Add shadow security finding inbox

- default DetMir DLP runtime to core_only/disabled with load-guard protection

- add fail-closed placeholder validation and runtime-scoped artifact checks

- document operator re-enable flow for light profile and guard rollback

- update prod docs, env examples, and Ansible DLP defaults

adk-rust/Cargo.lock

@@ -122,9 +122,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
 [[package]]
 name = "arbitrary"
@@ -561,6 +561,18 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
+[[package]]
+name = "containment-engine"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "chrono",
+ "clap",
+ "serde",
+ "serde_json",
+ "sha2",
+]
+
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -739,6 +751,7 @@ dependencies = [
  "sha2",
  "tempfile",
  "tiny_http",
+ "url",
 ]
 
 [[package]]
@@ -1255,8 +1268,10 @@ dependencies = [
  "reqwest",
  "serde",
  "serde_json",
+ "sha2",
  "tempfile",
  "urlencoding",
+ "zip 2.4.2",
 ]
 
 [[package]]
@@ -2120,6 +2135,21 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "security-finding-inbox"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "chrono",
+ "clap",
+ "hayabusa-tools",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "sha2",
+ "tempfile",
+]
+
 [[package]]
 name = "semver"
 version = "1.0.28"

adk-rust/Cargo.toml

@@ -36,6 +36,7 @@ members = [
     "crates/aw-rus-healthd",
     "crates/detmir-check",
     "crates/detmir-core",
+    "crates/security-finding-inbox",
     "crates/dlp-health-check",
     "crates/dlp-content-analyzer",
     "crates/dlp-admin-cli",
@@ -57,6 +58,7 @@ members = [
     "crates/detmir-heal-safe",
     "crates/detmir-status",
     "crates/detmir-state",
+    "crates/containment-engine",
     "crates/tsj-guardian-status",
     "crates/tsj-guardian-watchdog",
 ]

adk-rust/crates/aw-1c-ingest/src/main.rs

@@ -176,6 +176,10 @@ fn run() -> Result<i32> {
             &root.join("detections/open_cases_from_detections.sql"),
             &mut summary,
         )?;
+        let security_inbox_schema = root.join("security/security_finding_inbox.sql");
+        if security_inbox_schema.exists() {
+            run_sql_file(&client, &security_inbox_schema, &mut summary)?;
+        }
         if !cli.skip_briefs {
             let _ = run_optional_script(&root.join("ops/run_manager_brief.sh"));
             let _ = run_optional_script(&root.join("ops/run_recovery_brief.sh"));

adk-rust/crates/aw-rus-healthd/src/main.rs

@@ -6,7 +6,7 @@ use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
 use std::time::{Duration, Instant};
 
-use anyhow::{Context, Result};
+use anyhow::{Context, Result, anyhow};
 use chrono::{DateTime, Duration as ChronoDuration, SecondsFormat, Utc};
 use clap::Parser;
 use detmir_core::{exit_codes, parse_utc_rfc3339};
@@ -25,10 +25,10 @@ struct Cli {
     #[arg(long, default_value = "http://127.0.0.1:5610")]
     worktime_api: String,
 
-    #[arg(long, default_value = "198.51.100.18")]
+    #[arg(long, default_value = "")]
     rdp_host: String,
 
-    #[arg(long, default_value = "HOST-EXAMPLE")]
+    #[arg(long, default_value = "")]
     rdp_hostname: String,
 
     #[arg(long, default_value = "/var/lib/activitywatch/health")]
@@ -61,6 +61,9 @@ struct Cli {
     #[arg(long, default_value_t = 3.0)]
     tcp_timeout_seconds: f64,
 
+    #[arg(long, default_value_t = true)]
+    rdp_tcp_required: bool,
+
     #[arg(long)]
     json: bool,
 }
@@ -129,6 +132,10 @@ impl Cli {
                 self.tcp_timeout_seconds,
             );
         }
+        if !cli_arg_present("--rdp-tcp-required") {
+            self.rdp_tcp_required =
+                env_bool_default("AW_RUS_HEALTH_RDP_TCP_REQUIRED", self.rdp_tcp_required);
+        }
         self
     }
 }
@@ -221,9 +228,42 @@ fn env_f64(name: &str, fallback: f64) -> f64 {
 }
 
 fn env_bool(name: &str) -> bool {
+    env_bool_default(name, false)
+}
+
+fn env_bool_default(name: &str, fallback: bool) -> bool {
     env_string(name)
-        .map(|value| matches!(value.to_ascii_lowercase().as_str(), "1" | "true" | "yes"))
-        .unwrap_or(false)
+        .map(|value| match value.to_ascii_lowercase().as_str() {
+            "1" | "true" | "yes" | "on" => true,
+            "0" | "false" | "no" | "off" => false,
+            _ => fallback,
+        })
+        .unwrap_or(fallback)
+}
+
+fn validate_cli_config(cli: &Cli) -> Result<()> {
+    validate_prod_host("rdp_host", &cli.rdp_host)?;
+    validate_prod_host("rdp_hostname", &cli.rdp_hostname)?;
+    Ok(())
+}
+
+fn validate_prod_host(name: &str, value: &str) -> Result<()> {
+    let value = value.trim();
+    if value.is_empty() {
+        return Err(anyhow!("invalid config {name}: value is empty"));
+    }
+    let lowered = value.to_ascii_lowercase();
+    if lowered == "host-example"
+        || lowered.ends_with(".example")
+        || lowered.starts_with("192.0.2.")
+        || lowered.starts_with("198.51.100.")
+        || lowered.starts_with("203.0.113.")
+    {
+        return Err(anyhow!(
+            "invalid config {name}: placeholder/documentation host is not allowed"
+        ));
+    }
+    Ok(())
 }
 
 fn load_env_file(path: &Path) {
@@ -681,6 +721,16 @@ fn normalize_aw_api_base(aw_server: &str) -> String {
     }
 }
 
+fn tcp_check_status(ok: bool, required: bool) -> &'static str {
+    if ok {
+        "ok"
+    } else if required {
+        "fail"
+    } else {
+        "warn"
+    }
+}
+
 fn validation_check(report: &mut ReportBuilder, validation_dir: &Path, max_age_seconds: i64) {
     let Some(path) = latest_validation_report(validation_dir) else {
         report.add(
@@ -812,15 +862,18 @@ fn run(cli: &Cli) -> Result<HealthReport> {
 
     for (port, label) in [(5985_u16, "winrm"), (3389_u16, "rdp")] {
         let (ok, message) = tcp_connect(&cli.rdp_host, port, cli.tcp_timeout_seconds);
+        let status = tcp_check_status(ok, cli.rdp_tcp_required);
         report.add(
             format!("tcp:{label}"),
-            if ok { "ok" } else { "fail" },
+            status,
             if ok {
                 message
-            } else {
+            } else if cli.rdp_tcp_required {
                 format!("unreachable: {message}")
+            } else {
+                format!("optional unreachable: {message}")
             },
-            json!({"host": cli.rdp_host, "port": port}),
+            json!({"host": cli.rdp_host, "port": port, "required": cli.rdp_tcp_required}),
         );
     }
 
@@ -949,6 +1002,7 @@ fn run(cli: &Cli) -> Result<HealthReport> {
 
 fn main() -> Result<()> {
     let cli = Cli::parse().apply_env();
+    validate_cli_config(&cli)?;
     let report = run(&cli)?;
     let json_text = serde_json::to_string_pretty(&report)? + "\n";
     let text = render_text(&report) + "\n";
@@ -1029,4 +1083,20 @@ mod tests {
             "http://127.0.0.1:5600/api/0"
         );
     }
+
+    #[test]
+    fn optional_rdp_tcp_downgrades_unreachable_to_warn() {
+        assert_eq!(tcp_check_status(false, true), "fail");
+        assert_eq!(tcp_check_status(false, false), "warn");
+        assert_eq!(tcp_check_status(true, false), "ok");
+    }
+
+    #[test]
+    fn healthd_rejects_placeholder_hosts() {
+        assert!(validate_prod_host("rdp_host", "192.168.100.19").is_ok());
+        assert!(validate_prod_host("rdp_hostname", "SHARKON2025").is_ok());
+        assert!(validate_prod_host("rdp_host", "198.51.100.18").is_err());
+        assert!(validate_prod_host("rdp_hostname", "HOST-EXAMPLE").is_err());
+        assert!(validate_prod_host("rdp_host", "").is_err());
+    }
 }

adk-rust/crates/containment-engine/Cargo.toml

@@ -0,0 +1,15 @@
+[package]
+name = "containment-engine"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[dependencies]
+anyhow.workspace = true
+chrono.workspace = true
+clap.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+sha2.workspace = true

adk-rust/crates/detmir-portal/Cargo.toml

@@ -18,6 +18,7 @@ serde_json.workspace = true
 serde_yaml.workspace = true
 sha2.workspace = true
 tiny_http.workspace = true
+url.workspace = true
 
 [dev-dependencies]
 tempfile.workspace = true

adk-rust/crates/detmir-portal/src/production/limits.rs

@@ -11,6 +11,7 @@ use anyhow::{Result, anyhow};
 use chrono::NaiveDate;
 use serde_json::{Value, json};
 use tiny_http::StatusCode;
+use url::Url;
 
 use crate::{
     Cli, MAX_ALLOWED_PAGE_SIZE, MAX_ALLOWED_REPORT_DATE_RANGE_DAYS, MAX_ALLOWED_REQUEST_BODY_BYTES,
@@ -77,6 +78,11 @@ pub(crate) fn validate_portal_config(args: &Cli) -> Result<()> {
             "invalid config max_request_body_bytes: expected 1024..={MAX_ALLOWED_REQUEST_BODY_BYTES}"
         ));
     }
+    validate_runtime_url("worktime_url", &args.worktime_url)?;
+    validate_runtime_url("one_c_url", &args.one_c_url)?;
+    validate_probe_command("status_cmd", &args.status_cmd)?;
+    validate_probe_command("check_cmd", &args.check_cmd)?;
+    validate_probe_command("failed_units_cmd", &args.failed_units_cmd)?;
 
     // SECURITY: environment and module names can reach metrics/log labels.
     // Restrict them to short ASCII tokens to avoid label injection and runaway
@@ -112,6 +118,46 @@ pub(crate) fn validate_portal_config(args: &Cli) -> Result<()> {
     Ok(())
 }
 
+fn validate_runtime_url(name: &str, value: &str) -> Result<()> {
+    let url = Url::parse(value).map_err(|err| anyhow!("invalid config {name}: {err}"))?;
+    if !matches!(url.scheme(), "http" | "https") {
+        return Err(anyhow!("invalid config {name}: expected http or https URL"));
+    }
+    let Some(host) = url.host_str() else {
+        return Err(anyhow!("invalid config {name}: missing host"));
+    };
+    if is_placeholder_host(host) {
+        return Err(anyhow!(
+            "invalid config {name}: placeholder/documentation host is not allowed in production"
+        ));
+    }
+    Ok(())
+}
+
+fn is_placeholder_host(host: &str) -> bool {
+    let host = host.trim().to_ascii_lowercase();
+    host.is_empty()
+        || host == "host-example"
+        || host.ends_with(".example")
+        || host.starts_with("192.0.2.")
+        || host.starts_with("198.51.100.")
+        || host.starts_with("203.0.113.")
+}
+
+fn validate_probe_command(name: &str, command: &str) -> Result<()> {
+    let command = command.trim();
+    if command.is_empty() {
+        return Err(anyhow!("invalid config {name}: command is empty"));
+    }
+    let forbidden = ['\n', '\r', '\0', ';', '|', '&', '<', '>', '`'];
+    if command.contains("$(") || command.chars().any(|ch| forbidden.contains(&ch)) {
+        return Err(anyhow!(
+            "invalid config {name}: shell control operators are not allowed"
+        ));
+    }
+    Ok(())
+}
+
 fn is_safe_environment_name(value: &str) -> bool {
     let value = value.trim();
     !value.is_empty()
@@ -230,6 +276,7 @@ mod tests {
             slow_request_log_ms: DEFAULT_SLOW_REQUEST_LOG_MS,
             environment: "test".to_string(),
             enabled_modules: "executive,workforce,security,forensics,admin".to_string(),
+            dlp_module_enabled: true,
             state_dir: dir.join("state"),
             dlp_db_path: dir.join("dlp.sqlite"),
             evidence_root: dir.to_path_buf(),
@@ -293,6 +340,39 @@ mod tests {
         );
     }
 
+    #[test]
+    fn config_validation_rejects_placeholder_endpoints_and_shell_operators() {
+        let dir = tempfile::tempdir().unwrap();
+        let args = test_cli(dir.path());
+
+        let mut invalid = args.clone();
+        invalid.worktime_url = "http://192.0.2.13:5610".to_string();
+        assert!(
+            validate_portal_config(&invalid)
+                .unwrap_err()
+                .to_string()
+                .contains("placeholder")
+        );
+
+        let mut invalid = args.clone();
+        invalid.one_c_url = "http://198.51.100.2:8710".to_string();
+        assert!(
+            validate_portal_config(&invalid)
+                .unwrap_err()
+                .to_string()
+                .contains("placeholder")
+        );
+
+        let mut invalid = args.clone();
+        invalid.check_cmd = "detmir-check --json; curl http://127.0.0.1".to_string();
+        assert!(
+            validate_portal_config(&invalid)
+                .unwrap_err()
+                .to_string()
+                .contains("shell control")
+        );
+    }
+
     #[test]
     fn query_limits_reject_page_size_and_report_range() {
         let dir = tempfile::tempdir().unwrap();

adk-rust/crates/detmir-portal/src/production/metrics.rs

@@ -34,6 +34,10 @@ struct HttpMetricValue {
 #[derive(Clone, Debug, Default)]
 struct PortalMetrics {
     http: BTreeMap<HttpMetricKey, HttpMetricValue>,
+    report_requests_total: u64,
+    report_cache_hits_total: u64,
+    report_cache_misses_total: u64,
+    report_cache_stale_hits_total: u64,
     reports_generated_total: u64,
     ingestion_records_total: u64,
     ingestion_rejected_total: u64,
@@ -70,6 +74,32 @@ pub(crate) fn record_report_generated() {
     }
 }
 
+pub(crate) fn record_report_request() {
+    if let Ok(mut metrics) = portal_metrics().lock() {
+        metrics.report_requests_total = metrics.report_requests_total.saturating_add(1);
+    }
+}
+
+pub(crate) fn record_report_cache_hit() {
+    if let Ok(mut metrics) = portal_metrics().lock() {
+        metrics.report_cache_hits_total = metrics.report_cache_hits_total.saturating_add(1);
+    }
+}
+
+pub(crate) fn record_report_cache_stale_hit() {
+    if let Ok(mut metrics) = portal_metrics().lock() {
+        metrics.report_cache_hits_total = metrics.report_cache_hits_total.saturating_add(1);
+        metrics.report_cache_stale_hits_total =
+            metrics.report_cache_stale_hits_total.saturating_add(1);
+    }
+}
+
+pub(crate) fn record_report_cache_miss() {
+    if let Ok(mut metrics) = portal_metrics().lock() {
+        metrics.report_cache_misses_total = metrics.report_cache_misses_total.saturating_add(1);
+    }
+}
+
 pub(crate) fn record_ingestion_accepted() {
     if let Ok(mut metrics) = portal_metrics().lock() {
         metrics.ingestion_records_total = metrics.ingestion_records_total.saturating_add(1);
@@ -149,6 +179,26 @@ pub(crate) fn render_prometheus_metrics(args: &Cli) -> String {
         .ok();
     }
     for (name, help, value) in [
+        (
+            "awatch_report_requests_total",
+            "Report payload requests handled by the portal cache layer",
+            metrics.report_requests_total,
+        ),
+        (
+            "awatch_report_cache_hits_total",
+            "Report payload requests served from the in-process cache",
+            metrics.report_cache_hits_total,
+        ),
+        (
+            "awatch_report_cache_misses_total",
+            "Report payload requests that triggered report regeneration",
+            metrics.report_cache_misses_total,
+        ),
+        (
+            "awatch_report_cache_stale_hits_total",
+            "Report payload requests served from stale cache while refresh runs",
+            metrics.report_cache_stale_hits_total,
+        ),
         (
             "awatch_reports_generated_total",
             "Reports generated by the portal",

adk-rust/crates/detmir-portal/src/production/mod.rs

@@ -22,7 +22,8 @@ pub(crate) use limits::{is_limited_api_route, validate_api_query_limits, validat
 pub(crate) use logging::log_http_request;
 pub(crate) use metrics::{
     record_http_metric, record_ingestion_accepted, record_ingestion_rejected,
-    record_report_generated, render_prometheus_metrics,
+    record_report_cache_hit, record_report_cache_miss, record_report_cache_stale_hit,
+    record_report_generated, record_report_request, render_prometheus_metrics,
 };
 pub(crate) use readiness::build_readyz;
 pub(crate) use request_context::{http_request_metadata, mark_request_started};

adk-rust/crates/detmir-portal/src/snapshot_cache.rs

@@ -6,13 +6,20 @@
 
 use std::collections::BTreeMap;
 use std::sync::{Arc, Mutex};
+use std::thread;
 use std::time::{Duration, Instant};
 
 use crate::{Cli, HealthResponse, Snapshot, build_health, build_snapshot, now};
 
 const SNAPSHOT_CACHE_TTL: Duration = Duration::from_secs(120);
 
-pub(crate) type SnapshotCache = Arc<Mutex<Option<CachedSnapshot>>>;
+pub(crate) type SnapshotCache = Arc<Mutex<SnapshotCacheState>>;
+
+#[derive(Clone, Debug, Default)]
+pub(crate) struct SnapshotCacheState {
+    pub(crate) entry: Option<CachedSnapshot>,
+    pub(crate) refresh_in_progress: bool,
+}
 
 #[derive(Clone, Debug)]
 pub(crate) struct CachedSnapshot {
@@ -21,7 +28,7 @@ pub(crate) struct CachedSnapshot {
 }
 
 pub(crate) fn new_snapshot_cache() -> SnapshotCache {
-    Arc::new(Mutex::new(None))
+    Arc::new(Mutex::new(SnapshotCacheState::default()))
 }
 
 pub(crate) fn clone_snapshot_cache(cache: &SnapshotCache) -> SnapshotCache {
@@ -29,23 +36,76 @@ pub(crate) fn clone_snapshot_cache(cache: &SnapshotCache) -> SnapshotCache {
 }
 
 pub(crate) fn cached_snapshot(args: &Cli, cache: &SnapshotCache) -> Snapshot {
-    let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
-    if let Some(cached) = guard.as_ref() {
-        if cached.created.elapsed() <= SNAPSHOT_CACHE_TTL {
-            return cached.snapshot.clone();
+    {
+        let guard = cache.lock().expect("snapshot cache mutex poisoned");
+        if let Some(cached) = guard.entry.as_ref() {
+            if cached.created.elapsed() <= SNAPSHOT_CACHE_TTL {
+                return cached.snapshot.clone();
+            }
         }
     }
+
     let snapshot = build_snapshot(args);
-    *guard = Some(CachedSnapshot {
+    let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
+    guard.entry = Some(CachedSnapshot {
         created: Instant::now(),
         snapshot: snapshot.clone(),
     });
+    guard.refresh_in_progress = false;
     snapshot
 }
 
+pub(crate) fn cached_snapshot_or_refresh(args: &Cli, cache: &SnapshotCache) -> Option<Snapshot> {
+    let mut should_spawn = false;
+    let mut snapshot_to_return = None;
+    {
+        let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
+        if let Some(cached) = guard.entry.as_ref() {
+            let snapshot = cached.snapshot.clone();
+            if cached.created.elapsed() <= SNAPSHOT_CACHE_TTL {
+                return Some(snapshot);
+            }
+            if !guard.refresh_in_progress {
+                guard.refresh_in_progress = true;
+                should_spawn = true;
+            }
+            snapshot_to_return = Some(snapshot);
+        } else if !guard.refresh_in_progress {
+            guard.refresh_in_progress = true;
+            should_spawn = true;
+        }
+    }
+
+    if should_spawn {
+        spawn_snapshot_refresh(args.clone(), clone_snapshot_cache(cache));
+    }
+    snapshot_to_return
+}
+
+fn spawn_snapshot_refresh(args: Cli, cache: SnapshotCache) {
+    thread::spawn(move || {
+        let result =
+            std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| build_snapshot(&args)));
+        let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
+        match result {
+            Ok(snapshot) => {
+                guard.entry = Some(CachedSnapshot {
+                    created: Instant::now(),
+                    snapshot,
+                });
+            }
+            Err(_) => {
+                eprintln!("detmir-portal snapshot cache refresh panicked");
+            }
+        }
+        guard.refresh_in_progress = false;
+    });
+}
+
 pub(crate) fn build_fast_health(cache: &SnapshotCache) -> HealthResponse {
     match cache.try_lock() {
         Ok(guard) => guard
+            .entry
             .as_ref()
             .map(|cached| build_health(&cached.snapshot))
             .unwrap_or_else(lightweight_health),

adk-rust/crates/detmir-portal/src/workforce_kpi_explain.rs

@@ -549,6 +549,7 @@ mod tests {
         };
         Snapshot {
             generated_at_utc: "2026-06-07T10:00:00Z".to_string(),
+            dlp_module_enabled: true,
             detmir_status: SourceStatus {
                 ok: true,
                 status: "OK".to_string(),

adk-rust/crates/detmir-readiness/src/main.rs

@@ -18,7 +18,9 @@ const DEFAULT_AW_ENV_FILE: &str = "/etc/activitywatch/aw-server.env";
 const DEFAULT_GRAFANA_ENV_FILE: &str = "/etc/detmir-grafana-check.env";
 const DEFAULT_GRAFANA_URL: &str = "http://127.0.0.1:3000";
 const DEFAULT_GRAFANA_DATASOURCE_UID: &str = "influxdb_aw";
-const DEFAULT_SYSTEMD_SERVICES: &str = "activitywatch-server,aw-worktime-api,aw-worktime-influx-exporter.timer,aw-dlp-influx-exporter.timer";
+const DEFAULT_SYSTEMD_SERVICES: &str =
+    "activitywatch-server,aw-worktime-api,aw-worktime-influx-exporter.timer";
+const DEFAULT_DLP_SYSTEMD_SERVICES: &str = "aw-dlp-influx-exporter.timer";
 const DEFAULT_RETENTION_DAYS: i64 = 30;
 
 #[derive(Debug, Parser)]
@@ -218,14 +220,26 @@ fn run(cli: &Cli) -> Result<Report> {
     let mut checks = Vec::new();
     let worktime = influx_config(&aw_env, "AW_WORKTIME_INFLUX");
     let dlp = influx_config(&aw_env, "AW_DLP_INFLUX");
+    let dlp_enabled = env_bool(&aw_env, "AW_DLP_ENABLED", true);
 
     checks.push(check_influx_env(&worktime, cli.allow_disabled_influx));
-    checks.push(check_influx_env(&dlp, cli.allow_disabled_influx));
+    if dlp_enabled {
+        checks.push(check_influx_env(&dlp, cli.allow_disabled_influx));
+    } else {
+        checks.push(warn(
+            "env:AW_DLP_INFLUX",
+            "DLP Influx runtime disabled by AW_DLP_ENABLED=false",
+            json!({"enabled": false, "mode": "disabled"}),
+        ));
+    }
 
     if cli.skip_systemd {
         checks.push(warn("systemd", "systemd checks skipped", json!({})));
     } else {
-        checks.extend(check_systemd_services(&cli.systemd_services));
+        checks.extend(check_systemd_services(&systemd_services_for_mode(
+            &cli.systemd_services,
+            dlp_enabled,
+        )));
     }
 
     if cli.skip_influx_write {
@@ -236,7 +250,15 @@ fn run(cli: &Cli) -> Result<Report> {
         ));
     } else {
         checks.push(check_influx_write(&client, "worktime", &worktime));
-        checks.push(check_influx_write(&client, "dlp", &dlp));
+        if dlp_enabled {
+            checks.push(check_influx_write(&client, "dlp", &dlp));
+        } else {
+            checks.push(warn(
+                "influx:write:dlp",
+                "DLP write probe skipped because DLP is disabled",
+                json!({"enabled": false, "mode": "disabled"}),
+            ));
+        }
     }
 
     if cli.skip_grafana {
@@ -270,7 +292,7 @@ fn run(cli: &Cli) -> Result<Report> {
         git_commit: cli.git_commit.clone(),
         counts,
         checks,
-        limitations: build_limitations(cli),
+        limitations: build_limitations(cli, dlp_enabled),
     })
 }
 
@@ -338,6 +360,20 @@ fn split_csv(value: &str) -> Vec<String> {
         .collect()
 }
 
+fn systemd_services_for_mode(csv: &str, dlp_enabled: bool) -> String {
+    let mut services = split_csv(csv);
+    if dlp_enabled {
+        for service in split_csv(DEFAULT_DLP_SYSTEMD_SERVICES) {
+            if !services.iter().any(|item| item == &service) {
+                services.push(service);
+            }
+        }
+    } else {
+        services.retain(|service| !service.contains("dlp"));
+    }
+    services.into_iter().collect::<Vec<_>>().join(",")
+}
+
 fn hostname() -> String {
     Command::new("hostname")
         .output()
@@ -348,7 +384,7 @@ fn hostname() -> String {
         .unwrap_or_else(|| "unknown".to_string())
 }
 
-fn build_limitations(cli: &Cli) -> Vec<String> {
+fn build_limitations(cli: &Cli, dlp_enabled: bool) -> Vec<String> {
     let mut limitations = Vec::new();
     limitations.push(
         "Проверка подтверждает состояние runtime на момент формирования акта и не заменяет аудит конфигурации, нагрузочное тестирование или приемочные испытания заказчика.".to_string(),
@@ -377,6 +413,11 @@ fn build_limitations(cli: &Cli) -> Vec<String> {
                 .to_string(),
         );
     }
+    if !dlp_enabled {
+        limitations.push(
+            "DLP runtime отключен штатно через AW_DLP_ENABLED=false; readiness не считает DLP services/timers и DLP Influx write обязательными.".to_string(),
+        );
+    }
     limitations
 }
 

adk-rust/crates/hayabusa-tools/Cargo.toml

@@ -32,6 +32,8 @@ reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 urlencoding.workspace = true
+sha2.workspace = true
+zip = { version = "2", default-features = false, features = ["deflate"] }
 
 [dev-dependencies]
 tempfile.workspace = true

adk-rust/crates/hayabusa-tools/src/bin/autoprocess.rs

@@ -1,17 +1,22 @@
 use std::fs::{self, File};
+use std::io::{self, Read};
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
 use anyhow::{Context, Result, bail};
+use chrono::Utc;
 use clap::Parser;
 use fs2::FileExt;
-use hayabusa_tools::{guess_host_from_filename, read_json_file};
+use hayabusa_tools::{env_bool, env_string, guess_host_from_filename, read_json_file};
 use serde_json::{Value, json};
+use sha2::{Digest, Sha256};
+use zip::ZipArchive;
 
 const LOCK_PATH: &str = "/opt/hayabusa/state/aw-hayabusa-autoprocess.lock";
 const WRAPPER: &str = "/usr/local/bin/aw-hayabusa";
 const LINKER: &str = "/usr/local/bin/aw-hayabusa-link-case";
 const CASE_ALERT: &str = "/usr/local/bin/aw-hayabusa-case-alert";
+const SECURITY_FINDING_INBOX: &str = "/usr/local/bin/security-finding-inbox";
 const LATEST_INTAKE: &str = "/opt/hayabusa/state/latest-intake.json";
 
 #[derive(Debug, Parser)]
@@ -20,6 +25,9 @@ struct Cli {
     #[arg(long, default_value = "/opt/activitywatch/aw-rus-ops/drop")]
     drop_dir: PathBuf,
 
+    #[arg(long, default_value = "/opt/hayabusa/quarantine/drop")]
+    quarantine_dir: PathBuf,
+
     #[arg(long, default_value_t = true)]
     once: bool,
 }
@@ -65,16 +73,43 @@ fn run() -> Result<i32> {
         println!("no zip packages in drop dir");
         return Ok(0);
     }
+    let mut operational_failures = 0usize;
     for zip_path in zips {
-        let result = process_one(&zip_path)?;
-        println!(
-            "{}",
-            serde_json::to_string_pretty(&json!({
-                "processed": zip_path.display().to_string(),
-                "latest_intake": result.latest_intake,
-                "case_alert": result.case_alert,
-            }))?
-        );
+        if let Err(err) = validate_drop_inputs(&zip_path) {
+            let quarantine_dir = quarantine_drop_package(&cli.quarantine_dir, &zip_path, &err)?;
+            println!(
+                "{}",
+                serde_json::to_string_pretty(&json!({
+                    "quarantined": zip_path.display().to_string(),
+                    "quarantine_dir": quarantine_dir.display().to_string(),
+                    "reason": err.to_string(),
+                }))?
+            );
+            continue;
+        }
+        match process_one(&zip_path) {
+            Ok(result) => {
+                println!(
+                    "{}",
+                    serde_json::to_string_pretty(&json!({
+                        "processed": zip_path.display().to_string(),
+                        "latest_intake": result.latest_intake,
+                        "case_alert": result.case_alert,
+                        "security_finding_ingest": result.security_finding_ingest,
+                    }))?
+                );
+            }
+            Err(err) => {
+                operational_failures += 1;
+                eprintln!(
+                    "ERROR: operational failure while processing {}: {err:#}",
+                    zip_path.display()
+                );
+            }
+        }
+    }
+    if operational_failures > 0 {
+        bail!("{operational_failures} operational Hayabusa package failure(s)");
     }
     Ok(0)
 }
@@ -82,6 +117,7 @@ fn run() -> Result<i32> {
 struct ProcessResult {
     latest_intake: Value,
     case_alert: Option<Value>,
+    security_finding_ingest: Option<Value>,
 }
 
 fn list_zips(drop_dir: &Path) -> Result<Vec<PathBuf>> {
@@ -96,6 +132,42 @@ fn list_zips(drop_dir: &Path) -> Result<Vec<PathBuf>> {
     Ok(zips)
 }
 
+fn validate_drop_inputs(zip_path: &Path) -> Result<()> {
+    validate_zip_package(zip_path)?;
+    load_sidecars(zip_path)?;
+    Ok(())
+}
+
+fn validate_zip_package(zip_path: &Path) -> Result<()> {
+    let file = File::open(zip_path).with_context(|| format!("open {}", zip_path.display()))?;
+    let mut archive =
+        ZipArchive::new(file).with_context(|| format!("read zip {}", zip_path.display()))?;
+    if archive.is_empty() {
+        bail!("zip package has no entries: {}", zip_path.display());
+    }
+    for index in 0..archive.len() {
+        let mut entry = archive
+            .by_index(index)
+            .with_context(|| format!("read zip entry {index} from {}", zip_path.display()))?;
+        let name = entry.name().replace('\\', "/");
+        if name.starts_with('/') || name.split('/').any(|part| part == "..") {
+            bail!(
+                "unsafe zip entry in {}: {}",
+                zip_path.display(),
+                entry.name()
+            );
+        }
+        io::copy(&mut entry, &mut io::sink()).with_context(|| {
+            format!(
+                "test zip entry {} from {}",
+                entry.name(),
+                zip_path.display()
+            )
+        })?;
+    }
+    Ok(())
+}
+
 fn process_one(zip_path: &Path) -> Result<ProcessResult> {
     let sidecars = load_sidecars(zip_path)?;
     let host = guess_host(zip_path, &sidecars);
@@ -123,6 +195,7 @@ fn process_one(zip_path: &Path) -> Result<ProcessResult> {
         ],
     )?;
     let latest = read_json_file(Path::new(LATEST_INTAKE))?;
+    let security_finding_ingest = ingest_security_finding_best_effort(Path::new(LATEST_INTAKE))?;
     let report_dir = PathBuf::from(
         latest
             .get("report_dir")
@@ -154,6 +227,7 @@ fn process_one(zip_path: &Path) -> Result<ProcessResult> {
             return Ok(ProcessResult {
                 latest_intake: latest,
                 case_alert,
+                security_finding_ingest,
             });
         }
         run_checked(
@@ -171,9 +245,63 @@ fn process_one(zip_path: &Path) -> Result<ProcessResult> {
     Ok(ProcessResult {
         latest_intake: latest,
         case_alert,
+        security_finding_ingest,
     })
 }
 
+fn ingest_security_finding_best_effort(intake_path: &Path) -> Result<Option<Value>> {
+    if !env_bool("AW_SECURITY_FINDING_INBOX_ENABLED", false) {
+        return Ok(None);
+    }
+    let binary = PathBuf::from(env_string(
+        "AW_SECURITY_FINDING_INBOX_BIN",
+        SECURITY_FINDING_INBOX,
+    ));
+    let required = env_bool("AW_SECURITY_FINDING_INBOX_REQUIRED", false);
+    if !binary.is_file() {
+        let message = format!(
+            "security finding inbox binary not found: {}",
+            binary.display()
+        );
+        if required {
+            bail!("{message}");
+        }
+        eprintln!("WARNING: {message}");
+        return Ok(Some(json!({"ok": false, "warning": message})));
+    }
+    let min_severity = env_string("AW_SECURITY_FINDING_INBOX_MIN_SEVERITY", "medium");
+    let output = Command::new(&binary)
+        .arg("ingest-hayabusa")
+        .arg("--intake")
+        .arg(intake_path)
+        .arg("--min-severity")
+        .arg(min_severity)
+        .output()
+        .with_context(|| format!("run {}", binary.display()))?;
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    if !output.status.success() {
+        let message = format!(
+            "security finding ingest failed: status={} stderr={}",
+            output.status,
+            stderr.trim()
+        );
+        if required {
+            bail!("{message}");
+        }
+        eprintln!("WARNING: {message}");
+        return Ok(Some(json!({"ok": false, "warning": message})));
+    }
+    let payload = serde_json::from_str(stdout.trim()).unwrap_or_else(|_| {
+        json!({
+            "ok": true,
+            "stdout": stdout.trim(),
+            "stderr": stderr.trim()
+        })
+    });
+    Ok(Some(payload))
+}
+
 fn load_sidecars(zip_path: &Path) -> Result<Sidecars> {
     let base = zip_path.with_extension("");
     let caseid_path = base.with_extension("caseid");
@@ -241,6 +369,108 @@ fn archive_drop_package(report_dir: &Path, zip_path: &Path) -> Result<()> {
     Ok(())
 }
 
+fn quarantine_drop_package(
+    quarantine_root: &Path,
+    zip_path: &Path,
+    err: &anyhow::Error,
+) -> Result<PathBuf> {
+    fs::create_dir_all(quarantine_root)
+        .with_context(|| format!("create {}", quarantine_root.display()))?;
+    let name = zip_path
+        .file_name()
+        .and_then(|name| name.to_str())
+        .unwrap_or("package.zip");
+    let stamp = Utc::now().format("%Y%m%dT%H%M%SZ");
+    let mut quarantine_dir = quarantine_root.join(format!("{stamp}_{}", sanitize_component(name)));
+    if quarantine_dir.exists() {
+        quarantine_dir = quarantine_root.join(format!(
+            "{stamp}_{}_{}",
+            sanitize_component(name),
+            std::process::id()
+        ));
+    }
+    fs::create_dir_all(&quarantine_dir)
+        .with_context(|| format!("create {}", quarantine_dir.display()))?;
+
+    let sha256 = if zip_path.is_file() {
+        Some(sha256_file(zip_path)?)
+    } else {
+        None
+    };
+    move_if_exists(zip_path, &quarantine_dir)?;
+    let base = zip_path.with_extension("");
+    for sidecar in [
+        base.with_extension("caseid"),
+        base.with_extension("meta.json"),
+        zip_path.with_extension("zip.sha256"),
+    ] {
+        move_if_exists(&sidecar, &quarantine_dir)?;
+    }
+    let reason = json!({
+        "quarantined_at": Utc::now().to_rfc3339(),
+        "source": "aw-hayabusa-autoprocess-rust",
+        "original_path": zip_path.display().to_string(),
+        "sha256": sha256,
+        "reason": err.to_string(),
+        "detail": format!("{err:#}"),
+        "operator_action": "inspect source package, re-export EVTX archive if needed, then replay by moving a fixed package back to the drop directory",
+    });
+    fs::write(
+        quarantine_dir.join("reason.json"),
+        serde_json::to_string_pretty(&reason)?,
+    )
+    .with_context(|| format!("write {}", quarantine_dir.join("reason.json").display()))?;
+    Ok(quarantine_dir)
+}
+
+fn move_if_exists(path: &Path, target_dir: &Path) -> Result<()> {
+    if !path.exists() {
+        return Ok(());
+    }
+    let target = target_dir.join(path.file_name().context("quarantine file name")?);
+    fs::rename(path, &target)
+        .or_else(|_| {
+            fs::copy(path, &target)?;
+            fs::remove_file(path)
+        })
+        .with_context(|| format!("move {} to {}", path.display(), target.display()))?;
+    Ok(())
+}
+
+fn sha256_file(path: &Path) -> Result<String> {
+    let mut file = File::open(path).with_context(|| format!("open {}", path.display()))?;
+    let mut hasher = Sha256::new();
+    let mut buf = [0u8; 8192];
+    loop {
+        let read = file
+            .read(&mut buf)
+            .with_context(|| format!("read {}", path.display()))?;
+        if read == 0 {
+            break;
+        }
+        hasher.update(&buf[..read]);
+    }
+    Ok(format!("{:x}", hasher.finalize()))
+}
+
+fn sanitize_component(value: &str) -> String {
+    let clean = value
+        .chars()
+        .map(|ch| {
+            if ch.is_ascii_alphanumeric() || matches!(ch, '.' | '_' | '-') {
+                ch
+            } else {
+                '_'
+            }
+        })
+        .collect::<String>();
+    if clean.is_empty() {
+        "package".to_string()
+    } else {
+        clean
+    }
+}
+
 fn guess_host(zip_path: &Path, sidecars: &Sidecars) -> Option<String> {
     if let Some(host) = &sidecars.host {
         if !host.is_empty() {
@@ -302,3 +532,57 @@ fn run_capture(program: &Path, args: &[String]) -> Result<Captured> {
         stderr: String::from_utf8_lossy(&output.stderr).to_string(),
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Write;
+
+    #[test]
+    fn invalid_zip_is_rejected_before_accept() {
+        let dir = tempfile::tempdir().unwrap();
+        let zip_path = dir.path().join("bad.zip");
+        fs::write(&zip_path, b"not a zip").unwrap();
+
+        let err = validate_drop_inputs(&zip_path).unwrap_err();
+        assert!(err.to_string().contains("read zip"));
+    }
+
+    #[test]
+    fn quarantine_moves_package_sidecars_and_writes_reason() {
+        let dir = tempfile::tempdir().unwrap();
+        let drop = dir.path().join("drop");
+        let quarantine = dir.path().join("quarantine");
+        fs::create_dir_all(&drop).unwrap();
+        let zip_path = drop.join("HOST-20260624.zip");
+        fs::write(&zip_path, b"bad").unwrap();
+        fs::write(drop.join("HOST-20260624.meta.json"), b"{bad").unwrap();
+        fs::write(drop.join("HOST-20260624.caseid"), b"30").unwrap();
+
+        let err = anyhow::anyhow!("bad zip");
+        let target = quarantine_drop_package(&quarantine, &zip_path, &err).unwrap();
+
+        assert!(!zip_path.exists());
+        assert!(target.join("HOST-20260624.zip").is_file());
+        assert!(target.join("HOST-20260624.meta.json").is_file());
+        assert!(target.join("HOST-20260624.caseid").is_file());
+        let reason = fs::read_to_string(target.join("reason.json")).unwrap();
+        assert!(reason.contains("bad zip"));
+        assert!(reason.contains("aw-hayabusa-autoprocess-rust"));
+    }
+
+    #[test]
+    fn valid_zip_with_backslash_entry_is_accepted_by_precheck() {
+        let dir = tempfile::tempdir().unwrap();
+        let zip_path = dir.path().join("ok.zip");
+        let file = File::create(&zip_path).unwrap();
+        let mut zip = zip::ZipWriter::new(file);
+        let options = zip::write::SimpleFileOptions::default()
+            .compression_method(zip::CompressionMethod::Deflated);
+        zip.start_file("evtx\\sample.evtx", options).unwrap();
+        zip.write_all(b"evtx").unwrap();
+        zip.finish().unwrap();
+
+        validate_drop_inputs(&zip_path).unwrap();
+    }
+}

adk-rust/crates/security-finding-inbox/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "security-finding-inbox"
+version = "0.1.0"
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+publish.workspace = true
+
+[dependencies]
+anyhow.workspace = true
+chrono.workspace = true
+clap.workspace = true
+hayabusa-tools = { path = "../hayabusa-tools" }
+reqwest.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+sha2.workspace = true
+
+[dev-dependencies]
+tempfile.workspace = true

ansible/deploy_aw_server.yml

@@ -19,6 +19,22 @@
     aw_db_vacuum_timer_enabled: false
 
   tasks:
+    - name: Refuse inconsistent DLP resource profile
+      ansible.builtin.assert:
+        that:
+          - aw_dlp_profile | default('core_only') in ['core_only', 'light', 'on_demand', 'full']
+          - (aw_dlp_profile | default('core_only') == 'core_only') or (aw_dlp_enabled | default(false) | bool)
+          - (aw_dlp_enabled | default(false) | bool) or not (
+              aw_dlp_influx_enabled | default(false) | bool
+              or aw_dlp_ioc_enabled | default(false) | bool
+              or aw_dlp_policy_engine_enabled | default(false) | bool
+              or aw_dlp_content_analysis_enabled | default(false) | bool
+              or aw_dlp_integrations_enabled | default(false) | bool
+              or aw_dlp_case_management_enabled | default(false) | bool
+              or aw_dlp_compliance_enabled | default(false) | bool
+            )
+        fail_msg: "Inconsistent DLP profile: keep aw_dlp_enabled=false with all DLP component flags false, or explicitly choose aw_dlp_enabled=true and aw_dlp_profile=light|on_demand|full."
+
     - name: Установить базовые пакеты
       ansible.builtin.apt:
         name:
@@ -78,6 +94,7 @@
         - "{{ aw_server_data_dir }}/backups"
         - "{{ aw_server_data_dir }}/slo"
         - "{{ aw_server_data_dir }}/browser-smoke"
+        - "{{ aw_security_finding_executor_work_dir | default(aw_server_data_dir ~ '/security-finding-executor') }}"
         - "{{ aw_rus_health_state_dir }}"
         - "{{ aw_rus_health_validation_dir }}"
         - "{{ aw_server_log_dir }}"
@@ -108,6 +125,7 @@
         - "{{ aw_server_data_dir }}/backups"
         - "{{ aw_server_data_dir }}/slo"
         - "{{ aw_server_data_dir }}/browser-smoke"
+        - "{{ aw_security_finding_executor_work_dir | default(aw_server_data_dir ~ '/security-finding-executor') }}"
         - "{{ aw_rus_health_state_dir }}"
         - "{{ aw_rus_health_validation_dir }}"
         - "{{ aw_server_log_dir }}"
@@ -713,7 +731,9 @@
               - aw_effective_dlp_influx_token | length > 0
               - (aw_effective_dlp_influx_token | string | lower | regex_search('^(change_me|changeme|replace-me|replace_me|token|secret|password|api_key|influx_token|write_token|your_.*|<.*>)$')) is none
             fail_msg: "aw_dlp_influx_enabled=true, но token пуст и в локальном env, и в текущем /etc/activitywatch/aw-server.env. Exporter будет падать и Grafana не получит DLP-ряды."
-          when: aw_dlp_influx_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_influx_enabled | default(false) | bool
 
         - name: Проверить destination для AW worktime Influx exporter
           ansible.builtin.assert:
@@ -745,7 +765,9 @@
               - (aw_dlp_influx_hosts | default('') | string | length) > 0
               - "'WINDOWS_USER_EXAMPLE' not in (aw_dlp_influx_hosts | default('') | string)"
             fail_msg: "aw_dlp_influx_enabled=true, но URL/org/bucket/hosts похожи на public example/TEST-NET значения. Задайте live значения в private inventory/env, не в public repo."
-          when: aw_dlp_influx_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_influx_enabled | default(false) | bool
 
         - name: Записать /etc/activitywatch/aw-server.env перед хотфиксами
           ansible.builtin.copy:
@@ -764,7 +786,7 @@
               AW_SERVER_GROUP={{ aw_server_group }}
               AW_WORKTIME_REPORT_BASE={{ aw_worktime_report_base }}
               AW_WORKTIME_TZ={{ aw_worktime_timezone }}
-              AW_WORKTIME_HOST={{ aw_effective_worktime_host | default(aw_effective_monitored_windows_hostname | default('SHARKON2025')) }}
+              AW_WORKTIME_HOST={{ aw_effective_worktime_host | default(aw_effective_monitored_windows_hostname | default('HOST-EXAMPLE')) }}
               AW_WORKTIME_EVENTS_LIMIT={{ aw_worktime_events_limit | default(5000) }}
               AW_WORKTIME_AW_HTTP_TIMEOUT_SECONDS={{ aw_worktime_aw_http_timeout_seconds | default(6) }}
               AW_WORKTIME_EVENTS_CACHE_TTL_SECONDS={{ aw_worktime_events_cache_ttl_seconds | default(300) }}
@@ -787,7 +809,7 @@
               AW_WORKTIME_INFLUX_URL={{ aw_worktime_influx_url | default('') }}
               AW_WORKTIME_INFLUX_ORG={{ aw_worktime_influx_org | default('proxmox') }}
               AW_WORKTIME_INFLUX_BUCKET={{ aw_worktime_influx_bucket | default('aw_metrics') }}
-              AW_WORKTIME_INFLUX_HOSTS={{ aw_worktime_influx_hosts | default('SHARKON2025') }}
+              AW_WORKTIME_INFLUX_HOSTS={{ aw_worktime_influx_hosts | default(aw_effective_monitored_windows_hostname | default('HOST-EXAMPLE')) }}
               AW_WORKTIME_INFLUX_DAYS={{ aw_worktime_influx_days | default('today,yesterday') }}
               AW_WORKTIME_INFLUX_TOKEN={{ aw_effective_worktime_influx_token | default('') }}
               AW_WORKTIME_MANAGEMENT_HISTORY_DIR={{ aw_worktime_management_history_dir | default(aw_server_data_dir ~ '/worktime-management-history') }}
@@ -798,11 +820,28 @@
               AW_WORKTIME_MANAGER_TREND_DELTA_PCT={{ aw_worktime_manager_trend_delta_pct | default(10) }}
               AW_WORKTIME_MANAGER_OFF_HOURS_THRESHOLD_SECONDS={{ aw_worktime_manager_off_hours_threshold_seconds | default(1800) }}
               AW_WORKTIME_MANAGER_INTERPRETATION_POLICY={{ aw_worktime_interpretation_policy_path | default('/etc/activitywatch/worktime-interpretation-policy.json') }}
-              AW_DLP_INFLUX_ENABLED={{ 'true' if (aw_dlp_influx_enabled | default(false) | bool) else 'false' }}
+              AW_DLP_ENABLED={{ 'true' if (aw_dlp_enabled | default(false) | bool) else 'false' }}
+              AW_DLP_PROFILE={{ aw_dlp_profile | default('core_only') }}
+              AW_DLP_DISABLED_REASON={{ aw_dlp_disabled_reason | default('') }}
+              AW_DLP_DISABLED_SINCE={{ aw_dlp_disabled_since | default('') }}
+              AW_DLP_GUARD_ENABLED={{ 'true' if (aw_dlp_light_guard_enabled | default(true) | bool) else 'false' }}
+              AW_DLP_GUARD_STATE_DIR={{ aw_dlp_light_guard_state_dir | default(aw_server_data_dir ~ '/health') }}
+              AW_DLP_GUARD_LOAD_RATIO={{ aw_dlp_light_guard_load_ratio | default('1.50') }}
+              AW_DLP_GUARD_MEM_AVAILABLE_PCT_MIN={{ aw_dlp_light_guard_mem_available_pct_min | default('15') }}
+              AW_DLP_GUARD_IOWAIT_PCT_MAX={{ aw_dlp_light_guard_iowait_pct_max | default('20') }}
+              AW_DLP_GUARD_STRIKES_REQUIRED={{ aw_dlp_light_guard_strikes_required | default(3) }}
+              AW_DLP_CONTROL_BIN=/usr/local/bin/detmir-dlp-runtime-control
+              AW_CONTAINMENT_ENABLED={{ 'true' if (aw_containment_enabled | default(false) | bool) else 'false' }}
+              AW_CONTAINMENT_MODE={{ aw_containment_mode | default('shadow') }}
+              AW_CONTAINMENT_POLICY={{ aw_containment_policy_path | default('/etc/activitywatch/containment-policy.json') }}
+              AW_CONTAINMENT_DEFAULT_TTL_MINUTES={{ aw_containment_default_ttl_minutes | default(60) }}
+              AW_CONTAINMENT_REQUIRE_ADMIN_CHANNEL_CHECK={{ 'true' if (aw_containment_require_admin_channel_check | default(true) | bool) else 'false' }}
+              AW_CONTAINMENT_ALLOW_AUTO_FOR_SERVERS={{ 'true' if (aw_containment_allow_auto_for_servers | default(false) | bool) else 'false' }}
+              AW_DLP_INFLUX_ENABLED={{ 'true' if ((aw_dlp_enabled | default(false) | bool) and (aw_dlp_influx_enabled | default(false) | bool)) else 'false' }}
               AW_DLP_INFLUX_URL={{ aw_dlp_influx_url | default('') }}
               AW_DLP_INFLUX_ORG={{ aw_dlp_influx_org | default('proxmox') }}
               AW_DLP_INFLUX_BUCKET={{ aw_dlp_influx_bucket | default('aw_metrics') }}
-              AW_DLP_INFLUX_HOSTS={{ aw_dlp_influx_hosts | default('SHARKON2025') }}
+              AW_DLP_INFLUX_HOSTS={{ aw_dlp_influx_hosts | default(aw_effective_monitored_windows_hostname | default('HOST-EXAMPLE')) }}
               AW_DLP_INFLUX_LOOKBACK_DAYS={{ aw_dlp_influx_lookback_days | default(30) }}
               AW_DLP_INFLUX_EVENT_LIMIT={{ aw_dlp_influx_event_limit | default(2000) }}
               AW_DLP_INFLUX_TOKEN={{ aw_effective_dlp_influx_token | default('') }}
@@ -820,6 +859,7 @@
               AW_RUS_HEALTH_SESSION_EVENTS_MAX_AGE_SECONDS={{ aw_rus_health_session_events_max_age_seconds | default(86400) }}
               AW_RUS_HEALTH_GUARD_MAX_AGE_SECONDS={{ aw_rus_health_guard_max_age_seconds | default(300) }}
               AW_RUS_HEALTH_GUARD_REQUIRED={{ 1 if (aw_rus_health_guard_required | default(true) | bool) else 0 }}
+              AW_RUS_HEALTH_RDP_TCP_REQUIRED={{ 'true' if (aw_rus_health_rdp_tcp_required | default(true) | bool) else 'false' }}
               AW_RUS_SLO_STATE_DIR={{ aw_server_data_dir }}/slo
               AW_RUS_SLO_AW_BASE=http://127.0.0.1:5600
               AW_RUS_SLO_WORKTIME_BASE={{ aw_rus_health_worktime_api_base | default('http://127.0.0.1:5610') }}
@@ -837,6 +877,104 @@
               AW_HAYABUSA_TELEGRAM_MIN_SEVERITY={{ aw_hayabusa_telegram_min_severity | default('high') }}
               AW_HAYABUSA_TELEGRAM_BOT_TOKEN={{ aw_hayabusa_telegram_bot_token | default('') }}
               AW_HAYABUSA_TELEGRAM_CHAT_IDS={{ aw_hayabusa_telegram_chat_ids | default('') }}
+              AW_SECURITY_FINDING_INBOX_ENABLED={{ 'true' if (aw_security_finding_inbox_enabled | default(false) | bool) else 'false' }}
+              AW_SECURITY_FINDING_INBOX_REQUIRED={{ 'true' if (aw_security_finding_inbox_required | default(false) | bool) else 'false' }}
+              AW_SECURITY_FINDING_INBOX_BIN={{ aw_security_finding_inbox_bin | default('/usr/local/bin/security-finding-inbox') }}
+              AW_SECURITY_FINDING_INBOX_MIN_SEVERITY={{ aw_security_finding_inbox_min_severity | default('medium') }}
+              AW_SECURITY_FINDING_EXECUTOR_WORK_DIR={{ aw_security_finding_executor_work_dir | default(aw_server_data_dir ~ '/security-finding-executor') }}
+              AW_SECURITY_FINDING_EXECUTOR_LOCK={{ aw_security_finding_executor_lock | default('/var/lock/aw-security-finding-executor.lock') }}
+              AW_CONTAINMENT_ENGINE_BIN={{ aw_containment_engine_bin | default('/usr/local/bin/containment-engine') }}
+              AW_CONTAINMENT_MANAGEMENT_ALLOWLIST={{ aw_containment_management_allowlist | default('') }}
+              AW_CONTAINMENT_BLOCKED_REMOTE_ADDRESSES={{ aw_containment_blocked_remote_addresses | default('') }}
+
+        - name: Установить runtime control для optional DLP контура
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/scripts/detmir_dlp_runtime_control.sh"
+            dest: /usr/local/bin/detmir-dlp-runtime-control
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: Установить load guard для lightweight DLP контура
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/scripts/detmir_dlp_load_guard.sh"
+            dest: /usr/local/bin/detmir-dlp-load-guard
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: Установить systemd unit DLP load guard
+          ansible.builtin.copy:
+            dest: /etc/systemd/system/detmir-dlp-load-guard.service
+            owner: root
+            group: root
+            mode: "0644"
+            content: |
+              [Unit]
+              Description=DetMir lightweight DLP load guard
+              After=activitywatch-server.service
+
+              [Service]
+              Type=oneshot
+              EnvironmentFile=-/etc/activitywatch/aw-server.env
+              ExecStart=/usr/local/bin/detmir-dlp-load-guard
+              Nice=10
+              IOSchedulingClass=best-effort
+              IOSchedulingPriority=7
+              TimeoutStartSec=45
+
+        - name: Установить systemd timer DLP load guard
+          ansible.builtin.copy:
+            dest: /etc/systemd/system/detmir-dlp-load-guard.timer
+            owner: root
+            group: root
+            mode: "0644"
+            content: |
+              [Unit]
+              Description=Run DetMir lightweight DLP load guard
+
+              [Timer]
+              OnBootSec=3min
+              OnUnitActiveSec=1min
+              AccuracySec=30s
+              Persistent=false
+
+              [Install]
+              WantedBy=timers.target
+
+        - name: Включить DLP load guard timer
+          ansible.builtin.systemd:
+            name: detmir-dlp-load-guard.timer
+            enabled: true
+            state: started
+            daemon_reload: true
+          when: aw_dlp_light_guard_enabled | default(true) | bool
+
+        - name: Отключить DLP load guard timer, если guard явно выключен
+          ansible.builtin.systemd:
+            name: detmir-dlp-load-guard.timer
+            enabled: false
+            state: stopped
+            daemon_reload: true
+          failed_when: false
+          when: not (aw_dlp_light_guard_enabled | default(true) | bool)
+
+        - name: Создать каталог containment policy
+          ansible.builtin.file:
+            path: "{{ (aw_containment_policy_path | default('/etc/activitywatch/containment-policy.json')) | dirname }}"
+            state: directory
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: Установить default containment policy, если live policy отсутствует
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/configs/containment-policy.example.json"
+            dest: "{{ aw_containment_policy_path | default('/etc/activitywatch/containment-policy.json') }}"
+            owner: root
+            group: root
+            mode: "0644"
+            force: false
 
         - name: Создать каталог DLP policy engine
           ansible.builtin.file:
@@ -845,7 +983,9 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when: aw_dlp_policy_engine_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_policy_engine_enabled | default(false) | bool
 
         - name: Установить systemd unit DLP policy engine
           ansible.builtin.copy:
@@ -854,7 +994,9 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_policy_engine_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_policy_engine_enabled | default(false) | bool
 
         - name: Проверить локальный Rust DLP policy engine
           ansible.builtin.stat:
@@ -889,7 +1031,7 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when: aw_dlp_content_analysis_enabled | default(true) | bool
+          when: aw_dlp_content_analysis_enabled | default(false) | bool
 
         - name: Скопировать файлы DLP content analysis
           ansible.builtin.copy:
@@ -898,7 +1040,7 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0644"
-          when: aw_dlp_content_analysis_enabled | default(true) | bool
+          when: aw_dlp_content_analysis_enabled | default(false) | bool
 
         - name: Установить wrapper запуска DLP content analysis через virtualenv
           ansible.builtin.copy:
@@ -907,7 +1049,7 @@
             owner: root
             group: root
             mode: "0755"
-          when: aw_dlp_content_analysis_enabled | default(true) | bool
+          when: aw_dlp_content_analysis_enabled | default(false) | bool
 
         - name: Проверить локальный Rust DLP content analyzer
           ansible.builtin.stat:
@@ -915,7 +1057,7 @@
           delegate_to: localhost
           register: dlp_content_analyzer_rust_binary
           become: false
-          when: aw_dlp_content_analysis_enabled | default(true) | bool
+          when: aw_dlp_content_analysis_enabled | default(false) | bool
 
         - name: Установить Rust DLP content analyzer
           ansible.builtin.copy:
@@ -925,7 +1067,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_content_analysis_enabled | default(true) | bool
+            - aw_dlp_content_analysis_enabled | default(false) | bool
             - dlp_content_analyzer_rust_binary.stat.exists | default(false)
 
         - name: Создать virtualenv DLP content analysis
@@ -933,13 +1075,13 @@
             cmd: python3 -m venv /opt/activitywatch/dlp-content-analysis/.venv
           args:
             creates: /opt/activitywatch/dlp-content-analysis/.venv/bin/python
-          when: aw_dlp_content_analysis_enabled | default(true) | bool
+          when: aw_dlp_content_analysis_enabled | default(false) | bool
 
         - name: Установить зависимости DLP content analysis
           ansible.builtin.pip:
             requirements: /opt/activitywatch/dlp-content-analysis/requirements.txt
             virtualenv: /opt/activitywatch/dlp-content-analysis/.venv
-          when: aw_dlp_content_analysis_enabled | default(true) | bool
+          when: aw_dlp_content_analysis_enabled | default(false) | bool
 
         - name: Создать каталог DLP integrations
           ansible.builtin.file:
@@ -948,7 +1090,9 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Скопировать файлы DLP integrations
           ansible.builtin.copy:
@@ -961,7 +1105,9 @@
             - cef-config.yaml
             - syslog-forwarder-config.yaml
             - webhook-config.yaml
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Создать state каталог DLP integrations
           ansible.builtin.file:
@@ -970,7 +1116,9 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить systemd unit CEF exporter
           ansible.builtin.copy:
@@ -979,7 +1127,9 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить systemd timer CEF exporter
           ansible.builtin.copy:
@@ -988,7 +1138,9 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Проверить локальный Rust CEF exporter
           ansible.builtin.stat:
@@ -996,14 +1148,16 @@
           delegate_to: localhost
           register: dlp_cef_exporter_rust_binary
           become: false
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Требовать Rust CEF exporter artifact
           ansible.builtin.assert:
             that:
               - dlp_cef_exporter_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-cef-exporter"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить Rust CEF exporter
           ansible.builtin.copy:
@@ -1013,7 +1167,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_integrations_enabled | default(true) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
             - dlp_cef_exporter_rust_binary.stat.exists | default(false)
 
         - name: Установить systemd unit syslog forwarder
@@ -1023,7 +1177,7 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить systemd timer syslog forwarder
           ansible.builtin.copy:
@@ -1032,7 +1186,7 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Проверить локальный Rust syslog forwarder
           ansible.builtin.stat:
@@ -1040,14 +1194,14 @@
           delegate_to: localhost
           register: dlp_syslog_forwarder_rust_binary
           become: false
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Требовать Rust syslog forwarder artifact
           ansible.builtin.assert:
             that:
               - dlp_syslog_forwarder_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-syslog-forwarder"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить Rust syslog forwarder
           ansible.builtin.copy:
@@ -1057,7 +1211,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_integrations_enabled | default(true) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
             - dlp_syslog_forwarder_rust_binary.stat.exists | default(false)
 
         - name: Установить systemd unit webhook sender
@@ -1067,7 +1221,7 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить systemd timer webhook sender
           ansible.builtin.copy:
@@ -1076,7 +1230,7 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Проверить локальный Rust webhook sender
           ansible.builtin.stat:
@@ -1084,14 +1238,14 @@
           delegate_to: localhost
           register: dlp_webhook_sender_rust_binary
           become: false
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Требовать Rust webhook sender artifact
           ansible.builtin.assert:
             that:
               - dlp_webhook_sender_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-webhook-sender"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить Rust webhook sender
           ansible.builtin.copy:
@@ -1101,7 +1255,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_integrations_enabled | default(true) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
             - dlp_webhook_sender_rust_binary.stat.exists | default(false)
 
         - name: Создать каталог DLP case management
@@ -1111,7 +1265,9 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when: aw_dlp_case_management_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_case_management_enabled | default(false) | bool
 
         - name: Установить systemd unit DLP case management
           ansible.builtin.copy:
@@ -1120,7 +1276,9 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_case_management_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_case_management_enabled | default(false) | bool
 
         - name: Проверить локальный Rust DLP case management
           ansible.builtin.stat:
@@ -1128,14 +1286,14 @@
           delegate_to: localhost
           register: aw_dlp_case_management_rust_binary
           become: false
-          when: aw_dlp_case_management_enabled | default(true) | bool
+          when: aw_dlp_case_management_enabled | default(false) | bool
 
         - name: Требовать Rust DLP case management artifact
           ansible.builtin.assert:
             that:
               - aw_dlp_case_management_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-case-management"
-          when: aw_dlp_case_management_enabled | default(true) | bool
+          when: aw_dlp_case_management_enabled | default(false) | bool
 
         - name: Установить Rust DLP case management
           ansible.builtin.copy:
@@ -1145,7 +1303,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_case_management_enabled | default(true) | bool
+            - aw_dlp_case_management_enabled | default(false) | bool
             - aw_dlp_case_management_rust_binary.stat.exists | default(false)
 
         - name: Создать каталоги DLP compliance
@@ -1159,7 +1317,9 @@
             - /opt/activitywatch/dlp-compliance
             - /opt/activitywatch/dlp-compliance/templates
             - "{{ aw_dlp_compliance_report_dir }}"
-          when: aw_dlp_compliance_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_compliance_enabled | default(false) | bool
 
         - name: Скопировать файлы DLP compliance
           ansible.builtin.copy:
@@ -1173,7 +1333,9 @@
             - { src: "templates/pci-dss-report.html", dest: "/opt/activitywatch/dlp-compliance/templates/pci-dss-report.html", mode: "0644" }
             - { src: "report-scheduler.service", dest: "/etc/systemd/system/aw-dlp-report-scheduler.service", mode: "0644" }
             - { src: "report-scheduler.timer", dest: "/etc/systemd/system/aw-dlp-report-scheduler.timer", mode: "0644" }
-          when: aw_dlp_compliance_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_compliance_enabled | default(false) | bool
 
         - name: Проверить локальный Rust DLP compliance
           ansible.builtin.stat:
@@ -1181,14 +1343,18 @@
           delegate_to: localhost
           register: aw_dlp_compliance_rust_binary
           become: false
-          when: aw_dlp_compliance_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_compliance_enabled | default(false) | bool
 
         - name: Требовать Rust DLP compliance artifact
           ansible.builtin.assert:
             that:
               - aw_dlp_compliance_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-compliance"
-          when: aw_dlp_compliance_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_compliance_enabled | default(false) | bool
 
         - name: Установить Rust DLP compliance
           ansible.builtin.copy:
@@ -1198,7 +1364,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_compliance_enabled | default(true) | bool
+            - aw_dlp_compliance_enabled | default(false) | bool
             - aw_dlp_compliance_rust_binary.stat.exists | default(false)
 
         - name: Проверить локальный Rust dlp-admin-cli
@@ -1437,6 +1603,47 @@
             mode: "0755"
           when: dlp_health_check_rust_binary.stat.exists | default(false)
 
+        - name: Проверить локальный Rust containment-engine
+          ansible.builtin.stat:
+            path: "{{ aw_rust_release_dir }}/containment-engine"
+          delegate_to: localhost
+          register: containment_engine_rust_binary
+          become: false
+
+        - name: Установить Rust containment-engine
+          ansible.builtin.copy:
+            src: "{{ aw_rust_release_dir }}/containment-engine"
+            dest: /usr/local/bin/containment-engine
+            owner: root
+            group: root
+            mode: "0755"
+          when: containment_engine_rust_binary.stat.exists | default(false)
+
+        - name: Проверить локальный Rust security-finding-inbox
+          ansible.builtin.stat:
+            path: "{{ aw_rust_release_dir }}/security-finding-inbox"
+          delegate_to: localhost
+          register: security_finding_inbox_rust_binary
+          become: false
+
+        - name: Установить Rust security-finding-inbox
+          ansible.builtin.copy:
+            src: "{{ aw_rust_release_dir }}/security-finding-inbox"
+            dest: /usr/local/bin/security-finding-inbox
+            owner: root
+            group: root
+            mode: "0755"
+          when: security_finding_inbox_rust_binary.stat.exists | default(false)
+
+        - name: Установить systemd unit Security Finding Inbox executor
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/ops/systemd/aw-security-finding-executor.service"
+            dest: /etc/systemd/system/aw-security-finding-executor.service
+            owner: root
+            group: root
+            mode: "0644"
+          notify: Перезагрузить systemd
+
         - name: Проверить локальный Rust AW-RUS healthd
           ansible.builtin.stat:
             path: "{{ aw_rust_release_dir }}/aw-rus-healthd"
@@ -1644,7 +1851,9 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_influx_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_influx_enabled | default(false) | bool
 
         - name: Проверить локальный Rust AW DLP Influx exporter
           ansible.builtin.stat:
@@ -1652,14 +1861,18 @@
           delegate_to: localhost
           register: aw_dlp_influx_exporter_rust_binary
           become: false
-          when: aw_dlp_influx_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_influx_enabled | default(false) | bool
 
         - name: Требовать Rust AW DLP Influx exporter artifact
           ansible.builtin.assert:
             that:
               - aw_dlp_influx_exporter_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-influx-exporter"
-          when: aw_dlp_influx_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_influx_enabled | default(false) | bool
 
         - name: Установить Rust AW DLP Influx exporter
           ansible.builtin.copy:
@@ -1679,7 +1892,9 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_influx_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_influx_enabled | default(false) | bool
 
         - name: Проверить локальный Rust DetMir readiness checker
           ansible.builtin.stat:
@@ -1831,42 +2046,42 @@
             name: aw-dlp-cef-exporter.timer
             enabled: true
             state: restarted
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Включить и перезапустить timer syslog forwarder
           ansible.builtin.systemd:
             name: aw-dlp-syslog-forwarder.timer
             enabled: true
             state: restarted
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Включить и перезапустить timer webhook sender
           ansible.builtin.systemd:
             name: aw-dlp-webhook-sender.timer
             enabled: true
             state: restarted
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Включить и перезапустить DLP case management
           ansible.builtin.systemd:
             name: aw-dlp-case-management.service
             enabled: true
             state: restarted
-          when: aw_dlp_case_management_enabled | default(true) | bool
+          when: aw_dlp_case_management_enabled | default(false) | bool
 
         - name: Включить и перезапустить timer DLP compliance report
           ansible.builtin.systemd:
             name: aw-dlp-report-scheduler.timer
             enabled: true
             state: restarted
-          when: aw_dlp_compliance_enabled | default(true) | bool
+          when: aw_dlp_compliance_enabled | default(false) | bool
 
         - name: Выполнить разовый прогон DLP compliance report
           ansible.builtin.systemd:
             name: aw-dlp-report-scheduler.service
             state: started
           failed_when: false
-          when: aw_dlp_compliance_enabled | default(true) | bool
+          when: aw_dlp_compliance_enabled | default(false) | bool
 
         - name: Включить и перезапустить AW worktime API
           ansible.builtin.systemd:
@@ -2233,6 +2448,11 @@
             mode: "0755"
           when: dlp_aggregator_rust_binary.stat.exists | default(false)
 
+        - name: Удалить stale drop-in, переопределяющий lightweight DLP aggregator
+          ansible.builtin.file:
+            path: /etc/systemd/system/activitywatch-dlp-aggregator.service.d/20-rust-switch.conf
+            state: absent
+
         - name: Установить systemd unit для агрегатора
           ansible.builtin.copy:
             dest: /etc/systemd/system/activitywatch-dlp-aggregator.service
@@ -2241,7 +2461,7 @@
             mode: "0644"
             content: |
               [Unit]
-              Description=ActivityWatch DLP Event Aggregator
+              Description=ActivityWatch Lightweight DLP Event Aggregator
               After=activitywatch-server.service
 
               [Service]
@@ -2251,7 +2471,18 @@
               ExecStart=/usr/local/bin/dlp-aggregator-rust \
                 --aw-url http://127.0.0.1:{{ aw_server_port }}/api/0 \
                 --sqlite-path {{ aw_server_data_dir }}/dlp_warehouse.sqlite \
-                --state-path {{ aw_server_data_dir }}/dlp-aggregator-state.json
+                --state-path {{ aw_server_data_dir }}/dlp-aggregator-state.json \
+                --bucket-prefixes {{ aw_dlp_aggregator_bucket_prefixes | default('aw-file-operations_,aw-dlp-incidents_') }} \
+                --lookback-hours {{ aw_dlp_aggregator_lookback_hours | default(2) }} \
+                --overlap-seconds {{ aw_dlp_aggregator_overlap_seconds | default(60) }} \
+                --limit {{ aw_dlp_aggregator_limit | default(500) }} \
+                --timeout {{ aw_dlp_aggregator_timeout_seconds | default(8) }}
+              Nice=10
+              IOSchedulingClass=best-effort
+              IOSchedulingPriority=7
+              CPUQuota={{ aw_dlp_aggregator_cpu_quota | default('10%') }}
+              MemoryMax={{ aw_dlp_aggregator_memory_max | default('256M') }}
+              TimeoutStartSec={{ (aw_dlp_aggregator_timeout_seconds | default(8) | int) + 15 }}
 
               [Install]
               WantedBy=multi-user.target
@@ -2261,10 +2492,10 @@
             dest: /etc/systemd/system/activitywatch-dlp-aggregator.timer
             content: |
               [Unit]
-              Description=Run ActivityWatch DLP Aggregator every 5 minutes
+              Description=Run ActivityWatch Lightweight DLP Aggregator
 
               [Timer]
-              OnCalendar=*:3/10:10
+              OnCalendar={{ aw_dlp_aggregator_on_calendar | default('*:3/15:10') }}
               AccuracySec=30s
               RandomizedDelaySec=30s
               Persistent=false
@@ -2278,9 +2509,14 @@
             enabled: true
             state: started
             daemon_reload: true
+      when:
+        - aw_dlp_enabled | default(false) | bool
+        - aw_dlp_light_collector_enabled | default(false) | bool
 
     - name: Настроить IOC enrichment из Hayabusa Sigma
-      when: aw_dlp_ioc_enabled | default(false) | bool
+      when:
+        - aw_dlp_enabled | default(false) | bool
+        - aw_dlp_ioc_enabled | default(false) | bool
       block:
         - name: Создать каталог IOC enrichment
           ansible.builtin.file:

ansible/deploy_detmir_portal.yml

@@ -15,8 +15,16 @@
     detmir_portal_workforce_policy_path: "/etc/detmir-portal-workforce-policy.json"
     detmir_portal_ueba_policy_path: "/etc/detmir-portal-ueba-policy.yaml"
     detmir_portal_readiness_bundle_dir: "{{ detmir_portal_readiness_bundle_dir_override | default('/var/lib/activitywatch/health/readiness-bundle', true) }}"
+    detmir_portal_dlp_module_enabled: "{{ detmir_portal_dlp_module_enabled_override | default(false) }}"
 
   tasks:
+    - name: Refuse inconsistent DetMir portal DLP profile
+      ansible.builtin.assert:
+        that:
+          - detmir_portal_dlp_profile | default('core_only') in ['core_only', 'light', 'on_demand', 'full']
+          - (detmir_portal_dlp_profile | default('core_only') != 'core_only') or not (detmir_portal_dlp_module_enabled | bool)
+        fail_msg: "Inconsistent DetMir portal DLP profile: core_only must keep DETMIR_PORTAL_DLP_MODULE_ENABLED=false."
+
     - name: Check local detmir-portal binary
       ansible.builtin.stat:
         path: "{{ aw_rust_release_dir }}/detmir-portal"
@@ -54,6 +62,8 @@
           DETMIR_PORTAL_UEBA_POLICY_PATH={{ detmir_portal_ueba_policy_path }}
           DETMIR_PORTAL_TIMEOUT_SECONDS=25
           DETMIR_PORTAL_STATE_DIR=/var/lib/detmir-portal
+          DETMIR_PORTAL_DLP_MODULE_ENABLED={{ detmir_portal_dlp_module_enabled | bool | ternary('true', 'false') }}
+          DETMIR_PORTAL_DLP_PROFILE={{ detmir_portal_dlp_profile | default('core_only') }}
           DETMIR_PORTAL_DLP_DB_PATH=/var/lib/activitywatch/dlp_warehouse.sqlite
           DETMIR_PORTAL_EVIDENCE_ROOT=/var/lib/detmir-portal/evidence
           DETMIR_PORTAL_READINESS_BUNDLE_DIR={{ detmir_portal_readiness_bundle_dir }}
@@ -65,6 +75,65 @@
           CLICKHOUSE_USER={{ detmir_clickhouse_user | default('default') }}
           CLICKHOUSE_PASSWORD={{ detmir_clickhouse_password | default('') }}
 
+    - name: Install lightweight DLP warehouse sync helper
+      ansible.builtin.copy:
+        src: "{{ aw_repo_root }}/scripts/detmir_dlp_warehouse_sync.sh"
+        dest: /usr/local/bin/detmir-dlp-warehouse-sync
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Install lightweight DLP warehouse sync service
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/detmir-dlp-warehouse-sync.service
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Unit]
+          Description=Sync lightweight DetMir DLP SQLite warehouse for portal
+          After=network-online.target
+          Wants=network-online.target
+
+          [Service]
+          Type=oneshot
+          Environment=AW_DLP_WAREHOUSE_SOURCE_HOST={{ detmir_portal_dlp_warehouse_source_host | default('igor@10.10.10.13') }}
+          Environment=AW_DLP_WAREHOUSE_SOURCE_PATH={{ detmir_portal_dlp_warehouse_source_path | default('/var/lib/activitywatch/dlp_warehouse.sqlite') }}
+          Environment=AW_DLP_WAREHOUSE_DEST_PATH={{ detmir_portal_dlp_warehouse_dest_path | default('/var/lib/activitywatch/dlp_warehouse.sqlite') }}
+          Environment=AW_DLP_WAREHOUSE_SYNC_STATE_DIR={{ detmir_portal_dlp_warehouse_sync_state_dir | default('/var/lib/activitywatch/health') }}
+          ExecStart=/usr/local/bin/detmir-dlp-warehouse-sync
+          Nice=10
+          IOSchedulingClass=best-effort
+          IOSchedulingPriority=7
+          TimeoutStartSec=60
+
+    - name: Install lightweight DLP warehouse sync timer
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/detmir-dlp-warehouse-sync.timer
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Unit]
+          Description=Run lightweight DetMir DLP SQLite warehouse sync
+
+          [Timer]
+          OnBootSec=4min
+          OnUnitActiveSec={{ detmir_portal_dlp_warehouse_sync_interval | default('2min') }}
+          AccuracySec=30s
+          Persistent=false
+
+          [Install]
+          WantedBy=timers.target
+
+    - name: Enable lightweight DLP warehouse sync timer
+      ansible.builtin.systemd:
+        name: detmir-dlp-warehouse-sync.timer
+        enabled: true
+        state: started
+        daemon_reload: true
+      when: detmir_portal_dlp_module_enabled | bool
+
     - name: Preserve local ClickHouse security-events settings when available
       ansible.builtin.shell: |
         set -euo pipefail
@@ -117,7 +186,9 @@
         state: absent
       loop:
         - /etc/systemd/system/detmir-portal.service.d/20-timeouts.conf
+        - /etc/systemd/system/detmir-portal.service.d/20-prod-timeout.conf
         - /etc/systemd/system/detmir-portal.service.d/30-warm-cache.conf
+        - /etc/systemd/system/detmir-portal.service.d/30-prewarm-after-start.conf
       register: detmir_portal_stale_overrides
 
     - name: Install initial workforce policy when absent
@@ -174,6 +245,11 @@
           WantedBy=multi-user.target
       register: detmir_portal_service_unit
 
+    - name: Remove stale detmir-portal timeout override
+      ansible.builtin.file:
+        path: /etc/systemd/system/detmir-portal.service.d/10-detmir-check-env.conf
+        state: absent
+
     - name: Reload systemd
       ansible.builtin.systemd:
         daemon_reload: true

ansible/group_vars/all.yml

@@ -33,7 +33,10 @@ aw_worktime_manager_trend_min_points: 3
 aw_worktime_manager_trend_delta_pct: 10
 aw_worktime_manager_off_hours_threshold_seconds: 1800
 aw_worktime_interpretation_policy_path: "/etc/activitywatch/worktime-interpretation-policy.json"
-aw_dlp_influx_enabled: true
+aw_dlp_profile: "core_only"
+detmir_portal_dlp_profile: "light"
+detmir_portal_dlp_module_enabled_override: true
+aw_dlp_influx_enabled: false
 aw_dlp_influx_url: "http://192.0.2.10:8086"
 aw_dlp_influx_org: "proxmox"
 aw_dlp_influx_bucket: "aw_metrics"
@@ -47,6 +50,7 @@ aw_worktime_host: "{{ aw_monitored_windows_hostname }}"
 aw_rus_health_worktime_api_base: "http://127.0.0.1:5610"
 aw_rus_health_state_dir: "{{ aw_server_data_dir }}/health"
 aw_rus_health_validation_dir: "{{ aw_rus_health_state_dir }}/windows-validation"
+aw_rus_health_rdp_tcp_required: false
 aw_hayabusa_auto_case_enabled: true
 aw_hayabusa_auto_case_min_severity: "medium"
 aw_hayabusa_telegram_enabled: true
@@ -65,22 +69,46 @@ aw_server_cors_origins:
 
 aw_apply_worktime_settings: true
 
-aw_dlp_ioc_enabled: true
+aw_dlp_ioc_enabled: false
+aw_dlp_enabled: false
+aw_dlp_disabled_reason: ""
+aw_dlp_disabled_since: ""
+aw_dlp_light_collector_enabled: false
+aw_dlp_light_guard_enabled: true
+aw_dlp_light_guard_load_ratio: "1.50"
+aw_dlp_light_guard_mem_available_pct_min: "15"
+aw_dlp_light_guard_iowait_pct_max: "20"
+aw_dlp_light_guard_strikes_required: 3
+aw_dlp_light_guard_state_dir: "{{ aw_server_data_dir }}/health"
+aw_dlp_aggregator_bucket_prefixes: "aw-file-operations_,aw-dlp-incidents_"
+aw_dlp_aggregator_limit: 500
+aw_dlp_aggregator_lookback_hours: 2
+aw_dlp_aggregator_overlap_seconds: 60
+aw_dlp_aggregator_timeout_seconds: 8
+aw_dlp_aggregator_on_calendar: "*:3/15:10"
+aw_dlp_aggregator_cpu_quota: "10%"
+aw_dlp_aggregator_memory_max: "256M"
+aw_containment_enabled: false
+aw_containment_mode: "shadow"
+aw_containment_policy_path: "/etc/activitywatch/containment-policy.json"
+aw_containment_default_ttl_minutes: 60
+aw_containment_require_admin_channel_check: true
+aw_containment_allow_auto_for_servers: false
 aw_dlp_ioc_workdir: "/opt/activitywatch/dlp-ioc"
 aw_dlp_ioc_rules_zip_url: "https://github.com/Yamato-Security/hayabusa-rules/archive/refs/heads/main.zip"
 aw_dlp_ioc_refresh_on_boot_sec: "5min"
 aw_dlp_ioc_refresh_interval: "6h"
-aw_dlp_policy_engine_enabled: true
+aw_dlp_policy_engine_enabled: false
 aw_dlp_policy_engine_bind_host: "0.0.0.0"
 aw_dlp_policy_engine_port: 5601
 aw_dlp_policy_engine_db_path: "{{ aw_server_data_dir }}/dlp-policy-engine.sqlite"
-aw_dlp_content_analysis_enabled: true
-aw_dlp_integrations_enabled: true
-aw_dlp_case_management_enabled: true
+aw_dlp_content_analysis_enabled: false
+aw_dlp_integrations_enabled: false
+aw_dlp_case_management_enabled: false
 aw_dlp_case_bind_host: "0.0.0.0"
 aw_dlp_case_port: 5602
 aw_dlp_case_db_path: "/opt/activitywatch/dlp-case-management/cases.db"
-aw_dlp_compliance_enabled: true
+aw_dlp_compliance_enabled: false
 aw_dlp_compliance_report_dir: "/opt/activitywatch/dlp-compliance/reports"
 aw_dlp_compliance_template_path: "/opt/activitywatch/dlp-compliance/templates/152-fz-report.html"
 aw_server_post_deploy_health_check_enabled: true

aw-server/aw-server.env.example

@@ -16,7 +16,7 @@ AW_SERVER_GROUP=activitywatch
 AW_SERVER_PUBLIC_HOST=aw-server
 AW_WORKTIME_REPORT_BASE=http://aw-server:5610
 AW_WORKTIME_TZ=Europe/Moscow
-AW_WORKTIME_HOST=SHARKON2025
+AW_WORKTIME_HOST=HOST-EXAMPLE
 AW_WORKTIME_EVENTS_LIMIT=5000
 AW_WORKTIME_AW_HTTP_TIMEOUT_SECONDS=6
 AW_WORKTIME_EVENTS_CACHE_TTL_SECONDS=300
@@ -33,6 +33,16 @@ AW_WORKTIME_MANAGEMENT_WARM_URL=http://127.0.0.1:5610/reports/worktime/managemen
 AW_WORKTIME_MANAGEMENT_WARM_TIMEOUT_SECONDS=70
 
 # DLP IOC Configuration
+AW_DLP_ENABLED=false
+AW_DLP_PROFILE=core_only
+AW_DLP_DISABLED_REASON=detmir_prod_resource_guardrail
+AW_DLP_DISABLED_SINCE=
+AW_CONTAINMENT_ENABLED=false
+AW_CONTAINMENT_MODE=shadow
+AW_CONTAINMENT_POLICY=/etc/activitywatch/containment-policy.json
+AW_CONTAINMENT_DEFAULT_TTL_MINUTES=60
+AW_CONTAINMENT_REQUIRE_ADMIN_CHANNEL_CHECK=true
+AW_CONTAINMENT_ALLOW_AUTO_FOR_SERVERS=false
 AW_DLP_IOC_DIR=/opt/activitywatch/dlp-ioc/output
 
 # DLP Policy Engine Configuration
@@ -50,22 +60,24 @@ AW_HEALTH_CHECK_ENABLED=true
 AW_HEALTH_CHECK_INTERVAL=60
 AW_EXPECT_START_OF_DAY=00:00
 AW_EXPECT_ALWAYS_ACTIVE_PATTERN=aw-watcher-window
-AW_EXPECT_LANDINGPAGE=/#/activity/SHARKON2025/view/
+AW_EXPECT_LANDINGPAGE=/#/activity/HOST-EXAMPLE/view/
 AW_HEALTH_STRICT_FILEOPS=0
 AW_MONITORED_WINDOWS_HOST=<WINDOWS_HOST>
-AW_MONITORED_WINDOWS_HOSTNAME=SHARKON2025
+AW_MONITORED_WINDOWS_HOSTNAME=HOST-EXAMPLE
 AW_RUS_HEALTH_WORKTIME_API=http://127.0.0.1:5610
 AW_RUS_HEALTH_STATE_DIR=/var/lib/activitywatch/health
 AW_RUS_HEALTH_VALIDATION_DIR=/var/lib/activitywatch/health/windows-validation
 AW_RUS_HEALTH_SESSION_EVENTS_MAX_AGE_SECONDS=86400
 AW_RUS_HEALTH_GUARD_MAX_AGE_SECONDS=300
 AW_RUS_HEALTH_GUARD_REQUIRED=1
+AW_RUS_HEALTH_RDP_TCP_REQUIRED=true
+AW_RUS_HEALTH_WRAPPER_TIMEOUT_SECONDS=90
 AW_RUS_SLO_AW_BASE=http://127.0.0.1:5600
 AW_RUS_SLO_WORKTIME_BASE=http://127.0.0.1:5610
 AW_RUS_SLO_TARGET_PERCENT=99.97
 AW_BROWSER_SMOKE_AW_BASE=http://127.0.0.1:5600
 AW_BROWSER_SMOKE_WORKTIME_BASE=http://127.0.0.1:5610
-AW_BROWSER_SMOKE_HOST=SHARKON2025
+AW_BROWSER_SMOKE_HOST=HOST-EXAMPLE
 AW_BROWSER_SMOKE_OUTPUT_DIR=/var/lib/activitywatch/browser-smoke
 AW_BROWSER_SMOKE_KEEP_RUNS=24
 AW_BROWSER_SMOKE_ENGINE=chromium-cli
@@ -79,6 +91,15 @@ AW_HAYABUSA_TELEGRAM_ENABLED=true
 AW_HAYABUSA_TELEGRAM_MIN_SEVERITY=high
 AW_HAYABUSA_TELEGRAM_BOT_TOKEN=
 AW_HAYABUSA_TELEGRAM_CHAT_IDS=
+AW_SECURITY_FINDING_INBOX_ENABLED=false
+AW_SECURITY_FINDING_INBOX_REQUIRED=false
+AW_SECURITY_FINDING_INBOX_BIN=/usr/local/bin/security-finding-inbox
+AW_SECURITY_FINDING_INBOX_MIN_SEVERITY=medium
+AW_SECURITY_FINDING_EXECUTOR_WORK_DIR=/var/lib/activitywatch/security-finding-executor
+AW_SECURITY_FINDING_EXECUTOR_LOCK=/var/lock/aw-security-finding-executor.lock
+AW_CONTAINMENT_ENGINE_BIN=/usr/local/bin/containment-engine
+AW_CONTAINMENT_MANAGEMENT_ALLOWLIST=
+AW_CONTAINMENT_BLOCKED_REMOTE_ADDRESSES=
 
 # Integration Test Configuration
 AW_INTEGRATION_TEST_ENABLED=false

aw-server/hayabusa/README.md

@@ -79,6 +79,13 @@ Behavior:
 - optional `*.caseid` sidecar with the same basename triggers automatic bounded case linkage
 - processed `*.zip` is moved out of `drop/` into `report_dir/input-drop/` to avoid repeated re-trigger loops
 - sidecars are archived into `report_dir/input-sidecars/`
+- bad drop packages are rejected before `accept`, moved to
+  `/opt/hayabusa/quarantine/drop/<timestamp>_<package>/`, and recorded with a
+  `reason.json` file instead of blocking later packages
+- bad or partially extracted incoming packages are moved to
+  `/opt/hayabusa/quarantine/incoming/<timestamp>_<package>/`; `process-inbox`
+  continues with the remaining queue and does not trip systemd start-limit only
+  because of one poison archive
 
 ## Windows direct upload into the drop zone
 
@@ -118,4 +125,43 @@ Production scheduled task on `SHARKON2025`:
 
 Do not switch this task back to `SYSTEM` on the current RDP host: Task Scheduler starts `powershell.exe` under `SYSTEM`, but the process exits with `0xC0000142` before the upload script starts.
 
-Server-side processing accepts Windows zip packages with backslash path separators and UTF-8 BOM in sidecar JSON. `aw-hayabusa-autoprocess` processes the full incoming queue after accepting a drop package, so stale incoming files from an earlier failed run are drained before the latest intake is recorded.
+Server-side processing accepts Windows zip packages with backslash path
+separators and UTF-8 BOM in sidecar JSON. `aw-hayabusa-autoprocess` processes
+the full incoming queue after accepting a drop package, so stale incoming files
+from an earlier failed run are drained before the latest intake is recorded.
+
+Poison-package handling is fail-closed:
+
+- Rust `aw-hayabusa-autoprocess-rust` validates the zip and sidecars before
+  calling `aw-hayabusa accept`.
+- A corrupt/empty/unsafe drop package is quarantined with its `.meta.json`,
+  `.caseid`, optional checksum sidecar and `reason.json`.
+- `aw-hayabusa process-inbox` isolates a failed incoming package instead of
+  aborting the whole batch.
+- Operators replay only a fixed/re-exported package by moving it back to the
+  drop zone or incoming queue. Do not edit quarantined evidence in place.
+
+## Security Finding Inbox integration
+
+`aw-hayabusa-autoprocess-rust` can publish a normalized suspicious-workstation
+finding after a successful intake is written to `/opt/hayabusa/state/latest-intake.json`.
+
+Default is disabled to keep forensic processing independent from ClickHouse:
+
+```bash
+AW_SECURITY_FINDING_INBOX_ENABLED=false
+```
+
+Enable after the ClickHouse schema and CLI are installed:
+
+```bash
+AW_SECURITY_FINDING_INBOX_ENABLED=true
+AW_SECURITY_FINDING_INBOX_BIN=/usr/local/bin/security-finding-inbox
+AW_SECURITY_FINDING_INBOX_MIN_SEVERITY=medium
+AW_SECURITY_FINDING_INBOX_REQUIRED=false
+```
+
+With `AW_SECURITY_FINDING_INBOX_REQUIRED=false`, a temporary ClickHouse/inbox
+failure is logged as warning and does not poison the Hayabusa backlog. Use
+`true` only when the operator wants inbox publication failure to become an
+operational failure for the drop service.

aw-server/hayabusa/aw-hayabusa.sh

@@ -14,6 +14,7 @@ HAYA_STAGING_DIR="${AW_HAYABUSA_STAGING_DIR:-${HAYA_ROOT}/inbox/staging}"
 HAYA_ARCHIVE_PACKAGES_DIR="${AW_HAYABUSA_ARCHIVE_PACKAGES_DIR:-${HAYA_ROOT}/archive/packages}"
 HAYA_ARCHIVE_EXTRACTED_DIR="${AW_HAYABUSA_ARCHIVE_EXTRACTED_DIR:-${HAYA_ROOT}/archive/extracted}"
 HAYA_LOGS_DIR="${AW_HAYABUSA_LOGS_DIR:-${HAYA_ROOT}/state/logs}"
+HAYA_QUARANTINE_DIR="${AW_HAYABUSA_QUARANTINE_DIR:-${HAYA_ROOT}/quarantine/incoming}"
 LAST_REPORT_DIR=""
 
 usage() {
@@ -57,7 +58,8 @@ ensure_layout() {
     "${HAYA_INCOMING_DIR}" \
     "${HAYA_STAGING_DIR}" \
     "${HAYA_ARCHIVE_PACKAGES_DIR}" \
-    "${HAYA_ARCHIVE_EXTRACTED_DIR}"
+    "${HAYA_ARCHIVE_EXTRACTED_DIR}" \
+    "${HAYA_QUARANTINE_DIR}"
 }
 
 run_logged() {
@@ -405,7 +407,8 @@ process_one_package() {
 
   package_sha256="$(sha256sum "${package_path}" | awk '{print $1}')"
   if ! extract_zip_normalized "${package_path}" "${stage_dir}"; then
-    fail "normalized zip extraction failed for ${package_path}"
+    echo "ERROR: normalized zip extraction failed for ${package_path}" >&2
+    return 1
   fi
 
   local manifest_path host evtx_root archive_pkg_dir archive_extract_dir status report_dir
@@ -453,7 +456,47 @@ process_one_package() {
   if [ -n "${report_dir}" ]; then
     echo "Report directory: ${report_dir}"
   fi
-  [ "${status}" = "ok" ] || fail "Package workflow ended with status=${status}; archived for inspection"
+  if [ "${status}" != "ok" ]; then
+    echo "ERROR: Package workflow ended with status=${status}; archived for inspection" >&2
+    return 1
+  fi
+}
+
+quarantine_incoming_package() {
+  local package_path="$1"
+  local reason="$2"
+  local ts package_name package_base safe_base target_dir stage_dir sha256
+  ts="$(date -u +%Y%m%dT%H%M%SZ)"
+  package_name="$(basename "${package_path}")"
+  package_base="${package_name%.zip}"
+  safe_base="$(sanitize "${package_name}")"
+  [ -n "${safe_base}" ] || safe_base="package.zip"
+  target_dir="${HAYA_QUARANTINE_DIR}/${ts}_${safe_base}"
+  mkdir -p "${target_dir}"
+  sha256=""
+  if [ -f "${package_path}" ] && command -v sha256sum >/dev/null 2>&1; then
+    sha256="$(sha256sum "${package_path}" | awk '{print $1}')"
+  fi
+  for candidate in "${package_path}" "${package_path}.sha256" "${package_path}.host"; do
+    if [ -e "${candidate}" ]; then
+      mv "${candidate}" "${target_dir}/"
+    fi
+  done
+  stage_dir="${HAYA_STAGING_DIR}/${package_base}"
+  if [ -d "${stage_dir}" ]; then
+    mv "${stage_dir}" "${target_dir}/staging-partial"
+  fi
+  cat >"${target_dir}/reason.json" <<EOF
+{
+  "quarantined_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
+  "source": "aw-hayabusa process-inbox",
+  "original_path": "${package_path}",
+  "sha256": "${sha256}",
+  "reason": "${reason}",
+  "operator_action": "inspect source package, re-export EVTX archive if needed, then replay by moving a fixed package back to incoming or drop"
+}
+EOF
+  echo "Quarantined failed incoming package: ${target_dir}" >&2
 }
 
 process_inbox() {
@@ -482,15 +525,26 @@ process_inbox() {
   esac
   ensure_layout
 
-  local count=0 pkg
+  local count=0 failed=0 pkg
   while IFS= read -r pkg; do
-    process_one_package "${pkg}" "${mode}"
-    count=$((count + 1))
+    if process_one_package "${pkg}" "${mode}"; then
+      count=$((count + 1))
+    else
+      failed=$((failed + 1))
+      if [ -f "${pkg}" ]; then
+        quarantine_incoming_package "${pkg}" "process_one_package failed"
+      else
+        echo "Package failed after archive/move, see archive intake manifest for details: ${pkg}" >&2
+      fi
+    fi
     if [ "${limit}" -gt 0 ] && [ "${count}" -ge "${limit}" ]; then
       break
     fi
   done < <(find "${HAYA_INCOMING_DIR}" -maxdepth 1 -type f -name '*.zip' | sort)
   [ "${count}" -gt 0 ] || echo "No packages in ${HAYA_INCOMING_DIR}"
+  if [ "${failed}" -gt 0 ]; then
+    echo "process-inbox completed with quarantined_or_archived_failures=${failed}" >&2
+  fi
 }
 
 main() {

clickhouse-1c/README.md

@@ -66,6 +66,9 @@ File 1C + reglog + host telemetry
 - `grafana/provisioning/dashboards/files/1c-telemetry-board.json` — telemetry dashboard по состоянию файловых баз, reglog growth, busy markers и host load.
 - `detections/build_entity_timeline.sql` — сборка единого timeline слоя.
 - `detections/open_cases_from_detections.sql` — шаблон открытия cases из detections.
+- `security/security_finding_inbox.sql` — schema Security Finding Inbox:
+  подозрительные станции, raw finding evidence, workflow/executor events и
+  latest-state view для DetMir Portal.
 - `ops/etl-cron.example` — legacy cron example; production использует
   `aw-1c-ingest.timer`.
 - `ops/retention-policy.md` — минимальная retention policy.

clickhouse-1c/docker-compose.yml

@@ -10,6 +10,16 @@ services:
     ports:
       - "${CLICKHOUSE_PORT}:8123"
       - "${CLICKHOUSE_NATIVE_PORT}:9000"
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "clickhouse-client --host 127.0.0.1 --user \"$${CLICKHOUSE_USER}\" --password \"$${CLICKHOUSE_PASSWORD}\" --database \"$${CLICKHOUSE_DB}\" --query 'SELECT 1' >/dev/null",
+        ]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 30s
     volumes:
       - clickhouse_1c_data:/var/lib/clickhouse
       - ./clickhouse/init:/docker-entrypoint-initdb.d:ro

clickhouse-1c/ops/run_ingest_cycle.sh

@@ -76,6 +76,14 @@ docker exec -i "${CH_CONTAINER}" clickhouse-client \
   --database "${CLICKHOUSE_DB}" \
   < "${ROOT}/detections/open_cases_from_detections.sql"
 
+if [[ -f "${ROOT}/security/security_finding_inbox.sql" ]]; then
+  docker exec -i "${CH_CONTAINER}" clickhouse-client \
+    --user "${CLICKHOUSE_USER}" \
+    --password "${CLICKHOUSE_PASSWORD}" \
+    --database "${CLICKHOUSE_DB}" \
+    < "${ROOT}/security/security_finding_inbox.sql"
+fi
+
 if [[ "${RUN_MANAGER_BRIEF_AFTER_INGEST}" == "1" ]]; then
   if ! "${ROOT}/ops/run_manager_brief.sh"; then
     echo "warning: manager brief refresh failed after ingest" >&2

clickhouse-1c/security/security_finding_inbox.sql

@@ -0,0 +1,97 @@
+CREATE TABLE IF NOT EXISTS analytics_1c.security_findings
+(
+    ts DateTime64(3, 'UTC'),
+    finding_id String,
+    host String,
+    user String,
+    ip String,
+    department LowCardinality(String),
+    state LowCardinality(String),
+    severity LowCardinality(String),
+    confidence LowCardinality(String),
+    score UInt16,
+    source LowCardinality(String),
+    rule_id String,
+    rule_title String,
+    summary String,
+    recommended_action LowCardinality(String),
+    management_channel_checked UInt8,
+    evidence_ref String,
+    raw_json String,
+    ingested_at DateTime64(3, 'UTC') DEFAULT now64(3)
+)
+ENGINE = MergeTree
+PARTITION BY toYYYYMM(ts)
+ORDER BY (state, severity, host, ts, finding_id);
+
+CREATE TABLE IF NOT EXISTS analytics_1c.security_finding_workflow_events
+(
+    ts DateTime64(3, 'UTC'),
+    finding_id String,
+    event_type LowCardinality(String),
+    status LowCardinality(String),
+    actor String,
+    comment String,
+    decision_status String,
+    rollback_plan_id String,
+    plan_id String,
+    evidence_json String
+)
+ENGINE = MergeTree
+PARTITION BY toYYYYMM(ts)
+ORDER BY (finding_id, ts, event_type);
+
+DROP VIEW IF EXISTS analytics_1c.security_finding_inbox;
+
+CREATE VIEW analytics_1c.security_finding_inbox AS
+SELECT
+    f.finding_id AS finding_id,
+    min(f.ts) AS first_seen,
+    max(f.ts) AS last_seen,
+    argMax(f.host, f.ingested_at) AS host,
+    argMax(f.user, f.ingested_at) AS user,
+    argMax(f.ip, f.ingested_at) AS ip,
+    argMax(f.department, f.ingested_at) AS department,
+    argMax(f.state, f.ingested_at) AS state,
+    argMax(f.severity, f.ingested_at) AS severity,
+    argMax(f.confidence, f.ingested_at) AS confidence,
+    argMax(f.score, f.ingested_at) AS score,
+    argMax(f.source, f.ingested_at) AS source,
+    argMax(f.rule_id, f.ingested_at) AS rule_id,
+    argMax(f.rule_title, f.ingested_at) AS rule_title,
+    argMax(f.summary, f.ingested_at) AS summary,
+    argMax(f.recommended_action, f.ingested_at) AS recommended_action,
+    argMax(f.management_channel_checked, f.ingested_at) AS management_channel_checked,
+    argMax(f.evidence_ref, f.ingested_at) AS evidence_ref,
+    argMax(f.raw_json, f.ingested_at) AS raw_json,
+    coalesce(nullIf(w.status, ''), 'new') AS workflow_status,
+    coalesce(nullIf(w.event_type, ''), 'created') AS last_workflow_event,
+    w.workflow_updated_at AS workflow_updated_at,
+    coalesce(w.actor, '') AS workflow_actor,
+    coalesce(w.decision_status, '') AS decision_status,
+    coalesce(w.rollback_plan_id, '') AS rollback_plan_id,
+    coalesce(w.plan_id, '') AS plan_id
+FROM analytics_1c.security_findings AS f
+LEFT JOIN
+(
+    SELECT
+        finding_id,
+        argMax(event_type, ts) AS event_type,
+        argMax(status, ts) AS status,
+        argMax(actor, ts) AS actor,
+        argMax(decision_status, ts) AS decision_status,
+        argMax(rollback_plan_id, ts) AS rollback_plan_id,
+        argMax(plan_id, ts) AS plan_id,
+        max(ts) AS workflow_updated_at
+    FROM analytics_1c.security_finding_workflow_events
+    GROUP BY finding_id
+) AS w USING finding_id
+GROUP BY
+    f.finding_id,
+    w.status,
+    w.event_type,
+    w.workflow_updated_at,
+    w.actor,
+    w.decision_status,
+    w.rollback_plan_id,
+    w.plan_id;

configs/containment-finding.example.json

@@ -0,0 +1,21 @@
+{
+  "host": "HOST-EXAMPLE",
+  "host_role": "workstation",
+  "state": "suspected_infected",
+  "confidence": "high",
+  "signals": [
+    {
+      "source": "hayabusa",
+      "rule_id": "sigma-placeholder-critical",
+      "confidence": "critical"
+    },
+    {
+      "source": "velociraptor",
+      "rule_id": "Windows.Hayabusa.Monitoring",
+      "confidence": "high"
+    }
+  ],
+  "recommended_action": "windows_firewall_quarantine",
+  "management_channel_checked": true,
+  "manual_operator_flag": false
+}

configs/containment-policy.example.json

@@ -0,0 +1,17 @@
+{
+  "enabled": false,
+  "mode": "shadow",
+  "default_ttl_minutes": 60,
+  "require_admin_channel_check": true,
+  "allow_auto_for_servers": false,
+  "allowed_actions": [
+    "windows_firewall_quarantine",
+    "pfsense_host_block"
+  ],
+  "management_allowlist": [
+    "aw_server",
+    "velociraptor_server",
+    "admin_jump_host"
+  ],
+  "minimum_high_signals_for_auto": 2
+}

configs/security/security-finding.example.json

@@ -0,0 +1,21 @@
+{
+  "ts": "2026-06-25T10:00:00Z",
+  "host": "HOST-EXAMPLE",
+  "user": "user-example",
+  "ip": "10.10.20.42",
+  "department": "demo",
+  "state": "suspected_infected",
+  "severity": "critical",
+  "confidence": "high",
+  "score": 95,
+  "source": "hayabusa",
+  "rule_id": "demo-sigma-critical",
+  "rule_title": "Demo high-confidence suspicious workstation",
+  "summary": "Demo finding for Security Finding Inbox validation.",
+  "recommended_action": "windows_firewall_quarantine",
+  "management_channel_checked": true,
+  "evidence_ref": "demo://hayabusa/HOST-EXAMPLE/demo-sigma-critical",
+  "metadata": {
+    "sample": "true"
+  }
+}

configs/windows-firewall-containment-request.example.json

@@ -0,0 +1,18 @@
+{
+  "target_host": "HOST-EXAMPLE",
+  "plan_id": "rollback-host-example-001",
+  "ttl_minutes": 60,
+  "reason": "High-confidence Hayabusa and Velociraptor containment drill",
+  "management_allowlist": [
+    "10.10.10.10",
+    "10.10.10.11",
+    "10.10.10.12"
+  ],
+  "blocked_remote_addresses": [
+    "10.10.20.0/24",
+    "10.10.30.0/24"
+  ],
+  "profiles": [
+    "Domain"
+  ]
+}

docs/CONTAINMENT_OPERATOR_RUNBOOK_RU.md

@@ -0,0 +1,194 @@
+# AWatch-rus containment operator runbook
+
+Дата: 2026-06-25.
+
+Runbook для безопасной проверки containment-логики. Текущая реализация не
+блокирует рабочие станции и не меняет сеть. Она только рассчитывает решение и
+показывает, был бы quarantine рекомендован или отказан.
+
+## 1. Сборка
+
+```bash
+cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian
+export CARGO_TARGET_DIR=/home/igor/.cache/detmir-adk-rust-target
+cargo build --manifest-path adk-rust/Cargo.toml -p containment-engine
+```
+
+## 2. Smoke в disabled/shadow режиме
+
+```bash
+cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian
+bash scripts/containment_shadow_smoke.sh
+```
+
+Ожидаемо:
+
+- JSON содержит `would_mutate=false`;
+- `decision_status=disabled` для default example policy;
+- нет изменений firewall, pfSense, AD, VLAN, routes.
+
+## 3. Проверка shadow recommendation
+
+Создайте временный policy с:
+
+```json
+{
+  "enabled": true,
+  "mode": "shadow"
+}
+```
+
+на базе `configs/containment-policy.example.json`, затем выполните:
+
+```bash
+containment-engine decide \
+  --policy /tmp/containment-policy-shadow.json \
+  --finding configs/containment-finding.example.json \
+  --pretty
+```
+
+Ожидаемо:
+
+- `decision_status=shadow_recommended`;
+- `would_mutate=false`;
+- `rollback_plan_id` заполнен;
+- `blockers=[]`.
+
+## 4. Manual approval mode
+
+`manual_approval` должен только поставить решение в состояние
+`manual_approval_required`. Он не применяет block сам.
+
+## 5. Auto mode
+
+В текущей реализации `auto` может вернуть `auto_ready`, но `would_mutate=false`.
+Это намеренно: decision layer сам не применяет блокировки.
+
+Запрещено считать `auto_ready` фактической блокировкой. Это только решение
+control plane.
+
+## 6. Windows Firewall executor dry-run
+
+Security Finding Inbox показывает подозрительные станции и фиксирует workflow
+события. Портал не выполняет firewall apply. После `approved` и
+`apply_requested` отдельный процесс `security-finding-inbox executor` может
+выполнить контролируемый цикл `decide -> plan -> apply -> verify`, а при
+ошибке `rollback`. По умолчанию executor работает dry-run/fail-closed.
+
+Сгенерируйте план:
+
+```bash
+cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian
+containment-engine windows-firewall plan \
+  --request configs/windows-firewall-containment-request.example.json \
+  --pretty > /tmp/windows-firewall-plan.json
+```
+
+Проверьте `blockers`. Для корректного example они должны быть пустыми.
+
+Dry-run apply:
+
+```bash
+containment-engine windows-firewall apply \
+  --plan /tmp/windows-firewall-plan.json \
+  --confirm-apply YES \
+  --pretty
+```
+
+Ожидаемо:
+
+- `execution_status=dry_run_commands_ready`;
+- `would_mutate=false`;
+- в JSON есть PowerShell-команды `New-NetFirewallRule`;
+- реальные firewall-правила не создаются.
+
+Verify dry-run:
+
+```bash
+containment-engine windows-firewall verify \
+  --plan /tmp/windows-firewall-plan.json \
+  --pretty
+```
+
+Rollback dry-run:
+
+```bash
+containment-engine windows-firewall rollback \
+  --plan /tmp/windows-firewall-plan.json \
+  --confirm-rollback YES \
+  --pretty
+```
+
+## 7. Real Windows execution rules
+
+Dry-run polling из центрального контура:
+
+```bash
+security-finding-inbox executor \
+  --once \
+  --dry-run \
+  --containment-engine-bin /usr/local/bin/containment-engine \
+  --policy /etc/activitywatch/containment-policy.json \
+  --management-allowlist 10.10.10.10,10.10.10.11 \
+  --blocked-remote-addresses 10.10.20.0/24,10.10.30.0/24
+```
+
+Реальный Windows Firewall apply допускается только на целевой Windows-станции:
+
+```powershell
+security-finding-inbox.exe executor `
+  --once `
+  --execute-local `
+  --confirm-execute YES `
+  --executor-host HOST-EXAMPLE `
+  --containment-engine-bin C:\ProgramData\AWatch-rus\containment-engine.exe `
+  --policy C:\ProgramData\AWatch-rus\containment-policy.json `
+  --management-allowlist 10.10.10.10,10.10.10.11 `
+  --blocked-remote-addresses 10.10.20.0/24,10.10.30.0/24
+```
+
+Executor откажется, если нет `approved` перед `apply_requested`, finding не
+`suspected_infected`/`confirmed_infected`, management channel не проверен,
+allowlist/block ranges пустые, host finding не совпадает с executor host для
+local apply, containment policy возвращает blocker или Windows Firewall plan
+содержит blockers.
+
+`--execute-local` разрешён только для отдельного lab Windows host, где заранее
+проверены:
+
+- доступ с admin jump host;
+- доступ к AWatch/Velociraptor management адресам;
+- rollback command;
+- out-of-band доступ, если firewall rule ошибочен;
+- TTL и оператор, ответственный за возврат.
+
+Не использовать широкие блокировки `Any`/`LocalSubnet`: Windows Firewall
+block-правила могут перекрыть allow-правила и отрезать управление.
+
+## 8. Когда можно расширять real containment executor
+
+Только после выполнения условий:
+
+- есть lab host;
+- подтвержден management allowlist;
+- есть rollback command;
+- есть TTL rollback;
+- есть audit log;
+- `plan`, `apply`, `verify`, `rollback` покрыты тестами;
+- auto-containment для серверов остается disabled.
+
+## 9. Проверки перед commit
+
+```bash
+cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian
+python3 scripts/public_secret_pattern_check.py
+bash -n scripts/containment_shadow_smoke.sh
+bash scripts/containment_shadow_smoke.sh
+git diff --check
+
+cd adk-rust
+export CARGO_TARGET_DIR=/home/igor/.cache/detmir-adk-rust-target
+cargo fmt --all --check
+cargo test -p containment-engine
+cargo clippy -p containment-engine --all-targets -- -D warnings
+```

docs/CONTAINMENT_POLICY_RU.md

@@ -0,0 +1,146 @@
+# AWatch-rus containment policy
+
+Дата: 2026-06-25.
+
+Этот документ описывает безопасную политику автоматической/полуавтоматической
+изоляции рабочих станций. Containment нужен для быстрого ограничения
+распространения заражения, но не является автоматическим лечением,
+remediation, EDR/XDR или сертифицированной СЗИ.
+
+## Default posture
+
+По умолчанию containment выключен:
+
+```text
+AW_CONTAINMENT_ENABLED=false
+AW_CONTAINMENT_MODE=shadow
+```
+
+`shadow` означает: система рассчитывает рекомендацию и audit, но не меняет
+firewall, pfSense, AD, VLAN, маршруты или состояние рабочих станций.
+
+## Policy file
+
+Default path:
+
+```text
+/etc/activitywatch/containment-policy.json
+```
+
+Repo example:
+
+```text
+configs/containment-policy.example.json
+```
+
+Критичные поля:
+
+- `enabled`: глобальный opt-in;
+- `mode`: `shadow`, `manual_approval`, `auto`;
+- `default_ttl_minutes`: срок quarantine до rollback/review;
+- `require_admin_channel_check`: запрещает блокировку, если управляемый канал
+  не проверен;
+- `allow_auto_for_servers`: по умолчанию `false`;
+- `allowed_actions`: whitelist containment-действий;
+- `management_allowlist`: каналы, которые должны оставаться доступными;
+- `minimum_high_signals_for_auto`: минимальный порог high/critical signals.
+
+## Safety rules
+
+- Не включать `auto` до успешного shadow burn-in.
+- Не включать auto-containment для серверов и domain controllers.
+- Не запускать containment без rollback record.
+- Не запускать containment, если будет потерян admin/management channel.
+- Не применять широкие AD/OU/domain actions.
+- Не удалять файлы, registry keys или процессы как часть containment.
+- Не заявлять, что containment гарантированно остановил заражение.
+
+## Decision threshold
+
+Automatic quarantine допускается только если:
+
+- host role is `workstation`;
+- host не входит в critical infrastructure denylist;
+- есть один `critical` signal или несколько `high` signals;
+- management-channel precheck passed;
+- action есть в `allowed_actions`;
+- rollback record создан успешно.
+
+## Security Finding Inbox handoff
+
+Security Finding Inbox (`docs/SECURITY_FINDING_INBOX_RU.md`) является входной
+очередью для подозрительных рабочих станций. Он хранит findings и workflow
+events в ClickHouse, показывает их в DetMir Portal. Портал не выполняет
+containment самостоятельно.
+
+Workflow `apply_requested` означает только операторский запрос на применение.
+Фактическое применение идет через отдельный процесс
+`security-finding-inbox executor`, который повторно проверяет `approved`,
+запускает `containment-engine decide`, строит Windows Firewall plan, затем
+выполняет `apply`, `verify` и при ошибке `rollback`. Реальная мутация firewall
+разрешена только на целевой Windows-станции при `--execute-local`,
+`--confirm-execute YES` и совпадении `--executor-host` с finding host.
+
+## Current implementation status
+
+Реализован первый безопасный слой:
+
+- Rust CLI `containment-engine`;
+- strict JSON policy/finding parsing;
+- `disabled`, `shadow`, `manual_approval`, `auto` decision states;
+- server/unknown host roles refused for auto mode by default;
+- `would_mutate=false` for current implementation;
+- separate Windows Firewall executor interface:
+  `plan`, `apply`, `verify`, `rollback`;
+- Windows Firewall executor defaults to dry-run command generation unless
+  `--execute-local` and explicit confirmation are used.
+
+pfSense/AD/VLAN mutation paths are not implemented.
+
+## Windows Firewall executor
+
+Executor input example:
+
+```text
+configs/windows-firewall-containment-request.example.json
+```
+
+The executor is deliberately separate from decision making:
+
+```bash
+containment-engine windows-firewall plan \
+  --request configs/windows-firewall-containment-request.example.json \
+  --pretty > /tmp/windows-firewall-plan.json
+
+containment-engine windows-firewall apply \
+  --plan /tmp/windows-firewall-plan.json \
+  --confirm-apply YES \
+  --pretty
+
+containment-engine windows-firewall verify \
+  --plan /tmp/windows-firewall-plan.json \
+  --pretty
+
+containment-engine windows-firewall rollback \
+  --plan /tmp/windows-firewall-plan.json \
+  --confirm-rollback YES \
+  --pretty
+```
+
+Without `--execute-local`, `apply` and `rollback` return generated PowerShell
+commands and `would_mutate=false`.
+
+With `--execute-local`, execution is allowed only on a Windows host and only
+after explicit confirmation. On non-Windows hosts the executor fails closed.
+
+## Windows Firewall guardrails
+
+- `management_allowlist` is mandatory.
+- `blocked_remote_addresses` must be explicit IPs/subnets.
+- Broad block targets such as `Any`, `*`, `LocalSubnet`, `Internet`,
+  `Intranet` are refused.
+- The executor does not change Windows Firewall profile defaults.
+- The executor does not disable interfaces, routes, users, services or
+  processes.
+- Every plan includes rollback through `Remove-NetFirewallRule -Group ...`.
+- A successful dry-run is not evidence that the workstation has been isolated.

docs/DETMIR_CURRENT_STATE_RU.md

@@ -26,19 +26,38 @@ logical host id остаётся `SHARKON2025`. Подробный post-restore
   `653b22b0fbf29a22f7de42ade7b689490b1de16fa07e785e4e0efd3078e7a3bc`.
 - Бэкап предыдущего binary на сервере:
   `/usr/local/bin/detmir-portal.bak.20260625T045640Z`.
-- Runtime mode после phase 1 deploy:
-  `DETMIR_PORTAL_DLP_MODULE_ENABLED=false`.
+- Runtime mode после 2026-06-30 prod hardening:
+  server-side DLP runtime зафиксирован в `core_only/disabled`.
+  Portal DLP UI/API module может оставаться включённым для чтения исторического
+  SQLite/evidence-среза, но это не означает запуск DLP collectors/exporters.
 - Server-side optional DLP runtime control:
   `AW_DLP_ENABLED=false|true` и `DETMIR_DLP_ENABLED=false|true`.
+- Current resource profile: `AW_DLP_ENABLED=false`,
+  `AW_DLP_PROFILE=core_only`; возврат в `light` выполняется только вручную
+  после проверки нагрузки.
 - Runtime control/statistics script:
   `scripts/detmir_dlp_runtime_control.sh` / live
   `/usr/local/bin/detmir-dlp-runtime-control`.
-- Live DLP runtime state after 2026-06-25 controlled disable:
-  `AW_DLP_ENABLED=false`, `AW_DLP_INFLUX_ENABLED=false`;
-  active/enabled DLP units: `0/0`.
+- DLP runtime state after 2026-06-30 prod hardening:
+  `AW_DLP_ENABLED=false`, `AW_DLP_PROFILE=core_only`,
+  `AW_DLP_INFLUX_ENABLED=false`; optional DLP units should be
+  `inactive/disabled`. `detmir-dlp-load-guard.timer` remains enabled and active
+  as protection for any later operator re-enable.
 - Reason: DLP runtime materially increases Proxmox VM/LXC, InfluxDB, Grafana,
-  ClickHouse and AW server load. In production DetMir it is currently kept
-  disabled, but remains a documented optional module that can be enabled later.
+  ClickHouse and AW server load. In production DetMir the safe default is
+  `core_only`; `light` is a reconnectable profile, not the automatic default.
+- Auto-disable guard:
+  `scripts/detmir_dlp_load_guard.sh` / live
+  `/usr/local/bin/detmir-dlp-load-guard`. При перегрузе переводит DLP в
+  `core_only` через runtime-control и пишет evidence в
+  `/var/lib/activitywatch/health/dlp-light-guard-state.json`.
+- DLP warehouse sync для портала:
+  `scripts/detmir_dlp_warehouse_sync.sh` / live
+  `/usr/local/bin/detmir-dlp-warehouse-sync`. Доставляет локальный SQLite
+  snapshot на portal host для UEBA/DLP views без heavy DLP hot path.
+- Loki CT is intentionally excluded from the current DetMir production resource
+  profile. It must not be returned by routine deploy/recovery while the goal is
+  to keep Proxmox VM/LXC load low.
 - Health после деплоя: `/healthz` возвращал `status=ok`.
 - Readiness после деплоя: `/readyz` возвращал `status=ready`.
 
@@ -84,9 +103,11 @@ logical host id остаётся `SHARKON2025`. Подробный post-restore
 - DLP evidence, screenshots, endpoint signals, case review и forensics
   enrichment требуют больше CPU/IO/сетевых операций, чем Workforce core.
 
-Вывод: DLP/evidence/forensics enrichment уже вынесен из обязательного hot path
-phase 1 через `DETMIR_PORTAL_DLP_MODULE_ENABLED=false`, но полная оптимизация
-тяжелого snapshot/prewarm остается отдельной инженерной задачей.
+Вывод: DLP/evidence/forensics enrichment вынесен из обязательного hot path.
+Phase 1 делал это через `DETMIR_PORTAL_DLP_MODULE_ENABLED=false`; текущий
+lightweight-профиль оставляет DLP-status/UEBA-сигналы включенными без тяжелого
+evidence/case/exporter path. Полная оптимизация тяжелого snapshot/prewarm
+остается отдельной инженерной задачей.
 
 ## Целевая граница после переработки
 
@@ -154,23 +175,45 @@ AW_DLP_ENABLED=true|false
 DETMIR_DLP_ENABLED=true|false
 ```
 
-Default остается `true`, чтобы существующее поведение не менялось без явного
-решения администратора. Для ускоренного Workforce/operator режима допускается
-`DETMIR_PORTAL_DLP_MODULE_ENABLED=false`; в этом режиме портал:
+DetMir production default после 2026-06-30 hardening:
+`AW_DLP_ENABLED=false` / `AW_DLP_PROFILE=core_only`. Portal DLP module may stay
+enabled for historical/security views, but server-side DLP collectors/exporters
+remain off. В этом режиме портал:
 
 - не читает DLP incident/case/review/audit файлы в основном report/operator
   path;
-- отключает security-events backend внутри snapshot, не меняя сохраненные
-  ClickHouse credentials;
-- возвращает disabled-state для DLP evidence API;
-- не считает отсутствие DLP ошибкой Workforce core.
+- использует только уже имеющийся лёгкий DLP-срез для UEBA и статуса;
+- не включает evidence/case/exporters/Loki/Influx-heavy path;
+- не считает отсутствие heavy DLP ошибкой Workforce core.
 
-Ansible-параметр поставки:
+Ansible-параметр поставки для старого disabled-профиля:
 
 ```yaml
 detmir_portal_dlp_module_enabled_override: false
 ```
 
+Для текущего safe production профиля:
+
+```yaml
+detmir_portal_dlp_module_enabled_override: true
+aw_dlp_profile: "core_only"
+aw_dlp_enabled: false
+aw_dlp_influx_enabled: false
+aw_dlp_light_collector_enabled: false
+aw_dlp_light_guard_enabled: true
+```
+
+Возврат в `light` выполняется только после resource check:
+
+```bash
+sudo AW_DLP_DISABLED_REASON=operator_reenable_after_resource_check \
+  /usr/local/bin/detmir-dlp-runtime-control set-profile light
+sudo sed -i \
+  -e 's/^AW_DLP_ENABLED=.*/AW_DLP_ENABLED=true/' \
+  -e 's/^AW_DLP_PROFILE=.*/AW_DLP_PROFILE=light/' \
+  /etc/activitywatch/aw-server.env
+```
+
 Отдельный `detmir-portal-evidence` сервис не отключается этим флагом и остается
 самостоятельным контуром evidence/API при наличии отдельной конфигурации.
 
@@ -189,6 +232,7 @@ Hayabusa/Velociraptor boundary:
 Server-side optional DLP runtime описан отдельно:
 
 - [DLP_OPTIONAL_RUNTIME_RU.md](DLP_OPTIONAL_RUNTIME_RU.md).
+- [DLP_RESOURCE_PROFILES_RU.md](DLP_RESOURCE_PROFILES_RU.md).
 
 При `AW_DLP_ENABLED=false`:
 
@@ -197,10 +241,27 @@ Server-side optional DLP runtime описан отдельно:
 - `detmir-check`, `check-aw-full` и `check-aw-data` не считают DLP buckets
   обязательными;
 - `detmir-readiness` не требует DLP Influx write и DLP systemd units;
+- DLP profile changes use
+  `/usr/local/bin/detmir-dlp-runtime-control set-profile <profile>` and keep a
+  rollback snapshot for `/usr/local/bin/detmir-dlp-runtime-control rollback`;
 - перед отключением и после отключения собираются JSON-срезы в
   `/var/lib/activitywatch/health/dlp-runtime-history/`, latest-срез остается в
   `/var/lib/activitywatch/health/dlp-runtime-state.json`.
 
+При `AW_DLP_PROFILE=light`:
+
+- `activitywatch-dlp-aggregator.timer` собирает только ограниченный набор DLP
+  events в локальный SQLite warehouse;
+- `detmir-dlp-warehouse-sync.timer` доставляет этот warehouse на portal host
+  атомарным snapshot;
+- UEBA может учитывать `dlp_warn`/`dlp_fail` без запуска Loki/Influx-heavy path;
+- `detmir-dlp-load-guard.timer` автоматически переводит профиль в `core_only`
+  при превышении порогов load/RAM/iowait;
+- тяжёлые DLP units (`aw-dlp-influx-exporter`, report/syslog/webhook/CEF,
+  policy engine, case management, evidence API) должны оставаться выключенными.
+- если `detmir-dlp-load-guard.timer` видит повторный перегруз, он автоматически
+  возвращает DLP runtime в `core_only`.
+
 Live disable evidence 2026-06-25:
 
 - `dlp-health-check` returned `ok=true`, `dlp:mode=disabled`;
@@ -307,6 +368,7 @@ curl -sS --max-time 5 http://10.10.10.2:8720/healthz
 - Не удалять DLP collectors и warehouse ради ускорения портала.
 - Не включать heavy DLP или Velociraptor server runtime автоматически при
   обычном deploy без ресурсного решения.
+- Не включать Loki CT автоматически при обычном deploy/recovery DetMir.
 - Не менять UI/API несовместимо: новые поля должны быть additive.
 - Не заявлять completed DLP decoupling до live deploy и browser/API smoke.
 - Не позиционировать AWatch-rus как сертифицированную DLP/SIEM/EDR/СЗИ.

docs/DLP_OPTIONAL_RUNTIME_RU.md

@@ -1,14 +1,37 @@
 # Optional DLP runtime for DetMir
 
-Цель: DLP-контур должен отключаться управляемо, без ложных аварий в health/readiness и без автоматического подъема heavy-пайплайна, когда задача контура - снизить нагрузку на InfluxDB, Grafana и ClickHouse.
+Цель: DLP-контур должен оставаться подключаемым, но production default для
+DetMir сейчас `core_only/disabled`. Возврат в лёгкий режим выполняется вручную
+после resource check; при перегрузе guard снова переводит DLP в `core_only`.
+
+Ресурсные профили и rollback-процедура описаны отдельно:
+[DLP_RESOURCE_PROFILES_RU.md](DLP_RESOURCE_PROFILES_RU.md).
 
 ## Что отключается
 
+Текущий production-профиль DetMir после 2026-06-30 prod hardening -
+`core_only/disabled`:
+
+- `AW_DLP_ENABLED=false`;
+- `AW_DLP_PROFILE=core_only`;
+- `AW_DLP_INFLUX_ENABLED=false`;
+- optional DLP timers/services inactive/disabled;
+- `detmir-dlp-load-guard.timer` остаётся enabled/active как защита на случай
+  последующего operator re-enable;
+- heavy DLP units, Influx exporter, evidence/case/report/integration units и
+  Loki остаются выключенными.
+
+Автоотключение выполняет `detmir-dlp-load-guard`: при превышении порогов
+load/RAM/iowait он переводит DLP в `core_only` через
+`detmir-dlp-runtime-control set-profile core_only`. После стабилизации контур
+возвращается вручную командой `set-profile light`.
+
 Штатный runtime off включает:
 
 - `AW_DLP_ENABLED=false` на AW server;
 - `DETMIR_DLP_ENABLED=false` в управляющем DetMir contour check;
-- `DETMIR_PORTAL_DLP_MODULE_ENABLED=false` для portal UI/API DLP-модуля;
+- portal UI/API DLP-модуль может оставаться включённым для исторического
+  SQLite/evidence-среза; это не запускает server-side DLP runtime;
 - остановку DLP timers/services:
   - `aw-dlp-influx-exporter.timer`;
   - `activitywatch-dlp-aggregator.timer`;
@@ -137,10 +160,31 @@ AW_DLP_ENABLED=false check-aw-full
 
 ## Возврат DLP
 
+Для DetMir предпочтительно возвращать не весь DLP сразу, а лёгкий профиль.
+Перед этим проверить load/RAM/iowait на Proxmox/AW/Influx/Grafana/ClickHouse.
+
 ```bash
-sudo sed -i 's/^AW_DLP_ENABLED=.*/AW_DLP_ENABLED=true/' /etc/activitywatch/aw-server.env
-sudo /usr/local/bin/detmir-dlp-runtime-control enable
-sudo systemctl restart aw-worktime-api.service || true
+sudo AW_DLP_DISABLED_REASON=operator_reenable_after_resource_check \
+  /usr/local/bin/detmir-dlp-runtime-control set-profile light
+sudo sed -i \
+  -e 's/^AW_DLP_ENABLED=.*/AW_DLP_ENABLED=true/' \
+  -e 's/^AW_DLP_PROFILE=.*/AW_DLP_PROFILE=light/' \
+  -e 's/^AW_DLP_INFLUX_ENABLED=.*/AW_DLP_INFLUX_ENABLED=false/' \
+  /etc/activitywatch/aw-server.env
+```
+
+Если профиль ухудшил состояние контура:
+
+```bash
+sudo /usr/local/bin/detmir-dlp-runtime-control rollback
+```
+
+`on_demand` и `full` включаются только вручную после отдельного resource
+preflight:
+
+```bash
+sudo /usr/local/bin/detmir-dlp-runtime-control set-profile on_demand
+sudo /usr/local/bin/detmir-dlp-runtime-control set-profile full
 ```
 
 Для portal:
@@ -187,13 +231,27 @@ production DetMir без отдельного ресурсного решени
 В inventory/group vars:
 
 ```yaml
+aw_dlp_profile: "core_only"
 aw_dlp_enabled: false
-aw_dlp_disabled_reason: "operator_disabled_to_reduce_influx_grafana_clickhouse_load"
-aw_dlp_disabled_since: "2026-06-25"
-detmir_portal_dlp_module_enabled_override: false
+aw_dlp_influx_enabled: false
+aw_dlp_light_collector_enabled: false
+aw_dlp_light_guard_enabled: true
+detmir_portal_dlp_module_enabled_override: true
 ```
 
-При `aw_dlp_enabled: false` playbook пишет `AW_DLP_ENABLED=false`, не включает DLP service/timer runtime и не должен возвращать DLP Influx exporter/aggregator в active state.
+Для временного operator re-enable в `light`:
+
+```yaml
+aw_dlp_profile: "light"
+aw_dlp_enabled: true
+aw_dlp_influx_enabled: false
+aw_dlp_light_collector_enabled: true
+aw_dlp_light_guard_enabled: true
+```
+
+При `aw_dlp_profile: light` playbook включает только лёгкий агрегатор, IOC
+refresh и load guard. DLP Influx exporter, report/syslog/webhook/CEF,
+policy/case/evidence и Loki не должны возвращаться в active state.
 
 ## Ограничения
 

docs/DLP_RESOURCE_PROFILES_RU.md

@@ -0,0 +1,196 @@
+# DLP resource profiles for DetMir
+
+Дата фиксации: 2026-06-30.
+
+Цель: сохранить стабильный Workforce/AW hot path на малом DetMir Proxmox
+контуре и оставить DLP подключаемым модулем. Loki CT в текущем production
+resource profile отключен намеренно и не является обязательной зависимостью
+AWatch-rus.
+
+## Профили
+
+### `core_only`
+
+Production default и аварийный/экономный профиль для DetMir.
+
+- DLP runtime: выключен.
+- DLP Influx exporter: выключен.
+- DLP aggregators/report/syslog/webhook/CEF/case/evidence units: выключены.
+- Loki/Promtail: выключены.
+- Workforce, Worktime, ActivityWatch, ClickHouse 1C, Grafana core,
+  Hayabusa/Security Finding Inbox: работают независимо от DLP.
+
+Назначение: безопасное состояние при перегрузе CPU/RAM/IOPS или при ручном
+отключении DLP.
+
+### `light`
+
+Операторский re-enable профиль для DetMir после проверки ресурсов: лёгкий DLP
+режим без Loki и без Influx-heavy path.
+
+- Разрешены `activitywatch-dlp-aggregator.timer` и
+  `aw-dlp-ioc-refresh.timer`.
+- `dlp-aggregator-rust` собирает ограниченный срез из bucket-ов
+  `aw-file-operations_` и `aw-dlp-incidents_` в локальный
+  `dlp_warehouse.sqlite` для последующей UEBA-корреляции.
+- `detmir-dlp-warehouse-sync.timer` доставляет SQLite warehouse на portal host
+  через атомарный snapshot, чтобы DetMir Portal/UEBA читали локальный файл, а
+  не блокировали AW server hot path.
+- Для агрегатора заданы короткий lookback, малый event limit, timeout,
+  `CPUQuota` и `MemoryMax`.
+- Evidence, screenshots, case management и exporters остаются выключенными.
+- InfluxDB/Grafana/Loki не участвуют в hot path лёгкого DLP.
+- Используется для ежедневной эксплуатации, когда нужны DLP-сигналы для UEBA,
+  но нельзя нагружать Proxmox/Influx/Grafana/ClickHouse.
+
+### `on_demand`
+
+Временный режим для конкретного инцидента или окна проверки.
+
+- Разрешены IOC refresh, policy engine, case management и evidence API.
+- Influx exporter, CEF/syslog/webhook/report scheduler и aggregator остаются
+  выключенными, если администратор отдельно не выбрал `full`.
+- После окна проверки профиль должен быть возвращён в `core_only`.
+
+### `full`
+
+Только вручную, только после resource preflight.
+
+- Может включать DLP Influx exporter, aggregator, reports, integrations,
+  policy/case и evidence.
+- На DetMir не является штатным production режимом.
+- Запрещено включать автоматически при обычном deploy/recovery.
+
+## Управление
+
+На AW server:
+
+```bash
+sudo /usr/local/bin/detmir-dlp-runtime-control status
+sudo /usr/local/bin/detmir-dlp-runtime-control set-profile core_only
+sudo /usr/local/bin/detmir-dlp-runtime-control set-profile light
+sudo /usr/local/bin/detmir-dlp-runtime-control set-profile on_demand
+sudo /usr/local/bin/detmir-dlp-runtime-control set-profile full
+sudo /usr/local/bin/detmir-dlp-load-guard
+```
+
+Перед каждым `set-profile` скрипт сохраняет rollback-снимок active/enabled
+состояния DLP units:
+
+```text
+/var/lib/activitywatch/health/dlp-runtime-rollback.state
+```
+
+Откат к предыдущему состоянию:
+
+```bash
+sudo /usr/local/bin/detmir-dlp-runtime-control rollback
+```
+
+Важно: rollback восстанавливает только systemd active/enabled состояния DLP
+units. Он не меняет retention, не удаляет данные и не включает Loki CT.
+
+## Автоотключение при перегрузе
+
+`detmir-dlp-load-guard.timer` запускает
+`/usr/local/bin/detmir-dlp-load-guard`. Guard читает `/proc/loadavg`,
+`/proc/meminfo` и `/proc/stat`; если load, свободная память или iowait выходят
+за пороги несколько запусков подряд (`AW_DLP_GUARD_STRIKES_REQUIRED`, default
+`3`), а DLP units активны, он переводит DLP в `core_only` через:
+
+```bash
+AW_DLP_DISABLED_REASON=auto_disabled_by_dlp_load_guard:<reason> \
+  /usr/local/bin/detmir-dlp-runtime-control set-profile core_only
+```
+
+State и история пишутся в:
+
+```text
+/var/lib/activitywatch/health/dlp-light-guard-state.json
+/var/lib/activitywatch/health/dlp-light-guard-history/
+```
+
+Единичный IO/load spike фиксируется как `observe_overload`, но DLP не
+отключается до достижения порога подряд. Guard не перезапускает
+ActivityWatch/портал, не меняет маршруты, не трогает ClickHouse/Grafana и не
+включает Loki. Возврат из `core_only` в `light` делает администратор после
+стабилизации контура и проверки Proxmox/AW/Influx/Grafana/ClickHouse load. Если
+перегруз повторится, guard снова переведёт профиль в `core_only`.
+
+## Доставка DLP warehouse на портал
+
+Portal читает DLP-срез из локального
+`/var/lib/activitywatch/dlp_warehouse.sqlite`. На разнесённом контуре DetMir
+этот файл создаётся на AW server, поэтому используется лёгкий sync:
+
+```bash
+sudo systemctl start detmir-dlp-warehouse-sync.service
+sudo systemctl status detmir-dlp-warehouse-sync.timer
+sudo jq . /var/lib/activitywatch/health/dlp-warehouse-sync-state.json
+```
+
+Sync делает SQLite backup на AW server и атомарно заменяет локальный файл на
+portal host. Он не запускает DLP evidence/case/exporters и не включает Loki.
+
+## Ansible defaults
+
+Для DetMir production defaults должны оставаться экономными и
+самозащищающимися:
+
+```yaml
+aw_dlp_profile: "core_only"
+aw_dlp_enabled: false
+aw_dlp_influx_enabled: false
+aw_dlp_light_collector_enabled: false
+aw_dlp_light_guard_enabled: true
+detmir_portal_dlp_profile: "core_only"
+detmir_portal_dlp_module_enabled_override: true
+```
+
+Для временного возврата в лёгкий профиль:
+
+```yaml
+aw_dlp_profile: "light"
+aw_dlp_enabled: true
+aw_dlp_influx_enabled: false
+aw_dlp_light_collector_enabled: true
+aw_dlp_light_guard_enabled: true
+detmir_portal_dlp_profile: "light"
+detmir_portal_dlp_module_enabled_override: true
+```
+
+Все тяжёлые DLP component flags должны быть `false`, пока администратор явно не
+выбрал `on_demand` или `full`.
+
+## Resource preflight перед `full`
+
+Перед временным включением `full` проверить:
+
+- Proxmox host load и steal/wait;
+- свободную RAM и swap pressure;
+- IOPS/latency storage;
+- ClickHouse health и backlog ingest;
+- InfluxDB/Grafana health, если они участвуют в выбранном профиле;
+- ActivityWatch `/healthz`, Worktime API и portal latency;
+- отсутствие старого Loki CT в autostart.
+
+Если любой core-сервис деградирует, DLP возвращается в `core_only`.
+
+## Проверка
+
+```bash
+DETMIR_RESILIENCE_EXPECT_DLP_PROFILE=light \
+DETMIR_RESILIENCE_EXPECT_LOKI_OFF=1 \
+scripts/detmir_resilience_check.sh --repo
+```
+
+Live check на сервере в `light` должен показывать inactive для heavy DLP units
+и Loki units. В `core_only` inactive должны быть все optional DLP units.
+
+## Запрещённые утверждения
+
+- Не заявлять, что AWatch-rus заменяет DLP/SIEM/EDR.
+- Не заявлять, что Loki обязателен для DetMir production.
+- Не заявлять DLP health OK, если DLP выключен.
+- Не запускать автоматическое блокирование рабочих станций без approve/apply
+  workflow.

docs/LOW_COST_SIGMA_HAYABUSA_VELOCIRAPTOR_ADDON_RU.md

@@ -0,0 +1,813 @@
+# Low-cost Sigma/Hayabusa/Velociraptor containment addon
+
+Дата: 2026-06-25.
+
+Цель: добавить в AWatch-rus дешевый, воспроизводимый и отключаемый слой
+security containment + forensics для организаций без зрелого SIEM/EDR. Главный
+смысл модуля - быстро ограничить дальнейшее распространение заражения или
+подозрительной активности с рабочей станции, сохранив управляемый канал
+расследования и восстановления.
+
+Это дополнение не делает AWatch-rus сертифицированной DLP/SIEM/EDR/XDR/СЗИ и
+не заменяет штатные средства защиты. Автоматическая блокировка здесь означает
+policy-approved containment/quarantine, а не автоматическое лечение системы.
+
+## Upstream basis
+
+- Hayabusa: fast Windows event log forensics timeline generator and threat
+  hunting tool, written in Rust, using Sigma-compatible Hayabusa rules.
+- Hayabusa supports single-host/live analysis, offline analysis of collected
+  logs, and enterprise-wide use through a Velociraptor artifact.
+- Hayabusa outputs timeline/results suitable for CSV, JSON/JSONL and HTML
+  reports.
+- `Windows.Hayabusa.Monitoring` in Velociraptor Curated Sigma is an artifact
+  intended to triage a Windows host and is based on `Windows.Sigma.BaseEvents`.
+- Velociraptor is an endpoint visibility and collection tool using VQL
+  artifacts. Its normal deployment is server + clients, but it also supports
+  offline collectors and command-line artifact execution.
+
+Primary references:
+
+- https://github.com/Yamato-Security/hayabusa
+- https://github.com/Yamato-Security/hayabusa/wiki/About-Hayabusa
+- https://github.com/Yamato-Security/hayabusa-rules
+- https://sigma.velocidex.com/docs/artifacts/windows.hayabusa.monitoring/
+- https://github.com/Velocidex/velociraptor
+- https://docs.velociraptor.app/docs/deployment/
+
+## Product positioning
+
+Рабочее название модуля:
+
+```text
+AWatch-rus Low-Cost Containment Pack
+```
+
+Назначение:
+
+- быстро получить полезный containment + DFIR/threat-hunting слой там, где
+  нет SIEM/EDR;
+- автоматически или полуавтоматически изолировать подозрительно зараженную
+  рабочую станцию от критичных сегментов;
+- сохранить минимальный управляемый канал: AWatch-rus/Velociraptor server,
+  администраторский jump/VPN, DNS/NTP при необходимости;
+- запускать Hayabusa/Sigma-анализ EVTX и Velociraptor artifact collection;
+- давать владельцу и администратору понятные findings, timeline и evidence;
+- связывать findings с AWatch-rus cases и operator/forensics views;
+- оставаться optional и выключаемым без деградации Workforce core.
+
+Запрещенные claims:
+
+- не писать, что это SIEM replacement;
+- не писать, что это DLP replacement;
+- не писать, что это EDR/XDR;
+- не писать, что это сертифицированная СЗИ;
+- не писать, что автоматическое remediation включено;
+- не писать, что automatic containment гарантированно остановит заражение;
+- не писать, что threat detection ML/LLM-based;
+- не писать, что найденные события являются доказанной атакой без ручной
+  проверки.
+
+Допустимая формулировка:
+
+```text
+Optional low-cost containment, security analytics and forensics layer based on
+open-source Hayabusa/Sigma/Velociraptor workflows.
+```
+
+## Containment objective
+
+Модуль должен отвечать на вопрос:
+
+```text
+Как максимально быстро ограничить рабочую станцию, которая выглядит зараженной,
+чтобы она не заражала соседние машины и не продолжала утечку/распространение?
+```
+
+Необходимо разделять:
+
+- `suspected_infected` - есть правила/сигналы/аномалии, достаточные для
+  карантина по политике организации;
+- `confirmed_infected` - есть ручное подтверждение администратора/ИБ;
+- `contained` - станция технически ограничена;
+- `released` - карантин снят вручную или по документированному rollback.
+
+Containment actions должны быть обратимыми, журналируемыми и ограниченными по
+blast radius. По умолчанию допускается `shadow` или `manual_approval`; fully
+automatic quarantine включается только отдельным флагом и только после
+allowlist/rollback проверки.
+
+## Architecture
+
+### Modes
+
+1. `disabled`
+   - default для conservative deployment;
+   - все readiness checks возвращают disabled-state;
+   - Workforce/ActivityWatch core не зависит от модуля.
+
+2. `hayabusa_offline`
+   - текущий базовый режим;
+   - Windows scheduled task экспортирует EVTX zip;
+   - серверный `aw-hayabusa-drop.path` принимает package;
+   - `aw-hayabusa-autoprocess` валидирует zip, process-inbox, quarantine.
+
+3. `velociraptor_offline_collector`
+   - для бедных/малых контуров без постоянно работающего Velociraptor server;
+   - AWatch-rus собирает/хранит signed offline collector bundle;
+   - запуск collector выполняется вручную или scheduled task;
+   - результаты импортируются как artifact bundle.
+
+4. `velociraptor_server_clients`
+   - optional managed mode;
+   - Linux server рядом с AW/Proxmox или отдельной VM;
+   - Windows clients ставятся только явным Ansible-флагом;
+   - используется для управляемого запуска `Windows.Hayabusa.Monitoring`.
+
+5. `containment_shadow`
+   - decision engine считает, что сделал бы, но ничего не блокирует;
+   - безопасный default для пилота;
+   - используется для настройки правил и false-positive анализа.
+
+6. `containment_manual_approval`
+   - система формирует containment recommendation;
+   - администратор подтверждает действие в CLI/портале;
+   - все действия пишутся в audit trail.
+
+7. `containment_auto`
+   - система сама применяет заранее разрешенные quarantine-действия;
+   - включается только явным флагом;
+   - требует allowlist, rollback TTL и проверку сохранения admin channel.
+
+### Boundaries
+
+Core remains:
+
+- ActivityWatch server;
+- Workforce reports;
+- RDP/window/AFK/worktime collectors;
+- 1C/ClickHouse analytics;
+- portal health/readiness;
+- Hayabusa drop quarantine hardening.
+
+Optional containment/forensics layer:
+
+- Hayabusa binary and rules;
+- Sigma/Hayabusa curated rules cache;
+- Velociraptor binary/config/artifacts;
+- Velociraptor clients/offline collectors;
+- artifact result import;
+- findings summary and case links;
+- containment decision engine;
+- containment executor for approved channels.
+
+Containment channels:
+
+- Windows host firewall quarantine:
+  allow only AWatch-rus/Velociraptor server, DNS/NTP if required, and admin
+  jump/VPN;
+- pfSense/network gateway block:
+  block workstation IP/MAC from lateral/internal segments, keep management
+  exception;
+- switch/VLAN quarantine when supported:
+  move port/client to quarantine VLAN through explicit integration;
+- Windows local containment:
+  stop risky shares/services, disable outbound SMB/RDP to peers, collect
+  evidence;
+- Active Directory actions, if configured:
+  disable only the workstation account or user session by policy, never broad
+  OU/domain actions by default.
+
+Non-goals:
+
+- deleting malware;
+- cleaning registry/files;
+- killing arbitrary processes based on weak signal;
+- disabling domain-wide accounts;
+- blocking servers/shared infrastructure automatically;
+- hiding the host from administrators.
+
+No hot-path dependency:
+
+- portal first screen must not wait for Velociraptor;
+- Workforce reports must not query Velociraptor;
+- readiness must not fail when module is disabled;
+- heavy artifact execution must be timer/manual/background only.
+
+## Proposed configuration
+
+Ansible group vars:
+
+```yaml
+aw_forensics_pack_enabled: false
+aw_hayabusa_enabled: true
+aw_hayabusa_rules_enabled: true
+aw_hayabusa_rules_version: "pinned"
+aw_hayabusa_rules_update_enabled: false
+
+aw_velociraptor_enabled: false
+aw_velociraptor_mode: "disabled" # disabled|offline_collector|server_clients
+aw_velociraptor_version: "pinned"
+aw_velociraptor_server_bind_host: "127.0.0.1"
+aw_velociraptor_public_enabled: false
+aw_velociraptor_artifact_pack_enabled: true
+aw_velociraptor_hayabusa_artifact_enabled: true
+
+aw_forensics_store_raw_artifacts: false
+aw_forensics_raw_retention_days: 7
+aw_forensics_result_retention_days: 90
+aw_forensics_max_parallel_jobs: 1
+aw_forensics_max_job_minutes: 30
+aw_forensics_cpu_quota_pct: 25
+aw_forensics_io_nice: true
+
+aw_containment_enabled: false
+aw_containment_mode: "shadow" # shadow|manual_approval|auto
+aw_containment_default_ttl_minutes: 60
+aw_containment_require_admin_channel_check: true
+aw_containment_allow_auto_for_servers: false
+aw_containment_allowed_actions:
+  - windows_firewall_quarantine
+  - pfsense_host_block
+aw_containment_management_allowlist:
+  - "aw_server"
+  - "velociraptor_server"
+  - "admin_jump_host"
+```
+
+Runtime env:
+
+```text
+AW_FORENSICS_PACK_ENABLED=false
+AW_HAYABUSA_ENABLED=true
+AW_VELOCIRAPTOR_ENABLED=false
+AW_VELOCIRAPTOR_MODE=disabled
+AW_FORENSICS_STORE_RAW_ARTIFACTS=false
+AW_CONTAINMENT_ENABLED=false
+AW_CONTAINMENT_MODE=shadow
+```
+
+## Data flow
+
+### Existing Hayabusa path
+
+```text
+Windows EVTX export
+  -> zip + sidecars
+  -> /opt/activitywatch/aw-rus-ops/drop
+  -> aw-hayabusa-autoprocess
+  -> validate package
+  -> accept/process-inbox
+  -> result_dir/latest-intake.json
+  -> case link / portal summary
+  -> quarantine on bad package
+```
+
+### New Velociraptor path
+
+```text
+Velociraptor artifact run
+  -> Windows.Hayabusa.Monitoring / custom artifact
+  -> Velociraptor result export
+  -> AWatch-rus import directory
+  -> schema validation
+  -> derived findings JSON/SQLite
+  -> optional case link
+  -> portal forensics summary
+```
+
+### Containment path
+
+```text
+Finding/signals
+  -> confidence and policy evaluation
+  -> containment decision record
+  -> admin-channel precheck
+  -> shadow/manual/auto execution
+  -> verify containment
+  -> case/audit record
+  -> TTL/rollback queue
+```
+
+Raw artifacts and derived results must be separated:
+
+- raw EVTX/result bundles: restricted evidence storage;
+- derived findings: sanitized AWatch-rus views;
+- operator notes/case links: case database;
+- public/demo exports: no raw hostnames, users, IPs, paths or secrets.
+
+## Security and privacy guardrails
+
+- Store no secrets in repo, docs, demo data or screenshots.
+- Do not commit generated Velociraptor config with private keys/client secrets.
+- Do not expose Velociraptor GUI publicly by default.
+- Default server bind should be loopback or private VPN-only address.
+- Require explicit operator action for client deployment.
+- Require retention policy for raw artifacts.
+- Require redaction for export/demo packs.
+- Require audit log for artifact imports, deletes and case links.
+- Treat Velociraptor outputs as untrusted input: validate schema, size, paths
+  and timestamps before import.
+- Never execute arbitrary downloaded artifacts without pinning/checksums.
+- Never run containment if management channel would be lost.
+- Never auto-contain servers unless explicitly allowed and tested.
+- Always create rollback record before applying a block.
+- Always include TTL or manual release path.
+- Always log who/what triggered containment, which signals were used and which
+  network paths remain allowed.
+
+## Containment decision model
+
+Inputs:
+
+- high/critical Hayabusa/Sigma rule hits;
+- suspicious Windows event sequence from Velociraptor artifact;
+- AWatch-rus endpoint signals such as mass file changes, unusual process/file
+  behavior, DLP/security signal spikes;
+- administrator manual flag.
+
+Decision fields:
+
+```json
+{
+  "host": "HOST",
+  "host_role": "workstation",
+  "state": "suspected_infected",
+  "confidence": "medium|high|critical",
+  "signals": ["hayabusa:rule-id", "velociraptor:artifact"],
+  "recommended_action": "windows_firewall_quarantine",
+  "mode": "shadow|manual_approval|auto",
+  "ttl_minutes": 60,
+  "management_channel_checked": true,
+  "rollback_plan_id": "opaque-id"
+}
+```
+
+Minimum threshold for automatic quarantine:
+
+- host role is workstation;
+- host is not in denylist of critical infrastructure;
+- at least one critical signal or multiple high-confidence signals;
+- management channel precheck passed;
+- containment action is in allowlist;
+- rollback record successfully written.
+
+## Current implementation status
+
+Implemented first safe layer:
+
+- Rust CLI `containment-engine`;
+- strict JSON parsing for policy/finding input;
+- example files:
+  `configs/containment-policy.example.json`,
+  `configs/containment-finding.example.json`,
+  `configs/windows-firewall-containment-request.example.json`;
+- disabled-by-default Ansible/env configuration;
+- `shadow`, `manual_approval` and `auto` decision states;
+- automatic containment refused for non-workstation roles by default;
+- `would_mutate=false` in current implementation;
+- Windows Firewall executor interface:
+  `plan`, `apply`, `verify`, `rollback`;
+- Windows Firewall dry-run generates PowerShell `New-NetFirewallRule`,
+  `Get-NetFirewallRule` and `Remove-NetFirewallRule` commands;
+- Windows Firewall execution is fail-closed without explicit confirmation and
+  `--execute-local`;
+- Security Finding Inbox:
+  ClickHouse schema, Rust ingest CLI, Hayabusa/Velociraptor source adapters,
+  portal page `Подозрительные станции` and separate executor process for
+  approved `apply_requested` workflow;
+- smoke script:
+  `bash scripts/containment_shadow_smoke.sh`;
+- operator/policy docs:
+  `docs/CONTAINMENT_OPERATOR_RUNBOOK_RU.md`,
+  `docs/CONTAINMENT_POLICY_RU.md`.
+
+Not implemented yet:
+
+- production-verified Windows Firewall mutation on lab/real workstations;
+- real pfSense alias/table mutation;
+- AD/VLAN executor;
+- TTL rollback service;
+- portal containment action execution. The current portal records workflow
+  events only and does not mutate firewall/network state; mutation is reserved
+  for `security-finding-inbox executor` with explicit local Windows
+  confirmation.
+
+## Codex implementation plan
+
+### Phase 0. Architecture and docs only
+
+Files:
+
+- `docs/LOW_COST_SIGMA_HAYABUSA_VELOCIRAPTOR_ADDON_RU.md`;
+- `docs/PROJECT_STATUS_RU.md`;
+- `docs/REGISTRY_FUNCTIONAL_SCOPE_RU.md`;
+- `README.md`.
+
+Tasks:
+
+- record addon scope and non-goals;
+- document upstream references and license/supply-chain review requirement;
+- state that module is planned/optional until implemented;
+- keep forbidden SIEM/DLP/СЗИ claims blocked.
+
+Acceptance:
+
+- docs mention optional low-cost containment/forensics layer;
+- no runtime/API/UI/product code change;
+- secret scan and diff check pass.
+
+### Phase 1. Inventory current Hayabusa implementation
+
+Files:
+
+- `aw-server/hayabusa/README.md`;
+- `aw-server/hayabusa/aw-hayabusa.sh`;
+- `adk-rust/crates/hayabusa-tools/`;
+- `windows/export-evtx-for-hayabusa.ps1`;
+- `windows/export-upload-hayabusa-to-aw-server.ps1`;
+- `ansible/deploy_aw_server.yml`;
+- `ansible/deploy_aw_windows.yml`.
+
+Tasks:
+
+- document installed binaries, units, timers, directories and retention;
+- verify current drop/inbox/quarantine behavior;
+- add a manifest file for current Hayabusa server bundle;
+- add a read-only status command if missing.
+
+Acceptance:
+
+- `aw-hayabusa doctor` remains green;
+- bad zip quarantine behavior remains intact;
+- no change to DLP disabled runtime state.
+
+### Phase 2. Supply-chain manifest and pinned downloads
+
+New files:
+
+- `third_party/forensics/manifest.json`;
+- `scripts/prepare_forensics_binaries.sh`;
+- `docs/FORENSICS_SUPPLY_CHAIN_RU.md`.
+
+Tasks:
+
+- define pinned versions for Hayabusa, Hayabusa rules and Velociraptor;
+- define SHA256 checksums and source URLs;
+- support offline cache directory;
+- fail closed if checksum mismatch;
+- never auto-update rules in production unless explicitly enabled.
+
+Acceptance:
+
+- dry-run prints planned downloads only;
+- checksum verification works on cached fixture;
+- no network required for deploy when cache exists.
+
+### Phase 3. Optional Velociraptor server install
+
+New/changed files:
+
+- `ansible/group_vars/all.yml`;
+- `ansible/group_vars/all.example.yml`;
+- `ansible/deploy_aw_server.yml`;
+- `ops/systemd/velociraptor.service`;
+- `docs/VELOCIRAPTOR_DEPLOYMENT_RU.md`.
+
+Tasks:
+
+- add `aw_velociraptor_enabled=false` default;
+- install Velociraptor binary only when enabled;
+- generate config only on target host, not in repo;
+- bind to loopback/private address by default;
+- store datastore under `/var/lib/velociraptor`;
+- store config under `/etc/velociraptor`;
+- add systemd service with resource limits;
+- avoid public exposure unless explicitly configured.
+
+Acceptance:
+
+- disabled mode creates no running service;
+- enabled mode installs service and returns local health;
+- generated config is not committed;
+- Ansible syntax check passes.
+
+### Phase 4. Velociraptor client/offline collector packaging
+
+Files:
+
+- `ansible/deploy_aw_windows.yml`;
+- `windows/ActivityWatch.Windows.Common.psm1`;
+- `windows/validate-deployment.ps1`;
+- optional `windows/install-velociraptor-client.ps1`.
+
+Tasks:
+
+- add explicit deployment mode:
+  `disabled|offline_collector|client_service`;
+- package client installer/offline collector from pinned binary/config;
+- install client service only when explicitly enabled;
+- keep scheduled/manual offline collector for low-cost mode;
+- log to `C:\ProgramData\AWatch-rus\logs\velociraptor-*.log`;
+- include service/task checks in validation only when enabled.
+
+Acceptance:
+
+- disabled mode leaves Windows host untouched;
+- offline collector can run and produce an export bundle;
+- service mode reports healthy enrollment without exposing credentials.
+
+### Phase 5. Hayabusa/Sigma artifact integration
+
+Files:
+
+- `third_party/forensics/artifacts/`;
+- `scripts/import_velociraptor_artifact_pack.sh`;
+- `docs/HAYABUSA_SIGMA_RULES_RU.md`.
+
+Tasks:
+
+- import/prepare `Windows.Hayabusa.Monitoring` artifact pack;
+- document mapping to Hayabusa rules;
+- create curated profile:
+  `low-cost-default`, `incident`, `full`;
+- add noisy-rule tuning file;
+- require version metadata in every run.
+
+Acceptance:
+
+- artifact pack import is reproducible;
+- rules profile can be listed without running collection;
+- config supports small-host low-resource default.
+
+### Phase 6. AWatch-rus result import
+
+Prefer Rust.
+
+New crate or extension:
+
+- `adk-rust/crates/forensics-importer`;
+  or extend `adk-rust/crates/hayabusa-tools`.
+
+Tasks:
+
+- import Hayabusa JSON/JSONL/CSV summary;
+- import Velociraptor artifact result export;
+- normalize to derived finding schema:
+  `source`, `host`, `time`, `rule`, `level`, `mitre`, `summary`,
+  `evidence_ref`, `case_id`, `tool_version`, `rules_version`;
+- reject oversized, malformed and path-traversal payloads;
+- write derived SQLite/JSON under `/var/lib/activitywatch/forensics`;
+- do not copy raw artifacts unless `AW_FORENSICS_STORE_RAW_ARTIFACTS=true`.
+
+Acceptance:
+
+- unit tests cover malformed JSON, oversized file, path traversal, empty result;
+- fixture import produces stable output;
+- raw-sensitive data is not rendered in default portal view.
+
+### Phase 7. Containment control plane
+
+Prefer Rust.
+
+New crate or extension:
+
+- `adk-rust/crates/containment-engine`;
+  or extend `adk-rust/crates/forensics-importer` with a separate module.
+
+Tasks:
+
+- define containment decision schema and audit log;
+- add policy file:
+  `/etc/activitywatch/containment-policy.json`;
+- add host role model:
+  `workstation|server|domain_controller|unknown`;
+- add safe defaults:
+  `enabled=false`, `mode=shadow`, server auto-containment disabled;
+- implement decision evaluation from imported findings;
+- implement dry-run/shadow output;
+- implement manual approval queue;
+- implement rollback record format.
+
+Acceptance:
+
+- unit tests cover workstation/server/unknown host roles;
+- automatic action is refused for server/unknown role by default;
+- no action runs if management channel precheck fails;
+- shadow mode produces audit record and does not mutate host/network.
+
+### Phase 8. Containment executors
+
+Executor targets:
+
+- Windows firewall quarantine through PowerShell/Rust Windows helper;
+- pfSense alias/table block through explicit API/SSH integration;
+- optional switch/VLAN integration only behind feature flag.
+
+Tasks:
+
+- implement executor interface:
+  `plan`, `apply`, `verify`, `rollback`;
+- first implemented executor: Windows Firewall explicit management allowlist
+  plus explicit block ranges, without broad `Any`/`LocalSubnet` block and
+  without default firewall profile changes;
+- apply pfSense host block using IP/MAC only after current lease/identity
+  verification;
+- store rollback before mutation;
+- add TTL-based rollback timer;
+- add emergency release command.
+
+Acceptance:
+
+- fixture mode shows exact firewall/pfSense plan;
+- apply refuses empty allowlist;
+- verify confirms blocked lateral path and allowed management path;
+- rollback restores previous rules;
+- logs contain no secrets.
+
+### Phase 9. Portal and API integration
+
+Files:
+
+- `adk-rust/crates/detmir-portal/`;
+- `docs/PORTAL_API_CONTRACTS_RU.md`;
+- `docs/DETMIR_CURRENT_STATE_RU.md`.
+
+Tasks:
+
+- add optional forensics module state:
+  `disabled|not_configured|ready|degraded`;
+- show derived findings count, latest run, severity histogram;
+- show containment state:
+  `disabled|shadow|recommended|contained|rollback_pending|released`;
+- show clear action buttons only for authorized admin/security roles;
+- link to case/evidence only by opaque ID;
+- do not block Workforce first screen;
+- do not include raw artifacts in frontend payload.
+
+Acceptance:
+
+- with module disabled, portal shows disabled-state and remains fast;
+- with fixture findings, portal renders summary;
+- with fixture containment recommendation, portal renders action state without
+  applying action;
+- Playwright smoke confirms no endless loading and no raw sensitive fields.
+
+### Phase 10. Health/readiness/checks
+
+Files:
+
+- `adk-rust/crates/detmir-check/`;
+- `adk-rust/crates/detmir-readiness/`;
+- `scripts/detmir-full-diagnostics/aw-contour-diag.sh`;
+- `scripts/aw-contour-diag.sh`;
+- `check-aw-full.sh`.
+
+Tasks:
+
+- add optional forensics status checks;
+- disabled mode must be OK/Skipped, not fail;
+- add optional containment status checks;
+- enabled mode checks:
+  Velociraptor service, artifact pack, latest run age, importer health,
+  queue/quarantine counts, containment executor health;
+- add resource pressure checks for long-running scans.
+
+Acceptance:
+
+- disabled mode produces `forensics:mode=disabled`;
+- disabled containment mode produces `containment:mode=disabled`;
+- enabled mode fails closed on stale/broken artifact importer;
+- containment auto mode fails closed if rollback store or admin-channel precheck
+  is unavailable;
+- checks do not restart services unless explicit autoheal mode exists.
+
+### Phase 11. Runtime safety and resource budgets
+
+Files:
+
+- systemd units/timers;
+- Ansible vars;
+- docs runbooks.
+
+Tasks:
+
+- enforce `Nice`, `IOSchedulingClass`, CPU quota and timeout for heavy scans;
+- serialize jobs through lock file;
+- add cancellation/timeout behavior;
+- quarantine failed artifact runs;
+- keep `aw-server-rust`, worktime API, ClickHouse and portal out of the scan
+  critical path.
+- enforce containment mutation lock so two block/unblock actions cannot race.
+
+Acceptance:
+
+- two concurrent scan requests do not run two heavy jobs;
+- timeout leaves a clear failed run record;
+- core health remains green under disabled mode.
+- rollback timer is tested and idempotent.
+
+### Phase 12. Documentation and operator runbooks
+
+New docs:
+
+- `docs/VELOCIRAPTOR_DEPLOYMENT_RU.md`;
+- `docs/FORENSICS_SUPPLY_CHAIN_RU.md`;
+- `docs/FORENSICS_OPERATOR_RUNBOOK_RU.md`;
+- `docs/FORENSICS_RETENTION_POLICY_RU.md`;
+- `docs/FORENSICS_PRIVACY_GUARDRAILS_RU.md`.
+- `docs/CONTAINMENT_OPERATOR_RUNBOOK_RU.md`;
+- `docs/CONTAINMENT_POLICY_RU.md`.
+
+Tasks:
+
+- describe installation modes;
+- describe offline collector workflow;
+- describe artifact run, import, case link and cleanup;
+- describe forbidden data in screenshots/demo packs;
+- document rollback and disable commands.
+- describe quarantine policy, management allowlist, manual approval, emergency
+  release and TTL rollback.
+
+Acceptance:
+
+- admin can install disabled/offline/server modes from docs;
+- admin can test shadow containment safely before auto mode;
+- docs clearly say GitHub/public demo is not evidence storage;
+- no claim of SIEM/DLP/EDR/СЗИ replacement.
+
+### Phase 13. Tests and gates
+
+Required checks:
+
+```bash
+python3 scripts/public_secret_pattern_check.py
+bash -n scripts/prepare_forensics_binaries.sh
+ansible-playbook -i ansible/inventory.ini ansible/deploy_aw_server.yml --syntax-check
+ansible-playbook -i ansible/inventory.ini ansible/deploy_aw_windows.yml --syntax-check
+
+cd adk-rust
+export CARGO_TARGET_DIR=/home/igor/.cache/detmir-adk-rust-target
+cargo fmt --all --check
+cargo test -p hayabusa-tools
+cargo test -p forensics-importer
+cargo test -p containment-engine
+cargo clippy -p hayabusa-tools -p forensics-importer -p containment-engine --all-targets -- -D warnings
+
+cd ..
+git diff --check
+```
+
+Manual/live checks:
+
+- disabled mode on clean install;
+- Hayabusa current drop-zone smoke;
+- Velociraptor offline collector fixture run;
+- Velociraptor server health if enabled;
+- containment shadow run with fixture critical finding;
+- manual approval containment in isolated lab host;
+- rollback verification;
+- portal browser smoke with module disabled and with fixture findings;
+- no public exposure of Velociraptor GUI unless explicitly configured.
+
+## Codex guardrails
+
+Codex must not:
+
+- change Workforce core behavior while adding this module;
+- re-enable heavy DLP runtime by accident;
+- expose Velociraptor or Hayabusa outputs publicly;
+- commit generated secrets, private configs or raw evidence;
+- auto-block hosts before policy, allowlist, rollback and admin-channel checks
+  exist;
+- auto-block servers/domain infrastructure by default;
+- claim completed integration before live/manual evidence exists;
+- change Rust/API/UI runtime outside the planned files without documenting why.
+
+Codex should:
+
+- start with docs/config disabled mode;
+- implement supply-chain pinning before service deployment;
+- prefer Rust for import/validation/parsing;
+- treat containment as a separate audited control plane, not as generic
+  remediation;
+- keep PowerShell only for Windows install/run wrappers;
+- add small fixtures and negative tests before live deployment;
+- update project status after each successfully verified phase.
+
+## Expected result
+
+After implementation AWatch-rus should have:
+
+- installed/pinned Hayabusa and rules workflow;
+- optional bundled Velociraptor server/client/offline collector modes;
+- reproducible artifact pack handling for `Windows.Hayabusa.Monitoring`;
+- derived findings importer into AWatch-rus forensics views;
+- policy-controlled automated/manual quarantine of suspected infected
+  workstations;
+- rollback and emergency release path for every containment action;
+- disabled-by-default safety;
+- resource-bounded scans;
+- clear runbooks for poor/small organizations;
+- honest positioning as low-cost containment, security analytics and forensics, not
+  SIEM/DLP/EDR/СЗИ.

docs/PRODUCTION_READINESS_RU.md

@@ -47,6 +47,8 @@ bounded payload/query limits и role-gate smoke.
 | `--slow-request-log-ms` | `AWATCH_PORTAL_SLOW_REQUEST_LOG_MS` | Порог медленного запроса для логов |
 | `--environment` | `AWATCH_PORTAL_ENVIRONMENT` | Безопасное имя окружения |
 | `--enabled-modules` | `AWATCH_PORTAL_ENABLED_MODULES` | Разрешенные модули портала |
+| `--dlp-module-enabled` | `DETMIR_PORTAL_DLP_MODULE_ENABLED` | Включает DLP/security status для портала; может оставаться `true` для исторического SQLite/evidence-среза без запуска server-side DLP runtime |
+| DLP resource profile | `AW_DLP_PROFILE`, `DETMIR_PORTAL_DLP_PROFILE` | Для DetMir production default `core_only`; `light` включается оператором после resource check |
 
 Ограничения применяются к тяжелым API:
 
@@ -66,6 +68,21 @@ bounded payload/query limits и role-gate smoke.
   возвращает `400`;
 - слишком большое тело запроса возвращает `413`;
 - role gate возвращает `403`.
+- при `DETMIR_PORTAL_DLP_MODULE_ENABLED=true` и `AW_DLP_PROFILE=core_only`
+  портал может показывать исторический DLP/security status без запуска
+  collectors/exporters.
+- при `DETMIR_PORTAL_DLP_MODULE_ENABLED=true` и `AW_DLP_PROFILE=light`
+  Workforce core, `/healthz`, `/readyz`, `/api/reports` и `/api/operator`
+  должны оставаться доступными без тяжелого DLP/case/evidence чтения.
+- при `AW_DLP_ENABLED=false` и `DETMIR_DLP_ENABLED=false` server-side
+  DLP health/readiness/checks должны возвращать контролируемый disabled-state,
+  а не пытаться поднять DLP Influx/exporter/aggregator/case runtime.
+  Runbook: [DLP_OPTIONAL_RUNTIME_RU.md](DLP_OPTIONAL_RUNTIME_RU.md).
+- при `AW_DLP_PROFILE=light` активны только lightweight collector/IOC/guard;
+  Loki/DLP heavy runtime должен оставаться inactive. При перегрузе
+  `detmir-dlp-load-guard` переводит DLP в `core_only`; возврат выполняется
+  только через profile switch и rollback, см.
+  [DLP_RESOURCE_PROFILES_RU.md](DLP_RESOURCE_PROFILES_RU.md).
 
 ### Request ID, logs и metrics
 

docs/PROJECT_STATUS_RU.md

@@ -66,23 +66,25 @@ backup, registry-readiness документации, плана российск
   `653b22b0fbf29a22f7de42ade7b689490b1de16fa07e785e4e0efd3078e7a3bc`.
 - DetMir portal cold-start UI hang: mitigated. During cold/prewarm state the UI
   now shows `STALE / Первичный срез прогревается`, not endless loading.
-- DetMir DLP hot-path boundary: phase 1 deployed on the portal service with
-  `DETMIR_PORTAL_DLP_MODULE_ENABLED=false`.
+- DetMir DLP hot-path boundary: phase 1 deployed; current production runtime
+  uses `AW_DLP_ENABLED=false`, `AW_DLP_PROFILE=core_only`. The portal DLP module
+  may stay enabled for historical/security views, but server-side DLP
+  collectors/exporters are off.
 - DetMir optional DLP runtime controls: implemented in code/docs through
   `AW_DLP_ENABLED`, `DETMIR_DLP_ENABLED`,
   `scripts/detmir_dlp_runtime_control.sh` and
-  `docs/DLP_OPTIONAL_RUNTIME_RU.md`.
-- DetMir optional DLP runtime live state: disabled on 2026-06-25 to reduce
-  InfluxDB/Grafana/ClickHouse/AW server load. Evidence:
-  `dlp-health-check=dlp:mode disabled`, `detmir-dlp=dlp:mode disabled`,
-  active/enabled DLP units `0/0`, history snapshots under
-  `/var/lib/activitywatch/health/dlp-runtime-history/`.
-- DetMir DLP contour status: disabled for the current production resource
-  profile, not removed. It remains a documented optional module and must only be
-  re-enabled after explicit operator decision and Proxmox/InfluxDB/Grafana/
-  ClickHouse capacity check.
-- DetMir DLP buckets in manual full check: `SKIPPED` under
-  `AW_DLP_ENABLED=false`, not reported as dead.
+  `docs/DLP_OPTIONAL_RUNTIME_RU.md`. Resource profiles
+  `core_only|light|on_demand|full` and rollback are documented in
+  `docs/DLP_RESOURCE_PROFILES_RU.md`.
+- DetMir optional DLP runtime state: 2026-06-25 controlled disable evidence is
+  retained; 2026-06-30 prod hardening keeps production in `core_only` by
+  default. `light` can be re-enabled by operator command after
+  Proxmox/InfluxDB/Grafana/ClickHouse capacity check.
+- DetMir DLP contour status: server-side DLP collection is currently disabled;
+  heavy DLP remains optional and must only be enabled after explicit operator
+  decision and resource check.
+- DetMir DLP auto-disable guard: `detmir-dlp-load-guard` records load/RAM/iowait
+  state and switches DLP to `core_only` if thresholds are exceeded.
 - DetMir RDP collector freshness after 2026-06-29 restore: physical RDP target
   is `192.168.100.19`, stable AW logical host id remains `SHARKON2025`.
   Buckets are fresh/inactive as expected, collector guard quarantine was reset,
@@ -112,6 +114,9 @@ backup, registry-readiness документации, плана российск
   resource usage. Proxmox LXC `202 loki-logs` is stopped, active config has
   `onboot: 0`, and smoke checks skip Loki by default unless
   `AW_SMOKE_LOKI_ENABLED=1` is set.
+- DetMir DLP rollback guard: `detmir-dlp-runtime-control set-profile` stores
+  the previous DLP systemd active/enabled state and `rollback` restores it.
+  Rollback does not start Loki CT.
 - DetMir restore baseline 2026-06-29:
   `docs/DETMIR_RESTORE_BASELINE_2026-06-29_RU.md`.
 - DetMir API smoke after phase 1: `/healthz` and `/readyz` OK;
@@ -197,9 +202,9 @@ backup, registry-readiness документации, плана российск
 - External peer review remains pending.
 - Community adoption remains low until external contributors, public reviews
   and sustained third-party activity appear.
-- DetMir DLP runtime disable is complete for the current live contour; deeper
-  long-term DLP product modularization and retention/cleanup policy remain
-  separate future work.
+- DetMir lightweight DLP profile is implemented in repo defaults/scripts/docs;
+  heavy DLP modularization and retention/cleanup policy remain separate future
+  work.
 - DetMir RDP collector/session recovery after 2026-06-29 restore is verified by
   live smoke: `check-aw-full` reports `FRESH=8 STALE=0 DEAD=0`.
 

docs/SECURITY_FINDING_INBOX_RU.md

@@ -0,0 +1,279 @@
+# Security Finding Inbox
+
+Дата: 2026-06-25.
+
+Security Finding Inbox - это очередь подозрительных рабочих станций для
+связки Hayabusa/Sigma, Velociraptor, AWatch context и ручных ИБ-сигналов.
+Очередь нужна для контролируемого процесса:
+
+```text
+finding -> triage -> decide -> plan -> approve -> apply_requested -> executor -> verify/rollback
+```
+
+Важно: портал inbox сам не применяет Windows Firewall, pfSense, AD или VLAN
+изменения. Он фиксирует findings и workflow-события. Реальное применение
+делается отдельным процессом `security-finding-inbox executor`, который
+вызывает `containment-engine windows-firewall plan/apply/verify/rollback`.
+По умолчанию executor работает безопасно: dry-run/fail-closed, без локального
+изменения firewall.
+
+## Компоненты
+
+- ClickHouse schema:
+  `clickhouse-1c/security/security_finding_inbox.sql`
+- normalized finding example:
+  `configs/security/security-finding.example.json`
+- ingest/workflow CLI:
+  `adk-rust/crates/security-finding-inbox`
+- executor CLI:
+  `security-finding-inbox executor`
+- portal API:
+  `/api/security/findings`
+  `/api/security/findings/workflow`
+- portal page:
+  `Подозрительные станции`
+
+## ClickHouse tables
+
+`security_findings`
+
+- normalized finding records;
+- source: `hayabusa`, `sigma`, `velociraptor`, `awatch`, `manual`, `dlp`;
+- states: `new`, `suspected_infected`, `confirmed_infected`, `contained`,
+  `released`, `false_positive`;
+- recommended action remains a recommendation, not a mutation.
+
+`security_finding_workflow_events`
+
+- append-only workflow audit;
+- event types: `decide_requested`, `plan_requested`, `approved`,
+  `apply_requested`, `verify_requested`, `rollback_requested`, `rejected`,
+  `false_positive`, plus executor audit events:
+  `executor_plan_ready`, `executor_apply_succeeded`,
+  `executor_apply_failed`, `executor_verify_succeeded`,
+  `executor_verify_failed`, `executor_refused`,
+  `executor_rollback_succeeded`, `executor_rollback_failed`;
+- portal writes only workflow events.
+
+`security_finding_inbox`
+
+- latest-state view for portal/dashboard;
+- filters released/rejected/false-positive rows out of the active queue.
+
+## Ingest
+
+Build:
+
+```bash
+cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian
+export CARGO_TARGET_DIR=/home/igor/.cache/detmir-adk-rust-target
+cargo build --manifest-path adk-rust/Cargo.toml -p security-finding-inbox
+```
+
+Validate sample:
+
+```bash
+security-finding-inbox validate \
+  --input configs/security/security-finding.example.json
+```
+
+Dry-run ingest:
+
+```bash
+security-finding-inbox ingest \
+  --input configs/security/security-finding.example.json \
+  --dry-run
+```
+
+Apply schema and ingest into ClickHouse:
+
+```bash
+security-finding-inbox ingest \
+  --input configs/security/security-finding.example.json \
+  --clickhouse-url http://10.10.10.2:8123 \
+  --database analytics_1c \
+  --user "$CLICKHOUSE_USER" \
+  --password "$CLICKHOUSE_PASSWORD" \
+  --apply-schema
+```
+
+The CLI accepts a single JSON object, JSON array, or JSONL.
+
+### Real Hayabusa source
+
+После `aw-hayabusa process-inbox` реальный источник находится в
+`/opt/hayabusa/state/latest-intake.json`. CLI читает `report_dir`, анализирует
+`timeline.jsonl`, logon summaries и строит normalized finding:
+
+```bash
+security-finding-inbox ingest-hayabusa \
+  --intake /opt/hayabusa/state/latest-intake.json \
+  --min-severity medium \
+  --clickhouse-url http://127.0.0.1:8123 \
+  --database analytics_1c
+```
+
+Для автоматического подключения Hayabusa drop/autoprocess:
+
+```bash
+AW_SECURITY_FINDING_INBOX_ENABLED=true
+AW_SECURITY_FINDING_INBOX_BIN=/usr/local/bin/security-finding-inbox
+AW_SECURITY_FINDING_INBOX_MIN_SEVERITY=medium
+```
+
+`AW_SECURITY_FINDING_INBOX_REQUIRED=false` оставляет forensic pipeline живым,
+если ClickHouse или inbox CLI временно недоступны. В `true`-режиме ошибка
+ingest считается operational failure.
+
+### Real Velociraptor source
+
+Velociraptor artifact JSON/JSONL можно загрузить через generic adapter:
+
+```bash
+security-finding-inbox ingest-velociraptor-json \
+  --input /path/to/velociraptor-artifact.jsonl \
+  --default-severity high \
+  --clickhouse-url http://127.0.0.1:8123 \
+  --database analytics_1c
+```
+
+Adapter ищет стандартные поля `Hostname`, `Artifact`, `Severity`, `Message`,
+`User`, `IP`. Если формат артефакта отличается, используйте normalized
+`security-finding-inbox ingest --input ...`.
+
+## Portal workflow
+
+Open:
+
+```text
+DetMir Portal -> Подозрительные станции
+```
+
+The page shows:
+
+- host/user/IP/department;
+- severity/confidence/score;
+- source/rule;
+- state and latest workflow status;
+- recommended action;
+- workflow buttons.
+
+Portal buttons record only workflow events:
+
+- `decide`: request decision calculation;
+- `plan`: request containment plan;
+- `approve`: operator approval record;
+- `apply`: request to perform apply outside the portal;
+- `rollback`: rollback request record.
+
+The portal does not run `containment-engine`, PowerShell, firewall commands or
+network changes.
+
+## Executor handoff
+
+Executor читает из ClickHouse только те findings, где:
+
+- последний workflow event: `apply_requested`;
+- status: `apply_pending`;
+- ранее есть `approved`;
+- еще нет `executor_apply_succeeded`, `executor_apply_failed`,
+  `executor_refused` или rollback terminal event.
+
+Dry-run executor:
+
+```bash
+security-finding-inbox executor \
+  --once \
+  --dry-run \
+  --containment-engine-bin /usr/local/bin/containment-engine \
+  --policy /etc/activitywatch/containment-policy.json \
+  --management-allowlist 10.10.10.10,10.10.10.11 \
+  --blocked-remote-addresses 10.10.20.0/24,10.10.30.0/24
+```
+
+Linux systemd example for central dry-run/polling mode:
+
+```text
+ops/systemd/aw-security-finding-executor.service
+```
+
+Real local Windows apply is allowed only when all conditions are true:
+
+- executor runs on the target Windows workstation;
+- `--execute-local` is set;
+- `--confirm-execute YES` is set;
+- `--executor-host` or local `COMPUTERNAME` matches finding `host`;
+- containment policy returns `manual_approval_required` or `auto_ready`;
+- management allowlist and blocked remote ranges are explicit;
+- generated Windows Firewall plan has no blockers.
+
+Example on the target Windows host:
+
+```powershell
+security-finding-inbox.exe executor `
+  --once `
+  --execute-local `
+  --confirm-execute YES `
+  --executor-host HOST-EXAMPLE `
+  --containment-engine-bin C:\ProgramData\AWatch-rus\containment-engine.exe `
+  --policy C:\ProgramData\AWatch-rus\containment-policy.json `
+  --management-allowlist 10.10.10.10,10.10.10.11 `
+  --blocked-remote-addresses 10.10.20.0/24,10.10.30.0/24
+```
+
+Executor writes `executor_*` workflow events back into ClickHouse. It does not
+update or delete source findings.
+
+## Manual containment handoff
+
+After a finding is approved:
+
+1. Build or review a containment policy/finding.
+2. Run:
+
+```bash
+containment-engine decide \
+  --policy /etc/activitywatch/containment-policy.json \
+  --finding /path/to/finding.json \
+  --pretty
+```
+
+3. Build Windows Firewall request with explicit management allowlist.
+4. Run:
+
+```bash
+containment-engine windows-firewall plan \
+  --request /path/to/windows-firewall-request.json \
+  --pretty > /tmp/fw-plan.json
+```
+
+5. Confirm `blockers=[]`.
+6. Dry-run:
+
+```bash
+containment-engine windows-firewall apply \
+  --plan /tmp/fw-plan.json \
+  --confirm-apply YES \
+  --pretty
+```
+
+7. Real apply only on the target Windows host:
+
+```powershell
+containment-engine.exe windows-firewall apply `
+  --plan C:\Temp\fw-plan.json `
+  --confirm-apply YES `
+  --execute-local `
+  --pretty
+```
+
+## Guardrails
+
+- Do not place raw employee logs, secrets, passwords or customer identifiers in
+  findings.
+- Do not treat `apply_requested` as successful containment.
+- Do not run broad `Any`/`LocalSubnet` firewall blocks.
+- Do not enable automatic action for servers/domain controllers.
+- Keep GitHub/portal evidence separate from Russian registry release evidence.
+- Keep DLP optional: Hayabusa/Velociraptor findings can continue while heavy DLP
+  runtime is disabled.

docs/wiki/Hayabusa-Security-Analytics.md

@@ -31,7 +31,7 @@ journalctl -u aw-hayabusa-drop.service -n 80 --no-pager
 curl -fsS http://127.0.0.1:5602/api/0/dlp/cases/30
 ```
 
-Ожидаемо: `drop` и `incoming` пустые, `latest-intake.json` имеет `status=ok`, `host=SHARKON2025`, а `LastTaskResult` Windows-задачи равен `0`.
+Ожидаемо: `drop` и `incoming` пустые, `latest-intake.json` имеет `status=ok`, `host=<stable-aw-logical-host-id>`, а `LastTaskResult` Windows-задачи равен `0`. Для текущего DetMir production historical logical id может оставаться `SHARKON2025`, даже если физический `COMPUTERNAME` RDP-сервера изменён.
 
 ## Что получает оператор
 

grafana/detmir-aw-main-dashboard.json

@@ -342,7 +342,7 @@
       "id": 7,
       "targets": [
         {
-          "query": "import \"date\"\nimport \"strings\"\nimport \"timezone\"\noption location = timezone.location(name: \"Europe/Moscow\")\ntoday = strings.substring(v: string(v: date.add(d: 3h, to: date.truncate(t: now(), unit: 1d))), start: 0, end: 10)\nbase = from(bucket: \"aw_metrics\")\n  |> range(start: -3d)\n  |> filter(fn: (r) => r._measurement == \"aw_true_active_app_daily\" and r.host == \"${host}\" and r.report_date == today)\n\nnums = base\n  |> filter(fn: (r) => r._field == \"proved_work_seconds\" or r._field == \"evidence_events\")\n  |> group(columns:[\"application\",\"_field\"])\n  |> last()\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n\ntexts = base\n  |> filter(fn: (r) => r._field == \"last_action\" or r._field == \"last_action_local\")\n  |> group(columns:[\"application\",\"_field\"])\n  |> last()\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n\njoin(tables: {n: nums, t: texts}, on: [\"application\", \"report_date\"])\n  |> map(fn:(r)=>({ r with hours: float(v:r.proved_work_seconds) / 3600.0 }))\n  |> sort(columns:[\"proved_work_seconds\"], desc:true)\n  |> group()\n  |> keep(columns:[\"report_date\",\"application\",\"hours\",\"last_action_local\",\"last_action\",\"evidence_events\"])\n  |> rename(columns:{report_date:\"Дата\", application:\"Приложение\", hours:\"Доказано, ч\", last_action_local:\"Последнее действие\", last_action:\"Окно / действие\", evidence_events:\"Подтверждений\"})\n",
+          "query": "import \"date\"\nimport \"strings\"\nimport \"timezone\"\noption location = timezone.location(name: \"Europe/Moscow\")\ntoday = strings.substring(v: string(v: date.add(d: 3h, to: date.truncate(t: now(), unit: 1d))), start: 0, end: 10)\nfrom(bucket: \"aw_metrics\")\n  |> range(start: -3d)\n  |> filter(fn: (r) => r._measurement == \"aw_true_active_app_daily\" and r.host == \"${host}\" and r.report_date == today)\n  |> filter(fn: (r) => r._field == \"proved_work_seconds\" or r._field == \"evidence_events\" or r._field == \"last_action\" or r._field == \"last_action_local\")\n  |> group(columns:[\"application\",\"report_date\",\"_field\"])\n  |> last()\n  |> keep(columns:[\"application\",\"report_date\",\"_field\",\"_value\"])\n  |> map(fn:(r)=>({ r with _value: string(v:r._value) }))\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n  |> map(fn:(r)=>({ r with hours: float(v:r.proved_work_seconds) / 3600.0 }))\n  |> sort(columns:[\"hours\"], desc:true)\n  |> group()\n  |> keep(columns:[\"report_date\",\"application\",\"hours\",\"last_action_local\",\"last_action\",\"evidence_events\"])\n  |> rename(columns:{report_date:\"Дата\", application:\"Приложение\", hours:\"Доказано, ч\", last_action_local:\"Последнее действие\", last_action:\"Окно / действие\", evidence_events:\"Подтверждений\"})\n",
           "refId": "A"
         }
       ],

grafana/detmir-rdp-user-activity-dashboard.json

@@ -630,7 +630,7 @@
       },
       "targets": [
         {
-          "query": "import \"date\"\nimport \"strings\"\nimport \"timezone\"\noption location = timezone.location(name: \"Europe/Moscow\")\ntoday = strings.substring(v: string(v: date.add(d: 3h, to: date.truncate(t: now(), unit: 1d))), start: 0, end: 10)\nbase = from(bucket: \"aw_metrics\")\n  |> range(start: -3d)\n  |> filter(fn: (r) => r._measurement == \"aw_true_active_app_daily\" and r.host == \"${host}\" and r.report_date == today)\n\nnums = base\n  |> filter(fn: (r) => r._field == \"proved_work_seconds\" or r._field == \"evidence_events\")\n  |> group(columns:[\"application\",\"_field\"])\n  |> last()\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n\ntexts = base\n  |> filter(fn: (r) => r._field == \"last_action\" or r._field == \"last_action_local\")\n  |> group(columns:[\"application\",\"_field\"])\n  |> last()\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n\njoin(tables: {n: nums, t: texts}, on: [\"application\", \"report_date\"])\n  |> map(fn:(r)=>({ r with hours: float(v:r.proved_work_seconds) / 3600.0 }))\n  |> sort(columns:[\"proved_work_seconds\"], desc:true)\n  |> group()\n  |> keep(columns:[\"report_date\",\"application\",\"hours\",\"last_action_local\",\"last_action\",\"evidence_events\"])\n  |> rename(columns:{report_date:\"Дата\", application:\"Приложение\", hours:\"Доказано, ч\", last_action_local:\"Последнее действие\", last_action:\"Окно / действие\", evidence_events:\"Подтверждений\"})",
+          "query": "import \"date\"\nimport \"strings\"\nimport \"timezone\"\noption location = timezone.location(name: \"Europe/Moscow\")\ntoday = strings.substring(v: string(v: date.add(d: 3h, to: date.truncate(t: now(), unit: 1d))), start: 0, end: 10)\nfrom(bucket: \"aw_metrics\")\n  |> range(start: -3d)\n  |> filter(fn: (r) => r._measurement == \"aw_true_active_app_daily\" and r.host == \"${host}\" and r.report_date == today)\n  |> filter(fn: (r) => r._field == \"proved_work_seconds\" or r._field == \"evidence_events\" or r._field == \"last_action\" or r._field == \"last_action_local\")\n  |> group(columns:[\"application\",\"report_date\",\"_field\"])\n  |> last()\n  |> keep(columns:[\"application\",\"report_date\",\"_field\",\"_value\"])\n  |> map(fn:(r)=>({ r with _value: string(v:r._value) }))\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n  |> map(fn:(r)=>({ r with hours: float(v:r.proved_work_seconds) / 3600.0 }))\n  |> sort(columns:[\"hours\"], desc:true)\n  |> group()\n  |> keep(columns:[\"report_date\",\"application\",\"hours\",\"last_action_local\",\"last_action\",\"evidence_events\"])\n  |> rename(columns:{report_date:\"Дата\", application:\"Приложение\", hours:\"Доказано, ч\", last_action_local:\"Последнее действие\", last_action:\"Окно / действие\", evidence_events:\"Подтверждений\"})",
           "refId": "A"
         }
       ],

ops/systemd/aw-security-finding-executor.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=AWatch-rus Security Finding Inbox executor
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+EnvironmentFile=-/etc/activitywatch/aw-server.env
+ExecStart=/usr/local/bin/security-finding-inbox executor \
+  --poll-seconds 30 \
+  --dry-run
+Restart=on-failure
+RestartSec=10
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=full
+ProtectHome=true
+ReadWritePaths=/var/lib/activitywatch /var/lock
+
+[Install]
+WantedBy=multi-user.target

scripts/check_detmir_rust_release_artifacts.sh

@@ -4,8 +4,33 @@ set -euo pipefail
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 TARGET_ROOT="${CARGO_TARGET_DIR:-$ROOT_DIR/adk-rust/target}"
 RELEASE_DIR="$TARGET_ROOT/release"
+SCOPE="${CHECK_DETMIR_RUST_RELEASE_SCOPE:-prod-runtime}"
 
-required_bins=(
+prod_runtime_bins=(
+  aw-1c-ingest
+  aw-hayabusa-autoprocess-rust
+  aw-rus-healthd
+  aw-slo-monitor
+  aw-workforce-ingest
+  detmir-auto
+  detmir-portal
+  detmir-readiness
+  dlp-aggregator
+  dlp-case-management
+  dlp-cef-exporter
+  dlp-compliance
+  dlp-influx-exporter
+  dlp-policy-engine
+  dlp-syslog-forwarder
+  dlp-webhook-sender
+  worktime-api
+  worktime-autoheal
+  worktime-influx-exporter
+  worktime-prewarm
+  worktime-ui-bridge
+)
+
+workspace_bins=(
   detmir-status
   detmir-adk-status
   detmir-check
@@ -61,8 +86,23 @@ required_bins=(
   aw-hayabusa-from-windows-rust
   aw-hayabusa-autoprocess-rust
   aw-1c-ingest
+  containment-engine
+  security-finding-inbox
 )
 
+case "$SCOPE" in
+  prod-runtime)
+    required_bins=("${prod_runtime_bins[@]}")
+    ;;
+  workspace)
+    required_bins=("${workspace_bins[@]}")
+    ;;
+  *)
+    echo "Unsupported CHECK_DETMIR_RUST_RELEASE_SCOPE=$SCOPE; expected prod-runtime or workspace" >&2
+    exit 2
+    ;;
+esac
+
 missing=0
 for bin in "${required_bins[@]}"; do
   if [[ -x "$RELEASE_DIR/$bin" ]]; then
@@ -76,7 +116,7 @@ done
 if (( missing != 0 )); then
   cat >&2 <<EOF
 
-Missing DetMir Rust release artifacts.
+Missing DetMir Rust release artifacts for scope: $SCOPE.
 Build them with:
   cd "$ROOT_DIR/adk-rust"
   CARGO_TARGET_DIR="$TARGET_ROOT" cargo build --release --workspace
@@ -84,4 +124,4 @@ EOF
   exit 1
 fi
 
-echo "detmir rust release artifacts: OK ($RELEASE_DIR)"
+echo "detmir rust release artifacts: OK scope=$SCOPE ($RELEASE_DIR)"

scripts/containment_shadow_smoke.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+ENGINE="${CONTAINMENT_ENGINE_BIN:-}"
+POLICY="${1:-$ROOT_DIR/configs/containment-policy.example.json}"
+FINDING="${2:-$ROOT_DIR/configs/containment-finding.example.json}"
+FIREWALL_REQUEST="${3:-$ROOT_DIR/configs/windows-firewall-containment-request.example.json}"
+TMP_DIR="$(mktemp -d /tmp/containment-shadow-smoke.XXXXXX)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+if [[ -z "$ENGINE" ]]; then
+  for candidate in \
+    "${CARGO_TARGET_DIR:-}/debug/containment-engine" \
+    "${CARGO_TARGET_DIR:-}/release/containment-engine" \
+    "$ROOT_DIR/adk-rust/target/debug/containment-engine" \
+    "$ROOT_DIR/adk-rust/target/release/containment-engine" \
+    "/usr/local/bin/containment-engine"; do
+    if [[ -n "$candidate" && -x "$candidate" ]]; then
+      ENGINE="$candidate"
+      break
+    fi
+  done
+fi
+
+if [[ -z "$ENGINE" ]]; then
+  printf 'containment-engine binary not found. Build: cargo build --manifest-path adk-rust/Cargo.toml -p containment-engine\n' >&2
+  exit 2
+fi
+
+validate_payload() {
+  local expected_status="$1"
+  python3 -c '
+import json
+import sys
+
+expected_status = sys.argv[1]
+payload = json.load(sys.stdin)
+if payload.get("would_mutate") is not False:
+    raise SystemExit("containment smoke failed: would_mutate must be false")
+status = payload.get("decision_status")
+if status != expected_status:
+    raise SystemExit(f"containment smoke failed: expected {expected_status!r}, got {status!r}")
+print(f"containment_shadow_smoke=ok status={status}")
+' "$expected_status"
+}
+
+disabled_out="$("$ENGINE" decide --policy "$POLICY" --finding "$FINDING" --pretty)"
+printf '%s\n' "$disabled_out"
+validate_payload "disabled" <<<"$disabled_out"
+
+shadow_policy="$TMP_DIR/containment-policy-shadow.json"
+python3 - "$POLICY" "$shadow_policy" <<'PY'
+import json
+import sys
+
+payload = json.load(open(sys.argv[1], encoding="utf-8"))
+payload["enabled"] = True
+payload["mode"] = "shadow"
+json.dump(payload, open(sys.argv[2], "w", encoding="utf-8"), ensure_ascii=False, indent=2)
+PY
+
+shadow_out="$("$ENGINE" decide --policy "$shadow_policy" --finding "$FINDING" --pretty)"
+printf '%s\n' "$shadow_out"
+validate_payload "shadow_recommended" <<<"$shadow_out"
+
+firewall_plan="$TMP_DIR/windows-firewall-plan.json"
+"$ENGINE" windows-firewall plan --request "$FIREWALL_REQUEST" --pretty >"$firewall_plan"
+cat "$firewall_plan"
+
+python3 - "$firewall_plan" <<'PY'
+import json
+import sys
+
+payload = json.load(open(sys.argv[1], encoding="utf-8"))
+if payload.get("executor") != "windows_firewall":
+    raise SystemExit("firewall smoke failed: executor must be windows_firewall")
+if payload.get("blockers"):
+    raise SystemExit(f"firewall smoke failed: unexpected blockers {payload['blockers']!r}")
+if not payload.get("apply_commands") or not payload.get("rollback_commands"):
+    raise SystemExit("firewall smoke failed: apply/rollback commands must exist")
+print("windows_firewall_plan_smoke=ok")
+PY
+
+firewall_apply_out="$("$ENGINE" windows-firewall apply --plan "$firewall_plan" --confirm-apply YES --pretty)"
+printf '%s\n' "$firewall_apply_out"
+
+python3 -c '
+import json
+import sys
+
+payload = json.load(sys.stdin)
+if payload.get("execution_status") != "dry_run_commands_ready":
+    raise SystemExit("firewall apply smoke failed: expected dry_run_commands_ready")
+if payload.get("would_mutate") is not False:
+    raise SystemExit("firewall apply smoke failed: dry-run must not mutate")
+print("windows_firewall_apply_dry_run_smoke=ok")
+' <<<"$firewall_apply_out"

scripts/detmir_dlp_load_guard.sh

@@ -0,0 +1,260 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ENABLED="${AW_DLP_GUARD_ENABLED:-true}"
+PROFILE="${AW_DLP_PROFILE:-light}"
+STATE_DIR="${AW_DLP_GUARD_STATE_DIR:-/var/lib/activitywatch/health}"
+STATE_FILE="${AW_DLP_GUARD_STATE_FILE:-${STATE_DIR}/dlp-light-guard-state.json}"
+STATE_HISTORY_DIR="${AW_DLP_GUARD_HISTORY_DIR:-${STATE_DIR}/dlp-light-guard-history}"
+CONTROL_BIN="${AW_DLP_CONTROL_BIN:-/usr/local/bin/detmir-dlp-runtime-control}"
+LOAD_RATIO="${AW_DLP_GUARD_LOAD_RATIO:-1.50}"
+MEM_AVAILABLE_PCT_MIN="${AW_DLP_GUARD_MEM_AVAILABLE_PCT_MIN:-15}"
+IOWAIT_PCT_MAX="${AW_DLP_GUARD_IOWAIT_PCT_MAX:-20}"
+STRIKES_REQUIRED="${AW_DLP_GUARD_STRIKES_REQUIRED:-3}"
+
+DLP_GUARDED_UNITS=(
+  aw-dlp-influx-exporter.timer
+  aw-dlp-influx-exporter.service
+  activitywatch-dlp-aggregator.timer
+  activitywatch-dlp-aggregator.service
+  aw-dlp-report-scheduler.timer
+  aw-dlp-report-scheduler.service
+  aw-dlp-syslog-forwarder.timer
+  aw-dlp-syslog-forwarder.service
+  aw-dlp-webhook-sender.timer
+  aw-dlp-webhook-sender.service
+  aw-dlp-cef-exporter.timer
+  aw-dlp-cef-exporter.service
+  aw-dlp-ioc-refresh.timer
+  aw-dlp-ioc-refresh.service
+  aw-dlp-policy-engine.service
+  aw-dlp-case-management.service
+  detmir-portal-evidence.service
+)
+
+json_string() {
+  python3 -c 'import json,sys; print(json.dumps(sys.argv[1], ensure_ascii=False))' "$1"
+}
+
+number_or_null() {
+  local value="${1:-}"
+  if [[ "$value" =~ ^-?[0-9]+([.][0-9]+)?$ ]]; then
+    printf '%s' "$value"
+  else
+    printf 'null'
+  fi
+}
+
+active_dlp_units_json() {
+  local first=1 unit
+  printf '['
+  if command -v systemctl >/dev/null 2>&1; then
+    for unit in "${DLP_GUARDED_UNITS[@]}"; do
+      if systemctl is-active --quiet "$unit" 2>/dev/null; then
+        [[ "$first" -eq 1 ]] || printf ','
+        first=0
+        json_string "$unit"
+      fi
+    done
+  fi
+  printf ']'
+}
+
+active_dlp_unit_count() {
+  local count=0 unit
+  if command -v systemctl >/dev/null 2>&1; then
+    for unit in "${DLP_GUARDED_UNITS[@]}"; do
+      if systemctl is-active --quiet "$unit" 2>/dev/null; then
+        count=$((count + 1))
+      fi
+    done
+  fi
+  printf '%s\n' "$count"
+}
+
+read_load1() {
+  awk '{print $1}' /proc/loadavg 2>/dev/null || printf '0'
+}
+
+read_cpu_count() {
+  local cores
+  cores="$(getconf _NPROCESSORS_ONLN 2>/dev/null || printf '1')"
+  if [[ ! "$cores" =~ ^[0-9]+$ || "$cores" -lt 1 ]]; then
+    cores=1
+  fi
+  printf '%s\n' "$cores"
+}
+
+read_mem_available_pct() {
+  awk '
+    /^MemTotal:/ { total=$2 }
+    /^MemAvailable:/ { available=$2 }
+    END {
+      if (total > 0) {
+        printf "%.2f", (available * 100.0 / total)
+      } else {
+        printf "0"
+      }
+    }
+  ' /proc/meminfo 2>/dev/null || printf '0'
+}
+
+read_cpu_sample() {
+  awk '/^cpu / {
+    idle=$5
+    iowait=$6
+    total=0
+    for (i=2; i<=NF; i++) total += $i
+    printf "%s %s\n", total, iowait
+    exit
+  }' /proc/stat 2>/dev/null || printf '0 0'
+}
+
+read_iowait_pct() {
+  local total1 wait1 total2 wait2 dtotal dwait
+  read -r total1 wait1 < <(read_cpu_sample)
+  sleep 1
+  read -r total2 wait2 < <(read_cpu_sample)
+  dtotal=$((total2 - total1))
+  dwait=$((wait2 - wait1))
+  if [[ "$dtotal" -le 0 || "$dwait" -lt 0 ]]; then
+    printf '0'
+    return
+  fi
+  awk -v wait="$dwait" -v total="$dtotal" 'BEGIN { printf "%.2f", wait * 100.0 / total }'
+}
+
+is_over_threshold() {
+  local value="$1"
+  local threshold="$2"
+  awk -v value="$value" -v threshold="$threshold" 'BEGIN { exit !(value > threshold) }'
+}
+
+is_under_threshold() {
+  local value="$1"
+  local threshold="$2"
+  awk -v value="$value" -v threshold="$threshold" 'BEGIN { exit !(value < threshold) }'
+}
+
+write_state() {
+  local action="$1"
+  local reason="$2"
+  local load1="$3"
+  local cores="$4"
+  local load_threshold="$5"
+  local mem_pct="$6"
+  local iowait_pct="$7"
+  local active_count="$8"
+  local active_units_json="$9"
+  local control_exit="${10}"
+  local strikes="${11:-0}"
+  local now stamp tmp history
+
+  now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  stamp="$(date -u +%Y%m%dT%H%M%SZ)"
+  mkdir -p "$STATE_DIR" "$STATE_HISTORY_DIR"
+  tmp="$(mktemp "${STATE_FILE}.tmp.XXXXXX")"
+  {
+    printf '{'
+    printf '"generated_at_utc":%s,' "$(json_string "$now")"
+    printf '"profile":%s,' "$(json_string "$PROFILE")"
+    printf '"guard_enabled":%s,' "$(json_string "$ENABLED")"
+    printf '"action":%s,' "$(json_string "$action")"
+    printf '"reason":%s,' "$(json_string "$reason")"
+    printf '"consecutive_overload_count":%s,' "$(number_or_null "$strikes")"
+    printf '"consecutive_overload_required":%s,' "$(number_or_null "$STRIKES_REQUIRED")"
+    printf '"control_bin":%s,' "$(json_string "$CONTROL_BIN")"
+    printf '"control_exit":%s,' "$(number_or_null "$control_exit")"
+    printf '"metrics":{'
+    printf '"load1":%s,' "$(number_or_null "$load1")"
+    printf '"cpu_count":%s,' "$(number_or_null "$cores")"
+    printf '"load_threshold":%s,' "$(number_or_null "$load_threshold")"
+    printf '"mem_available_pct":%s,' "$(number_or_null "$mem_pct")"
+    printf '"mem_available_pct_min":%s,' "$(number_or_null "$MEM_AVAILABLE_PCT_MIN")"
+    printf '"iowait_pct":%s,' "$(number_or_null "$iowait_pct")"
+    printf '"iowait_pct_max":%s' "$(number_or_null "$IOWAIT_PCT_MAX")"
+    printf '},'
+    printf '"active_dlp_unit_count":%s,' "$(number_or_null "$active_count")"
+    printf '"active_dlp_units":%s' "$active_units_json"
+    printf '}\n'
+  } >"$tmp"
+  mv "$tmp" "$STATE_FILE"
+  history="${STATE_HISTORY_DIR}/dlp-light-guard-${stamp}.json"
+  cp -a "$STATE_FILE" "$history"
+  printf 'dlp guard action=%s reason=%s state=%s history=%s\n' "$action" "$reason" "$STATE_FILE" "$history"
+}
+
+main() {
+  local load1 cores load_threshold mem_pct iowait_pct active_count active_units_json overloaded reason control_exit strikes prev_strikes
+
+  load1="$(read_load1)"
+  cores="$(read_cpu_count)"
+  load_threshold="$(awk -v cores="$cores" -v ratio="$LOAD_RATIO" 'BEGIN { printf "%.2f", cores * ratio }')"
+  mem_pct="$(read_mem_available_pct)"
+  iowait_pct="$(read_iowait_pct)"
+  active_units_json="$(active_dlp_units_json)"
+  active_count="$(active_dlp_unit_count)"
+  overloaded=0
+  reason="within_thresholds"
+  prev_strikes="$(
+    python3 - "$STATE_FILE" <<'PY' 2>/dev/null || true
+import json, sys
+try:
+    print(int(json.load(open(sys.argv[1])).get("consecutive_overload_count", 0)))
+except Exception:
+    print(0)
+PY
+  )"
+  [[ "$prev_strikes" =~ ^[0-9]+$ ]] || prev_strikes=0
+  strikes=0
+
+  if is_over_threshold "$load1" "$load_threshold"; then
+    overloaded=1
+    reason="load1_above_threshold"
+  elif is_under_threshold "$mem_pct" "$MEM_AVAILABLE_PCT_MIN"; then
+    overloaded=1
+    reason="mem_available_below_threshold"
+  elif is_over_threshold "$iowait_pct" "$IOWAIT_PCT_MAX"; then
+    overloaded=1
+    reason="iowait_above_threshold"
+  fi
+
+  if [[ "$ENABLED" != "true" && "$ENABLED" != "1" && "$ENABLED" != "yes" ]]; then
+    write_state "skipped" "guard_disabled" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "0" "0"
+    return 0
+  fi
+
+  if [[ "$overloaded" -eq 0 ]]; then
+    write_state "none" "$reason" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "0" "0"
+    return 0
+  fi
+
+  strikes=$((prev_strikes + 1))
+
+  if [[ "$strikes" -lt "$STRIKES_REQUIRED" ]]; then
+    write_state "observe_overload" "$reason" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "0" "$strikes"
+    return 0
+  fi
+
+  if [[ "$active_count" -eq 0 ]]; then
+    write_state "none" "${reason}_but_no_active_dlp_units" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "0" "$strikes"
+    return 0
+  fi
+
+  if [[ ! -x "$CONTROL_BIN" ]]; then
+    write_state "failed" "${reason}_control_bin_missing" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "127" "$strikes"
+    printf 'DLP guard cannot disable overloaded DLP: executable not found: %s\n' "$CONTROL_BIN" >&2
+    return 127
+  fi
+
+  control_exit=0
+  AW_DLP_DISABLED_REASON="auto_disabled_by_dlp_load_guard:${reason}" "$CONTROL_BIN" set-profile core_only || control_exit=$?
+  if [[ "$control_exit" -eq 0 ]]; then
+    write_state "auto_disabled" "$reason" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "$control_exit" "$strikes"
+  else
+    write_state "failed" "${reason}_control_exit_${control_exit}" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "$control_exit" "$strikes"
+  fi
+  return "$control_exit"
+}
+
+main "$@"

scripts/detmir_dlp_runtime_control.sh

@@ -0,0 +1,269 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ACTION="${1:-status}"
+PROFILE="${2:-${AW_DLP_PROFILE:-core_only}}"
+AW_BASE="${AW_DLP_CONTROL_AW_BASE:-http://127.0.0.1:5600}"
+HOSTNAME_FILTER="${AW_DLP_CONTROL_HOSTNAME:-${AW_LOGICAL_HOST_ID:-${AW_MONITORED_WINDOWS_HOSTNAME:-HOST-EXAMPLE}}}"
+STATE_DIR="${AW_DLP_CONTROL_STATE_DIR:-/var/lib/activitywatch/health}"
+STATE_FILE="${AW_DLP_CONTROL_STATE_FILE:-${STATE_DIR}/dlp-runtime-state.json}"
+STATE_HISTORY_DIR="${AW_DLP_CONTROL_HISTORY_DIR:-${STATE_DIR}/dlp-runtime-history}"
+ROLLBACK_FILE="${AW_DLP_CONTROL_ROLLBACK_FILE:-${STATE_DIR}/dlp-runtime-rollback.state}"
+REASON="${AW_DLP_DISABLED_REASON:-dlp_runtime_profile_control}"
+
+DLP_UNITS=(
+  aw-dlp-influx-exporter.timer
+  aw-dlp-influx-exporter.service
+  activitywatch-dlp-aggregator.timer
+  activitywatch-dlp-aggregator.service
+  aw-dlp-report-scheduler.timer
+  aw-dlp-report-scheduler.service
+  aw-dlp-syslog-forwarder.timer
+  aw-dlp-syslog-forwarder.service
+  aw-dlp-webhook-sender.timer
+  aw-dlp-webhook-sender.service
+  aw-dlp-cef-exporter.timer
+  aw-dlp-cef-exporter.service
+  aw-dlp-ioc-refresh.timer
+  aw-dlp-ioc-refresh.service
+  aw-dlp-policy-engine.service
+  aw-dlp-case-management.service
+  detmir-portal-evidence.service
+)
+
+DLP_BUCKET_PREFIXES=(
+  aw-dlp-endpoint-signals
+  aw-dlp-incidents
+  aw-dlp-review
+  aw-dlp-rules
+)
+
+DLP_LIGHT_UNITS=(
+  activitywatch-dlp-aggregator.timer
+  aw-dlp-ioc-refresh.timer
+)
+
+DLP_ON_DEMAND_UNITS=(
+  aw-dlp-ioc-refresh.timer
+  aw-dlp-policy-engine.service
+  aw-dlp-case-management.service
+  detmir-portal-evidence.service
+)
+
+json_escape() {
+  local value="$1"
+  python3 -c 'import json,sys; print(json.dumps(sys.argv[1], ensure_ascii=False))' "$value"
+}
+
+unit_json() {
+  local first=1 unit active enabled load
+  printf '['
+  for unit in "${DLP_UNITS[@]}"; do
+    load="$(systemctl show -p LoadState --value "$unit" 2>/dev/null || true)"
+    if [[ "$load" == "not-found" || -z "$load" ]]; then
+      active="not-found"
+      enabled="not-found"
+    else
+      active="$(systemctl is-active "$unit" 2>/dev/null || true)"
+      enabled="$(systemctl is-enabled "$unit" 2>/dev/null || true)"
+    fi
+    [[ "$first" -eq 1 ]] || printf ','
+    first=0
+    printf '{"unit":%s,"load":%s,"active":%s,"enabled":%s}' \
+      "$(json_escape "$unit")" \
+      "$(json_escape "${load:-not-found}")" \
+      "$(json_escape "${active:-unknown}")" \
+      "$(json_escape "${enabled:-unknown}")"
+  done
+  printf ']'
+}
+
+bucket_json() {
+  local first=1 prefix bucket url payload ts count
+  printf '['
+  for prefix in "${DLP_BUCKET_PREFIXES[@]}"; do
+    bucket="${prefix}_${HOSTNAME_FILTER}"
+    url="${AW_BASE%/}/api/0/buckets/${bucket}/events?limit=1"
+    payload="$(curl -sS --connect-timeout 3 --max-time 8 "$url" 2>/dev/null || true)"
+    ts="$(printf '%s' "$payload" | jq -r '.[0].timestamp // ""' 2>/dev/null || true)"
+    count="$(printf '%s' "$payload" | jq -r 'if type == "array" then length else 0 end' 2>/dev/null || printf '0')"
+    [[ "$first" -eq 1 ]] || printf ','
+    first=0
+    printf '{"bucket":%s,"sample_count":%s,"latest_timestamp":%s}' \
+      "$(json_escape "$bucket")" \
+      "${count:-0}" \
+      "$(json_escape "$ts")"
+  done
+  printf ']'
+}
+
+unit_exists() {
+  local unit="$1"
+  systemctl list-unit-files "$unit" --no-legend 2>/dev/null | grep -q . || systemctl status "$unit" >/dev/null 2>&1
+}
+
+stop_disable_all_dlp() {
+  local unit
+  for unit in "${DLP_UNITS[@]}"; do
+    if unit_exists "$unit"; then
+      systemctl stop "$unit" >/dev/null 2>&1 || true
+      systemctl disable "$unit" >/dev/null 2>&1 || true
+      systemctl reset-failed "$unit" >/dev/null 2>&1 || true
+    fi
+  done
+}
+
+enable_start_units() {
+  local unit
+  for unit in "$@"; do
+    if unit_exists "$unit"; then
+      systemctl enable --now "$unit" >/dev/null 2>&1 || true
+    fi
+  done
+}
+
+capture_rollback_state() {
+  local tmp unit load active enabled
+  mkdir -p "$STATE_DIR"
+  tmp="$(mktemp "${ROLLBACK_FILE}.tmp.XXXXXX")"
+  {
+    printf '# generated_at_utc=%s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    printf '# reason=pre_profile_change\n'
+    for unit in "${DLP_UNITS[@]}"; do
+      load="$(systemctl show -p LoadState --value "$unit" 2>/dev/null || true)"
+      if [[ "$load" == "not-found" || -z "$load" ]]; then
+        active="not-found"
+        enabled="not-found"
+      else
+        active="$(systemctl is-active "$unit" 2>/dev/null || true)"
+        enabled="$(systemctl is-enabled "$unit" 2>/dev/null || true)"
+      fi
+      printf '%s|%s|%s|%s\n' "$unit" "${load:-not-found}" "$active" "$enabled"
+    done
+  } >"$tmp"
+  mv "$tmp" "$ROLLBACK_FILE"
+}
+
+write_stats() {
+  local mode="${1:-current}" now stamp tmp history_file
+  now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  stamp="$(date -u +%Y%m%dT%H%M%SZ)"
+  mkdir -p "$STATE_DIR" "$STATE_HISTORY_DIR"
+  tmp="$(mktemp "${STATE_FILE}.tmp.XXXXXX")"
+  {
+    printf '{'
+    printf '"generated_at_utc":%s,' "$(json_escape "$now")"
+    printf '"mode":%s,' "$(json_escape "$mode")"
+    printf '"profile":%s,' "$(json_escape "${AW_DLP_PROFILE:-$PROFILE}")"
+    printf '"reason":%s,' "$(json_escape "$REASON")"
+    printf '"aw_base":%s,' "$(json_escape "$AW_BASE")"
+    printf '"hostname":%s,' "$(json_escape "$HOSTNAME_FILTER")"
+    printf '"units":'
+    unit_json
+    printf ',"buckets":'
+    bucket_json
+    printf '}\n'
+  } >"$tmp"
+  mv "$tmp" "$STATE_FILE"
+  history_file="${STATE_HISTORY_DIR}/dlp-runtime-${mode}-${stamp}.json"
+  cp -a "$STATE_FILE" "$history_file"
+  printf 'latest=%s\nhistory=%s\n' "$STATE_FILE" "$history_file"
+}
+
+apply_profile() {
+  local target_profile="$1"
+  capture_rollback_state
+  case "$target_profile" in
+    core_only|disabled|off)
+      PROFILE="core_only"
+      stop_disable_all_dlp
+      AW_DLP_PROFILE="core_only" write_stats "disabled"
+      ;;
+    light)
+      PROFILE="light"
+      stop_disable_all_dlp
+      enable_start_units "${DLP_LIGHT_UNITS[@]}"
+      AW_DLP_PROFILE="light" write_stats "enabled_light"
+      ;;
+    on_demand)
+      PROFILE="on_demand"
+      stop_disable_all_dlp
+      enable_start_units "${DLP_ON_DEMAND_UNITS[@]}"
+      AW_DLP_PROFILE="on_demand" write_stats "enabled_on_demand"
+      ;;
+    full|enabled|on)
+      PROFILE="full"
+      stop_disable_all_dlp
+      enable_start_units "${DLP_LIGHT_UNITS[@]}"
+      enable_start_units \
+        aw-dlp-influx-exporter.timer \
+        activitywatch-dlp-aggregator.timer \
+        aw-dlp-report-scheduler.timer \
+        aw-dlp-syslog-forwarder.timer \
+        aw-dlp-webhook-sender.timer \
+        aw-dlp-cef-exporter.timer \
+        aw-dlp-policy-engine.service \
+        aw-dlp-case-management.service \
+        detmir-portal-evidence.service
+      AW_DLP_PROFILE="full" write_stats "enabled_full"
+      ;;
+    *)
+      printf 'unsupported DLP profile: %s\n' "$target_profile" >&2
+      printf 'supported profiles: core_only, light, on_demand, full\n' >&2
+      exit 2
+      ;;
+  esac
+}
+
+disable_dlp() {
+  apply_profile "core_only"
+}
+
+enable_dlp() {
+  apply_profile "full"
+}
+
+rollback_dlp() {
+  local unit load active enabled
+  if [[ ! -s "$ROLLBACK_FILE" ]]; then
+    printf 'rollback state not found: %s\n' "$ROLLBACK_FILE" >&2
+    exit 1
+  fi
+  stop_disable_all_dlp
+  while IFS='|' read -r unit load active enabled; do
+    [[ -n "${unit:-}" && "${unit:0:1}" != "#" ]] || continue
+    [[ "$load" != "not-found" ]] || continue
+    if [[ "$enabled" == "enabled" ]]; then
+      systemctl enable "$unit" >/dev/null 2>&1 || true
+    fi
+    if [[ "$active" == "active" ]]; then
+      systemctl start "$unit" >/dev/null 2>&1 || true
+    fi
+  done <"$ROLLBACK_FILE"
+  write_stats "rollback"
+}
+
+case "$ACTION" in
+  status|stats)
+    write_stats "current"
+    ;;
+  profile)
+    printf '%s\n' "${AW_DLP_PROFILE:-$PROFILE}"
+    ;;
+  set-profile)
+    apply_profile "$PROFILE"
+    ;;
+  disable)
+    disable_dlp
+    ;;
+  enable)
+    enable_dlp
+    ;;
+  rollback)
+    rollback_dlp
+    ;;
+  *)
+    printf 'Usage: %s [status|stats|profile|set-profile <core_only|light|on_demand|full>|disable|enable|rollback]\n' "$0" >&2
+    exit 2
+    ;;
+esac

scripts/detmir_dlp_warehouse_sync.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SOURCE_HOST="${AW_DLP_WAREHOUSE_SOURCE_HOST:-igor@10.10.10.13}"
+SOURCE_PATH="${AW_DLP_WAREHOUSE_SOURCE_PATH:-/var/lib/activitywatch/dlp_warehouse.sqlite}"
+DEST_PATH="${AW_DLP_WAREHOUSE_DEST_PATH:-/var/lib/activitywatch/dlp_warehouse.sqlite}"
+STATE_DIR="${AW_DLP_WAREHOUSE_SYNC_STATE_DIR:-/var/lib/activitywatch/health}"
+STATE_FILE="${AW_DLP_WAREHOUSE_SYNC_STATE_FILE:-${STATE_DIR}/dlp-warehouse-sync-state.json}"
+SSH_OPTS="${AW_DLP_WAREHOUSE_SSH_OPTS:--o BatchMode=yes -o ConnectTimeout=5}"
+REMOTE_TMP="/tmp/dlp_warehouse_sync_$$.sqlite"
+LOCAL_TMP=""
+
+json_string() {
+  python3 -c 'import json,sys; print(json.dumps(sys.argv[1], ensure_ascii=False))' "$1"
+}
+
+write_state() {
+  local status="$1"
+  local message="$2"
+  local rows="${3:-}"
+  local bytes="${4:-}"
+  local now tmp
+  now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  mkdir -p "$STATE_DIR"
+  tmp="$(mktemp "${STATE_FILE}.tmp.XXXXXX")"
+  {
+    printf '{'
+    printf '"generated_at_utc":%s,' "$(json_string "$now")"
+    printf '"status":%s,' "$(json_string "$status")"
+    printf '"message":%s,' "$(json_string "$message")"
+    printf '"source_host":%s,' "$(json_string "$SOURCE_HOST")"
+    printf '"source_path":%s,' "$(json_string "$SOURCE_PATH")"
+    printf '"dest_path":%s,' "$(json_string "$DEST_PATH")"
+    if [[ "$rows" =~ ^[0-9]+$ ]]; then
+      printf '"dlp_events":%s,' "$rows"
+    else
+      printf '"dlp_events":null,'
+    fi
+    if [[ "$bytes" =~ ^[0-9]+$ ]]; then
+      printf '"bytes":%s' "$bytes"
+    else
+      printf '"bytes":null'
+    fi
+    printf '}\n'
+  } >"$tmp"
+  mv "$tmp" "$STATE_FILE"
+}
+
+cleanup_remote() {
+  ssh $SSH_OPTS "$SOURCE_HOST" "rm -f '$REMOTE_TMP'" >/dev/null 2>&1 || true
+}
+
+main() {
+  local dest_dir rows bytes
+  dest_dir="$(dirname "$DEST_PATH")"
+  mkdir -p "$dest_dir" "$STATE_DIR"
+  LOCAL_TMP="$(mktemp "${DEST_PATH}.tmp.XXXXXX")"
+  trap 'rm -f "${LOCAL_TMP:-}"; cleanup_remote' EXIT
+
+  ssh $SSH_OPTS "$SOURCE_HOST" \
+    "set -euo pipefail; if command -v sqlite3 >/dev/null 2>&1; then sqlite3 '$SOURCE_PATH' \".backup '$REMOTE_TMP'\" || cp -f '$SOURCE_PATH' '$REMOTE_TMP'; else cp -f '$SOURCE_PATH' '$REMOTE_TMP'; fi; test -s '$REMOTE_TMP'"
+  scp $SSH_OPTS "$SOURCE_HOST:$REMOTE_TMP" "$LOCAL_TMP"
+  chmod 0644 "$LOCAL_TMP"
+  mv "$LOCAL_TMP" "$DEST_PATH"
+
+  bytes="$(stat -c %s "$DEST_PATH" 2>/dev/null || printf '')"
+  rows="$(sqlite3 "$DEST_PATH" 'select count(*) from dlp_events;' 2>/dev/null || printf '')"
+  write_state "ok" "synced" "$rows" "$bytes"
+  printf 'dlp warehouse synced: source=%s:%s dest=%s rows=%s bytes=%s\n' \
+    "$SOURCE_HOST" "$SOURCE_PATH" "$DEST_PATH" "${rows:-unknown}" "${bytes:-unknown}"
+}
+
+main "$@"

scripts/diag_and_manual_restart.sh

@@ -53,6 +53,26 @@ done
 log() { printf "%s %s\n" "$(date +"%F %T")" "$*" >&2; }
 die() { log "ERROR: $*"; exit 1; }
 
+is_truthy() {
+  case "${1:-}" in
+    1|true|TRUE|yes|YES|on|ON) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+require_real_value() {
+  local name="$1"
+  local value="${!name:-}"
+  if [[ -z "$value" ]]; then
+    die "missing required variable: $name"
+  fi
+  case "$value" in
+    *192.0.2.*|*198.51.100.*|*203.0.113.*|*HOST-EXAMPLE*|*.example*)
+      die "refusing placeholder value for $name: $value"
+      ;;
+  esac
+}
+
 command -v ansible >/dev/null 2>&1 || die "ansible not found"
 command -v ansible-playbook >/dev/null 2>&1 || die "ansible-playbook not found"
 [[ -f "$INVENTORY" ]] || die "inventory not found: $INVENTORY"
@@ -68,10 +88,14 @@ restart_server_components() {
     "activitywatch-server"
     "aw-worktime-api"
     "aw-worktime-ui-bridge.timer"
-    "aw-dlp-policy-engine.service"
-    "aw-dlp-aggregator.timer"
-    "activitywatch-dlp-aggregator.timer"
   )
+  if is_truthy "${DETMIR_DLP_ENABLED:-${AW_DLP_ENABLED:-false}}"; then
+    units+=(
+      "aw-dlp-policy-engine.service"
+      "aw-dlp-aggregator.timer"
+      "activitywatch-dlp-aggregator.timer"
+    )
+  fi
   for unit in "${units[@]}"; do
     if ansible -i "$INVENTORY" aw_server -b -m ansible.builtin.command -a "systemctl status ${unit}" >/dev/null 2>&1; then
       ansible -i "$INVENTORY" aw_server -b -m ansible.builtin.systemd -a "name=${unit} state=restarted enabled=true" || true
@@ -80,24 +104,32 @@ restart_server_components() {
 }
 
 seed_server_dlp_events() {
+  if ! is_truthy "${ALLOW_DLP_SEED_EVENTS:-0}"; then
+    log "Skipping DLP freshness seeding; set ALLOW_DLP_SEED_EVENTS=1 with real DETMIR_HOSTNAME/DETMIR_AW_SERVER_HOST to allow it."
+    return 0
+  fi
+  require_real_value DETMIR_HOSTNAME
+  require_real_value DETMIR_AW_SERVER_HOST
   log "Seeding DLP freshness events on aw_server..."
-  local ts
+  local ts host server_host
   ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  host="${DETMIR_HOSTNAME}"
+  server_host="${DETMIR_AW_SERVER_HOST}"
   ansible -i "$INVENTORY" aw_server -b -m ansible.builtin.shell -a "cat >/tmp/aw-endpoint-seed.json <<'JSON'
-{\"timestamp\":\"${ts}\",\"duration\":0.0,\"data\":{\"hostname\":\"HOST-EXAMPLE\",\"signalType\":\"self_test\",\"source\":\"diag_and_manual_restart\",\"username\":\"system\",\"queueDepth\":0,\"eventsEnqueued\":0,\"eventsFlushed\":0,\"sendFailures\":0}}
+{\"timestamp\":\"${ts}\",\"duration\":0.0,\"data\":{\"hostname\":\"${host}\",\"signalType\":\"self_test\",\"source\":\"diag_and_manual_restart\",\"username\":\"system\",\"queueDepth\":0,\"eventsEnqueued\":0,\"eventsFlushed\":0,\"sendFailures\":0}}
 JSON
 cat >/tmp/aw-fileops-seed-host.json <<'JSON'
-{\"timestamp\":\"${ts}\",\"duration\":0.0,\"data\":{\"hostname\":\"HOST-EXAMPLE\",\"operation\":\"self_test\",\"source\":\"diag_and_manual_restart\"}}
+{\"timestamp\":\"${ts}\",\"duration\":0.0,\"data\":{\"hostname\":\"${host}\",\"operation\":\"self_test\",\"source\":\"diag_and_manual_restart\"}}
 JSON
 cat >/tmp/aw-fileops-seed-server.json <<'JSON'
-{\"timestamp\":\"${ts}\",\"duration\":0.0,\"data\":{\"hostname\":\"192.0.2.13\",\"operation\":\"self_test\",\"source\":\"diag_and_manual_restart\"}}
+{\"timestamp\":\"${ts}\",\"duration\":0.0,\"data\":{\"hostname\":\"${server_host}\",\"operation\":\"self_test\",\"source\":\"diag_and_manual_restart\"}}
 JSON
-curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-dlp-endpoint-signals_HOST-EXAMPLE' -H 'Content-Type: application/json' -d '{\"client\":\"aw-dlp-endpoint-signals\",\"type\":\"aw.dlp.endpoint.signal\",\"hostname\":\"HOST-EXAMPLE\"}' >/dev/null 2>&1 || true
-curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_HOST-EXAMPLE' -H 'Content-Type: application/json' -d '{\"client\":\"aw-file-operations\",\"type\":\"aw.file.operation\",\"hostname\":\"HOST-EXAMPLE\"}' >/dev/null 2>&1 || true
-curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_192.0.2.13' -H 'Content-Type: application/json' -d '{\"client\":\"aw-file-operations\",\"type\":\"aw.file.operation\",\"hostname\":\"192.0.2.13\"}' >/dev/null 2>&1 || true
-curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-dlp-endpoint-signals_HOST-EXAMPLE/heartbeat?pulsetime=30' -H 'Content-Type: application/json' --data-binary @/tmp/aw-endpoint-seed.json >/dev/null
-curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_HOST-EXAMPLE/heartbeat?pulsetime=30' -H 'Content-Type: application/json' --data-binary @/tmp/aw-fileops-seed-host.json >/dev/null
-curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_192.0.2.13/heartbeat?pulsetime=30' -H 'Content-Type: application/json' --data-binary @/tmp/aw-fileops-seed-server.json >/dev/null
+curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-dlp-endpoint-signals_${host}' -H 'Content-Type: application/json' -d '{\"client\":\"aw-dlp-endpoint-signals\",\"type\":\"aw.dlp.endpoint.signal\",\"hostname\":\"${host}\"}' >/dev/null 2>&1 || true
+curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_${host}' -H 'Content-Type: application/json' -d '{\"client\":\"aw-file-operations\",\"type\":\"aw.file.operation\",\"hostname\":\"${host}\"}' >/dev/null 2>&1 || true
+curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_${server_host}' -H 'Content-Type: application/json' -d '{\"client\":\"aw-file-operations\",\"type\":\"aw.file.operation\",\"hostname\":\"${server_host}\"}' >/dev/null 2>&1 || true
+curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-dlp-endpoint-signals_${host}/heartbeat?pulsetime=30' -H 'Content-Type: application/json' --data-binary @/tmp/aw-endpoint-seed.json >/dev/null
+curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_${host}/heartbeat?pulsetime=30' -H 'Content-Type: application/json' --data-binary @/tmp/aw-fileops-seed-host.json >/dev/null
+curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_${server_host}/heartbeat?pulsetime=30' -H 'Content-Type: application/json' --data-binary @/tmp/aw-fileops-seed-server.json >/dev/null
 " >/dev/null
 }
 
@@ -107,8 +139,14 @@ restart_windows_collectors() {
 }
 
 seed_windows_dlp_events() {
+  if ! is_truthy "${ALLOW_DLP_SEED_EVENTS:-0}"; then
+    log "Skipping Windows DLP freshness seeding; set ALLOW_DLP_SEED_EVENTS=1 with real DETMIR_HOSTNAME/DETMIR_AW_API to allow it."
+    return 0
+  fi
+  require_real_value DETMIR_HOSTNAME
+  require_real_value DETMIR_AW_API
   log "Seeding endpoint/file-ops events from aw_windows..."
-  ansible -i "$INVENTORY" aw_windows -m ansible.windows.win_shell -a "powershell -NoProfile -ExecutionPolicy Bypass -Command \"\$ErrorActionPreference = 'Stop'; \$ts = (Get-Date).ToUniversalTime().ToString('o'); \$api='http://192.0.2.13:5600/api/0'; \$endpoint=@{timestamp=\$ts;duration=0.0;data=@{hostname='HOST-EXAMPLE';signalType='self_test';source='diag_and_manual_restart';username=\$env:USERNAME;queueDepth=0;eventsEnqueued=0;eventsFlushed=0;sendFailures=0}} | ConvertTo-Json -Depth 8 -Compress; \$fileops=@{timestamp=\$ts;duration=0.0;data=@{hostname='HOST-EXAMPLE';operation='self_test';source='diag_and_manual_restart';username=\$env:USERNAME}} | ConvertTo-Json -Depth 8 -Compress; Invoke-RestMethod -Method Post -Uri \$api'/buckets/aw-dlp-endpoint-signals_HOST-EXAMPLE' -ContentType 'application/json' -Body '{\\\"client\\\":\\\"aw-dlp-endpoint-signals\\\",\\\"type\\\":\\\"aw.dlp.endpoint.signal\\\",\\\"hostname\\\":\\\"HOST-EXAMPLE\\\"}' -TimeoutSec 15 -DisableKeepAlive -ErrorAction SilentlyContinue | Out-Null; Invoke-RestMethod -Method Post -Uri \$api'/buckets/aw-file-operations_HOST-EXAMPLE' -ContentType 'application/json' -Body '{\\\"client\\\":\\\"aw-file-operations\\\",\\\"type\\\":\\\"aw.file.operation\\\",\\\"hostname\\\":\\\"HOST-EXAMPLE\\\"}' -TimeoutSec 15 -DisableKeepAlive -ErrorAction SilentlyContinue | Out-Null; Invoke-RestMethod -Method Post -Uri \$api'/buckets/aw-dlp-endpoint-signals_HOST-EXAMPLE/heartbeat?pulsetime=30' -ContentType 'application/json' -Body \$endpoint -TimeoutSec 15 -DisableKeepAlive | Out-Null; Invoke-RestMethod -Method Post -Uri \$api'/buckets/aw-file-operations_HOST-EXAMPLE/heartbeat?pulsetime=30' -ContentType 'application/json' -Body \$fileops -TimeoutSec 15 -DisableKeepAlive | Out-Null; Write-Output 'windows-dlp-seeded'\""
+  ansible -i "$INVENTORY" aw_windows -m ansible.windows.win_shell -a "powershell -NoProfile -ExecutionPolicy Bypass -Command \"\$ErrorActionPreference = 'Stop'; \$ts = (Get-Date).ToUniversalTime().ToString('o'); \$api='${DETMIR_AW_API}'; \$hostName='${DETMIR_HOSTNAME}'; \$endpointBucket=\$api + '/buckets/aw-dlp-endpoint-signals_' + \$hostName; \$fileopsBucket=\$api + '/buckets/aw-file-operations_' + \$hostName; \$endpoint=@{timestamp=\$ts;duration=0.0;data=@{hostname=\$hostName;signalType='self_test';source='diag_and_manual_restart';username=\$env:USERNAME;queueDepth=0;eventsEnqueued=0;eventsFlushed=0;sendFailures=0}} | ConvertTo-Json -Depth 8 -Compress; \$fileops=@{timestamp=\$ts;duration=0.0;data=@{hostname=\$hostName;operation='self_test';source='diag_and_manual_restart';username=\$env:USERNAME}} | ConvertTo-Json -Depth 8 -Compress; Invoke-RestMethod -Method Post -Uri \$endpointBucket -ContentType 'application/json' -Body (@{client='aw-dlp-endpoint-signals';type='aw.dlp.endpoint.signal';hostname=\$hostName} | ConvertTo-Json -Compress) -TimeoutSec 15 -DisableKeepAlive -ErrorAction SilentlyContinue | Out-Null; Invoke-RestMethod -Method Post -Uri \$fileopsBucket -ContentType 'application/json' -Body (@{client='aw-file-operations';type='aw.file.operation';hostname=\$hostName} | ConvertTo-Json -Compress) -TimeoutSec 15 -DisableKeepAlive -ErrorAction SilentlyContinue | Out-Null; Invoke-RestMethod -Method Post -Uri (\$endpointBucket + '/heartbeat?pulsetime=30') -ContentType 'application/json' -Body \$endpoint -TimeoutSec 15 -DisableKeepAlive | Out-Null; Invoke-RestMethod -Method Post -Uri (\$fileopsBucket + '/heartbeat?pulsetime=30') -ContentType 'application/json' -Body \$fileops -TimeoutSec 15 -DisableKeepAlive | Out-Null; Write-Output 'windows-dlp-seeded'\""
 }
 
 confirm_restart() {

scripts/rdp-worktime-report.sh

@@ -4,14 +4,29 @@ set -euo pipefail
 DAY=""
 FROM=""
 TO=""
-AW_BASE_URL="${AW_BASE_URL:-http://192.0.2.13:5600/api/0}"
-AW_WORKTIME_HOST="${AW_WORKTIME_HOST:-HOST-EXAMPLE}"
+AW_BASE_URL="${AW_BASE_URL:-}"
+AW_WORKTIME_HOST="${AW_WORKTIME_HOST:-}"
 AW_WORKTIME_DEFAULT_SAMPLE_SECONDS="${AW_WORKTIME_DEFAULT_SAMPLE_SECONDS:-30}"
 AW_WORKTIME_MAX_SAMPLE_SECONDS="${AW_WORKTIME_MAX_SAMPLE_SECONDS:-300}"
 OUT_DIR="${OUT_DIR:-reports}"
 TARGET_ROOT="${CARGO_TARGET_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/adk-rust/target}"
 RUST_BIN="${RDP_WORKTIME_REPORT_RUST:-}"
 
+require_live_value() {
+  local name="$1"
+  local value="${!name:-}"
+  if [[ -z "$value" ]]; then
+    echo "Missing required variable: $name" >&2
+    exit 2
+  fi
+  case "$value" in
+    *192.0.2.*|*198.51.100.*|*203.0.113.*|*HOST-EXAMPLE*|*.example*)
+      echo "Refusing placeholder value for $name: $value" >&2
+      exit 2
+      ;;
+  esac
+}
+
 usage() {
   cat <<EOF
 Usage:
@@ -52,6 +67,9 @@ if [[ -z "$FROM" || -z "$TO" ]]; then
   exit 2
 fi
 
+require_live_value AW_BASE_URL
+require_live_value AW_WORKTIME_HOST
+
 mkdir -p "$OUT_DIR"
 CSV_OUT="${OUT_DIR}/rdp-worktime-${FROM}_${TO}.csv"
 JSON_OUT="${OUT_DIR}/rdp-worktime-${FROM}_${TO}.json"
@@ -80,7 +98,9 @@ import urllib.request
 from datetime import datetime, timedelta, timezone
 
 base, host, default_sample, max_sample, from_d, to_d, csv_out, json_out = sys.argv[1:9]
-base = (base or "http://192.0.2.13:5600").rstrip("/")
+if not base:
+    raise SystemExit("AW_BASE_URL is required")
+base = base.rstrip("/")
 if not base.endswith("/api/0"):
     base = base + "/api/0"
 default_sample = max(1.0, float(default_sample))

scripts/run_awatch_contour_check.sh

@@ -43,11 +43,27 @@ configure_detmir_env() {
     fi
   fi
 
-  export DETMIR_AW_API="${DETMIR_AW_API:-http://192.0.2.13:5600/api/0}"
-  export DETMIR_WORKTIME_URL="${DETMIR_WORKTIME_URL:-http://192.0.2.13:5610}"
-  export DETMIR_ONE_C_URL="${DETMIR_ONE_C_URL:-http://192.0.2.2:8710}"
-  export DETMIR_RDP_HOST="${DETMIR_RDP_HOST:-198.51.100.18}"
-  export DETMIR_HOSTNAME="${DETMIR_HOSTNAME:-HOST-EXAMPLE}"
+  export DETMIR_DLP_ENABLED="${DETMIR_DLP_ENABLED:-${AW_DLP_ENABLED:-false}}"
+  require_live_value DETMIR_AW_API
+  require_live_value DETMIR_WORKTIME_URL
+  require_live_value DETMIR_ONE_C_URL
+  require_live_value DETMIR_RDP_HOST
+  require_live_value DETMIR_HOSTNAME
+}
+
+require_live_value() {
+  local name="$1"
+  local value="${!name:-}"
+  if [[ -z "${value}" ]]; then
+    printf 'Missing required live contour variable: %s. Set it in %s or the environment.\n' "${name}" "${ENV_FILE}" >&2
+    exit 2
+  fi
+  case "${value}" in
+    *192.0.2.*|*198.51.100.*|*203.0.113.*|*HOST-EXAMPLE*|*.example*)
+      printf 'Refusing placeholder value for %s: %s\n' "${name}" "${value}" >&2
+      exit 2
+      ;;
+  esac
 }
 
 write_summary() {
@@ -64,6 +80,7 @@ write_summary() {
     printf 'DETMIR_HOSTNAME=%s\n' "${DETMIR_HOSTNAME}"
     printf 'DETMIR_GATEWAY_HOST=%s\n' "${DETMIR_GATEWAY_HOST}"
     printf 'DETMIR_PORTAL_URL=%s\n' "${DETMIR_PORTAL_URL}"
+    printf 'DETMIR_DLP_ENABLED=%s\n' "${DETMIR_DLP_ENABLED}"
     printf 'DETMIR_DLP_COMMAND=%s\n' "${DETMIR_DLP_COMMAND}"
     printf 'DETMIR_DISABLE_PORTAL_CHECK=%s\n' "${DETMIR_DISABLE_PORTAL_CHECK:-0}"
     printf 'DETMIR_DISABLE_DLP_HEALTH_CHECK=%s\n' "${DETMIR_DISABLE_DLP_HEALTH_CHECK:-0}"
@@ -181,5 +198,12 @@ if [[ "${RUN_REGISTRY_CHECK:-0}" == "1" ]] && [[ -x "${REPO_ROOT}/scripts/regist
   fi
 fi
 
+if [[ "${RUN_RESILIENCE_CHECK:-0}" == "1" ]] && [[ -f "${REPO_ROOT}/scripts/detmir_resilience_check.sh" ]]; then
+  resilience_mode="${RESILIENCE_CHECK_MODE:-repo}"
+  if ! run_and_log "detmir-resilience-check" bash "${REPO_ROOT}/scripts/detmir_resilience_check.sh" "--${resilience_mode}"; then
+    status=1
+  fi
+fi
+
 printf 'final_status: %s\n' "$([[ "${status}" -eq 0 ]] && printf ok || printf fail)" | tee -a "${OUTPUT_DIR}/SUMMARY.md"
 exit "${status}"

scripts/security_finding_inbox_smoke.sh

@@ -0,0 +1,110 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+BIN="${SECURITY_FINDING_INBOX_BIN:-}"
+SAMPLE="${1:-$ROOT_DIR/configs/security/security-finding.example.json}"
+TMP_DIR="$(mktemp -d /tmp/security-finding-inbox-smoke.XXXXXX)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+if [[ -z "$BIN" ]]; then
+  for candidate in \
+    "${CARGO_TARGET_DIR:-}/debug/security-finding-inbox" \
+    "${CARGO_TARGET_DIR:-}/release/security-finding-inbox" \
+    "$ROOT_DIR/adk-rust/target/debug/security-finding-inbox" \
+    "$ROOT_DIR/adk-rust/target/release/security-finding-inbox" \
+    "/usr/local/bin/security-finding-inbox"; do
+    if [[ -n "$candidate" && -x "$candidate" ]]; then
+      BIN="$candidate"
+      break
+    fi
+  done
+fi
+
+if [[ -z "$BIN" ]]; then
+  printf 'security-finding-inbox binary not found. Build: cargo build --manifest-path adk-rust/Cargo.toml -p security-finding-inbox\n' >&2
+  exit 2
+fi
+
+"$BIN" schema | grep -q 'CREATE TABLE IF NOT EXISTS analytics_1c.security_findings'
+"$BIN" validate --input "$SAMPLE" | python3 -c '
+import json
+import sys
+payload = json.load(sys.stdin)
+assert payload["ok"] is True
+assert payload["rows"] == 1
+assert payload["finding_ids"][0].startswith("sf-")
+print("security_finding_validate=ok")
+'
+
+"$BIN" ingest --input "$SAMPLE" --dry-run | python3 -c '
+import json
+import sys
+payload = json.load(sys.stdin)
+assert payload["ok"] is True
+assert payload["dry_run"] is True
+assert payload["rows"] == 1
+print("security_finding_ingest_dry_run=ok")
+'
+
+mkdir -p "$TMP_DIR/hayabusa-report"
+cat >"$TMP_DIR/hayabusa-report/timeline.jsonl" <<'EOF'
+{"Level":"high","RuleTitle":"PowerShell Credential Dump","Timestamp":"2026-06-25T10:00:00Z"}
+{"Level":"crit","RuleTitle":"Suspicious Credential Access","Timestamp":"2026-06-25T10:01:00Z"}
+EOF
+cat >"$TMP_DIR/hayabusa-report/logon-summary-failed.csv" <<'EOF'
+header
+1
+2
+EOF
+cat >"$TMP_DIR/latest-intake.json" <<EOF
+{
+  "host": "HOST-EXAMPLE",
+  "status": "ok",
+  "intake_id": "smoke-intake-001",
+  "package_path": "$TMP_DIR/HOST-EXAMPLE.zip",
+  "sha256": "demo",
+  "report_dir": "$TMP_DIR/hayabusa-report"
+}
+EOF
+"$BIN" ingest-hayabusa --intake "$TMP_DIR/latest-intake.json" --min-severity low --dry-run | python3 -c '
+import json
+import sys
+payload = json.load(sys.stdin)
+assert payload["ok"] is True
+assert payload["dry_run"] is True
+assert payload["rows"] == 1
+print("security_finding_hayabusa_ingest_dry_run=ok")
+'
+
+cat >"$TMP_DIR/velociraptor.jsonl" <<'EOF'
+{"Hostname":"HOST-EXAMPLE","Artifact":"Windows.Hayabusa.Monitoring","Severity":"high","Message":"Velociraptor smoke finding","User":"user-example"}
+EOF
+"$BIN" ingest-velociraptor-json --input "$TMP_DIR/velociraptor.jsonl" --dry-run | python3 -c '
+import json
+import sys
+payload = json.load(sys.stdin)
+assert payload["ok"] is True
+assert payload["dry_run"] is True
+assert payload["rows"] == 1
+print("security_finding_velociraptor_ingest_dry_run=ok")
+'
+
+"$BIN" workflow \
+  --finding-id sf-demo \
+  --event-type approved \
+  --actor smoke \
+  --comment "dry-run approval" \
+  --dry-run | python3 -c '
+import json
+import sys
+payload = json.load(sys.stdin)
+assert payload["ok"] is True
+assert payload["dry_run"] is True
+assert payload["event_type"] == "approved"
+print("security_finding_workflow_dry_run=ok")
+'
+
+"$BIN" executor --help >/dev/null
+printenv SECURITY_FINDING_INBOX_SKIP_EXECUTOR_SMOKE >/dev/null 2>&1 || \
+  printf 'security_finding_executor_cli=ok\n'