily points для тренда | `3..7` |
+| `off_hours_threshold_seconds` | минимум внерабочей активности для флага | `1800` |
+
+`underload_threshold` и `overload_threshold` можно задавать дробью или
+процентом: `0.45` равно `45`, `1.15` равно `115`.
+Для перегруза effective threshold fail-closed зажат в диапазон `100..300`, чтобы
+значение ниже 100% не создавало ложный статус перегруза.
+
+Env fallback:
+
+- `AW_WORKTIME_MANAGER_TARGET_COVERAGE_PCT`;
+- `AW_WORKTIME_MANAGER_LOW_COVERAGE_PCT`;
+- `AW_WORKTIME_MANAGER_OVERLOAD_COVERAGE_PCT`;
+- `AW_WORKTIME_MANAGER_TREND_MIN_POINTS`;
+- `AW_WORKTIME_MANAGER_TREND_DELTA_PCT`;
+- `AW_WORKTIME_MANAGER_OFF_HOURS_THRESHOLD_SECONDS`;
+- `AW_WORKTIME_MANAGER_NIGHT_WORK_AFTER`;
+- `AW_WORKTIME_MANAGER_WEEKEND_WORK_ENABLED`.
+
+Веса приложений остаются отдельной политикой:
+
+- пример: `configs/detmir-workforce-policy.example.json`;
+- runtime: `/etc/detmir-portal-workforce-policy.json`.
+
+Она влияет на explainable KPI и weighted activity, но не подменяет
+операционные статусы загрузки/простоя.
+
+## API contract
+
+`/reports/worktime/management?format=json` содержит:
+
+```json
+{
+  "workday": {
+    "target_coverage_pct": 75,
+    "low_coverage_pct": 35,
+    "overload_coverage_pct": 115
+  },
+  "workforce_operations": {
+    "status": "ATTENTION",
+    "summary": {},
+    "rows": [],
+    "model": {
+      "type": "rule_based",
+      "ml": false,
+      "llm": false,
+      "version": "workforce-operations-v1"
+    }
+  }
+}
+```
+
+Каждая строка сотрудника содержит:
+
+- `workday_active_seconds`, `workday_active_hhmm`;
+- `workday_idle_seconds`, `workday_idle_hhmm`;
+- `coverage_pct`;
+- `load_status`;
+- `idle_status`;
+- `discipline_status`;
+- `data_confidence`;
+- `recommended_action`.
+
+Полный roster в `rows[]` дополнительно содержит `operations`,
+`operations.evidence`, `operations.guardrail` и
+`operations_recommended_action`.
+
+## Статусы загрузки
+
+| Status | Значение | Действие |
+| --- | --- | --- |
+| `insufficient_data` | рабочее окно еще не началось или равно нулю | не делать вывод |
+| `no_data` | нет сессий или worktime samples | проверить источники |
+| `no_activity` | сессия/данные есть, активности в окне нет | проверить присутствие и задачи |
+| `underloaded` | ниже low threshold | проверить загрузку и доступ к процессам |
+| `below_target` | ниже target threshold | уточнить причину отклонения |
+| `normal` | в рабочем диапазоне | наблюдать |
+| `overloaded` | выше overload threshold | проверить переработку и риск аврала |
+
+## Статусы простоя
+
+| Status | Значение |
+| --- | --- |
+| `not_applicable` | нет рабочего окна |
+| `unknown` | нет достаточных источников |
+| `full_workday_idle_or_absent` | активность в рабочем окне отсутствует |
+| `idle_detected` | простой выше порога |
+| `no_significant_idle` | существенный простой не найден |
+
+## Дисциплина процесса
+
+`discipline_status` показывает отклонение от рабочего процесса, а не
+автоматическое нарушение:
+
+- `ok`;
+- `off_hours`;
+- `late_start`;
+- `early_finish`;
+- `multiple_flags`.
+
+Для текущего дня `early_finish` не выставляется до завершения рабочего окна.
+
+## Достоверность
+
+`data_confidence`:
+
+- `high`: есть session samples, worktime samples и active samples;
+- `medium`: данных мало или нет active samples;
+- `low`: нет сессий/worktime samples или рабочее окно невалидно.
+
+Правило: low confidence строки сначала проверяются как проблема источников.
+Их нельзя использовать как персональный дисциплинарный вывод.
+
+## Summary
+
+`workforce_operations.summary` содержит:
+
+- `users_count`;
+- `action_required_users`;
+- `load.unknown_or_no_data_users`;
+- `load.underloaded_users`;
+- `load.normal_users`;
+- `load.overloaded_users`;
+- `idle.idle_users`;
+- `discipline.review_users`;
+- `confidence.low_users`;
+- `confidence.medium_users`;
+- `confidence.high_users`;
+- `guardrail`.
+
+Summary status:
+
+- `LOW_CONFIDENCE`: нет строк или все строки low confidence;
+- `ATTENTION`: есть перегруз, простой или дисциплинарные флаги;
+- `WATCH`: есть недогруз, нет данных или low confidence;
+- `OK`: отклонений нет.
+
+## UI contract
+
+Портал показывает отдельный блок `Операционная загрузка`:
+
+- сводка: требуют разбора, недогруз, перегруз, простой, дисциплина, low
+  confidence;
+- таблица сотрудников: active/idle/coverage/load/idle/discipline/confidence;
+- рекомендуемое действие;
+- guardrail и версию rule-based модели.
+
+Это отдельный блок от `Почему такой индекс активности?`: explainable KPI
+отвечает на вопрос "почему такой процент", а Workforce Operations отвечает
+"кого и почему нужно разобрать".
+
+## Ограничения
+
+- Не утверждать автоматическую оценку эффективности сотрудника.
+- Не считать missing data простоем.
+- Не смешивать Security/Forensics claims с Workforce Operations.
+- Не заявлять ML/LLM detection.
+- Не выполнять автоматическое remediation/action.
+- Не использовать GitHub Actions или демо-данные как registry release evidence.
+
+## Проверка после изменения
+
+Минимальный локальный контур:
+
+```bash
+cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian/adk-rust
+export CARGO_TARGET_DIR=/home/igor/.cache/detmir-adk-rust-target
+cargo fmt --all --check
+cargo test -p worktime-api -p detmir-portal --locked
+cargo clippy -p worktime-api -p detmir-portal --all-targets --locked -- -D warnings
+```
+
+Минимальный live smoke:
+
+```bash
+curl -fsS 'http://10.10.10.13:5610/reports/worktime/management?format=json' \
+  | jq '.workforce_operations.summary'
+
+curl -fsS 'http://10.10.10.2:8720/api/reports?role=manager' \
+  | jq '{status: .workforce_operations.summary.status, rows: (.workforce_operations.rows | length)}'
+```
+
+Браузерный smoke: открыть `http://10.10.10.2:8720/`, выбрать представление
+менеджера и проверить блок `Операционная загрузка`. В рабочем состоянии должны
+быть видны summary-карточки, таблица сотрудников, `workforce-operations-v1` и
+guardrail про `low confidence`.

grafana/detmir-aw-main-dashboard.json

@@ -342,7 +342,7 @@
       "id": 7,
       "targets": [
         {
-          "query": "import \"date\"\nimport \"strings\"\nimport \"timezone\"\noption location = timezone.location(name: \"Europe/Moscow\")\ntoday = strings.substring(v: string(v: date.add(d: 3h, to: date.truncate(t: now(), unit: 1d))), start: 0, end: 10)\nbase = from(bucket: \"aw_metrics\")\n  |> range(start: -3d)\n  |> filter(fn: (r) => r._measurement == \"aw_true_active_app_daily\" and r.host == \"${host}\" and r.report_date == today)\n\nnums = base\n  |> filter(fn: (r) => r._field == \"proved_work_seconds\" or r._field == \"evidence_events\")\n  |> group(columns:[\"application\",\"_field\"])\n  |> last()\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n\ntexts = base\n  |> filter(fn: (r) => r._field == \"last_action\" or r._field == \"last_action_local\")\n  |> group(columns:[\"application\",\"_field\"])\n  |> last()\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n\njoin(tables: {n: nums, t: texts}, on: [\"application\", \"report_date\"])\n  |> map(fn:(r)=>({ r with hours: float(v:r.proved_work_seconds) / 3600.0 }))\n  |> sort(columns:[\"proved_work_seconds\"], desc:true)\n  |> group()\n  |> keep(columns:[\"report_date\",\"application\",\"hours\",\"last_action_local\",\"last_action\",\"evidence_events\"])\n  |> rename(columns:{report_date:\"Дата\", application:\"Приложение\", hours:\"Доказано, ч\", last_action_local:\"Последнее действие\", last_action:\"Окно / действие\", evidence_events:\"Подтверждений\"})\n",
+          "query": "import \"date\"\nimport \"strings\"\nimport \"timezone\"\noption location = timezone.location(name: \"Europe/Moscow\")\ntoday = strings.substring(v: string(v: date.add(d: 3h, to: date.truncate(t: now(), unit: 1d))), start: 0, end: 10)\nfrom(bucket: \"aw_metrics\")\n  |> range(start: -3d)\n  |> filter(fn: (r) => r._measurement == \"aw_true_active_app_daily\" and r.host == \"${host}\" and r.report_date == today)\n  |> filter(fn: (r) => r._field == \"proved_work_seconds\" or r._field == \"evidence_events\" or r._field == \"last_action\" or r._field == \"last_action_local\")\n  |> group(columns:[\"application\",\"report_date\",\"_field\"])\n  |> last()\n  |> keep(columns:[\"application\",\"report_date\",\"_field\",\"_value\"])\n  |> map(fn:(r)=>({ r with _value: string(v:r._value) }))\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n  |> map(fn:(r)=>({ r with hours: float(v:r.proved_work_seconds) / 3600.0 }))\n  |> sort(columns:[\"hours\"], desc:true)\n  |> group()\n  |> keep(columns:[\"report_date\",\"application\",\"hours\",\"last_action_local\",\"last_action\",\"evidence_events\"])\n  |> rename(columns:{report_date:\"Дата\", application:\"Приложение\", hours:\"Доказано, ч\", last_action_local:\"Последнее действие\", last_action:\"Окно / действие\", evidence_events:\"Подтверждений\"})\n",
           "refId": "A"
         }
       ],

grafana/detmir-rdp-user-activity-dashboard.json

@@ -630,7 +630,7 @@
       },
       "targets": [
         {
-          "query": "import \"date\"\nimport \"strings\"\nimport \"timezone\"\noption location = timezone.location(name: \"Europe/Moscow\")\ntoday = strings.substring(v: string(v: date.add(d: 3h, to: date.truncate(t: now(), unit: 1d))), start: 0, end: 10)\nbase = from(bucket: \"aw_metrics\")\n  |> range(start: -3d)\n  |> filter(fn: (r) => r._measurement == \"aw_true_active_app_daily\" and r.host == \"${host}\" and r.report_date == today)\n\nnums = base\n  |> filter(fn: (r) => r._field == \"proved_work_seconds\" or r._field == \"evidence_events\")\n  |> group(columns:[\"application\",\"_field\"])\n  |> last()\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n\ntexts = base\n  |> filter(fn: (r) => r._field == \"last_action\" or r._field == \"last_action_local\")\n  |> group(columns:[\"application\",\"_field\"])\n  |> last()\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n\njoin(tables: {n: nums, t: texts}, on: [\"application\", \"report_date\"])\n  |> map(fn:(r)=>({ r with hours: float(v:r.proved_work_seconds) / 3600.0 }))\n  |> sort(columns:[\"proved_work_seconds\"], desc:true)\n  |> group()\n  |> keep(columns:[\"report_date\",\"application\",\"hours\",\"last_action_local\",\"last_action\",\"evidence_events\"])\n  |> rename(columns:{report_date:\"Дата\", application:\"Приложение\", hours:\"Доказано, ч\", last_action_local:\"Последнее действие\", last_action:\"Окно / действие\", evidence_events:\"Подтверждений\"})",
+          "query": "import \"date\"\nimport \"strings\"\nimport \"timezone\"\noption location = timezone.location(name: \"Europe/Moscow\")\ntoday = strings.substring(v: string(v: date.add(d: 3h, to: date.truncate(t: now(), unit: 1d))), start: 0, end: 10)\nfrom(bucket: \"aw_metrics\")\n  |> range(start: -3d)\n  |> filter(fn: (r) => r._measurement == \"aw_true_active_app_daily\" and r.host == \"${host}\" and r.report_date == today)\n  |> filter(fn: (r) => r._field == \"proved_work_seconds\" or r._field == \"evidence_events\" or r._field == \"last_action\" or r._field == \"last_action_local\")\n  |> group(columns:[\"application\",\"report_date\",\"_field\"])\n  |> last()\n  |> keep(columns:[\"application\",\"report_date\",\"_field\",\"_value\"])\n  |> map(fn:(r)=>({ r with _value: string(v:r._value) }))\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n  |> map(fn:(r)=>({ r with hours: float(v:r.proved_work_seconds) / 3600.0 }))\n  |> sort(columns:[\"hours\"], desc:true)\n  |> group()\n  |> keep(columns:[\"report_date\",\"application\",\"hours\",\"last_action_local\",\"last_action\",\"evidence_events\"])\n  |> rename(columns:{report_date:\"Дата\", application:\"Приложение\", hours:\"Доказано, ч\", last_action_local:\"Последнее действие\", last_action:\"Окно / действие\", evidence_events:\"Подтверждений\"})",
           "refId": "A"
         }
       ],

ops/systemd/awatch-contour-daily-check.service

@@ -12,6 +12,7 @@ Environment=DETMIR_DLP_COMMAND=detmir-dlp
 Environment=CONTOUR_CHECK_OUTPUT_ROOT=/var/lib/detmir-ai/contour-check-runs
 Environment=CONTOUR_CHECK_ENV_FILE=/etc/detmir/detmir-check.env
 Environment=DETMIR_PORTAL_URL=http://127.0.0.1:8720
+Environment=DETMIR_DLP_ENABLED=false
 EnvironmentFile=-/etc/detmir/detmir-check.env
 EnvironmentFile=-/etc/awatch-rus/contour-check.env
 ExecStart=/usr/bin/env bash /usr/local/sbin/awatch-contour-check

ops/systemd/awatch-contour-weekly-check.service

@@ -13,6 +13,7 @@ Environment=DETMIR_DLP_COMMAND=detmir-dlp
 Environment=CONTOUR_CHECK_OUTPUT_ROOT=/var/lib/detmir-ai/contour-check-runs
 Environment=CONTOUR_CHECK_ENV_FILE=/etc/detmir/detmir-check.env
 Environment=DETMIR_PORTAL_URL=http://127.0.0.1:8720
+Environment=DETMIR_DLP_ENABLED=false
 EnvironmentFile=-/etc/detmir/detmir-check.env
 EnvironmentFile=-/etc/awatch-rus/contour-check.env
 ExecStart=/usr/bin/env bash /usr/local/sbin/awatch-contour-check

scripts/check_detmir_rust_release_artifacts.sh

@@ -4,8 +4,33 @@ set -euo pipefail
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 TARGET_ROOT="${CARGO_TARGET_DIR:-$ROOT_DIR/adk-rust/target}"
 RELEASE_DIR="$TARGET_ROOT/release"
+SCOPE="${CHECK_DETMIR_RUST_RELEASE_SCOPE:-prod-runtime}"
 
-required_bins=(
+prod_runtime_bins=(
+  aw-1c-ingest
+  aw-hayabusa-autoprocess-rust
+  aw-rus-healthd
+  aw-slo-monitor
+  aw-workforce-ingest
+  detmir-auto
+  detmir-portal
+  detmir-readiness
+  dlp-aggregator
+  dlp-case-management
+  dlp-cef-exporter
+  dlp-compliance
+  dlp-influx-exporter
+  dlp-policy-engine
+  dlp-syslog-forwarder
+  dlp-webhook-sender
+  worktime-api
+  worktime-autoheal
+  worktime-influx-exporter
+  worktime-prewarm
+  worktime-ui-bridge
+)
+
+workspace_bins=(
   detmir-status
   detmir-adk-status
   detmir-check
@@ -61,8 +86,23 @@ required_bins=(
   aw-hayabusa-from-windows-rust
   aw-hayabusa-autoprocess-rust
   aw-1c-ingest
+  containment-engine
+  security-finding-inbox
 )
 
+case "$SCOPE" in
+  prod-runtime)
+    required_bins=("${prod_runtime_bins[@]}")
+    ;;
+  workspace)
+    required_bins=("${workspace_bins[@]}")
+    ;;
+  *)
+    echo "Unsupported CHECK_DETMIR_RUST_RELEASE_SCOPE=$SCOPE; expected prod-runtime or workspace" >&2
+    exit 2
+    ;;
+esac
+
 missing=0
 for bin in "${required_bins[@]}"; do
   if [[ -x "$RELEASE_DIR/$bin" ]]; then
@@ -76,7 +116,7 @@ done
 if (( missing != 0 )); then
   cat >&2 <<EOF
 
-Missing DetMir Rust release artifacts.
+Missing DetMir Rust release artifacts for scope: $SCOPE.
 Build them with:
   cd "$ROOT_DIR/adk-rust"
   CARGO_TARGET_DIR="$TARGET_ROOT" cargo build --release --workspace
@@ -84,4 +124,4 @@ EOF
   exit 1
 fi
 
-echo "detmir rust release artifacts: OK ($RELEASE_DIR)"
+echo "detmir rust release artifacts: OK scope=$SCOPE ($RELEASE_DIR)"

scripts/check_orchestration_map.sh

@@ -1,98 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-DOC="$ROOT/docs/ORCHESTRATION_MAP_RU.md"
-failures=()
-
-fail() {
-  failures+=("$1")
-}
-
-require_file() {
-  local path="$1"
-  if [[ ! -s "$ROOT/$path" ]]; then
-    fail "missing_or_empty:$path"
-  fi
-}
-
-require_marker() {
-  local marker="$1"
-  local path="$2"
-  if ! grep -Fq "$marker" "$ROOT/$path"; then
-    fail "missing_marker:$path:$marker"
-  fi
-}
-
-require_absent() {
-  local marker="$1"
-  local path="$2"
-  if grep -Fq "$marker" "$ROOT/$path"; then
-    fail "forbidden_marker:$path:$marker"
-  fi
-}
-
-require_file "docs/ORCHESTRATION_MAP_RU.md"
-require_file "docs/MODULE_ARCHITECTURE_GRAPH_RU.md"
-require_file "ansible/README.md"
-require_file "README.md"
-
-entrypoints=(
-  "ansible/install_full_stack.yml"
-  "ansible/deploy_aw_server.yml"
-  "ansible/deploy_aw_windows.yml"
-  "ansible/post_validate_aw_windows.yml"
-  "ansible/deploy_detmir_portal.yml"
-  "ansible/deploy_proxmox_web_gateway.yml"
-  "ansible/deploy_grafana_dashboards.yml"
-  "ansible/deploy_grafana_check.yml"
-  "ansible/deploy_file_1c_analytics.yml"
-  "ansible/deploy_file_1c_windows_telemetry.yml"
-  "ansible/deploy_dlp_evidence_sync.yml"
-  "ansible/deploy_aw_pfsense_poller.yml"
-  "scripts/run_awatch_contour_check.sh"
-  "scripts/detmir-support-daily.sh"
-  "scripts/check_orchestration_map.sh"
-  "ops/systemd/awatch-contour-daily-check.timer"
-  "ops/systemd/awatch-contour-weekly-check.timer"
-)
-
-for path in "${entrypoints[@]}"; do
-  require_file "$path"
-  require_marker "$path" "docs/ORCHESTRATION_MAP_RU.md"
-done
-
-doc_markers=(
-  "GitHub/Gitea"
-  "DLP runtime"
-  "Hayabusa"
-  "Velociraptor"
-  "Security findings"
-  "approval"
-  "SHARKON2025"
-  "logical host id"
-  "quality-gate.sh"
-  "public mirror validation"
-  "российский build-runner"
-)
-
-for marker in "${doc_markers[@]}"; do
-  require_marker "$marker" "docs/ORCHESTRATION_MAP_RU.md"
-done
-
-require_marker "docs/ORCHESTRATION_MAP_RU.md" "docs/MODULE_ARCHITECTURE_GRAPH_RU.md"
-require_marker "docs/ORCHESTRATION_MAP_RU.md" "README.md"
-require_marker "docs/ORCHESTRATION_MAP_RU.md" "ansible/README.md"
-
-require_absent "FSTEC certified" "docs/ORCHESTRATION_MAP_RU.md"
-require_absent "ФСТЭК сертифицирован" "docs/ORCHESTRATION_MAP_RU.md"
-require_absent "automatic remediation" "docs/ORCHESTRATION_MAP_RU.md"
-require_absent "registry submission completed" "docs/ORCHESTRATION_MAP_RU.md"
-
-if (( ${#failures[@]} > 0 )); then
-  printf 'orchestration_map_check=fail\n' >&2
-  printf '%s\n' "${failures[@]}" >&2
-  exit 1
-fi
-
-printf 'orchestration_map_check=ok\n'

scripts/detmir_dlp_load_guard.sh

@@ -0,0 +1,260 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ENABLED="${AW_DLP_GUARD_ENABLED:-true}"
+PROFILE="${AW_DLP_PROFILE:-light}"
+STATE_DIR="${AW_DLP_GUARD_STATE_DIR:-/var/lib/activitywatch/health}"
+STATE_FILE="${AW_DLP_GUARD_STATE_FILE:-${STATE_DIR}/dlp-light-guard-state.json}"
+STATE_HISTORY_DIR="${AW_DLP_GUARD_HISTORY_DIR:-${STATE_DIR}/dlp-light-guard-history}"
+CONTROL_BIN="${AW_DLP_CONTROL_BIN:-/usr/local/bin/detmir-dlp-runtime-control}"
+LOAD_RATIO="${AW_DLP_GUARD_LOAD_RATIO:-1.50}"
+MEM_AVAILABLE_PCT_MIN="${AW_DLP_GUARD_MEM_AVAILABLE_PCT_MIN:-15}"
+IOWAIT_PCT_MAX="${AW_DLP_GUARD_IOWAIT_PCT_MAX:-20}"
+STRIKES_REQUIRED="${AW_DLP_GUARD_STRIKES_REQUIRED:-3}"
+
+DLP_GUARDED_UNITS=(
+  aw-dlp-influx-exporter.timer
+  aw-dlp-influx-exporter.service
+  activitywatch-dlp-aggregator.timer
+  activitywatch-dlp-aggregator.service
+  aw-dlp-report-scheduler.timer
+  aw-dlp-report-scheduler.service
+  aw-dlp-syslog-forwarder.timer
+  aw-dlp-syslog-forwarder.service
+  aw-dlp-webhook-sender.timer
+  aw-dlp-webhook-sender.service
+  aw-dlp-cef-exporter.timer
+  aw-dlp-cef-exporter.service
+  aw-dlp-ioc-refresh.timer
+  aw-dlp-ioc-refresh.service
+  aw-dlp-policy-engine.service
+  aw-dlp-case-management.service
+  detmir-portal-evidence.service
+)
+
+json_string() {
+  python3 -c 'import json,sys; print(json.dumps(sys.argv[1], ensure_ascii=False))' "$1"
+}
+
+number_or_null() {
+  local value="${1:-}"
+  if [[ "$value" =~ ^-?[0-9]+([.][0-9]+)?$ ]]; then
+    printf '%s' "$value"
+  else
+    printf 'null'
+  fi
+}
+
+active_dlp_units_json() {
+  local first=1 unit
+  printf '['
+  if command -v systemctl >/dev/null 2>&1; then
+    for unit in "${DLP_GUARDED_UNITS[@]}"; do
+      if systemctl is-active --quiet "$unit" 2>/dev/null; then
+        [[ "$first" -eq 1 ]] || printf ','
+        first=0
+        json_string "$unit"
+      fi
+    done
+  fi
+  printf ']'
+}
+
+active_dlp_unit_count() {
+  local count=0 unit
+  if command -v systemctl >/dev/null 2>&1; then
+    for unit in "${DLP_GUARDED_UNITS[@]}"; do
+      if systemctl is-active --quiet "$unit" 2>/dev/null; then
+        count=$((count + 1))
+      fi
+    done
+  fi
+  printf '%s\n' "$count"
+}
+
+read_load1() {
+  awk '{print $1}' /proc/loadavg 2>/dev/null || printf '0'
+}
+
+read_cpu_count() {
+  local cores
+  cores="$(getconf _NPROCESSORS_ONLN 2>/dev/null || printf '1')"
+  if [[ ! "$cores" =~ ^[0-9]+$ || "$cores" -lt 1 ]]; then
+    cores=1
+  fi
+  printf '%s\n' "$cores"
+}
+
+read_mem_available_pct() {
+  awk '
+    /^MemTotal:/ { total=$2 }
+    /^MemAvailable:/ { available=$2 }
+    END {
+      if (total > 0) {
+        printf "%.2f", (available * 100.0 / total)
+      } else {
+        printf "0"
+      }
+    }
+  ' /proc/meminfo 2>/dev/null || printf '0'
+}
+
+read_cpu_sample() {
+  awk '/^cpu / {
+    idle=$5
+    iowait=$6
+    total=0
+    for (i=2; i<=NF; i++) total += $i
+    printf "%s %s\n", total, iowait
+    exit
+  }' /proc/stat 2>/dev/null || printf '0 0'
+}
+
+read_iowait_pct() {
+  local total1 wait1 total2 wait2 dtotal dwait
+  read -r total1 wait1 < <(read_cpu_sample)
+  sleep 1
+  read -r total2 wait2 < <(read_cpu_sample)
+  dtotal=$((total2 - total1))
+  dwait=$((wait2 - wait1))
+  if [[ "$dtotal" -le 0 || "$dwait" -lt 0 ]]; then
+    printf '0'
+    return
+  fi
+  awk -v wait="$dwait" -v total="$dtotal" 'BEGIN { printf "%.2f", wait * 100.0 / total }'
+}
+
+is_over_threshold() {
+  local value="$1"
+  local threshold="$2"
+  awk -v value="$value" -v threshold="$threshold" 'BEGIN { exit !(value > threshold) }'
+}
+
+is_under_threshold() {
+  local value="$1"
+  local threshold="$2"
+  awk -v value="$value" -v threshold="$threshold" 'BEGIN { exit !(value < threshold) }'
+}
+
+write_state() {
+  local action="$1"
+  local reason="$2"
+  local load1="$3"
+  local cores="$4"
+  local load_threshold="$5"
+  local mem_pct="$6"
+  local iowait_pct="$7"
+  local active_count="$8"
+  local active_units_json="$9"
+  local control_exit="${10}"
+  local strikes="${11:-0}"
+  local now stamp tmp history
+
+  now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  stamp="$(date -u +%Y%m%dT%H%M%SZ)"
+  mkdir -p "$STATE_DIR" "$STATE_HISTORY_DIR"
+  tmp="$(mktemp "${STATE_FILE}.tmp.XXXXXX")"
+  {
+    printf '{'
+    printf '"generated_at_utc":%s,' "$(json_string "$now")"
+    printf '"profile":%s,' "$(json_string "$PROFILE")"
+    printf '"guard_enabled":%s,' "$(json_string "$ENABLED")"
+    printf '"action":%s,' "$(json_string "$action")"
+    printf '"reason":%s,' "$(json_string "$reason")"
+    printf '"consecutive_overload_count":%s,' "$(number_or_null "$strikes")"
+    printf '"consecutive_overload_required":%s,' "$(number_or_null "$STRIKES_REQUIRED")"
+    printf '"control_bin":%s,' "$(json_string "$CONTROL_BIN")"
+    printf '"control_exit":%s,' "$(number_or_null "$control_exit")"
+    printf '"metrics":{'
+    printf '"load1":%s,' "$(number_or_null "$load1")"
+    printf '"cpu_count":%s,' "$(number_or_null "$cores")"
+    printf '"load_threshold":%s,' "$(number_or_null "$load_threshold")"
+    printf '"mem_available_pct":%s,' "$(number_or_null "$mem_pct")"
+    printf '"mem_available_pct_min":%s,' "$(number_or_null "$MEM_AVAILABLE_PCT_MIN")"
+    printf '"iowait_pct":%s,' "$(number_or_null "$iowait_pct")"
+    printf '"iowait_pct_max":%s' "$(number_or_null "$IOWAIT_PCT_MAX")"
+    printf '},'
+    printf '"active_dlp_unit_count":%s,' "$(number_or_null "$active_count")"
+    printf '"active_dlp_units":%s' "$active_units_json"
+    printf '}\n'
+  } >"$tmp"
+  mv "$tmp" "$STATE_FILE"
+  history="${STATE_HISTORY_DIR}/dlp-light-guard-${stamp}.json"
+  cp -a "$STATE_FILE" "$history"
+  printf 'dlp guard action=%s reason=%s state=%s history=%s\n' "$action" "$reason" "$STATE_FILE" "$history"
+}
+
+main() {
+  local load1 cores load_threshold mem_pct iowait_pct active_count active_units_json overloaded reason control_exit strikes prev_strikes
+
+  load1="$(read_load1)"
+  cores="$(read_cpu_count)"
+  load_threshold="$(awk -v cores="$cores" -v ratio="$LOAD_RATIO" 'BEGIN { printf "%.2f", cores * ratio }')"
+  mem_pct="$(read_mem_available_pct)"
+  iowait_pct="$(read_iowait_pct)"
+  active_units_json="$(active_dlp_units_json)"
+  active_count="$(active_dlp_unit_count)"
+  overloaded=0
+  reason="within_thresholds"
+  prev_strikes="$(
+    python3 - "$STATE_FILE" <<'PY' 2>/dev/null || true
+import json, sys
+try:
+    print(int(json.load(open(sys.argv[1])).get("consecutive_overload_count", 0)))
+except Exception:
+    print(0)
+PY
+  )"
+  [[ "$prev_strikes" =~ ^[0-9]+$ ]] || prev_strikes=0
+  strikes=0
+
+  if is_over_threshold "$load1" "$load_threshold"; then
+    overloaded=1
+    reason="load1_above_threshold"
+  elif is_under_threshold "$mem_pct" "$MEM_AVAILABLE_PCT_MIN"; then
+    overloaded=1
+    reason="mem_available_below_threshold"
+  elif is_over_threshold "$iowait_pct" "$IOWAIT_PCT_MAX"; then
+    overloaded=1
+    reason="iowait_above_threshold"
+  fi
+
+  if [[ "$ENABLED" != "true" && "$ENABLED" != "1" && "$ENABLED" != "yes" ]]; then
+    write_state "skipped" "guard_disabled" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "0" "0"
+    return 0
+  fi
+
+  if [[ "$overloaded" -eq 0 ]]; then
+    write_state "none" "$reason" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "0" "0"
+    return 0
+  fi
+
+  strikes=$((prev_strikes + 1))
+
+  if [[ "$strikes" -lt "$STRIKES_REQUIRED" ]]; then
+    write_state "observe_overload" "$reason" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "0" "$strikes"
+    return 0
+  fi
+
+  if [[ "$active_count" -eq 0 ]]; then
+    write_state "none" "${reason}_but_no_active_dlp_units" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "0" "$strikes"
+    return 0
+  fi
+
+  if [[ ! -x "$CONTROL_BIN" ]]; then
+    write_state "failed" "${reason}_control_bin_missing" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "127" "$strikes"
+    printf 'DLP guard cannot disable overloaded DLP: executable not found: %s\n' "$CONTROL_BIN" >&2
+    return 127
+  fi
+
+  control_exit=0
+  AW_DLP_DISABLED_REASON="auto_disabled_by_dlp_load_guard:${reason}" "$CONTROL_BIN" set-profile core_only || control_exit=$?
+  if [[ "$control_exit" -eq 0 ]]; then
+    write_state "auto_disabled" "$reason" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "$control_exit" "$strikes"
+  else
+    write_state "failed" "${reason}_control_exit_${control_exit}" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "$control_exit" "$strikes"
+  fi
+  return "$control_exit"
+}
+
+main "$@"

scripts/detmir_dlp_runtime_control.sh

@@ -0,0 +1,269 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ACTION="${1:-status}"
+PROFILE="${2:-${AW_DLP_PROFILE:-core_only}}"
+AW_BASE="${AW_DLP_CONTROL_AW_BASE:-http://127.0.0.1:5600}"
+HOSTNAME_FILTER="${AW_DLP_CONTROL_HOSTNAME:-${AW_LOGICAL_HOST_ID:-${AW_MONITORED_WINDOWS_HOSTNAME:-HOST-EXAMPLE}}}"
+STATE_DIR="${AW_DLP_CONTROL_STATE_DIR:-/var/lib/activitywatch/health}"
+STATE_FILE="${AW_DLP_CONTROL_STATE_FILE:-${STATE_DIR}/dlp-runtime-state.json}"
+STATE_HISTORY_DIR="${AW_DLP_CONTROL_HISTORY_DIR:-${STATE_DIR}/dlp-runtime-history}"
+ROLLBACK_FILE="${AW_DLP_CONTROL_ROLLBACK_FILE:-${STATE_DIR}/dlp-runtime-rollback.state}"
+REASON="${AW_DLP_DISABLED_REASON:-dlp_runtime_profile_control}"
+
+DLP_UNITS=(
+  aw-dlp-influx-exporter.timer
+  aw-dlp-influx-exporter.service
+  activitywatch-dlp-aggregator.timer
+  activitywatch-dlp-aggregator.service
+  aw-dlp-report-scheduler.timer
+  aw-dlp-report-scheduler.service
+  aw-dlp-syslog-forwarder.timer
+  aw-dlp-syslog-forwarder.service
+  aw-dlp-webhook-sender.timer
+  aw-dlp-webhook-sender.service
+  aw-dlp-cef-exporter.timer
+  aw-dlp-cef-exporter.service
+  aw-dlp-ioc-refresh.timer
+  aw-dlp-ioc-refresh.service
+  aw-dlp-policy-engine.service
+  aw-dlp-case-management.service
+  detmir-portal-evidence.service
+)
+
+DLP_BUCKET_PREFIXES=(
+  aw-dlp-endpoint-signals
+  aw-dlp-incidents
+  aw-dlp-review
+  aw-dlp-rules
+)
+
+DLP_LIGHT_UNITS=(
+  activitywatch-dlp-aggregator.timer
+  aw-dlp-ioc-refresh.timer
+)
+
+DLP_ON_DEMAND_UNITS=(
+  aw-dlp-ioc-refresh.timer
+  aw-dlp-policy-engine.service
+  aw-dlp-case-management.service
+  detmir-portal-evidence.service
+)
+
+json_escape() {
+  local value="$1"
+  python3 -c 'import json,sys; print(json.dumps(sys.argv[1], ensure_ascii=False))' "$value"
+}
+
+unit_json() {
+  local first=1 unit active enabled load
+  printf '['
+  for unit in "${DLP_UNITS[@]}"; do
+    load="$(systemctl show -p LoadState --value "$unit" 2>/dev/null || true)"
+    if [[ "$load" == "not-found" || -z "$load" ]]; then
+      active="not-found"
+      enabled="not-found"
+    else
+      active="$(systemctl is-active "$unit" 2>/dev/null || true)"
+      enabled="$(systemctl is-enabled "$unit" 2>/dev/null || true)"
+    fi
+    [[ "$first" -eq 1 ]] || printf ','
+    first=0
+    printf '{"unit":%s,"load":%s,"active":%s,"enabled":%s}' \
+      "$(json_escape "$unit")" \
+      "$(json_escape "${load:-not-found}")" \
+      "$(json_escape "${active:-unknown}")" \
+      "$(json_escape "${enabled:-unknown}")"
+  done
+  printf ']'
+}
+
+bucket_json() {
+  local first=1 prefix bucket url payload ts count
+  printf '['
+  for prefix in "${DLP_BUCKET_PREFIXES[@]}"; do
+    bucket="${prefix}_${HOSTNAME_FILTER}"
+    url="${AW_BASE%/}/api/0/buckets/${bucket}/events?limit=1"
+    payload="$(curl -sS --connect-timeout 3 --max-time 8 "$url" 2>/dev/null || true)"
+    ts="$(printf '%s' "$payload" | jq -r '.[0].timestamp // ""' 2>/dev/null || true)"
+    count="$(printf '%s' "$payload" | jq -r 'if type == "array" then length else 0 end' 2>/dev/null || printf '0')"
+    [[ "$first" -eq 1 ]] || printf ','
+    first=0
+    printf '{"bucket":%s,"sample_count":%s,"latest_timestamp":%s}' \
+      "$(json_escape "$bucket")" \
+      "${count:-0}" \
+      "$(json_escape "$ts")"
+  done
+  printf ']'
+}
+
+unit_exists() {
+  local unit="$1"
+  systemctl list-unit-files "$unit" --no-legend 2>/dev/null | grep -q . || systemctl status "$unit" >/dev/null 2>&1
+}
+
+stop_disable_all_dlp() {
+  local unit
+  for unit in "${DLP_UNITS[@]}"; do
+    if unit_exists "$unit"; then
+      systemctl stop "$unit" >/dev/null 2>&1 || true
+      systemctl disable "$unit" >/dev/null 2>&1 || true
+      systemctl reset-failed "$unit" >/dev/null 2>&1 || true
+    fi
+  done
+}
+
+enable_start_units() {
+  local unit
+  for unit in "$@"; do
+    if unit_exists "$unit"; then
+      systemctl enable --now "$unit" >/dev/null 2>&1 || true
+    fi
+  done
+}
+
+capture_rollback_state() {
+  local tmp unit load active enabled
+  mkdir -p "$STATE_DIR"
+  tmp="$(mktemp "${ROLLBACK_FILE}.tmp.XXXXXX")"
+  {
+    printf '# generated_at_utc=%s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    printf '# reason=pre_profile_change\n'
+    for unit in "${DLP_UNITS[@]}"; do
+      load="$(systemctl show -p LoadState --value "$unit" 2>/dev/null || true)"
+      if [[ "$load" == "not-found" || -z "$load" ]]; then
+        active="not-found"
+        enabled="not-found"
+      else
+        active="$(systemctl is-active "$unit" 2>/dev/null || true)"
+        enabled="$(systemctl is-enabled "$unit" 2>/dev/null || true)"
+      fi
+      printf '%s|%s|%s|%s\n' "$unit" "${load:-not-found}" "$active" "$enabled"
+    done
+  } >"$tmp"
+  mv "$tmp" "$ROLLBACK_FILE"
+}
+
+write_stats() {
+  local mode="${1:-current}" now stamp tmp history_file
+  now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  stamp="$(date -u +%Y%m%dT%H%M%SZ)"
+  mkdir -p "$STATE_DIR" "$STATE_HISTORY_DIR"
+  tmp="$(mktemp "${STATE_FILE}.tmp.XXXXXX")"
+  {
+    printf '{'
+    printf '"generated_at_utc":%s,' "$(json_escape "$now")"
+    printf '"mode":%s,' "$(json_escape "$mode")"
+    printf '"profile":%s,' "$(json_escape "${AW_DLP_PROFILE:-$PROFILE}")"
+    printf '"reason":%s,' "$(json_escape "$REASON")"
+    printf '"aw_base":%s,' "$(json_escape "$AW_BASE")"
+    printf '"hostname":%s,' "$(json_escape "$HOSTNAME_FILTER")"
+    printf '"units":'
+    unit_json
+    printf ',"buckets":'
+    bucket_json
+    printf '}\n'
+  } >"$tmp"
+  mv "$tmp" "$STATE_FILE"
+  history_file="${STATE_HISTORY_DIR}/dlp-runtime-${mode}-${stamp}.json"
+  cp -a "$STATE_FILE" "$history_file"
+  printf 'latest=%s\nhistory=%s\n' "$STATE_FILE" "$history_file"
+}
+
+apply_profile() {
+  local target_profile="$1"
+  capture_rollback_state
+  case "$target_profile" in
+    core_only|disabled|off)
+      PROFILE="core_only"
+      stop_disable_all_dlp
+      AW_DLP_PROFILE="core_only" write_stats "disabled"
+      ;;
+    light)
+      PROFILE="light"
+      stop_disable_all_dlp
+      enable_start_units "${DLP_LIGHT_UNITS[@]}"
+      AW_DLP_PROFILE="light" write_stats "enabled_light"
+      ;;
+    on_demand)
+      PROFILE="on_demand"
+      stop_disable_all_dlp
+      enable_start_units "${DLP_ON_DEMAND_UNITS[@]}"
+      AW_DLP_PROFILE="on_demand" write_stats "enabled_on_demand"
+      ;;
+    full|enabled|on)
+      PROFILE="full"
+      stop_disable_all_dlp
+      enable_start_units "${DLP_LIGHT_UNITS[@]}"
+      enable_start_units \
+        aw-dlp-influx-exporter.timer \
+        activitywatch-dlp-aggregator.timer \
+        aw-dlp-report-scheduler.timer \
+        aw-dlp-syslog-forwarder.timer \
+        aw-dlp-webhook-sender.timer \
+        aw-dlp-cef-exporter.timer \
+        aw-dlp-policy-engine.service \
+        aw-dlp-case-management.service \
+        detmir-portal-evidence.service
+      AW_DLP_PROFILE="full" write_stats "enabled_full"
+      ;;
+    *)
+      printf 'unsupported DLP profile: %s\n' "$target_profile" >&2
+      printf 'supported profiles: core_only, light, on_demand, full\n' >&2
+      exit 2
+      ;;
+  esac
+}
+
+disable_dlp() {
+  apply_profile "core_only"
+}
+
+enable_dlp() {
+  apply_profile "full"
+}
+
+rollback_dlp() {
+  local unit load active enabled
+  if [[ ! -s "$ROLLBACK_FILE" ]]; then
+    printf 'rollback state not found: %s\n' "$ROLLBACK_FILE" >&2
+    exit 1
+  fi
+  stop_disable_all_dlp
+  while IFS='|' read -r unit load active enabled; do
+    [[ -n "${unit:-}" && "${unit:0:1}" != "#" ]] || continue
+    [[ "$load" != "not-found" ]] || continue
+    if [[ "$enabled" == "enabled" ]]; then
+      systemctl enable "$unit" >/dev/null 2>&1 || true
+    fi
+    if [[ "$active" == "active" ]]; then
+      systemctl start "$unit" >/dev/null 2>&1 || true
+    fi
+  done <"$ROLLBACK_FILE"
+  write_stats "rollback"
+}
+
+case "$ACTION" in
+  status|stats)
+    write_stats "current"
+    ;;
+  profile)
+    printf '%s\n' "${AW_DLP_PROFILE:-$PROFILE}"
+    ;;
+  set-profile)
+    apply_profile "$PROFILE"
+    ;;
+  disable)
+    disable_dlp
+    ;;
+  enable)
+    enable_dlp
+    ;;
+  rollback)
+    rollback_dlp
+    ;;
+  *)
+    printf 'Usage: %s [status|stats|profile|set-profile <core_only|light|on_demand|full>|disable|enable|rollback]\n' "$0" >&2
+    exit 2
+    ;;
+esac

scripts/detmir_dlp_warehouse_sync.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SOURCE_HOST="${AW_DLP_WAREHOUSE_SOURCE_HOST:-igor@10.10.10.13}"
+SOURCE_PATH="${AW_DLP_WAREHOUSE_SOURCE_PATH:-/var/lib/activitywatch/dlp_warehouse.sqlite}"
+DEST_PATH="${AW_DLP_WAREHOUSE_DEST_PATH:-/var/lib/activitywatch/dlp_warehouse.sqlite}"
+STATE_DIR="${AW_DLP_WAREHOUSE_SYNC_STATE_DIR:-/var/lib/activitywatch/health}"
+STATE_FILE="${AW_DLP_WAREHOUSE_SYNC_STATE_FILE:-${STATE_DIR}/dlp-warehouse-sync-state.json}"
+SSH_OPTS="${AW_DLP_WAREHOUSE_SSH_OPTS:--o BatchMode=yes -o ConnectTimeout=5}"
+REMOTE_TMP="/tmp/dlp_warehouse_sync_$$.sqlite"
+LOCAL_TMP=""
+
+json_string() {
+  python3 -c 'import json,sys; print(json.dumps(sys.argv[1], ensure_ascii=False))' "$1"
+}
+
+write_state() {
+  local status="$1"
+  local message="$2"
+  local rows="${3:-}"
+  local bytes="${4:-}"
+  local now tmp
+  now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  mkdir -p "$STATE_DIR"
+  tmp="$(mktemp "${STATE_FILE}.tmp.XXXXXX")"
+  {
+    printf '{'
+    printf '"generated_at_utc":%s,' "$(json_string "$now")"
+    printf '"status":%s,' "$(json_string "$status")"
+    printf '"message":%s,' "$(json_string "$message")"
+    printf '"source_host":%s,' "$(json_string "$SOURCE_HOST")"
+    printf '"source_path":%s,' "$(json_string "$SOURCE_PATH")"
+    printf '"dest_path":%s,' "$(json_string "$DEST_PATH")"
+    if [[ "$rows" =~ ^[0-9]+$ ]]; then
+      printf '"dlp_events":%s,' "$rows"
+    else
+      printf '"dlp_events":null,'
+    fi
+    if [[ "$bytes" =~ ^[0-9]+$ ]]; then
+      printf '"bytes":%s' "$bytes"
+    else
+      printf '"bytes":null'
+    fi
+    printf '}\n'
+  } >"$tmp"
+  mv "$tmp" "$STATE_FILE"
+}
+
+cleanup_remote() {
+  ssh $SSH_OPTS "$SOURCE_HOST" "rm -f '$REMOTE_TMP'" >/dev/null 2>&1 || true
+}
+
+main() {
+  local dest_dir rows bytes
+  dest_dir="$(dirname "$DEST_PATH")"
+  mkdir -p "$dest_dir" "$STATE_DIR"
+  LOCAL_TMP="$(mktemp "${DEST_PATH}.tmp.XXXXXX")"
+  trap 'rm -f "${LOCAL_TMP:-}"; cleanup_remote' EXIT
+
+  ssh $SSH_OPTS "$SOURCE_HOST" \
+    "set -euo pipefail; if command -v sqlite3 >/dev/null 2>&1; then sqlite3 '$SOURCE_PATH' \".backup '$REMOTE_TMP'\" || cp -f '$SOURCE_PATH' '$REMOTE_TMP'; else cp -f '$SOURCE_PATH' '$REMOTE_TMP'; fi; test -s '$REMOTE_TMP'"
+  scp $SSH_OPTS "$SOURCE_HOST:$REMOTE_TMP" "$LOCAL_TMP"
+  chmod 0644 "$LOCAL_TMP"
+  mv "$LOCAL_TMP" "$DEST_PATH"
+
+  bytes="$(stat -c %s "$DEST_PATH" 2>/dev/null || printf '')"
+  rows="$(sqlite3 "$DEST_PATH" 'select count(*) from dlp_events;' 2>/dev/null || printf '')"
+  write_state "ok" "synced" "$rows" "$bytes"
+  printf 'dlp warehouse synced: source=%s:%s dest=%s rows=%s bytes=%s\n' \
+    "$SOURCE_HOST" "$SOURCE_PATH" "$DEST_PATH" "${rows:-unknown}" "${bytes:-unknown}"
+}
+
+main "$@"

scripts/detmir_resilience_check.sh

@@ -0,0 +1,471 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+MODE="repo"
+AW_API="${AW_API:-http://127.0.0.1:5600}"
+AW_WORKTIME_API="${AW_WORKTIME_API:-http://127.0.0.1:5610}"
+AW_LOGICAL_HOST_ID="${AW_LOGICAL_HOST_ID:-${AW_MONITORED_WINDOWS_HOSTNAME:-SHARKON2025}}"
+AW_READINESS_TIMEOUT_SECONDS="${AW_READINESS_TIMEOUT_SECONDS:-60}"
+AW_READINESS_INTERVAL_SECONDS="${AW_READINESS_INTERVAL_SECONDS:-2}"
+AW_EVENTS_LIMIT="${AW_EVENTS_LIMIT:-100}"
+AW_EVENTS_MAX_SECONDS="${AW_EVENTS_MAX_SECONDS:-15}"
+HAYA_ROOT="${AW_HAYABUSA_ROOT:-/opt/hayabusa}"
+HAYA_DROP_DIR="${AW_HAYABUSA_DROP_DIR:-/opt/activitywatch/aw-rus-ops/drop}"
+SQLITE_DB="${AW_SQLITE_DB:-/var/lib/activitywatch/aw-server-rust/sqlite.db}"
+MAX_INCOMING_AGE_SECONDS="${MAX_HAYABUSA_INCOMING_AGE_SECONDS:-900}"
+STRICT_SECRETS="${DETMIR_RESILIENCE_STRICT_SECRETS:-0}"
+EXPECT_DLP_PROFILE="${DETMIR_RESILIENCE_EXPECT_DLP_PROFILE:-light}"
+EXPECT_OPTIONAL_DLP_OFF="${DETMIR_RESILIENCE_EXPECT_OPTIONAL_DLP_OFF:-0}"
+EXPECT_LOKI_OFF="${DETMIR_RESILIENCE_EXPECT_LOKI_OFF:-1}"
+
+DLP_RUNTIME_UNITS=(
+  aw-dlp-influx-exporter.timer
+  aw-dlp-influx-exporter.service
+  activitywatch-dlp-aggregator.timer
+  activitywatch-dlp-aggregator.service
+  aw-dlp-report-scheduler.timer
+  aw-dlp-report-scheduler.service
+  aw-dlp-syslog-forwarder.timer
+  aw-dlp-syslog-forwarder.service
+  aw-dlp-webhook-sender.timer
+  aw-dlp-webhook-sender.service
+  aw-dlp-cef-exporter.timer
+  aw-dlp-cef-exporter.service
+  aw-dlp-ioc-refresh.timer
+  aw-dlp-ioc-refresh.service
+  aw-dlp-policy-engine.service
+  aw-dlp-case-management.service
+  detmir-portal-evidence.service
+)
+
+DLP_LIGHT_ALLOWED_UNITS=(
+  activitywatch-dlp-aggregator.timer
+  activitywatch-dlp-aggregator.service
+  aw-dlp-ioc-refresh.timer
+  aw-dlp-ioc-refresh.service
+  detmir-dlp-load-guard.timer
+  detmir-dlp-load-guard.service
+)
+
+DLP_HEAVY_RUNTIME_UNITS=(
+  aw-dlp-influx-exporter.timer
+  aw-dlp-influx-exporter.service
+  aw-dlp-report-scheduler.timer
+  aw-dlp-report-scheduler.service
+  aw-dlp-syslog-forwarder.timer
+  aw-dlp-syslog-forwarder.service
+  aw-dlp-webhook-sender.timer
+  aw-dlp-webhook-sender.service
+  aw-dlp-cef-exporter.timer
+  aw-dlp-cef-exporter.service
+  aw-dlp-policy-engine.service
+  aw-dlp-case-management.service
+  detmir-portal-evidence.service
+)
+
+LOKI_RUNTIME_UNITS=(
+  loki.service
+  promtail.service
+)
+
+OK_COUNT=0
+WARN_COUNT=0
+FAIL_COUNT=0
+
+usage() {
+  cat <<'EOF'
+Usage:
+  scripts/detmir_resilience_check.sh [--repo|--live|--all]
+
+Modes:
+  --repo  check repository hardening and docs only (default, CI-safe)
+  --live  read-only checks for the local AW server/Hayabusa host
+  --all   repo + live
+
+Environment:
+  AW_API=http://127.0.0.1:5600
+  AW_WORKTIME_API=http://127.0.0.1:5610
+  AW_LOGICAL_HOST_ID=SHARKON2025
+  AW_READINESS_TIMEOUT_SECONDS=60
+  AW_EVENTS_MAX_SECONDS=15
+  AW_HAYABUSA_ROOT=/opt/hayabusa
+  AW_HAYABUSA_DROP_DIR=/opt/activitywatch/aw-rus-ops/drop
+  AW_SQLITE_DB=/var/lib/activitywatch/aw-server-rust/sqlite.db
+  DETMIR_RESILIENCE_EXPECT_DLP_PROFILE=light
+  DETMIR_RESILIENCE_EXPECT_OPTIONAL_DLP_OFF=0
+  DETMIR_RESILIENCE_EXPECT_LOKI_OFF=1
+  DETMIR_RESILIENCE_STRICT_SECRETS=1
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --repo) MODE="repo"; shift ;;
+    --live) MODE="live"; shift ;;
+    --all) MODE="all"; shift ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "unknown argument: $1" >&2; usage >&2; exit 2 ;;
+  esac
+done
+
+ok() {
+  OK_COUNT=$((OK_COUNT + 1))
+  printf '[OK]   %s\n' "$*"
+}
+
+warn() {
+  WARN_COUNT=$((WARN_COUNT + 1))
+  printf '[WARN] %s\n' "$*"
+}
+
+fail() {
+  FAIL_COUNT=$((FAIL_COUNT + 1))
+  printf '[FAIL] %s\n' "$*"
+}
+
+have() {
+  command -v "$1" >/dev/null 2>&1
+}
+
+require_file() {
+  local path="$1"
+  if [[ -f "$ROOT_DIR/$path" ]]; then
+    ok "file exists: $path"
+  else
+    fail "missing file: $path"
+  fi
+}
+
+require_pattern() {
+  local path="$1"
+  local pattern="$2"
+  local label="$3"
+  if grep -Eq "$pattern" "$ROOT_DIR/$path"; then
+    ok "$label"
+  else
+    fail "$label"
+  fi
+}
+
+check_repo() {
+  printf '== repo resilience checks ==\n'
+
+  require_file "scripts/detmir_resilience_check.sh"
+  require_file "docs/DETMIR_RESILIENCE_HARDENING_RU.md"
+  require_file "docs/DLP_RESOURCE_PROFILES_RU.md"
+  require_file "docs/DLP_OPTIONAL_RUNTIME_RU.md"
+  require_file "scripts/detmir_dlp_load_guard.sh"
+  require_file "scripts/detmir_dlp_warehouse_sync.sh"
+  require_file "aw-server/hayabusa/aw-hayabusa.sh"
+  require_file "adk-rust/crates/hayabusa-tools/src/bin/autoprocess.rs"
+  require_file "windows/AWatchRusCollectorGuardService.cs"
+  require_file "windows/install-collector-guard-service.ps1"
+
+  require_pattern "aw-server/hayabusa/aw-hayabusa.sh" "HAYA_QUARANTINE_DIR" "Hayabusa wrapper has quarantine root"
+  require_pattern "aw-server/hayabusa/aw-hayabusa.sh" "quarantine_incoming_package" "Hayabusa wrapper isolates incoming poison packages"
+  require_pattern "adk-rust/crates/hayabusa-tools/src/bin/autoprocess.rs" "validate_drop_inputs" "Hayabusa autoprocess validates drop package before accept"
+  require_pattern "adk-rust/crates/hayabusa-tools/src/bin/autoprocess.rs" "quarantine_drop_package" "Hayabusa autoprocess quarantines bad drop package"
+  require_pattern "windows/AWatchRusCollectorGuardService.cs" "Process\\.Exited|ChildExited" "Collector guard service watches child exit"
+  require_pattern "windows/AWatchRusCollectorGuardService.cs" "MaxChildRestartsInWindow" "Collector guard service has bounded child restart budget"
+  require_pattern "windows/install-collector-guard-service.ps1" "failureflag" "Collector guard installer enables SCM failureflag"
+  require_pattern "docs/DETMIR_RESILIENCE_HARDENING_RU.md" "Hayabusa poison-package isolation" "Resilience doc records Hayabusa hardening"
+  require_pattern "docs/DETMIR_RESILIENCE_HARDENING_RU.md" "Windows collector guard service child watchdog" "Resilience doc records guard child watchdog"
+  require_pattern "docs/DLP_RESOURCE_PROFILES_RU.md" "core_only" "DLP resource profiles document core_only"
+  require_pattern "docs/DLP_RESOURCE_PROFILES_RU.md" "auto.?disable|автоотключ" "DLP resource profiles document auto-disable guard"
+  require_pattern "docs/DLP_RESOURCE_PROFILES_RU.md" "rollback" "DLP resource profiles document rollback"
+  require_pattern "docs/DETMIR_CURRENT_STATE_RU.md" "AW_DLP_PROFILE=light" "Current state records DLP light profile"
+  require_pattern "scripts/detmir_dlp_runtime_control.sh" "set-profile" "DLP runtime control supports profile switching"
+  require_pattern "scripts/detmir_dlp_runtime_control.sh" "rollback_dlp" "DLP runtime control supports rollback"
+  require_pattern "scripts/detmir_dlp_load_guard.sh" "set-profile core_only" "DLP load guard can auto-disable DLP to core_only"
+  require_pattern "scripts/detmir_dlp_load_guard.sh" "STRIKES_REQUIRED" "DLP load guard requires consecutive overload checks"
+  require_pattern "scripts/detmir_dlp_warehouse_sync.sh" "sqlite3 .*\\.backup" "DLP warehouse sync uses SQLite backup"
+  require_pattern "ansible/group_vars/all.yml" 'aw_dlp_profile: "light"' "Production defaults keep DLP profile light"
+  require_pattern "ansible/group_vars/all.yml" 'aw_dlp_enabled: true' "Production defaults enable lightweight DLP"
+  require_pattern "ansible/group_vars/all.yml" 'aw_dlp_influx_enabled: false' "Production defaults keep DLP Influx disabled"
+  require_pattern "ansible/group_vars/all.yml" 'aw_dlp_light_collector_enabled: true' "Production defaults enable lightweight DLP collector"
+  require_pattern "ansible/group_vars/all.yml" 'aw_dlp_light_guard_enabled: true' "Production defaults enable DLP load guard"
+  require_pattern "ansible/group_vars/all.yml" 'detmir_portal_dlp_module_enabled_override: true' "Production defaults expose DLP light status to portal"
+  require_pattern "ansible/deploy_aw_server.yml" "detmir-dlp-load-guard.service" "AW server deploy installs DLP load guard service"
+  require_pattern "ansible/deploy_aw_server.yml" "CPUQuota=.*aw_dlp_aggregator_cpu_quota" "DLP aggregator has systemd CPU quota"
+  require_pattern "ansible/deploy_detmir_portal.yml" "detmir-dlp-warehouse-sync.service" "Portal deploy installs DLP warehouse sync service"
+  require_pattern "ansible/deploy_detmir_portal.yml" "detmir_portal_dlp_module_enabled_override \\| default\\(false\\)" "Portal deploy defaults DLP module to disabled"
+
+  if [[ -f "$ROOT_DIR/ansible/inventory.ini" ]] && grep -Eq '(^|[[:space:]])ansible_(become_)?password[[:space:]]*=[[:space:]]*[^<{]' "$ROOT_DIR/ansible/inventory.ini"; then
+    if [[ "$STRICT_SECRETS" == "1" ]]; then
+      fail "ansible/inventory.ini appears to contain literal password assignments; move them to vault/env"
+    else
+      warn "ansible/inventory.ini appears to contain literal password assignments; strict mode would fail"
+    fi
+  else
+    ok "no literal ansible password assignments detected in ansible/inventory.ini"
+  fi
+}
+
+check_systemd_unit() {
+  local unit="$1"
+  if ! have systemctl; then
+    warn "systemctl unavailable; skipping $unit"
+    return
+  fi
+  if systemctl is-active --quiet "$unit"; then
+    ok "systemd active: $unit"
+  else
+    fail "systemd not active: $unit"
+  fi
+}
+
+check_aw_api() {
+  if ! have curl; then
+    warn "curl unavailable; skipping AW API check"
+    return
+  fi
+  local deadline last_code elapsed
+  deadline=$((SECONDS + AW_READINESS_TIMEOUT_SECONDS))
+  last_code=""
+  while (( SECONDS <= deadline )); do
+    elapsed="$(
+      curl -sS --connect-timeout 3 --max-time 8 -o /dev/null -w '%{http_code} %{time_total}' \
+        "$AW_API/api/0/info" 2>/dev/null || true
+    )"
+    last_code="${elapsed%% *}"
+    if [[ "$last_code" == "200" ]]; then
+      ok "ActivityWatch API readiness /api/0/info returns 200 (${elapsed#* }s)"
+      return
+    fi
+    sleep "$AW_READINESS_INTERVAL_SECONDS"
+  done
+  case "$last_code" in
+    503) fail "ActivityWatch API readiness ended on 503; possible datastore lock poisoning" ;;
+    ""|000) fail "ActivityWatch API did not become ready within ${AW_READINESS_TIMEOUT_SECONDS}s" ;;
+    *) fail "ActivityWatch API readiness unexpected final HTTP status: $last_code" ;;
+  esac
+}
+
+check_aw_hot_path() {
+  if ! have curl; then
+    warn "curl unavailable; skipping AW hot-path event check"
+    return
+  fi
+  local url result code elapsed
+  url="${AW_API%/}/api/0/buckets/aw-worktime-sessions_${AW_LOGICAL_HOST_ID}/events?limit=${AW_EVENTS_LIMIT}"
+  result="$(curl -sS --connect-timeout 3 --max-time "$AW_EVENTS_MAX_SECONDS" -o /dev/null -w '%{http_code} %{time_total}' "$url" 2>/dev/null || true)"
+  code="${result%% *}"
+  elapsed="${result#* }"
+  if [[ "$code" != "200" ]]; then
+    fail "ActivityWatch worktime events hot path returned HTTP ${code:-none}"
+    return
+  fi
+  if awk -v t="$elapsed" -v max="$AW_EVENTS_MAX_SECONDS" 'BEGIN { exit !(t <= max) }'; then
+    ok "ActivityWatch worktime events hot path returns 200 (${elapsed}s, limit=${AW_EVENTS_LIMIT})"
+  else
+    fail "ActivityWatch worktime events hot path exceeded ${AW_EVENTS_MAX_SECONDS}s (${elapsed}s)"
+  fi
+}
+
+check_worktime_api() {
+  if ! have curl; then
+    warn "curl unavailable; skipping Worktime API check"
+    return
+  fi
+  local tmp code
+  tmp="$(mktemp)"
+  code="$(curl -sS --connect-timeout 3 --max-time 12 -o "$tmp" -w '%{http_code}' \
+    "${AW_WORKTIME_API%/}/reports/worktime/today?format=json&host=${AW_LOGICAL_HOST_ID}&allow_stale=1" 2>/dev/null || true)"
+  if [[ "$code" != "200" ]]; then
+    fail "Worktime API today report returned HTTP ${code:-none}"
+    rm -f "$tmp"
+    return
+  fi
+  if have jq; then
+    if jq -e '(.degraded // false) == false' "$tmp" >/dev/null 2>&1; then
+      ok "Worktime API today report is not degraded"
+    else
+      fail "Worktime API today report is degraded"
+    fi
+    if jq -e '((.rows // .users // []) | length) > 0' "$tmp" >/dev/null 2>&1; then
+      ok "Worktime API today report has employee rows"
+    else
+      fail "Worktime API today report has no employee rows"
+    fi
+  else
+    ok "Worktime API today report returns 200"
+  fi
+  rm -f "$tmp"
+}
+
+check_failed_units() {
+  if ! have systemctl; then
+    return
+  fi
+  local failed
+  failed="$(systemctl --failed --no-legend --plain 2>/dev/null | wc -l | tr -d ' ')"
+  if [[ "$failed" == "0" ]]; then
+    ok "systemd failed units count is 0"
+  else
+    fail "systemd failed units count is $failed"
+  fi
+}
+
+count_files() {
+  local dir="$1"
+  local pattern="$2"
+  if [[ ! -d "$dir" ]]; then
+    printf '0\n'
+    return
+  fi
+  find "$dir" -maxdepth 1 -type f -name "$pattern" | wc -l | tr -d ' '
+}
+
+check_hayabusa_queues() {
+  local incoming_dir="$HAYA_ROOT/inbox/incoming"
+  local quarantine_dir="$HAYA_ROOT/quarantine"
+  local incoming_count drop_count old_count quarantine_count
+  incoming_count="$(count_files "$incoming_dir" '*.zip')"
+  drop_count="$(count_files "$HAYA_DROP_DIR" '*.zip')"
+  old_count="0"
+  if [[ -d "$incoming_dir" ]]; then
+    old_count="$(find "$incoming_dir" -maxdepth 1 -type f -name '*.zip' -mmin "+$((MAX_INCOMING_AGE_SECONDS / 60))" | wc -l | tr -d ' ')"
+  fi
+  if [[ "$incoming_count" == "0" ]]; then
+    ok "Hayabusa incoming zip count is 0"
+  else
+    warn "Hayabusa incoming zip count is $incoming_count"
+  fi
+  if [[ "$drop_count" == "0" ]]; then
+    ok "Hayabusa drop zip count is 0"
+  else
+    warn "Hayabusa drop zip count is $drop_count"
+  fi
+  if [[ "$old_count" == "0" ]]; then
+    ok "Hayabusa incoming has no stale zip older than ${MAX_INCOMING_AGE_SECONDS}s"
+  else
+    fail "Hayabusa incoming has $old_count stale zip package(s)"
+  fi
+  if [[ -d "$quarantine_dir" ]]; then
+    quarantine_count="$(find "$quarantine_dir" -type f -name reason.json | wc -l | tr -d ' ')"
+    if [[ "$quarantine_count" == "0" ]]; then
+      ok "Hayabusa quarantine reason count is 0"
+    else
+      warn "Hayabusa quarantine reason count is $quarantine_count; review/replay policy required"
+    fi
+  else
+    warn "Hayabusa quarantine root not found yet: $quarantine_dir"
+  fi
+}
+
+check_sqlite_files() {
+  if [[ ! -f "$SQLITE_DB" ]]; then
+    warn "AW SQLite DB not found at $SQLITE_DB; skipping local DB size check"
+    return
+  fi
+  local db_size wal_size
+  db_size="$(stat -c '%s' "$SQLITE_DB")"
+  wal_size="0"
+  [[ -f "$SQLITE_DB-wal" ]] && wal_size="$(stat -c '%s' "$SQLITE_DB-wal")"
+  if (( db_size > 5 * 1024 * 1024 * 1024 )); then
+    fail "AW SQLite DB exceeds 5GiB"
+  elif (( db_size > 2 * 1024 * 1024 * 1024 )); then
+    warn "AW SQLite DB exceeds 2GiB"
+  else
+    ok "AW SQLite DB size below 2GiB"
+  fi
+  if (( wal_size > 1024 * 1024 * 1024 )); then
+    fail "AW SQLite WAL exceeds 1GiB"
+  elif (( wal_size > 256 * 1024 * 1024 )); then
+    warn "AW SQLite WAL exceeds 256MiB"
+  else
+    ok "AW SQLite WAL size below 256MiB"
+  fi
+}
+
+check_sqlite_hot_path_index() {
+  if [[ ! -f "$SQLITE_DB" ]]; then
+    warn "AW SQLite DB not found at $SQLITE_DB; skipping hot-path index check"
+    return
+  fi
+  if ! have sqlite3; then
+    warn "sqlite3 unavailable; skipping hot-path index check"
+    return
+  fi
+  local index_exists plan
+  index_exists="$(sqlite3 "$SQLITE_DB" "SELECT name FROM sqlite_master WHERE type='index' AND name='events_bucketrow_starttime_desc_index';" 2>/dev/null || true)"
+  if [[ "$index_exists" == "events_bucketrow_starttime_desc_index" ]]; then
+    ok "AW SQLite hot-path index exists"
+  else
+    fail "AW SQLite hot-path index events_bucketrow_starttime_desc_index is missing"
+    return
+  fi
+  plan="$(
+    sqlite3 "$SQLITE_DB" "EXPLAIN QUERY PLAN SELECT id,starttime,endtime,data FROM events WHERE bucketrow=(SELECT id FROM buckets WHERE name='aw-worktime-sessions_${AW_LOGICAL_HOST_ID}') ORDER BY starttime DESC LIMIT ${AW_EVENTS_LIMIT};" 2>/dev/null || true
+  )"
+  if printf '%s' "$plan" | grep -q 'events_bucketrow_starttime_desc_index'; then
+    ok "AW SQLite worktime event query uses hot-path index"
+  else
+    fail "AW SQLite worktime event query does not use hot-path index"
+  fi
+  if printf '%s' "$plan" | grep -q 'TEMP B-TREE'; then
+    fail "AW SQLite worktime event query still builds TEMP B-TREE"
+  else
+    ok "AW SQLite worktime event query avoids TEMP B-TREE"
+  fi
+}
+
+check_units_inactive() {
+  local label="$1"
+  shift
+  if ! have systemctl; then
+    warn "systemctl unavailable; skipping $label runtime check"
+    return
+  fi
+  local active_units=()
+  local unit active
+  for unit in "$@"; do
+    active="$(systemctl is-active "$unit" 2>/dev/null || true)"
+    if [[ "$active" == "active" || "$active" == "activating" ]]; then
+      active_units+=("$unit:$active")
+    fi
+  done
+  if [[ "${#active_units[@]}" -eq 0 ]]; then
+    ok "$label runtime units are inactive"
+  else
+    fail "$label runtime units active: ${active_units[*]}"
+  fi
+}
+
+check_live() {
+  printf '== live resilience checks ==\n'
+  check_systemd_unit "activitywatch-server"
+  check_systemd_unit "aw-worktime-api"
+  check_aw_api
+  check_aw_hot_path
+  check_worktime_api
+  check_failed_units
+  check_hayabusa_queues
+  check_sqlite_files
+  check_sqlite_hot_path_index
+  if [[ "$EXPECT_OPTIONAL_DLP_OFF" == "1" || "$EXPECT_DLP_PROFILE" == "core_only" ]]; then
+    check_units_inactive "optional DLP" "${DLP_RUNTIME_UNITS[@]}"
+  elif [[ "$EXPECT_DLP_PROFILE" == "light" ]]; then
+    check_units_inactive "heavy DLP" "${DLP_HEAVY_RUNTIME_UNITS[@]}"
+  else
+    warn "optional DLP runtime inactive check skipped for profile=$EXPECT_DLP_PROFILE"
+  fi
+  if [[ "$EXPECT_LOKI_OFF" == "1" ]]; then
+    check_units_inactive "Loki" "${LOKI_RUNTIME_UNITS[@]}"
+  else
+    warn "Loki inactive check skipped by env"
+  fi
+}
+
+case "$MODE" in
+  repo) check_repo ;;
+  live) check_live ;;
+  all) check_repo; check_live ;;
+  *) fail "invalid mode: $MODE" ;;
+esac
+
+printf 'summary: ok=%s warn=%s fail=%s\n' "$OK_COUNT" "$WARN_COUNT" "$FAIL_COUNT"
+if (( FAIL_COUNT > 0 )); then
+  exit 1
+fi

scripts/diag_and_manual_restart.sh

@@ -53,6 +53,26 @@ done
 log() { printf "%s %s\n" "$(date +"%F %T")" "$*" >&2; }
 die() { log "ERROR: $*"; exit 1; }
 
+is_truthy() {
+  case "${1:-}" in
+    1|true|TRUE|yes|YES|on|ON) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+require_real_value() {
+  local name="$1"
+  local value="${!name:-}"
+  if [[ -z "$value" ]]; then
+    die "missing required variable: $name"
+  fi
+  case "$value" in
+    *192.0.2.*|*198.51.100.*|*203.0.113.*|*HOST-EXAMPLE*|*.example*)
+      die "refusing placeholder value for $name: $value"
+      ;;
+  esac
+}
+
 command -v ansible >/dev/null 2>&1 || die "ansible not found"
 command -v ansible-playbook >/dev/null 2>&1 || die "ansible-playbook not found"
 [[ -f "$INVENTORY" ]] || die "inventory not found: $INVENTORY"
@@ -68,10 +88,14 @@ restart_server_components() {
     "activitywatch-server"
     "aw-worktime-api"
     "aw-worktime-ui-bridge.timer"
-    "aw-dlp-policy-engine.service"
-    "aw-dlp-aggregator.timer"
-    "activitywatch-dlp-aggregator.timer"
   )
+  if is_truthy "${DETMIR_DLP_ENABLED:-${AW_DLP_ENABLED:-false}}"; then
+    units+=(
+      "aw-dlp-policy-engine.service"
+      "aw-dlp-aggregator.timer"
+      "activitywatch-dlp-aggregator.timer"
+    )
+  fi
   for unit in "${units[@]}"; do
     if ansible -i "$INVENTORY" aw_server -b -m ansible.builtin.command -a "systemctl status ${unit}" >/dev/null 2>&1; then
       ansible -i "$INVENTORY" aw_server -b -m ansible.builtin.systemd -a "name=${unit} state=restarted enabled=true" || true
@@ -80,24 +104,32 @@ restart_server_components() {
 }
 
 seed_server_dlp_events() {
+  if ! is_truthy "${ALLOW_DLP_SEED_EVENTS:-0}"; then
+    log "Skipping DLP freshness seeding; set ALLOW_DLP_SEED_EVENTS=1 with real DETMIR_HOSTNAME/DETMIR_AW_SERVER_HOST to allow it."
+    return 0
+  fi
+  require_real_value DETMIR_HOSTNAME
+  require_real_value DETMIR_AW_SERVER_HOST
   log "Seeding DLP freshness events on aw_server..."
-  local ts
+  local ts host server_host
   ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  host="${DETMIR_HOSTNAME}"
+  server_host="${DETMIR_AW_SERVER_HOST}"
   ansible -i "$INVENTORY" aw_server -b -m ansible.builtin.shell -a "cat >/tmp/aw-endpoint-seed.json <<'JSON'
-{\"timestamp\":\"${ts}\",\"duration\":0.0,\"data\":{\"hostname\":\"HOST-EXAMPLE\",\"signalType\":\"self_test\",\"source\":\"diag_and_manual_restart\",\"username\":\"system\",\"queueDepth\":0,\"eventsEnqueued\":0,\"eventsFlushed\":0,\"sendFailures\":0}}
+{\"timestamp\":\"${ts}\",\"duration\":0.0,\"data\":{\"hostname\":\"${host}\",\"signalType\":\"self_test\",\"source\":\"diag_and_manual_restart\",\"username\":\"system\",\"queueDepth\":0,\"eventsEnqueued\":0,\"eventsFlushed\":0,\"sendFailures\":0}}
 JSON
 cat >/tmp/aw-fileops-seed-host.json <<'JSON'
-{\"timestamp\":\"${ts}\",\"duration\":0.0,\"data\":{\"hostname\":\"HOST-EXAMPLE\",\"operation\":\"self_test\",\"source\":\"diag_and_manual_restart\"}}
+{\"timestamp\":\"${ts}\",\"duration\":0.0,\"data\":{\"hostname\":\"${host}\",\"operation\":\"self_test\",\"source\":\"diag_and_manual_restart\"}}
 JSON
 cat >/tmp/aw-fileops-seed-server.json <<'JSON'
-{\"timestamp\":\"${ts}\",\"duration\":0.0,\"data\":{\"hostname\":\"192.0.2.13\",\"operation\":\"self_test\",\"source\":\"diag_and_manual_restart\"}}
+{\"timestamp\":\"${ts}\",\"duration\":0.0,\"data\":{\"hostname\":\"${server_host}\",\"operation\":\"self_test\",\"source\":\"diag_and_manual_restart\"}}
 JSON
-curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-dlp-endpoint-signals_HOST-EXAMPLE' -H 'Content-Type: application/json' -d '{\"client\":\"aw-dlp-endpoint-signals\",\"type\":\"aw.dlp.endpoint.signal\",\"hostname\":\"HOST-EXAMPLE\"}' >/dev/null 2>&1 || true
-curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_HOST-EXAMPLE' -H 'Content-Type: application/json' -d '{\"client\":\"aw-file-operations\",\"type\":\"aw.file.operation\",\"hostname\":\"HOST-EXAMPLE\"}' >/dev/null 2>&1 || true
-curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_192.0.2.13' -H 'Content-Type: application/json' -d '{\"client\":\"aw-file-operations\",\"type\":\"aw.file.operation\",\"hostname\":\"192.0.2.13\"}' >/dev/null 2>&1 || true
-curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-dlp-endpoint-signals_HOST-EXAMPLE/heartbeat?pulsetime=30' -H 'Content-Type: application/json' --data-binary @/tmp/aw-endpoint-seed.json >/dev/null
-curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_HOST-EXAMPLE/heartbeat?pulsetime=30' -H 'Content-Type: application/json' --data-binary @/tmp/aw-fileops-seed-host.json >/dev/null
-curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_192.0.2.13/heartbeat?pulsetime=30' -H 'Content-Type: application/json' --data-binary @/tmp/aw-fileops-seed-server.json >/dev/null
+curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-dlp-endpoint-signals_${host}' -H 'Content-Type: application/json' -d '{\"client\":\"aw-dlp-endpoint-signals\",\"type\":\"aw.dlp.endpoint.signal\",\"hostname\":\"${host}\"}' >/dev/null 2>&1 || true
+curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_${host}' -H 'Content-Type: application/json' -d '{\"client\":\"aw-file-operations\",\"type\":\"aw.file.operation\",\"hostname\":\"${host}\"}' >/dev/null 2>&1 || true
+curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_${server_host}' -H 'Content-Type: application/json' -d '{\"client\":\"aw-file-operations\",\"type\":\"aw.file.operation\",\"hostname\":\"${server_host}\"}' >/dev/null 2>&1 || true
+curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-dlp-endpoint-signals_${host}/heartbeat?pulsetime=30' -H 'Content-Type: application/json' --data-binary @/tmp/aw-endpoint-seed.json >/dev/null
+curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_${host}/heartbeat?pulsetime=30' -H 'Content-Type: application/json' --data-binary @/tmp/aw-fileops-seed-host.json >/dev/null
+curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_${server_host}/heartbeat?pulsetime=30' -H 'Content-Type: application/json' --data-binary @/tmp/aw-fileops-seed-server.json >/dev/null
 " >/dev/null
 }
 
@@ -107,8 +139,14 @@ restart_windows_collectors() {
 }
 
 seed_windows_dlp_events() {
+  if ! is_truthy "${ALLOW_DLP_SEED_EVENTS:-0}"; then
+    log "Skipping Windows DLP freshness seeding; set ALLOW_DLP_SEED_EVENTS=1 with real DETMIR_HOSTNAME/DETMIR_AW_API to allow it."
+    return 0
+  fi
+  require_real_value DETMIR_HOSTNAME
+  require_real_value DETMIR_AW_API
   log "Seeding endpoint/file-ops events from aw_windows..."
-  ansible -i "$INVENTORY" aw_windows -m ansible.windows.win_shell -a "powershell -NoProfile -ExecutionPolicy Bypass -Command \"\$ErrorActionPreference = 'Stop'; \$ts = (Get-Date).ToUniversalTime().ToString('o'); \$api='http://192.0.2.13:5600/api/0'; \$endpoint=@{timestamp=\$ts;duration=0.0;data=@{hostname='HOST-EXAMPLE';signalType='self_test';source='diag_and_manual_restart';username=\$env:USERNAME;queueDepth=0;eventsEnqueued=0;eventsFlushed=0;sendFailures=0}} | ConvertTo-Json -Depth 8 -Compress; \$fileops=@{timestamp=\$ts;duration=0.0;data=@{hostname='HOST-EXAMPLE';operation='self_test';source='diag_and_manual_restart';username=\$env:USERNAME}} | ConvertTo-Json -Depth 8 -Compress; Invoke-RestMethod -Method Post -Uri \$api'/buckets/aw-dlp-endpoint-signals_HOST-EXAMPLE' -ContentType 'application/json' -Body '{\\\"client\\\":\\\"aw-dlp-endpoint-signals\\\",\\\"type\\\":\\\"aw.dlp.endpoint.signal\\\",\\\"hostname\\\":\\\"HOST-EXAMPLE\\\"}' -TimeoutSec 15 -DisableKeepAlive -ErrorAction SilentlyContinue | Out-Null; Invoke-RestMethod -Method Post -Uri \$api'/buckets/aw-file-operations_HOST-EXAMPLE' -ContentType 'application/json' -Body '{\\\"client\\\":\\\"aw-file-operations\\\",\\\"type\\\":\\\"aw.file.operation\\\",\\\"hostname\\\":\\\"HOST-EXAMPLE\\\"}' -TimeoutSec 15 -DisableKeepAlive -ErrorAction SilentlyContinue | Out-Null; Invoke-RestMethod -Method Post -Uri \$api'/buckets/aw-dlp-endpoint-signals_HOST-EXAMPLE/heartbeat?pulsetime=30' -ContentType 'application/json' -Body \$endpoint -TimeoutSec 15 -DisableKeepAlive | Out-Null; Invoke-RestMethod -Method Post -Uri \$api'/buckets/aw-file-operations_HOST-EXAMPLE/heartbeat?pulsetime=30' -ContentType 'application/json' -Body \$fileops -TimeoutSec 15 -DisableKeepAlive | Out-Null; Write-Output 'windows-dlp-seeded'\""
+  ansible -i "$INVENTORY" aw_windows -m ansible.windows.win_shell -a "powershell -NoProfile -ExecutionPolicy Bypass -Command \"\$ErrorActionPreference = 'Stop'; \$ts = (Get-Date).ToUniversalTime().ToString('o'); \$api='${DETMIR_AW_API}'; \$hostName='${DETMIR_HOSTNAME}'; \$endpointBucket=\$api + '/buckets/aw-dlp-endpoint-signals_' + \$hostName; \$fileopsBucket=\$api + '/buckets/aw-file-operations_' + \$hostName; \$endpoint=@{timestamp=\$ts;duration=0.0;data=@{hostname=\$hostName;signalType='self_test';source='diag_and_manual_restart';username=\$env:USERNAME;queueDepth=0;eventsEnqueued=0;eventsFlushed=0;sendFailures=0}} | ConvertTo-Json -Depth 8 -Compress; \$fileops=@{timestamp=\$ts;duration=0.0;data=@{hostname=\$hostName;operation='self_test';source='diag_and_manual_restart';username=\$env:USERNAME}} | ConvertTo-Json -Depth 8 -Compress; Invoke-RestMethod -Method Post -Uri \$endpointBucket -ContentType 'application/json' -Body (@{client='aw-dlp-endpoint-signals';type='aw.dlp.endpoint.signal';hostname=\$hostName} | ConvertTo-Json -Compress) -TimeoutSec 15 -DisableKeepAlive -ErrorAction SilentlyContinue | Out-Null; Invoke-RestMethod -Method Post -Uri \$fileopsBucket -ContentType 'application/json' -Body (@{client='aw-file-operations';type='aw.file.operation';hostname=\$hostName} | ConvertTo-Json -Compress) -TimeoutSec 15 -DisableKeepAlive -ErrorAction SilentlyContinue | Out-Null; Invoke-RestMethod -Method Post -Uri (\$endpointBucket + '/heartbeat?pulsetime=30') -ContentType 'application/json' -Body \$endpoint -TimeoutSec 15 -DisableKeepAlive | Out-Null; Invoke-RestMethod -Method Post -Uri (\$fileopsBucket + '/heartbeat?pulsetime=30') -ContentType 'application/json' -Body \$fileops -TimeoutSec 15 -DisableKeepAlive | Out-Null; Write-Output 'windows-dlp-seeded'\""
 }
 
 confirm_restart() {

scripts/quality-gate.sh

@@ -17,25 +17,18 @@ else
   echo "node not found, skipping portal contract sync guard."
 fi
 
-echo "[preflight] Orchestration map guard"
-bash scripts/check_orchestration_map.sh
-
 rust_candidates=()
 if [[ -n "$RUST_BIN" ]]; then
   rust_candidates+=("$RUST_BIN")
 fi
-if [[ "${QUALITY_GATE_USE_RUST:-0}" == "1" ]]; then
-  if [[ -n "${AW_RUS_CARGO_TARGET_DIR:-}" ]]; then
-    rust_candidates+=("$AW_RUS_CARGO_TARGET_DIR/release/quality-gate")
-  fi
-  rust_candidates+=(
-    "$TARGET_ROOT/release/quality-gate"
-    "$ROOT_DIR/adk-rust/target/release/quality-gate"
-  )
-fi
-if [[ "${QUALITY_GATE_ALLOW_SYSTEM:-0}" == "1" ]]; then
-  rust_candidates+=("/usr/local/bin/quality-gate")
+if [[ -n "${AW_RUS_CARGO_TARGET_DIR:-}" ]]; then
+  rust_candidates+=("$AW_RUS_CARGO_TARGET_DIR/release/quality-gate")
 fi
+rust_candidates+=(
+  "$TARGET_ROOT/release/quality-gate"
+  "$ROOT_DIR/adk-rust/target/release/quality-gate"
+  "/usr/local/bin/quality-gate"
+)
 
 for candidate in "${rust_candidates[@]}"; do
   if [[ -x "$candidate" ]]; then
@@ -103,7 +96,7 @@ fi
 violations=()
 for path in "${tracked_py[@]}"; do
   case "$path" in
-    aw-server/dlp-content-analysis/*|clickhouse-1c/ai/*|clickhouse-1c/etl/*|detmir-mcp/main.py|grafana-1c/*|pfsense/*|proxmox/tsj_guardian_bot.py|proxmox/test_tsj_guardian_bot.py|scripts/package_rust_release_binaries.py|scripts/public_secret_pattern_check.py)
+    aw-server/dlp-content-analysis/*|clickhouse-1c/ai/*|clickhouse-1c/etl/*|detmir-mcp/main.py|grafana-1c/*|pfsense/*|proxmox/tsj_guardian_bot.py|proxmox/test_tsj_guardian_bot.py|scripts/package_rust_release_binaries.py)
       continue
       ;;
   esac

scripts/rdp-worktime-report.sh

@@ -4,14 +4,29 @@ set -euo pipefail
 DAY=""
 FROM=""
 TO=""
-AW_BASE_URL="${AW_BASE_URL:-http://192.0.2.13:5600/api/0}"
-AW_WORKTIME_HOST="${AW_WORKTIME_HOST:-HOST-EXAMPLE}"
+AW_BASE_URL="${AW_BASE_URL:-}"
+AW_WORKTIME_HOST="${AW_WORKTIME_HOST:-}"
 AW_WORKTIME_DEFAULT_SAMPLE_SECONDS="${AW_WORKTIME_DEFAULT_SAMPLE_SECONDS:-30}"
 AW_WORKTIME_MAX_SAMPLE_SECONDS="${AW_WORKTIME_MAX_SAMPLE_SECONDS:-300}"
 OUT_DIR="${OUT_DIR:-reports}"
 TARGET_ROOT="${CARGO_TARGET_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/adk-rust/target}"
 RUST_BIN="${RDP_WORKTIME_REPORT_RUST:-}"
 
+require_live_value() {
+  local name="$1"
+  local value="${!name:-}"
+  if [[ -z "$value" ]]; then
+    echo "Missing required variable: $name" >&2
+    exit 2
+  fi
+  case "$value" in
+    *192.0.2.*|*198.51.100.*|*203.0.113.*|*HOST-EXAMPLE*|*.example*)
+      echo "Refusing placeholder value for $name: $value" >&2
+      exit 2
+      ;;
+  esac
+}
+
 usage() {
   cat <<EOF
 Usage:
@@ -52,6 +67,9 @@ if [[ -z "$FROM" || -z "$TO" ]]; then
   exit 2
 fi
 
+require_live_value AW_BASE_URL
+require_live_value AW_WORKTIME_HOST
+
 mkdir -p "$OUT_DIR"
 CSV_OUT="${OUT_DIR}/rdp-worktime-${FROM}_${TO}.csv"
 JSON_OUT="${OUT_DIR}/rdp-worktime-${FROM}_${TO}.json"
@@ -80,7 +98,9 @@ import urllib.request
 from datetime import datetime, timedelta, timezone
 
 base, host, default_sample, max_sample, from_d, to_d, csv_out, json_out = sys.argv[1:9]
-base = (base or "http://192.0.2.13:5600").rstrip("/")
+if not base:
+    raise SystemExit("AW_BASE_URL is required")
+base = base.rstrip("/")
 if not base.endswith("/api/0"):
     base = base + "/api/0"
 default_sample = max(1.0, float(default_sample))

scripts/run_awatch_contour_check.sh

@@ -43,11 +43,27 @@ configure_detmir_env() {
     fi
   fi
 
-  export DETMIR_AW_API="${DETMIR_AW_API:-http://192.0.2.13:5600/api/0}"
-  export DETMIR_WORKTIME_URL="${DETMIR_WORKTIME_URL:-http://192.0.2.13:5610}"
-  export DETMIR_ONE_C_URL="${DETMIR_ONE_C_URL:-http://192.0.2.2:8710}"
-  export DETMIR_RDP_HOST="${DETMIR_RDP_HOST:-198.51.100.18}"
-  export DETMIR_HOSTNAME="${DETMIR_HOSTNAME:-HOST-EXAMPLE}"
+  export DETMIR_DLP_ENABLED="${DETMIR_DLP_ENABLED:-${AW_DLP_ENABLED:-false}}"
+  require_live_value DETMIR_AW_API
+  require_live_value DETMIR_WORKTIME_URL
+  require_live_value DETMIR_ONE_C_URL
+  require_live_value DETMIR_RDP_HOST
+  require_live_value DETMIR_HOSTNAME
+}
+
+require_live_value() {
+  local name="$1"
+  local value="${!name:-}"
+  if [[ -z "${value}" ]]; then
+    printf 'Missing required live contour variable: %s. Set it in %s or the environment.\n' "${name}" "${ENV_FILE}" >&2
+    exit 2
+  fi
+  case "${value}" in
+    *192.0.2.*|*198.51.100.*|*203.0.113.*|*HOST-EXAMPLE*|*.example*)
+      printf 'Refusing placeholder value for %s: %s\n' "${name}" "${value}" >&2
+      exit 2
+      ;;
+  esac
 }
 
 write_summary() {
@@ -64,6 +80,7 @@ write_summary() {
     printf 'DETMIR_HOSTNAME=%s\n' "${DETMIR_HOSTNAME}"
     printf 'DETMIR_GATEWAY_HOST=%s\n' "${DETMIR_GATEWAY_HOST}"
     printf 'DETMIR_PORTAL_URL=%s\n' "${DETMIR_PORTAL_URL}"
+    printf 'DETMIR_DLP_ENABLED=%s\n' "${DETMIR_DLP_ENABLED}"
     printf 'DETMIR_DLP_COMMAND=%s\n' "${DETMIR_DLP_COMMAND}"
     printf 'DETMIR_DISABLE_PORTAL_CHECK=%s\n' "${DETMIR_DISABLE_PORTAL_CHECK:-0}"
     printf 'DETMIR_DISABLE_DLP_HEALTH_CHECK=%s\n' "${DETMIR_DISABLE_DLP_HEALTH_CHECK:-0}"
@@ -181,5 +198,12 @@ if [[ "${RUN_REGISTRY_CHECK:-0}" == "1" ]] && [[ -x "${REPO_ROOT}/scripts/regist
   fi
 fi
 
+if [[ "${RUN_RESILIENCE_CHECK:-0}" == "1" ]] && [[ -f "${REPO_ROOT}/scripts/detmir_resilience_check.sh" ]]; then
+  resilience_mode="${RESILIENCE_CHECK_MODE:-repo}"
+  if ! run_and_log "detmir-resilience-check" bash "${REPO_ROOT}/scripts/detmir_resilience_check.sh" "--${resilience_mode}"; then
+    status=1
+  fi
+fi
+
 printf 'final_status: %s\n' "$([[ "${status}" -eq 0 ]] && printf ok || printf fail)" | tee -a "${OUTPUT_DIR}/SUMMARY.md"
 exit "${status}"