Add portal prewarm resilience docs

2026-07-01 06:13:06 +03:00
47 changed files with 1304 additions and 5549 deletions
@@ -710,6 +710,7 @@ version = "0.1.0"
 dependencies = [
 "anyhow",
 "clap",
+ "serde_json",
 ]

 [[package]]
@@ -36,7 +36,6 @@ members = [
    "crates/aw-rus-healthd",
    "crates/detmir-check",
    "crates/detmir-core",
-    "crates/security-finding-inbox",
    "crates/dlp-health-check",
    "crates/dlp-content-analyzer",
    "crates/dlp-admin-cli",
@@ -58,7 +57,6 @@ members = [
    "crates/detmir-heal-safe",
    "crates/detmir-status",
    "crates/detmir-state",
-    "crates/containment-engine",
    "crates/tsj-guardian-status",
    "crates/tsj-guardian-watchdog",
 ]
@@ -1796,6 +1796,76 @@ systemctl is-active tsj-guardian-bot tsj-guardian-watchdog gost-tg
 - требует laptop-only path или интерактивный shell;
 - выводит секреты в stdout/journald/report.

+## 12a. DetMir hardline resilience deltas
+
+2026-06-24 Hayabusa poison-package isolation:
+
+- `aw-hayabusa-autoprocess-rust` validates drop zip packages before `accept`;
+- corrupt/empty/unsafe packages and invalid sidecars are quarantined under
+  `/opt/hayabusa/quarantine/drop/...` with `reason.json`;
+- `aw-hayabusa process-inbox` isolates failed incoming packages under
+  `/opt/hayabusa/quarantine/incoming/...` and continues with the rest of the
+  queue;
+- one poison zip no longer blocks the whole Hayabusa batch or trips systemd
+  start-limit by itself;
+- verification: `bash -n aw-server/hayabusa/aw-hayabusa.sh` and
+  `cargo test -p hayabusa-tools` passed locally;
+- live rollout on AW server completed on 2026-06-24 with backups, `doctor` OK,
+  isolated empty-drop dry-run OK, production `incoming_zip=0`, `DROP_COUNT=0`,
+  `staged_dirs=0`; stale 2026-06-20 staging residue moved to quarantine with
+  `reason.json`.
+
+2026-06-24 Windows collector guard child watchdog:
+
+- `AWatchRusCollectorGuardService.cs` now watches the child process via
+  `Process.Exited`;
+- unexpected child exit triggers bounded restart inside the service wrapper;
+- restart budget exhaustion exits the service with a non-zero code so SCM
+  recovery can restart the wrapper instead of leaving `running/no child`;
+- `install-collector-guard-service.ps1` sets `sc.exe failureflag <service> 1`;
+- runtime contract is unchanged: Rust collector guard remains the preferred
+  child, PowerShell guard remains fallback, and `ActivityWatch Recovery` remains
+  enabled as bootstrap fallback;
+- local static verification passed: C# wrapper compiled through PowerShell
+  `Add-Type`; PowerShell installer parsed through the PowerShell parser;
+- live rollout on RDP completed on 2026-06-24 with backup, reinstall in
+  `enforce` mode, `failureflag` enabled, controlled child-kill fault injection,
+  and final validation `service=Running`, `child_count=1`, latest Rust guard
+  cycle `status=ok`.
+
+2026-06-24 DetMir contour resilience check:
+
+- added `scripts/detmir_resilience_check.sh`;
+- repo mode verifies hardening presence for Hayabusa poison quarantine, Windows
+  child watchdog, SCM `failureflag`, and resilience docs;
+- live mode is read-only and checks local AW service/API state, failed systemd
+  units, Hayabusa queues/quarantine, and AW SQLite DB/WAL size thresholds;
+- `scripts/run_awatch_contour_check.sh` can include it with
+  `RUN_RESILIENCE_CHECK=1` and `RESILIENCE_CHECK_MODE=repo|live|all`;
+- strict secret mode (`DETMIR_RESILIENCE_STRICT_SECRETS=1`) fails literal
+  Ansible password assignments without printing secret values;
+- local verification: shell syntax passed, repo mode passed with `ok=15`,
+  `fail=0`, and one WARN for literal private inventory password assignments;
+- live AW server verification passed with `ok=9`, `fail=0`; one expected WARN
+  remains for the deliberate quarantine `reason.json` created during stale
+  staging cleanup.
+
+2026-06-24 live healthd wrapper timeout correction:
+
+- `aw-rus-healthd-rust` had a 20 second default wrapper timeout for
+  `/usr/local/bin/aw-health-check` and `/usr/local/bin/dlp-health-check --json`;
+- under concurrent contour checks the DLP health command could exceed that
+  limit, be killed, and leave partial stdout that healthd reported as
+  `invalid JSON output`;
+- production `/etc/activitywatch/aw-server.env` now sets
+  `AW_RUS_HEALTH_WRAPPER_TIMEOUT_SECONDS=90`, still below the service
+  `TimeoutStartSec=180`;
+- `aw-server/aw-server.env.example` carries the same value so redeploys do not
+  restore the false-fail default;
+- live verification after the change: `aw-rus-healthd.service` finished with
+  `status=0/SUCCESS`, `fail=0`, while AW API, Worktime API and DLP health were
+  independently reachable.
+
 ## 13. Рабочий принцип

 Правильный перенос на Rust - это не переписывание строк один-в-один.
@@ -176,10 +176,6 @@ fn run() -> Result<i32> {
            &root.join("detections/open_cases_from_detections.sql"),
            &mut summary,
        )?;
-        let security_inbox_schema = root.join("security/security_finding_inbox.sql");
-        if security_inbox_schema.exists() {
-            run_sql_file(&client, &security_inbox_schema, &mut summary)?;
-        }
        if !cli.skip_briefs {
            let _ = run_optional_script(&root.join("ops/run_manager_brief.sh"));
            let _ = run_optional_script(&root.join("ops/run_recovery_brief.sh"));
@@ -1,15 +0,0 @@
-[package]
-name = "containment-engine"
-version = "0.1.0"
-edition.workspace = true
-rust-version.workspace = true
-license.workspace = true
-publish.workspace = true
-
-[dependencies]
-anyhow.workspace = true
-chrono.workspace = true
-clap.workspace = true
-serde.workspace = true
-serde_json.workspace = true
-sha2.workspace = true
@@ -97,6 +97,17 @@ body.security-mode .demo-button.is-active {
  color: var(--link);
 }

+.compact-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+  min-width: 220px;
+}
+
+.security-findings-table td {
+  vertical-align: top;
+}
+
 .shell {
  max-width: none;
  min-width: 0;
@@ -9,6 +9,7 @@ const state = {
  cases: null,
  kpiExplain: null,
  pendingScrollSelector: null,
+  refreshSeq: 0,
  load: {
    status: "LOADING",
    stage: "Инициализация портала",
@@ -81,7 +82,7 @@ function apiBase() {

 function apiRole() {
  if (state.tab === "employees" || state.tab === "departments") return "manager";
-  if (state.tab === "owner" || state.tab === "perimeter") return "security";
+  if (state.tab === "owner" || state.tab === "perimeter" || state.tab === "securityFindings") return "security";
  if (state.tab === "incidents") return "forensics";
  if (state.tab === "settings") return "admin";
  const mode = currentViewMode();
@@ -104,6 +105,22 @@ async function loadJson(path) {
  return response.json();
 }

+async function loadJsonWithTimeout(path, timeoutMs) {
+  const controller = new AbortController();
+  const timer = window.setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(`${apiBase()}${path}`, {
+      cache: "no-store",
+      headers: roleHeaders(),
+      signal: controller.signal
+    });
+    if (!response.ok) throw new Error(`${path}: HTTP ${response.status}`);
+    return response.json();
+  } finally {
+    window.clearTimeout(timer);
+  }
+}
+
 async function postJson(path, payload) {
  const response = await fetch(`${apiBase()}${path}`, {
    method: "POST",
@@ -114,6 +131,19 @@ async function postJson(path, payload) {
  return response.json();
 }

+function fallbackSummary(error) {
+  return {
+    operator_ok: false,
+    severity: "STALE",
+    blocks: {
+      collection: {
+        status: "STALE",
+        text: `Портал прогревает первичный срез; быстрый summary временно недоступен: ${error?.message || "timeout"}`
+      }
+    }
+  };
+}
+
 function statusClass(status) {
  const s = String(status || "UNKNOWN").toLowerCase();
  if (s === "ok" || s === "ready" || s === "true" || s === "normal" || s === "low" || s === "false_positive" || s === "resolved") return "status-ok";
@@ -480,6 +510,9 @@ function hasTabData(tab, payload) {
  if (tab === "owner" || tab === "perimeter") {
    return Boolean(payload.data && Object.keys(payload.data).length > 0);
  }
+  if (tab === "securityFindings") {
+    return Boolean(payload.data && Object.keys(payload.data).length > 0);
+  }
  if (tab === "incidents") {
    return (Array.isArray(payload.data?.incidents) && payload.data.incidents.length > 0)
      || (Array.isArray(payload.data?.reports?.risk_incident_candidates) && payload.data.reports.risk_incident_candidates.length > 0)
@@ -1370,6 +1403,7 @@ function renderSecurityView(data, report, extras = {}) {
  return `
    ${renderActionCenter(report?.recommended_actions, { title: "Рекомендуемые действия ИБ", security: true })}
    ${renderSecurityEventsSummary(report?.security_events_summary)}
+    ${renderSecurityFindingInbox(extras.securityFindings)}
    ${renderRiskIncidentCandidates(report?.risk_incident_candidates)}
    ${renderSecurityCorrelation(report?.security_correlation)}
    ${renderCases(cases)}
@@ -1382,10 +1416,84 @@ function renderSecurityView(data, report, extras = {}) {
  `;
 }

+function renderSecurityFindingInbox(inbox) {
+  if (!inbox) {
+    return `<section class="card security-findings-card"><h3>Подозрительные станции</h3><p class="muted">Очередь подозрительных станций загружается.</p></section>`;
+  }
+  const disabled = inbox.backend === "disabled" || inbox.status === "disabled";
+  const fallback = Boolean(inbox.fallback_used);
+  const status = disabled ? "UNKNOWN" : fallback ? "WARN" : Number(inbox.critical_count || 0) > 0 ? "FAIL" : Number(inbox.open_count || 0) > 0 ? "WARN" : "OK";
+  const items = Array.isArray(inbox.items) ? inbox.items : [];
+  const rows = items.map(item => `
+    <tr>
+      <td>
+        <strong>${ui(item.host || "-")}</strong>
+        <div class="muted small">${ui(item.ip || "-")} · ${ui(item.user || "-")} · ${ui(item.department || "-")}</div>
+      </td>
+      <td><span class="badge ${statusClass(item.severity)}">${ui(item.severity || "-")}</span></td>
+      <td>
+        <strong>${ui(item.state || "-")}</strong>
+        <div class="muted small">${ui(item.workflow_status || "new")} · ${ui(item.last_workflow_event || "created")}</div>
+      </td>
+      <td>
+        <strong>${ui(item.source || "-")}</strong>
+        <div class="muted small">${ui(item.rule_id || "-")}</div>
+      </td>
+      <td>${ui(item.summary || item.rule_title || "-")}</td>
+      <td>
+        <div class="actions compact-actions">
+          <button class="small-button" data-security-finding-action="decide" data-security-finding-id="${escapeHtml(item.finding_id)}">decide</button>
+          <button class="small-button" data-security-finding-action="plan" data-security-finding-id="${escapeHtml(item.finding_id)}">plan</button>
+          <button class="small-button" data-security-finding-action="approve" data-security-finding-id="${escapeHtml(item.finding_id)}">approve</button>
+          <button class="small-button" data-security-finding-action="apply" data-security-finding-id="${escapeHtml(item.finding_id)}">apply</button>
+          <button class="small-button" data-security-finding-action="rollback" data-security-finding-id="${escapeHtml(item.finding_id)}">rollback</button>
+        </div>
+      </td>
+    </tr>
+  `).join("");
+  return `
+    <section class="card security-findings-card">
+      <div class="section-head">
+        <div>
+          <h3 ${tooltip("Очередь подозрительных рабочих станций из Hayabusa/Sigma/Velociraptor/AWatch. Кнопки фиксируют workflow-события, но не выполняют firewall apply.")}>Подозрительные станции</h3>
+          <p class="muted">Security Finding Inbox: triage -> decide -> plan -> approve -> apply. Реальное применение выполняется отдельным executor.</p>
+        </div>
+        <span class="badge ${statusClass(status)}">${ui(status)}</span>
+      </div>
+      <div class="quality-grid">
+        <div><span class="muted">Открыто</span><strong>${ui(inbox.open_count ?? 0)}</strong></div>
+        <div><span class="muted">Critical</span><strong>${ui(inbox.critical_count ?? 0)}</strong></div>
+        <div><span class="muted">High</span><strong>${ui(inbox.high_count ?? 0)}</strong></div>
+        <div><span class="muted">Contained</span><strong>${ui(inbox.contained_count ?? 0)}</strong></div>
+      </div>
+      ${fallback ? `<div class="quality-warning">Security Finding Inbox временно недоступен: ${ui(inbox.error || "ошибка источника")}</div>` : ""}
+      ${disabled ? `<p class="muted small">Security Finding Inbox отключен: включите SECURITY_EVENTS_BACKEND=clickhouse и примените схему ClickHouse.</p>` : ""}
+      ${items.length === 0 ? `<p class="muted">Подозрительных станций в очереди нет.</p>` : `
+        <div class="table-scroll">
+          <table class="data-table security-findings-table">
+            <thead>
+              <tr>
+                <th>Станция</th>
+                <th>Риск</th>
+                <th>Статус</th>
+                <th>Источник</th>
+                <th>Описание</th>
+                <th>Workflow</th>
+              </tr>
+            </thead>
+            <tbody>${rows}</tbody>
+          </table>
+        </div>
+      `}
+    </section>
+  `;
+}
+
 function renderManagerView(report) {
  return `
    ${renderExecutiveDashboard(report)}
    ${renderKpiExplain(report?.workforce_kpi_explain)}
+    ${renderWorkforceOperations(report?.workforce_operations || report?.workforce?.operations)}
    ${renderDepartmentRanking(report)}
    ${renderDepartmentHeatMap(report)}
    ${renderOverviewAnalytics(report)}
@@ -1708,6 +1816,134 @@ function renderSimpleItems(items, emptyText) {
  `).join("")}</div>`;
 }

+function renderWorkforceOperations(ops) {
+  if (!ops || typeof ops !== "object") return "";
+  const summary = ops.summary || {};
+  const load = summary.load || {};
+  const idle = summary.idle || {};
+  const discipline = summary.discipline || {};
+  const confidence = summary.confidence || {};
+  const rows = Array.isArray(ops.rows) ? ops.rows.slice(0, 18) : [];
+  const model = ops.model || {};
+  const guardrail = summary.guardrail || "Low confidence строки требуют проверки источников до персонального вывода.";
+  return `
+    <section class="dashboard-band workforce-ops-band">
+      <div class="band-head">
+        <div>
+          <h3>Операционная загрузка</h3>
+          <span class="muted">загрузка, простои, перегруз, дисциплина процесса и достоверность</span>
+        </div>
+        <span class="badge ${statusClass(summary.status || ops.status)}">${ui(summary.status || ops.status || "UNKNOWN")}</span>
+      </div>
+      <div class="quality-grid">
+        <div><span class="muted">Требуют разбора</span><strong>${ui(summary.action_required_users ?? 0)}</strong></div>
+        <div><span class="muted">Недогруз / ниже цели</span><strong>${ui(load.underloaded_users ?? 0)}</strong></div>
+        <div><span class="muted">Перегруз</span><strong>${ui(load.overloaded_users ?? 0)}</strong></div>
+        <div><span class="muted">Простой</span><strong>${ui(idle.idle_users ?? 0)}</strong></div>
+        <div><span class="muted">Дисциплина процесса</span><strong>${ui(discipline.review_users ?? 0)}</strong></div>
+        <div><span class="muted">Low confidence</span><strong>${ui(confidence.low_users ?? 0)}</strong></div>
+      </div>
+      <div class="table-scroll">
+        <table class="data-table">
+          <thead>
+            <tr>
+              <th>Сотрудник</th>
+              <th>Ответственный</th>
+              <th>Активно</th>
+              <th>Простой</th>
+              <th>Coverage</th>
+              <th>Загрузка</th>
+              <th>Простой</th>
+              <th>Дисциплина</th>
+              <th>Достоверность</th>
+              <th>Действие</th>
+            </tr>
+          </thead>
+          <tbody>
+            ${rows.length ? rows.map(row => `
+              <tr>
+                <td><strong>${ui(row.user || "-")}</strong><small>${ui(row.department || "-")}</small></td>
+                <td>${ui(row.manager_owner || "-")}</td>
+                <td>${ui(row.workday_active_hhmm || "00:00")}</td>
+                <td>${ui(row.workday_idle_hhmm || "00:00")}</td>
+                <td>${ui(Math.round(Number(row.coverage_pct || 0)))}%</td>
+                <td><span class="badge ${statusClass(workforceOpsSeverity("load", row.load_status))}">${ui(workforceOpsLabel("load", row.load_status))}</span></td>
+                <td><span class="badge ${statusClass(workforceOpsSeverity("idle", row.idle_status))}">${ui(workforceOpsLabel("idle", row.idle_status))}</span></td>
+                <td><span class="badge ${statusClass(workforceOpsSeverity("discipline", row.discipline_status))}">${ui(workforceOpsLabel("discipline", row.discipline_status))}</span></td>
+                <td><span class="badge ${statusClass(workforceOpsSeverity("confidence", row.data_confidence))}">${ui(workforceOpsLabel("confidence", row.data_confidence))}</span></td>
+                <td>${ui(row.recommended_action || row.operations_recommended_action || row.operations?.recommended_action || "-")}</td>
+              </tr>
+            `).join("") : `
+              <tr><td colspan="10"><strong>Нет данных</strong><small>Управленческий срез Worktime пока не сформирован.</small></td></tr>
+            `}
+          </tbody>
+        </table>
+      </div>
+      <p class="muted small">${ui(guardrail)} · модель: <code>${escapeHtml(model.version || "workforce-operations-v1")}</code> / <code>${escapeHtml(model.type || "rule_based")}</code>.</p>
+    </section>
+  `;
+}
+
+function workforceOpsSeverity(kind, value) {
+  const status = String(value || "").toLowerCase();
+  if (kind === "load") {
+    if (status === "normal") return "OK";
+    if (status === "overloaded") return "HIGH";
+    if (["underloaded", "below_target", "no_activity"].includes(status)) return "WARN";
+    if (["no_data", "insufficient_data"].includes(status)) return "MISSING";
+  }
+  if (kind === "idle") {
+    if (status === "no_significant_idle") return "OK";
+    if (["idle_detected", "full_workday_idle_or_absent"].includes(status)) return "WARN";
+    if (status === "unknown") return "MISSING";
+  }
+  if (kind === "discipline") {
+    if (status === "ok") return "OK";
+    if (status) return "WARN";
+  }
+  if (kind === "confidence") {
+    if (status === "high") return "OK";
+    if (status === "medium") return "WARN";
+    if (status === "low") return "MISSING";
+  }
+  return "UNKNOWN";
+}
+
+function workforceOpsLabel(kind, value) {
+  const status = String(value || "").toLowerCase();
+  const labels = {
+    load: {
+      insufficient_data: "нет окна",
+      no_data: "нет данных",
+      no_activity: "нет активности",
+      underloaded: "недогруз",
+      below_target: "ниже цели",
+      normal: "норма",
+      overloaded: "перегруз",
+    },
+    idle: {
+      not_applicable: "не применимо",
+      unknown: "нет данных",
+      full_workday_idle_or_absent: "пустой день",
+      idle_detected: "простой",
+      no_significant_idle: "без простоя",
+    },
+    discipline: {
+      ok: "процесс в норме",
+      off_hours: "вне графика",
+      late_start: "поздний старт",
+      early_finish: "раннее завершение",
+      multiple_flags: "несколько отклонений",
+    },
+    confidence: {
+      high: "high",
+      medium: "medium",
+      low: "low",
+    },
+  };
+  return labels[kind]?.[status] || value || "unknown";
+}
+
 function workforceIndexText(usersCount, activeSeconds) {
  const users = Number(usersCount || 0);
  const seconds = Number(activeSeconds || 0);
@@ -3037,6 +3273,7 @@ function renderReports(data) {
    <h3 class="section-title">Ключевые показатели</h3>
    ${renderKpiCards(data.kpis)}
    ${renderKpiExplain(data.workforce_kpi_explain)}
+    ${renderWorkforceOperations(data.workforce_operations || data.workforce?.operations)}
    ${renderAgentQuality(data.agent_quality, data.agent_quality_explain)}
    ${renderAgentQualityHistory(data.agent_quality_history, data.agent_quality_history_summary)}
    ${renderAgentQualityNodes(data.agent_quality_nodes, data.agent_quality_nodes_summary)}
@@ -3107,28 +3344,41 @@ async function refresh(options = {}) {
  const content = document.getElementById("content");
  const background = Boolean(options.background);
  const stage = options.stage || "Получение данных";
+  const refreshSeq = ++state.refreshSeq;
+  const isCurrentRefresh = () => refreshSeq === state.refreshSeq;
  const progress = (status, label, value) => {
-    if (!background) setLoadStatus(status, label, value);
+    if (!background && isCurrentRefresh()) setLoadStatus(status, label, value);
  };
  try {
    progress("LOADING", stage, 8);
-    if (!background && content) content.innerHTML = renderLoadingContent(stage);
+    if (!background && content && isCurrentRefresh()) {
+      content.innerHTML = renderLoadingContent(stage);
+    }
    if (!state.links) {
      progress("LOADING", "Получение данных", 18);
      state.links = await loadJson("/links");
+      if (!isCurrentRefresh()) return;
    }
    progress("LOADING", "Расчёт показателей", 34);
-    const summary = await loadJson("/summary");
+    const summary = await loadJsonWithTimeout("/summary", 5000).catch(fallbackSummary);
+    if (!isCurrentRefresh()) return;
    progress("LOADING", "Расчёт показателей", 46);
    state.readiness = {
-      bundle: await loadJson("/readiness/bundle").catch(error => ({ ok: false, error: error.message })),
+      bundle: await loadJsonWithTimeout("/readiness/bundle", 3000).catch(error => ({ ok: false, error: error.message })),
      verify: state.readiness?.verify || null
    };
+    if (!isCurrentRefresh()) return;
    renderSummary(summary, state.readiness);
    progress("LOADING", "Формирование главного вывода", 68);
    const tabResult = await loadCurrentTab();
+    if (!isCurrentRefresh()) return;
    progress("LOADING", "Подготовка разделов", 88);
    if (!hasTabData(state.tab, tabResult)) {
+      if (tabResult.html && tabResult.html.includes("data-loading-state=\"STALE\"")) {
+        setLoadStatus("STALE", "Первичный срез прогревается", 100, { error: "cache/prewarm in progress" });
+        if (content) content.innerHTML = tabResult.html;
+        return;
+      }
      setLoadStatus("EMPTY", "Данные отсутствуют", 100);
      if (content) {
        content.innerHTML = `${renderEmptyState("Источники ответили, но полезные записи для текущего раздела пока не найдены.")}${tabResult.html || ""}`;
@@ -3139,20 +3389,29 @@ async function refresh(options = {}) {
    setLoadStatus("READY", "Данные готовы", 100);
    consumePendingScroll();
  } catch (error) {
+    if (!isCurrentRefresh()) return;
    showError(error);
  }
 }

 async function loadCurrentTab() {
  if (state.tab === "operator") {
-    const data = await loadJson("/operator");
+    const data = await loadJsonWithTimeout("/operator", 7000).catch(error => null);
+    if (!data) {
+      return {
+        data: {},
+        html: staleBanner("Портал прогревает первичный срез. Быстрые health/readiness доступны, тяжелый операционный срез будет подставлен после cache/prewarm.")
+      };
+    }
    state.operatorData = data;
-    state.reports = await loadJson("/reports").catch(() => state.reports);
+    state.reports = await loadJsonWithTimeout("/reports", 3000).catch(() => state.reports);
+    let securityFindings = null;
    if (currentViewMode() === "security" || currentViewMode() === "forensics") {
      state.cases = await loadJson("/cases").catch(error => ({ ok: false, error: error.message, cases: [] }));
+      securityFindings = await loadJson("/security/findings").catch(error => ({ status: "fallback", fallback_used: true, error: error.message, items: [] }));
    }
    updateFilters(state.reports);
-    return { data, report: state.reports, cases: state.cases, html: renderOperator(data, state.reports, { cases: state.cases }) };
+    return { data, report: state.reports, cases: state.cases, securityFindings, html: renderOperator(data, state.reports, { cases: state.cases, securityFindings }) };
  }
  if (state.tab === "manager") {
    const data = await loadJson("/manager");
@@ -3178,6 +3437,19 @@ async function loadCurrentTab() {
    const data = await loadJson("/owner");
    return { data, html: renderOwner(data) };
  }
+  if (state.tab === "securityFindings") {
+    const data = await loadJson("/security/findings");
+    return { data, html: `
+      <div class="page-head">
+        <div>
+          <h2 class="section-title">Подозрительные станции</h2>
+          <p class="muted">Очередь triage для Hayabusa/Sigma/Velociraptor/AWatch findings. Реальное применение containment выполняется отдельным executor.</p>
+        </div>
+        <span class="badge ${statusClass(data.status)}">${ui(data.status || "unknown")}</span>
+      </div>
+      ${renderSecurityFindingInbox(data)}
+    ` };
+  }
  if (state.tab === "incidents") {
    const data = await loadJson("/incidents");
    const evidence = await loadJson("/dlp/evidence").catch(error => ({ ok: false, error: error.message, items: [] }));
@@ -3213,6 +3485,7 @@ function tabLoadingStage(tab) {
    employees: "Получение данных сотрудников",
    departments: "Расчёт показателей подразделений",
    owner: "Формирование главного вывода по рискам",
+    securityFindings: "Загрузка очереди подозрительных станций",
    incidents: "Подготовка разделов расследований",
    perimeter: "Подготовка разделов сетевого периметра",
    reports: "Подготовка разделов отчета",
@@ -3230,7 +3503,7 @@ function setTab(tab) {
 }

 function applySecurityMode(tab) {
-  document.body.classList.toggle("security-mode", tab === "owner" || tab === "incidents" || tab === "perimeter");
+  document.body.classList.toggle("security-mode", tab === "owner" || tab === "incidents" || tab === "perimeter" || tab === "securityFindings");
 }

 function consumePendingScroll() {
@@ -3311,6 +3584,12 @@ document.addEventListener("click", event => {
  incidentAction(button).catch(showError);
 });

+document.addEventListener("click", event => {
+  const button = event.target.closest("[data-security-finding-action]");
+  if (!button) return;
+  securityFindingWorkflowAction(button).catch(showError);
+});
+
 document.addEventListener("click", event => {
  const button = event.target.closest("[data-review-status]");
  if (!button) return;
@@ -3425,6 +3704,23 @@ async function incidentAction(button) {
  await refresh({ stage: "Обновление статуса инцидента" });
 }

+async function securityFindingWorkflowAction(button) {
+  const findingId = button.dataset.securityFindingId;
+  const action = button.dataset.securityFindingAction;
+  const promptText = action === "apply"
+    ? "Комментарий к apply request. Реальное применение firewall отсюда не выполняется."
+    : `Комментарий к действию ${action}`;
+  const comment = window.prompt(promptText, "");
+  if (comment === null) return;
+  button.disabled = true;
+  await postJson("/security/findings/workflow", {
+    finding_id: findingId,
+    action,
+    comment,
+  });
+  await refresh({ stage: "Обновление очереди подозрительных станций" });
+}
+
 async function candidateReviewAction(button) {
  const candidateId = button.dataset.candidateId;
  const status = button.dataset.reviewStatus;
@@ -18,6 +18,7 @@
        <button class="tab" data-tab="employees">Сотрудники</button>
        <button class="tab" data-tab="departments">Подразделения</button>
        <button class="tab" data-tab="owner">Риски</button>
+        <button class="tab" data-tab="securityFindings">Подозрительные станции</button>
        <button class="tab" data-tab="incidents">Расследования</button>
        <button class="tab" data-tab="perimeter">Сетевой периметр</button>
        <button class="tab" data-tab="reports">Отчеты</button>
@@ -32,8 +32,6 @@ reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 urlencoding.workspace = true
-sha2.workspace = true
-zip = { version = "2", default-features = false, features = ["deflate"] }

 [dev-dependencies]
 tempfile.workspace = true
@@ -1,22 +1,17 @@
 use std::fs::{self, File};
-use std::io::{self, Read};
 use std::path::{Path, PathBuf};
 use std::process::Command;

 use anyhow::{Context, Result, bail};
-use chrono::Utc;
 use clap::Parser;
 use fs2::FileExt;
-use hayabusa_tools::{env_bool, env_string, guess_host_from_filename, read_json_file};
+use hayabusa_tools::{guess_host_from_filename, read_json_file};
 use serde_json::{Value, json};
-use sha2::{Digest, Sha256};
-use zip::ZipArchive;

 const LOCK_PATH: &str = "/opt/hayabusa/state/aw-hayabusa-autoprocess.lock";
 const WRAPPER: &str = "/usr/local/bin/aw-hayabusa";
 const LINKER: &str = "/usr/local/bin/aw-hayabusa-link-case";
 const CASE_ALERT: &str = "/usr/local/bin/aw-hayabusa-case-alert";
-const SECURITY_FINDING_INBOX: &str = "/usr/local/bin/security-finding-inbox";
 const LATEST_INTAKE: &str = "/opt/hayabusa/state/latest-intake.json";

 #[derive(Debug, Parser)]
@@ -25,9 +20,6 @@ struct Cli {
    #[arg(long, default_value = "/opt/activitywatch/aw-rus-ops/drop")]
    drop_dir: PathBuf,

-    #[arg(long, default_value = "/opt/hayabusa/quarantine/drop")]
-    quarantine_dir: PathBuf,
-
    #[arg(long, default_value_t = true)]
    once: bool,
 }
@@ -73,43 +65,16 @@ fn run() -> Result<i32> {
        println!("no zip packages in drop dir");
        return Ok(0);
    }
-    let mut operational_failures = 0usize;
    for zip_path in zips {
-        if let Err(err) = validate_drop_inputs(&zip_path) {
-            let quarantine_dir = quarantine_drop_package(&cli.quarantine_dir, &zip_path, &err)?;
-            println!(
-                "{}",
-                serde_json::to_string_pretty(&json!({
-                    "quarantined": zip_path.display().to_string(),
-                    "quarantine_dir": quarantine_dir.display().to_string(),
-                    "reason": err.to_string(),
-                }))?
-            );
-            continue;
-        }
-        match process_one(&zip_path) {
-            Ok(result) => {
-                println!(
-                    "{}",
-                    serde_json::to_string_pretty(&json!({
-                        "processed": zip_path.display().to_string(),
-                        "latest_intake": result.latest_intake,
-                        "case_alert": result.case_alert,
-                        "security_finding_ingest": result.security_finding_ingest,
-                    }))?
-                );
-            }
-            Err(err) => {
-                operational_failures += 1;
-                eprintln!(
-                    "ERROR: operational failure while processing {}: {err:#}",
-                    zip_path.display()
-                );
-            }
-        }
-    }
-    if operational_failures > 0 {
-        bail!("{operational_failures} operational Hayabusa package failure(s)");
+        let result = process_one(&zip_path)?;
+        println!(
+            "{}",
+            serde_json::to_string_pretty(&json!({
+                "processed": zip_path.display().to_string(),
+                "latest_intake": result.latest_intake,
+                "case_alert": result.case_alert,
+            }))?
+        );
    }
    Ok(0)
 }
@@ -117,7 +82,6 @@ fn run() -> Result<i32> {
 struct ProcessResult {
    latest_intake: Value,
    case_alert: Option<Value>,
-    security_finding_ingest: Option<Value>,
 }

 fn list_zips(drop_dir: &Path) -> Result<Vec<PathBuf>> {
@@ -132,42 +96,6 @@ fn list_zips(drop_dir: &Path) -> Result<Vec<PathBuf>> {
    Ok(zips)
 }

-fn validate_drop_inputs(zip_path: &Path) -> Result<()> {
-    validate_zip_package(zip_path)?;
-    load_sidecars(zip_path)?;
-    Ok(())
-}
-
-fn validate_zip_package(zip_path: &Path) -> Result<()> {
-    let file = File::open(zip_path).with_context(|| format!("open {}", zip_path.display()))?;
-    let mut archive =
-        ZipArchive::new(file).with_context(|| format!("read zip {}", zip_path.display()))?;
-    if archive.is_empty() {
-        bail!("zip package has no entries: {}", zip_path.display());
-    }
-    for index in 0..archive.len() {
-        let mut entry = archive
-            .by_index(index)
-            .with_context(|| format!("read zip entry {index} from {}", zip_path.display()))?;
-        let name = entry.name().replace('\\', "/");
-        if name.starts_with('/') || name.split('/').any(|part| part == "..") {
-            bail!(
-                "unsafe zip entry in {}: {}",
-                zip_path.display(),
-                entry.name()
-            );
-        }
-        io::copy(&mut entry, &mut io::sink()).with_context(|| {
-            format!(
-                "test zip entry {} from {}",
-                entry.name(),
-                zip_path.display()
-            )
-        })?;
-    }
-    Ok(())
-}
-
 fn process_one(zip_path: &Path) -> Result<ProcessResult> {
    let sidecars = load_sidecars(zip_path)?;
    let host = guess_host(zip_path, &sidecars);
@@ -195,7 +123,6 @@ fn process_one(zip_path: &Path) -> Result<ProcessResult> {
        ],
    )?;
    let latest = read_json_file(Path::new(LATEST_INTAKE))?;
-    let security_finding_ingest = ingest_security_finding_best_effort(Path::new(LATEST_INTAKE))?;
    let report_dir = PathBuf::from(
        latest
            .get("report_dir")
@@ -227,7 +154,6 @@ fn process_one(zip_path: &Path) -> Result<ProcessResult> {
            return Ok(ProcessResult {
                latest_intake: latest,
                case_alert,
-                security_finding_ingest,
            });
        }
        run_checked(
@@ -245,63 +171,9 @@ fn process_one(zip_path: &Path) -> Result<ProcessResult> {
    Ok(ProcessResult {
        latest_intake: latest,
        case_alert,
-        security_finding_ingest,
    })
 }

-fn ingest_security_finding_best_effort(intake_path: &Path) -> Result<Option<Value>> {
-    if !env_bool("AW_SECURITY_FINDING_INBOX_ENABLED", false) {
-        return Ok(None);
-    }
-    let binary = PathBuf::from(env_string(
-        "AW_SECURITY_FINDING_INBOX_BIN",
-        SECURITY_FINDING_INBOX,
-    ));
-    let required = env_bool("AW_SECURITY_FINDING_INBOX_REQUIRED", false);
-    if !binary.is_file() {
-        let message = format!(
-            "security finding inbox binary not found: {}",
-            binary.display()
-        );
-        if required {
-            bail!("{message}");
-        }
-        eprintln!("WARNING: {message}");
-        return Ok(Some(json!({"ok": false, "warning": message})));
-    }
-    let min_severity = env_string("AW_SECURITY_FINDING_INBOX_MIN_SEVERITY", "medium");
-    let output = Command::new(&binary)
-        .arg("ingest-hayabusa")
-        .arg("--intake")
-        .arg(intake_path)
-        .arg("--min-severity")
-        .arg(min_severity)
-        .output()
-        .with_context(|| format!("run {}", binary.display()))?;
-    let stdout = String::from_utf8_lossy(&output.stdout);
-    let stderr = String::from_utf8_lossy(&output.stderr);
-    if !output.status.success() {
-        let message = format!(
-            "security finding ingest failed: status={} stderr={}",
-            output.status,
-            stderr.trim()
-        );
-        if required {
-            bail!("{message}");
-        }
-        eprintln!("WARNING: {message}");
-        return Ok(Some(json!({"ok": false, "warning": message})));
-    }
-    let payload = serde_json::from_str(stdout.trim()).unwrap_or_else(|_| {
-        json!({
-            "ok": true,
-            "stdout": stdout.trim(),
-            "stderr": stderr.trim()
-        })
-    });
-    Ok(Some(payload))
-}
-
 fn load_sidecars(zip_path: &Path) -> Result<Sidecars> {
    let base = zip_path.with_extension("");
    let caseid_path = base.with_extension("caseid");
@@ -369,108 +241,6 @@ fn archive_drop_package(report_dir: &Path, zip_path: &Path) -> Result<()> {
    Ok(())
 }

-fn quarantine_drop_package(
-    quarantine_root: &Path,
-    zip_path: &Path,
-    err: &anyhow::Error,
-) -> Result<PathBuf> {
-    fs::create_dir_all(quarantine_root)
-        .with_context(|| format!("create {}", quarantine_root.display()))?;
-    let name = zip_path
-        .file_name()
-        .and_then(|name| name.to_str())
-        .unwrap_or("package.zip");
-    let stamp = Utc::now().format("%Y%m%dT%H%M%SZ");
-    let mut quarantine_dir = quarantine_root.join(format!("{stamp}_{}", sanitize_component(name)));
-    if quarantine_dir.exists() {
-        quarantine_dir = quarantine_root.join(format!(
-            "{stamp}_{}_{}",
-            sanitize_component(name),
-            std::process::id()
-        ));
-    }
-    fs::create_dir_all(&quarantine_dir)
-        .with_context(|| format!("create {}", quarantine_dir.display()))?;
-
-    let sha256 = if zip_path.is_file() {
-        Some(sha256_file(zip_path)?)
-    } else {
-        None
-    };
-    move_if_exists(zip_path, &quarantine_dir)?;
-    let base = zip_path.with_extension("");
-    for sidecar in [
-        base.with_extension("caseid"),
-        base.with_extension("meta.json"),
-        zip_path.with_extension("zip.sha256"),
-    ] {
-        move_if_exists(&sidecar, &quarantine_dir)?;
-    }
-    let reason = json!({
-        "quarantined_at": Utc::now().to_rfc3339(),
-        "source": "aw-hayabusa-autoprocess-rust",
-        "original_path": zip_path.display().to_string(),
-        "sha256": sha256,
-        "reason": err.to_string(),
-        "detail": format!("{err:#}"),
-        "operator_action": "inspect source package, re-export EVTX archive if needed, then replay by moving a fixed package back to the drop directory",
-    });
-    fs::write(
-        quarantine_dir.join("reason.json"),
-        serde_json::to_string_pretty(&reason)?,
-    )
-    .with_context(|| format!("write {}", quarantine_dir.join("reason.json").display()))?;
-    Ok(quarantine_dir)
-}
-
-fn move_if_exists(path: &Path, target_dir: &Path) -> Result<()> {
-    if !path.exists() {
-        return Ok(());
-    }
-    let target = target_dir.join(path.file_name().context("quarantine file name")?);
-    fs::rename(path, &target)
-        .or_else(|_| {
-            fs::copy(path, &target)?;
-            fs::remove_file(path)
-        })
-        .with_context(|| format!("move {} to {}", path.display(), target.display()))?;
-    Ok(())
-}
-
-fn sha256_file(path: &Path) -> Result<String> {
-    let mut file = File::open(path).with_context(|| format!("open {}", path.display()))?;
-    let mut hasher = Sha256::new();
-    let mut buf = [0u8; 8192];
-    loop {
-        let read = file
-            .read(&mut buf)
-            .with_context(|| format!("read {}", path.display()))?;
-        if read == 0 {
-            break;
-        }
-        hasher.update(&buf[..read]);
-    }
-    Ok(format!("{:x}", hasher.finalize()))
-}
-
-fn sanitize_component(value: &str) -> String {
-    let clean = value
-        .chars()
-        .map(|ch| {
-            if ch.is_ascii_alphanumeric() || matches!(ch, '.' | '_' | '-') {
-                ch
-            } else {
-                '_'
-            }
-        })
-        .collect::<String>();
-    if clean.is_empty() {
-        "package".to_string()
-    } else {
-        clean
-    }
-}
-
 fn guess_host(zip_path: &Path, sidecars: &Sidecars) -> Option<String> {
    if let Some(host) = &sidecars.host {
        if !host.is_empty() {
@@ -532,57 +302,3 @@ fn run_capture(program: &Path, args: &[String]) -> Result<Captured> {
        stderr: String::from_utf8_lossy(&output.stderr).to_string(),
    })
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::io::Write;
-
-    #[test]
-    fn invalid_zip_is_rejected_before_accept() {
-        let dir = tempfile::tempdir().unwrap();
-        let zip_path = dir.path().join("bad.zip");
-        fs::write(&zip_path, b"not a zip").unwrap();
-
-        let err = validate_drop_inputs(&zip_path).unwrap_err();
-        assert!(err.to_string().contains("read zip"));
-    }
-
-    #[test]
-    fn quarantine_moves_package_sidecars_and_writes_reason() {
-        let dir = tempfile::tempdir().unwrap();
-        let drop = dir.path().join("drop");
-        let quarantine = dir.path().join("quarantine");
-        fs::create_dir_all(&drop).unwrap();
-        let zip_path = drop.join("HOST-20260624.zip");
-        fs::write(&zip_path, b"bad").unwrap();
-        fs::write(drop.join("HOST-20260624.meta.json"), b"{bad").unwrap();
-        fs::write(drop.join("HOST-20260624.caseid"), b"30").unwrap();
-
-        let err = anyhow::anyhow!("bad zip");
-        let target = quarantine_drop_package(&quarantine, &zip_path, &err).unwrap();
-
-        assert!(!zip_path.exists());
-        assert!(target.join("HOST-20260624.zip").is_file());
-        assert!(target.join("HOST-20260624.meta.json").is_file());
-        assert!(target.join("HOST-20260624.caseid").is_file());
-        let reason = fs::read_to_string(target.join("reason.json")).unwrap();
-        assert!(reason.contains("bad zip"));
-        assert!(reason.contains("aw-hayabusa-autoprocess-rust"));
-    }
-
-    #[test]
-    fn valid_zip_with_backslash_entry_is_accepted_by_precheck() {
-        let dir = tempfile::tempdir().unwrap();
-        let zip_path = dir.path().join("ok.zip");
-        let file = File::create(&zip_path).unwrap();
-        let mut zip = zip::ZipWriter::new(file);
-        let options = zip::write::SimpleFileOptions::default()
-            .compression_method(zip::CompressionMethod::Deflated);
-        zip.start_file("evtx\\sample.evtx", options).unwrap();
-        zip.write_all(b"evtx").unwrap();
-        zip.finish().unwrap();
-
-        validate_drop_inputs(&zip_path).unwrap();
-    }
-}
@@ -1,20 +0,0 @@
-[package]
-name = "security-finding-inbox"
-version = "0.1.0"
-edition.workspace = true
-rust-version.workspace = true
-license.workspace = true
-publish.workspace = true
-
-[dependencies]
-anyhow.workspace = true
-chrono.workspace = true
-clap.workspace = true
-hayabusa-tools = { path = "../hayabusa-tools" }
-reqwest.workspace = true
-serde.workspace = true
-serde_json.workspace = true
-sha2.workspace = true
-
-[dev-dependencies]
-tempfile.workspace = true
@@ -38,9 +38,15 @@ ansible-playbook -i inventory.ini deploy_aw_server.yml
 Рекомендуемый способ не хранить пароли в репозитории — перед запуском экспортировать их в переменные окружения:

 - Linux `aw_server` (SSH пароль root): `AW_SSH_PASSWORD`
+- Linux `proxmox` (SSH пароль): `AW_PROXMOX_SSH_PASSWORD`
+- Sudo для Linux, если отличается от SSH: `AW_SUDO_PASSWORD` или
+  `AW_PROXMOX_SUDO_PASSWORD`
 - Windows `aw_windows` (WinRM пароль): `AW_WINRM_PASSWORD`

-В `group_vars/aw_server.yml` и `group_vars/windows.yml` они читаются через `lookup('env', ...)`.
+В `group_vars/aw_server.yml`, `group_vars/proxmox.yml` и
+`group_vars/aw_windows.yml` они читаются через `lookup('env', ...)`.
+В `ansible/inventory.ini` пароли хранить нельзя: там остаются только host,
+user, port и connection-параметры.

 ## Полный установочный playbook (всё за один запуск)

@@ -125,8 +131,8 @@ Playbook:
 - после deploy принудительно запускает `ActivityWatch Recovery` и managed `ActivityWatch Launch *` задачи;
 - включает (`Enable-ScheduledTask`) `ActivityWatch Recovery` и managed `ActivityWatch Launch *` задачи перед запуском (иначе WebUI может показывать `Active time: 0s`);
 - оставляет `ActivityWatch Recovery` включённым даже при активном `AWatchRusCollectorGuard`: guard является основным контроллером, recovery остаётся fallback/bootstrap path;
- выполняет API smoke-check bucket `aw-watcher-afk_<COMPUTERNAME>` и ожидает свежие события;
- выполняет API smoke-check bucket `aw-watcher-window_<COMPUTERNAME>` и ожидает свежие события (по умолчанию включено);
+- выполняет API smoke-check bucket `aw-watcher-afk_<aw_windows_logical_host_id>` и ожидает свежие события;
+- выполняет API smoke-check bucket `aw-watcher-window_<aw_windows_logical_host_id>` и ожидает свежие события (по умолчанию включено);
 - запускает `validate-deployment.ps1`;
 - забирает JSON-отчёт в локальную директорию (`/tmp/aw-rus-validation-<USER>` по умолчанию).
 - настраивает scheduled task `ActivityWatch Hayabusa Upload` с периодом и lookback по vars.
@@ -146,8 +152,10 @@ Playbook:
 - `aw_windows_legacy_install_root` / `aw_windows_legacy_state_root` — старые production paths, откуда выполняется перенос;
 - `aw_windows_migration_report_remote_path` — JSON-отчёт о миграции на Windows-хосте;
 - `aw_windows_package_version`, `aw_windows_package_url`, `aw_windows_package_zip_path` — версия и источник Windows-пакета ActivityWatch;
- `aw_windows_api_smoke_check_bucket: ""` — автоматически использовать `aw-watcher-afk_<COMPUTERNAME>`;
- `aw_windows_api_smoke_check_window_enabled: true` — включить дополнительный smoke-check `aw-watcher-window_<COMPUTERNAME>`;
+- `aw_windows_domain: ""` — Windows account domain/local logon prefix. Если пусто или `HOST-EXAMPLE`, playbook берёт текущий `$env:COMPUTERNAME` с Windows-хоста через WinRM;
+- `aw_windows_logical_host_id: ""` — stable ActivityWatch id для bucket-ов/дашбордов; если пусто, fallback к `COMPUTERNAME`;
+- `aw_windows_api_smoke_check_bucket: ""` — автоматически использовать `aw-watcher-afk_<aw_windows_logical_host_id>`;
+- `aw_windows_api_smoke_check_window_enabled: true` — включить дополнительный smoke-check `aw-watcher-window_<aw_windows_logical_host_id>` с fallback к физическому `COMPUTERNAME`;
 - `aw_windows_api_smoke_check_window_bucket: ""` — переопределить bucket для window smoke-check;
 - `aw_windows_api_smoke_check_min_events: 1` — минимум событий, ожидаемых в smoke-check;
 - `aw_windows_fail_on_validation_error: true` — завершать playbook ошибкой, если `validate-deployment.ps1` возвращает `overallOk=false`;
@@ -157,7 +165,7 @@ Playbook:
 - `aw_windows_hayabusa_auto_upload_hours_back: 6` — lookback для каждого запуска;
 - `aw_windows_hayabusa_auto_upload_mode: "incident"` — mode для server-side processing;
 - `aw_windows_hayabusa_auto_upload_task_name: "ActivityWatch Hayabusa Upload"` — имя scheduled task.
- `aw_windows_hayabusa_auto_upload_run_as_user: "Администратор"` — production principal для scheduled task на RDP-хосте. На `SHARKON2025` запуск `powershell.exe` из `SYSTEM` возвращал `0xC0000142`, поэтому авто-upload должен идти как interactive/highest task от локального администратора.
+- `aw_windows_hayabusa_auto_upload_run_as_user: "Администратор"` — production principal для scheduled task на RDP-хосте. На текущем DetMir RDP-контуре запуск `powershell.exe` из `SYSTEM` возвращал `0xC0000142`, поэтому auto-upload должен идти как interactive/highest task от локального администратора.

 ## Server-side Hayabusa auto-case и Telegram alerting

@@ -290,3 +298,5 @@ bash scripts/prod_rollout.sh
 ```

 Скрипт попросит `AW_SSH_PASSWORD` и `AW_WINRM_PASSWORD` интерактивно (ввод скрыт) и сложит логи в `.rollout-logs/`.
+Для Proxmox можно дополнительно экспортировать `AW_PROXMOX_SSH_PASSWORD`, если
+он отличается от `AW_SSH_PASSWORD`.
@@ -47,6 +47,7 @@ aw_worktime_host: "{{ aw_monitored_windows_hostname }}"
 aw_rus_health_worktime_api_base: "http://127.0.0.1:5610"
 aw_rus_health_state_dir: "{{ aw_server_data_dir }}/health"
 aw_rus_health_validation_dir: "{{ aw_rus_health_state_dir }}/windows-validation"
+aw_rus_health_rdp_tcp_required: true
 aw_browser_smoke_enabled: true
 aw_browser_smoke_engine: "chromium-cli"
 aw_legacy_db_merge_enabled: false
@@ -58,6 +59,15 @@ aw_hayabusa_telegram_enabled: true
 aw_hayabusa_telegram_min_severity: "high"
 aw_hayabusa_telegram_bot_token: ""
 aw_hayabusa_telegram_chat_ids: ""
+aw_security_finding_inbox_enabled: false
+aw_security_finding_inbox_required: false
+aw_security_finding_inbox_bin: "/usr/local/bin/security-finding-inbox"
+aw_security_finding_inbox_min_severity: "medium"
+aw_security_finding_executor_work_dir: "{{ aw_server_data_dir }}/security-finding-executor"
+aw_security_finding_executor_lock: "/var/lock/aw-security-finding-executor.lock"
+aw_containment_engine_bin: "/usr/local/bin/containment-engine"
+aw_containment_management_allowlist: ""
+aw_containment_blocked_remote_addresses: ""

 aw_repo_root: "{{ playbook_dir | dirname }}"

@@ -85,17 +95,44 @@ aw_server_always_active_pattern: "aw-watcher-window"
 aw_server_landingpage: "/#/activity/HOST-EXAMPLE/view/"
 aw_health_strict_fileops: 0

-aw_dlp_policy_engine_enabled: true
+aw_dlp_profile: "core_only"
+detmir_portal_dlp_profile: "core_only"
+detmir_portal_dlp_module_enabled_override: false
+aw_dlp_enabled: false
+aw_dlp_disabled_reason: "operator_disabled_to_reduce_proxmox_influx_grafana_clickhouse_load"
+aw_dlp_disabled_since: ""
+aw_dlp_light_collector_enabled: false
+aw_dlp_light_guard_enabled: true
+aw_dlp_light_guard_load_ratio: "1.50"
+aw_dlp_light_guard_mem_available_pct_min: "15"
+aw_dlp_light_guard_iowait_pct_max: "20"
+aw_dlp_light_guard_strikes_required: 3
+aw_dlp_light_guard_state_dir: "{{ aw_server_data_dir }}/health"
+aw_dlp_aggregator_bucket_prefixes: "aw-file-operations_,aw-dlp-incidents_"
+aw_dlp_aggregator_limit: 500
+aw_dlp_aggregator_lookback_hours: 2
+aw_dlp_aggregator_overlap_seconds: 60
+aw_dlp_aggregator_timeout_seconds: 8
+aw_dlp_aggregator_on_calendar: "*:3/15:10"
+aw_dlp_aggregator_cpu_quota: "10%"
+aw_dlp_aggregator_memory_max: "256M"
+aw_containment_enabled: false
+aw_containment_mode: "shadow"
+aw_containment_policy_path: "/etc/activitywatch/containment-policy.json"
+aw_containment_default_ttl_minutes: 60
+aw_containment_require_admin_channel_check: true
+aw_containment_allow_auto_for_servers: false
+aw_dlp_policy_engine_enabled: false
 aw_dlp_policy_engine_bind_host: "0.0.0.0"
 aw_dlp_policy_engine_port: 5601
 aw_dlp_policy_engine_db_path: "{{ aw_server_data_dir }}/dlp-policy-engine.sqlite"
-aw_dlp_content_analysis_enabled: true
-aw_dlp_integrations_enabled: true
-aw_dlp_case_management_enabled: true
+aw_dlp_content_analysis_enabled: false
+aw_dlp_integrations_enabled: false
+aw_dlp_case_management_enabled: false
 aw_dlp_case_bind_host: "0.0.0.0"
 aw_dlp_case_port: 5602
 aw_dlp_case_db_path: "/opt/activitywatch/dlp-case-management/cases.db"
-aw_dlp_compliance_enabled: true
+aw_dlp_compliance_enabled: false
 aw_dlp_compliance_report_dir: "/opt/activitywatch/dlp-compliance/reports"
 aw_dlp_compliance_template_path: "/opt/activitywatch/dlp-compliance/templates/152-fz-report.html"
 aw_server_post_deploy_health_check_enabled: true
@@ -0,0 +1,12 @@
+# Secret handling:
+# - put the real Proxmox SSH password into env var before running Ansible:
+#   export AW_PROXMOX_SSH_PASSWORD='...'
+# - if Proxmox and AW server share the same SSH credential, AW_SSH_PASSWORD is
+#   accepted as a fallback.
+ansible_password: "{{ lookup('env', 'AW_PROXMOX_SSH_PASSWORD') | default(lookup('env', 'AW_SSH_PASSWORD'), true) }}"
+
+ansible_become: true
+ansible_become_method: sudo
+# If sudo password differs, set AW_PROXMOX_SUDO_PASSWORD. Otherwise it reuses
+# AW_PROXMOX_SSH_PASSWORD and then AW_SSH_PASSWORD.
+ansible_become_password: "{{ lookup('env', 'AW_PROXMOX_SUDO_PASSWORD') | default(lookup('env', 'AW_PROXMOX_SSH_PASSWORD'), true) | default(lookup('env', 'AW_SUDO_PASSWORD'), true) | default(lookup('env', 'AW_SSH_PASSWORD'), true) }}"
@@ -6,7 +6,7 @@ aw-ct ansible_host=10.20.30.13 ansible_user=root ansible_port=22

 [aw_windows]
 # Примечание: в русифицированных Windows часто нужен "Администратор", а не "Administrator".
-win-node1 ansible_host=<WINDOWS_HOST> ansible_user=Администратор ansible_password=CHANGE_ME ansible_connection=winrm ansible_winrm_transport=ntlm ansible_port=5985 ansible_winrm_server_cert_validation=ignore
+win-node1 ansible_host=<WINDOWS_HOST> ansible_user=Администратор ansible_connection=winrm ansible_winrm_transport=ntlm ansible_port=5985 ansible_winrm_server_cert_validation=ignore

 [aw_pfsense_pollers]
 # pfsense-poller1 ansible_host=198.51.100.30 ansible_user=root ansible_port=22
@@ -274,7 +274,7 @@ server {
    location ^~ /portal/api/readiness {
        proxy_set_header Authorization "";
        proxy_set_header X-Remote-User $remote_user;
-        proxy_pass http://192.0.2.13:8721/api/readiness;
+        proxy_pass http://127.0.0.1:8720/api/readiness;
        proxy_redirect off;
    }

@@ -2,7 +2,7 @@
  "use strict";

  var BAD_HOST = ["HOST", "EXAMPLE"].join("-");
-  var DEFAULT_HOST = "SHARKON2025";
+  var DEFAULT_HOST = "HOST-EXAMPLE";

  function decode(value) {
    try {
@@ -79,13 +79,6 @@ Behavior:
 - optional `*.caseid` sidecar with the same basename triggers automatic bounded case linkage
 - processed `*.zip` is moved out of `drop/` into `report_dir/input-drop/` to avoid repeated re-trigger loops
 - sidecars are archived into `report_dir/input-sidecars/`
- bad drop packages are rejected before `accept`, moved to
-  `/opt/hayabusa/quarantine/drop/<timestamp>_<package>/`, and recorded with a
-  `reason.json` file instead of blocking later packages
- bad or partially extracted incoming packages are moved to
-  `/opt/hayabusa/quarantine/incoming/<timestamp>_<package>/`; `process-inbox`
-  continues with the remaining queue and does not trip systemd start-limit only
-  because of one poison archive

 ## Windows direct upload into the drop zone

@@ -125,43 +118,4 @@ Production scheduled task on `SHARKON2025`:

 Do not switch this task back to `SYSTEM` on the current RDP host: Task Scheduler starts `powershell.exe` under `SYSTEM`, but the process exits with `0xC0000142` before the upload script starts.

-Server-side processing accepts Windows zip packages with backslash path
-separators and UTF-8 BOM in sidecar JSON. `aw-hayabusa-autoprocess` processes
-the full incoming queue after accepting a drop package, so stale incoming files
-from an earlier failed run are drained before the latest intake is recorded.
-
-Poison-package handling is fail-closed:
-
- Rust `aw-hayabusa-autoprocess-rust` validates the zip and sidecars before
-  calling `aw-hayabusa accept`.
- A corrupt/empty/unsafe drop package is quarantined with its `.meta.json`,
-  `.caseid`, optional checksum sidecar and `reason.json`.
- `aw-hayabusa process-inbox` isolates a failed incoming package instead of
-  aborting the whole batch.
- Operators replay only a fixed/re-exported package by moving it back to the
-  drop zone or incoming queue. Do not edit quarantined evidence in place.
-
-## Security Finding Inbox integration
-
-`aw-hayabusa-autoprocess-rust` can publish a normalized suspicious-workstation
-finding after a successful intake is written to `/opt/hayabusa/state/latest-intake.json`.
-
-Default is disabled to keep forensic processing independent from ClickHouse:
-
-```bash
-AW_SECURITY_FINDING_INBOX_ENABLED=false
-```
-
-Enable after the ClickHouse schema and CLI are installed:
-
-```bash
-AW_SECURITY_FINDING_INBOX_ENABLED=true
-AW_SECURITY_FINDING_INBOX_BIN=/usr/local/bin/security-finding-inbox
-AW_SECURITY_FINDING_INBOX_MIN_SEVERITY=medium
-AW_SECURITY_FINDING_INBOX_REQUIRED=false
-```
-
-With `AW_SECURITY_FINDING_INBOX_REQUIRED=false`, a temporary ClickHouse/inbox
-failure is logged as warning and does not poison the Hayabusa backlog. Use
-`true` only when the operator wants inbox publication failure to become an
-operational failure for the drop service.
+Server-side processing accepts Windows zip packages with backslash path separators and UTF-8 BOM in sidecar JSON. `aw-hayabusa-autoprocess` processes the full incoming queue after accepting a drop package, so stale incoming files from an earlier failed run are drained before the latest intake is recorded.
@@ -14,7 +14,6 @@ HAYA_STAGING_DIR="${AW_HAYABUSA_STAGING_DIR:-${HAYA_ROOT}/inbox/staging}"
 HAYA_ARCHIVE_PACKAGES_DIR="${AW_HAYABUSA_ARCHIVE_PACKAGES_DIR:-${HAYA_ROOT}/archive/packages}"
 HAYA_ARCHIVE_EXTRACTED_DIR="${AW_HAYABUSA_ARCHIVE_EXTRACTED_DIR:-${HAYA_ROOT}/archive/extracted}"
 HAYA_LOGS_DIR="${AW_HAYABUSA_LOGS_DIR:-${HAYA_ROOT}/state/logs}"
-HAYA_QUARANTINE_DIR="${AW_HAYABUSA_QUARANTINE_DIR:-${HAYA_ROOT}/quarantine/incoming}"
 LAST_REPORT_DIR=""

 usage() {
@@ -58,8 +57,7 @@ ensure_layout() {
    "${HAYA_INCOMING_DIR}" \
    "${HAYA_STAGING_DIR}" \
    "${HAYA_ARCHIVE_PACKAGES_DIR}" \
-    "${HAYA_ARCHIVE_EXTRACTED_DIR}" \
-    "${HAYA_QUARANTINE_DIR}"
+    "${HAYA_ARCHIVE_EXTRACTED_DIR}"
 }

 run_logged() {
@@ -407,8 +405,7 @@ process_one_package() {

  package_sha256="$(sha256sum "${package_path}" | awk '{print $1}')"
  if ! extract_zip_normalized "${package_path}" "${stage_dir}"; then
-    echo "ERROR: normalized zip extraction failed for ${package_path}" >&2
-    return 1
+    fail "normalized zip extraction failed for ${package_path}"
  fi

  local manifest_path host evtx_root archive_pkg_dir archive_extract_dir status report_dir
@@ -456,47 +453,7 @@ process_one_package() {
  if [ -n "${report_dir}" ]; then
    echo "Report directory: ${report_dir}"
  fi
-  if [ "${status}" != "ok" ]; then
-    echo "ERROR: Package workflow ended with status=${status}; archived for inspection" >&2
-    return 1
-  fi
-}
-
-quarantine_incoming_package() {
-  local package_path="$1"
-  local reason="$2"
-  local ts package_name package_base safe_base target_dir stage_dir sha256
-  ts="$(date -u +%Y%m%dT%H%M%SZ)"
-  package_name="$(basename "${package_path}")"
-  package_base="${package_name%.zip}"
-  safe_base="$(sanitize "${package_name}")"
-  [ -n "${safe_base}" ] || safe_base="package.zip"
-  target_dir="${HAYA_QUARANTINE_DIR}/${ts}_${safe_base}"
-  mkdir -p "${target_dir}"
-  sha256=""
-  if [ -f "${package_path}" ] && command -v sha256sum >/dev/null 2>&1; then
-    sha256="$(sha256sum "${package_path}" | awk '{print $1}')"
-  fi
-  for candidate in "${package_path}" "${package_path}.sha256" "${package_path}.host"; do
-    if [ -e "${candidate}" ]; then
-      mv "${candidate}" "${target_dir}/"
-    fi
-  done
-  stage_dir="${HAYA_STAGING_DIR}/${package_base}"
-  if [ -d "${stage_dir}" ]; then
-    mv "${stage_dir}" "${target_dir}/staging-partial"
-  fi
-  cat >"${target_dir}/reason.json" <<EOF
-{
-  "quarantined_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
-  "source": "aw-hayabusa process-inbox",
-  "original_path": "${package_path}",
-  "sha256": "${sha256}",
-  "reason": "${reason}",
-  "operator_action": "inspect source package, re-export EVTX archive if needed, then replay by moving a fixed package back to incoming or drop"
-}
-EOF
-  echo "Quarantined failed incoming package: ${target_dir}" >&2
+  [ "${status}" = "ok" ] || fail "Package workflow ended with status=${status}; archived for inspection"
 }

 process_inbox() {
@@ -525,26 +482,15 @@ process_inbox() {
  esac
  ensure_layout

-  local count=0 failed=0 pkg
+  local count=0 pkg
  while IFS= read -r pkg; do
-    if process_one_package "${pkg}" "${mode}"; then
-      count=$((count + 1))
-    else
-      failed=$((failed + 1))
-      if [ -f "${pkg}" ]; then
-        quarantine_incoming_package "${pkg}" "process_one_package failed"
-      else
-        echo "Package failed after archive/move, see archive intake manifest for details: ${pkg}" >&2
-      fi
-    fi
+    process_one_package "${pkg}" "${mode}"
+    count=$((count + 1))
    if [ "${limit}" -gt 0 ] && [ "${count}" -ge "${limit}" ]; then
      break
    fi
  done < <(find "${HAYA_INCOMING_DIR}" -maxdepth 1 -type f -name '*.zip' | sort)
  [ "${count}" -gt 0 ] || echo "No packages in ${HAYA_INCOMING_DIR}"
-  if [ "${failed}" -gt 0 ]; then
-    echo "process-inbox completed with quarantined_or_archived_failures=${failed}" >&2
-  fi
 }

 main() {
@@ -66,9 +66,6 @@ File 1C + reglog + host telemetry
 - `grafana/provisioning/dashboards/files/1c-telemetry-board.json` — telemetry dashboard по состоянию файловых баз, reglog growth, busy markers и host load.
 - `detections/build_entity_timeline.sql` — сборка единого timeline слоя.
 - `detections/open_cases_from_detections.sql` — шаблон открытия cases из detections.
- `security/security_finding_inbox.sql` — schema Security Finding Inbox:
-  подозрительные станции, raw finding evidence, workflow/executor events и
-  latest-state view для DetMir Portal.
 - `ops/etl-cron.example` — legacy cron example; production использует
  `aw-1c-ingest.timer`.
 - `ops/retention-policy.md` — минимальная retention policy.
@@ -10,16 +10,6 @@ services:
    ports:
      - "${CLICKHOUSE_PORT}:8123"
      - "${CLICKHOUSE_NATIVE_PORT}:9000"
-    healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "clickhouse-client --host 127.0.0.1 --user \"$${CLICKHOUSE_USER}\" --password \"$${CLICKHOUSE_PASSWORD}\" --database \"$${CLICKHOUSE_DB}\" --query 'SELECT 1' >/dev/null",
-        ]
-      interval: 30s
-      timeout: 10s
-      retries: 5
-      start_period: 30s
    volumes:
      - clickhouse_1c_data:/var/lib/clickhouse
      - ./clickhouse/init:/docker-entrypoint-initdb.d:ro
@@ -76,14 +76,6 @@ docker exec -i "${CH_CONTAINER}" clickhouse-client \
  --database "${CLICKHOUSE_DB}" \
  < "${ROOT}/detections/open_cases_from_detections.sql"

-if [[ -f "${ROOT}/security/security_finding_inbox.sql" ]]; then
-  docker exec -i "${CH_CONTAINER}" clickhouse-client \
-    --user "${CLICKHOUSE_USER}" \
-    --password "${CLICKHOUSE_PASSWORD}" \
-    --database "${CLICKHOUSE_DB}" \
-    < "${ROOT}/security/security_finding_inbox.sql"
-fi
-
 if [[ "${RUN_MANAGER_BRIEF_AFTER_INGEST}" == "1" ]]; then
  if ! "${ROOT}/ops/run_manager_brief.sh"; then
    echo "warning: manager brief refresh failed after ingest" >&2
@@ -1,97 +0,0 @@
-CREATE TABLE IF NOT EXISTS analytics_1c.security_findings
-(
-    ts DateTime64(3, 'UTC'),
-    finding_id String,
-    host String,
-    user String,
-    ip String,
-    department LowCardinality(String),
-    state LowCardinality(String),
-    severity LowCardinality(String),
-    confidence LowCardinality(String),
-    score UInt16,
-    source LowCardinality(String),
-    rule_id String,
-    rule_title String,
-    summary String,
-    recommended_action LowCardinality(String),
-    management_channel_checked UInt8,
-    evidence_ref String,
-    raw_json String,
-    ingested_at DateTime64(3, 'UTC') DEFAULT now64(3)
-)
-ENGINE = MergeTree
-PARTITION BY toYYYYMM(ts)
-ORDER BY (state, severity, host, ts, finding_id);
-
-CREATE TABLE IF NOT EXISTS analytics_1c.security_finding_workflow_events
-(
-    ts DateTime64(3, 'UTC'),
-    finding_id String,
-    event_type LowCardinality(String),
-    status LowCardinality(String),
-    actor String,
-    comment String,
-    decision_status String,
-    rollback_plan_id String,
-    plan_id String,
-    evidence_json String
-)
-ENGINE = MergeTree
-PARTITION BY toYYYYMM(ts)
-ORDER BY (finding_id, ts, event_type);
-
-DROP VIEW IF EXISTS analytics_1c.security_finding_inbox;
-
-CREATE VIEW analytics_1c.security_finding_inbox AS
-SELECT
-    f.finding_id AS finding_id,
-    min(f.ts) AS first_seen,
-    max(f.ts) AS last_seen,
-    argMax(f.host, f.ingested_at) AS host,
-    argMax(f.user, f.ingested_at) AS user,
-    argMax(f.ip, f.ingested_at) AS ip,
-    argMax(f.department, f.ingested_at) AS department,
-    argMax(f.state, f.ingested_at) AS state,
-    argMax(f.severity, f.ingested_at) AS severity,
-    argMax(f.confidence, f.ingested_at) AS confidence,
-    argMax(f.score, f.ingested_at) AS score,
-    argMax(f.source, f.ingested_at) AS source,
-    argMax(f.rule_id, f.ingested_at) AS rule_id,
-    argMax(f.rule_title, f.ingested_at) AS rule_title,
-    argMax(f.summary, f.ingested_at) AS summary,
-    argMax(f.recommended_action, f.ingested_at) AS recommended_action,
-    argMax(f.management_channel_checked, f.ingested_at) AS management_channel_checked,
-    argMax(f.evidence_ref, f.ingested_at) AS evidence_ref,
-    argMax(f.raw_json, f.ingested_at) AS raw_json,
-    coalesce(nullIf(w.status, ''), 'new') AS workflow_status,
-    coalesce(nullIf(w.event_type, ''), 'created') AS last_workflow_event,
-    w.workflow_updated_at AS workflow_updated_at,
-    coalesce(w.actor, '') AS workflow_actor,
-    coalesce(w.decision_status, '') AS decision_status,
-    coalesce(w.rollback_plan_id, '') AS rollback_plan_id,
-    coalesce(w.plan_id, '') AS plan_id
-FROM analytics_1c.security_findings AS f
-LEFT JOIN
-(
-    SELECT
-        finding_id,
-        argMax(event_type, ts) AS event_type,
-        argMax(status, ts) AS status,
-        argMax(actor, ts) AS actor,
-        argMax(decision_status, ts) AS decision_status,
-        argMax(rollback_plan_id, ts) AS rollback_plan_id,
-        argMax(plan_id, ts) AS plan_id,
-        max(ts) AS workflow_updated_at
-    FROM analytics_1c.security_finding_workflow_events
-    GROUP BY finding_id
-) AS w USING finding_id
-GROUP BY
-    f.finding_id,
-    w.status,
-    w.event_type,
-    w.workflow_updated_at,
-    w.actor,
-    w.decision_status,
-    w.rollback_plan_id,
-    w.plan_id;
@@ -1,21 +0,0 @@
-{
-  "host": "HOST-EXAMPLE",
-  "host_role": "workstation",
-  "state": "suspected_infected",
-  "confidence": "high",
-  "signals": [
-    {
-      "source": "hayabusa",
-      "rule_id": "sigma-placeholder-critical",
-      "confidence": "critical"
-    },
-    {
-      "source": "velociraptor",
-      "rule_id": "Windows.Hayabusa.Monitoring",
-      "confidence": "high"
-    }
-  ],
-  "recommended_action": "windows_firewall_quarantine",
-  "management_channel_checked": true,
-  "manual_operator_flag": false
-}
@@ -1,17 +0,0 @@
-{
-  "enabled": false,
-  "mode": "shadow",
-  "default_ttl_minutes": 60,
-  "require_admin_channel_check": true,
-  "allow_auto_for_servers": false,
-  "allowed_actions": [
-    "windows_firewall_quarantine",
-    "pfsense_host_block"
-  ],
-  "management_allowlist": [
-    "aw_server",
-    "velociraptor_server",
-    "admin_jump_host"
-  ],
-  "minimum_high_signals_for_auto": 2
-}
@@ -1,21 +0,0 @@
-{
-  "ts": "2026-06-25T10:00:00Z",
-  "host": "HOST-EXAMPLE",
-  "user": "user-example",
-  "ip": "10.10.20.42",
-  "department": "demo",
-  "state": "suspected_infected",
-  "severity": "critical",
-  "confidence": "high",
-  "score": 95,
-  "source": "hayabusa",
-  "rule_id": "demo-sigma-critical",
-  "rule_title": "Demo high-confidence suspicious workstation",
-  "summary": "Demo finding for Security Finding Inbox validation.",
-  "recommended_action": "windows_firewall_quarantine",
-  "management_channel_checked": true,
-  "evidence_ref": "demo://hayabusa/HOST-EXAMPLE/demo-sigma-critical",
-  "metadata": {
-    "sample": "true"
-  }
-}
@@ -1,18 +0,0 @@
-{
-  "target_host": "HOST-EXAMPLE",
-  "plan_id": "rollback-host-example-001",
-  "ttl_minutes": 60,
-  "reason": "High-confidence Hayabusa and Velociraptor containment drill",
-  "management_allowlist": [
-    "10.10.10.10",
-    "10.10.10.11",
-    "10.10.10.12"
-  ],
-  "blocked_remote_addresses": [
-    "10.10.20.0/24",
-    "10.10.30.0/24"
-  ],
-  "profiles": [
-    "Domain"
-  ]
-}
@@ -19,10 +19,16 @@ Forensics усиливают продукт, но не должны перетя
 - как меняется загрузка сотрудников и подразделений;
 - где тормозят бизнес-процессы.

+Канонический контракт по загрузке, простоям, перегрузу, дисциплине процесса и
+достоверности данных: [WORKFORCE_OPERATIONS_MODEL_RU.md](WORKFORCE_OPERATIONS_MODEL_RU.md).
+
 Основные KPI:

 - UEBA риск: read-only `risk_score/risk_level/reasons` для приоритизации
  проверки;
+- операционная загрузка: rule-based статусы `load_status`, `idle_status`,
+  `discipline_status`, `data_confidence` для разбора загрузки, простоев,
+  перегруза и дисциплины процесса;
 - индекс активности: proxy `активное время / плановое рабочее время`;
 - взвешенная активность: только при настроенной role/application policy;
 - сравнение подразделений за текущий день;
@@ -195,7 +201,7 @@ Worktime API сохраняет daily history как агрегированны

 ```json
 {
-  "overload_threshold": 0.92,
+  "overload_threshold": 1.15,
  "underload_threshold": 0.45,
  "drop_threshold_pct": 20,
  "night_work_after": "20:00",
@@ -204,7 +210,9 @@ Worktime API сохраняет daily history как агрегированны
 ```

 `overload_threshold` и `underload_threshold` можно задавать дробью
-`0.92`/`0.45` или процентом `92`/`45`; внутри они нормализуются к процентам.
+`1.15`/`0.45` или процентом `115`/`45`; внутри они нормализуются к процентам.
+Порог перегруза ниже 100% не применяется как перегруз: это защищает отчет от
+ложного статуса "перегружен" при обычной высокой занятости.
 Если policy-файл отсутствует или отдельное поле не задано, используются
 env/default значения:

@@ -260,6 +268,27 @@ env/default значения:
 - подтвержденным инцидентом событие становится после регламентной валидации;
 - продукт не заявляется как сертифицированная DLP/SIEM/EDR/XDR/СЗИ.

+### Runtime boundary для DLP
+
+Актуальный DetMir baseline перед переработкой зафиксирован в
+[DETMIR_CURRENT_STATE_RU.md](DETMIR_CURRENT_STATE_RU.md).
+
+Коммерчески и технически DLP нужно подавать как подключаемый модуль, а не как
+обязательную часть первого экрана Workforce:
+
+- Workforce должен открываться и строить управленческие показатели без ожидания
+  DLP evidence, screenshots и heavy correlation;
+- DLP endpoint signals, clipboard/USB/print/web/file incidents, evidence review
+  и screenshots остаются ценным модулем Security/Forensics;
+- отключенная или не настроенная DLP должна давать честный disabled-state, а не
+  ошибку портала;
+- тяжелый DLP слой не должен блокировать `/api/operator`, prewarm и первичную
+  загрузку руководительского/операционного экрана.
+
+Это не означает отказ от DLP-сигналов. Это означает правильную модульность:
+ежедневная бизнес-ценность Workforce должна быть доступна быстро, а Security и
+Forensics подключаются как углубляющие слои.
+
 ## AWatch-rus Forensics

 Для разбора сложных событий и пост-инцидентной аналитики.
@@ -1,194 +0,0 @@
-# AWatch-rus containment operator runbook
-
-Дата: 2026-06-25.
-
-Runbook для безопасной проверки containment-логики. Текущая реализация не
-блокирует рабочие станции и не меняет сеть. Она только рассчитывает решение и
-показывает, был бы quarantine рекомендован или отказан.
-
-## 1. Сборка
-
-```bash
-cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian
-export CARGO_TARGET_DIR=/home/igor/.cache/detmir-adk-rust-target
-cargo build --manifest-path adk-rust/Cargo.toml -p containment-engine
-```
-
-## 2. Smoke в disabled/shadow режиме
-
-```bash
-cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian
-bash scripts/containment_shadow_smoke.sh
-```
-
-Ожидаемо:
-
- JSON содержит `would_mutate=false`;
- `decision_status=disabled` для default example policy;
- нет изменений firewall, pfSense, AD, VLAN, routes.
-
-## 3. Проверка shadow recommendation
-
-Создайте временный policy с:
-
-```json
-{
-  "enabled": true,
-  "mode": "shadow"
-}
-```
-
-на базе `configs/containment-policy.example.json`, затем выполните:
-
-```bash
-containment-engine decide \
-  --policy /tmp/containment-policy-shadow.json \
-  --finding configs/containment-finding.example.json \
-  --pretty
-```
-
-Ожидаемо:
-
- `decision_status=shadow_recommended`;
- `would_mutate=false`;
- `rollback_plan_id` заполнен;
- `blockers=[]`.
-
-## 4. Manual approval mode
-
-`manual_approval` должен только поставить решение в состояние
-`manual_approval_required`. Он не применяет block сам.
-
-## 5. Auto mode
-
-В текущей реализации `auto` может вернуть `auto_ready`, но `would_mutate=false`.
-Это намеренно: decision layer сам не применяет блокировки.
-
-Запрещено считать `auto_ready` фактической блокировкой. Это только решение
-control plane.
-
-## 6. Windows Firewall executor dry-run
-
-Security Finding Inbox показывает подозрительные станции и фиксирует workflow
-события. Портал не выполняет firewall apply. После `approved` и
-`apply_requested` отдельный процесс `security-finding-inbox executor` может
-выполнить контролируемый цикл `decide -> plan -> apply -> verify`, а при
-ошибке `rollback`. По умолчанию executor работает dry-run/fail-closed.
-
-Сгенерируйте план:
-
-```bash
-cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian
-containment-engine windows-firewall plan \
-  --request configs/windows-firewall-containment-request.example.json \
-  --pretty > /tmp/windows-firewall-plan.json
-```
-
-Проверьте `blockers`. Для корректного example они должны быть пустыми.
-
-Dry-run apply:
-
-```bash
-containment-engine windows-firewall apply \
-  --plan /tmp/windows-firewall-plan.json \
-  --confirm-apply YES \
-  --pretty
-```
-
-Ожидаемо:
-
- `execution_status=dry_run_commands_ready`;
- `would_mutate=false`;
- в JSON есть PowerShell-команды `New-NetFirewallRule`;
- реальные firewall-правила не создаются.
-
-Verify dry-run:
-
-```bash
-containment-engine windows-firewall verify \
-  --plan /tmp/windows-firewall-plan.json \
-  --pretty
-```
-
-Rollback dry-run:
-
-```bash
-containment-engine windows-firewall rollback \
-  --plan /tmp/windows-firewall-plan.json \
-  --confirm-rollback YES \
-  --pretty
-```
-
-## 7. Real Windows execution rules
-
-Dry-run polling из центрального контура:
-
-```bash
-security-finding-inbox executor \
-  --once \
-  --dry-run \
-  --containment-engine-bin /usr/local/bin/containment-engine \
-  --policy /etc/activitywatch/containment-policy.json \
-  --management-allowlist 10.10.10.10,10.10.10.11 \
-  --blocked-remote-addresses 10.10.20.0/24,10.10.30.0/24
-```
-
-Реальный Windows Firewall apply допускается только на целевой Windows-станции:
-
-```powershell
-security-finding-inbox.exe executor `
-  --once `
-  --execute-local `
-  --confirm-execute YES `
-  --executor-host HOST-EXAMPLE `
-  --containment-engine-bin C:\ProgramData\AWatch-rus\containment-engine.exe `
-  --policy C:\ProgramData\AWatch-rus\containment-policy.json `
-  --management-allowlist 10.10.10.10,10.10.10.11 `
-  --blocked-remote-addresses 10.10.20.0/24,10.10.30.0/24
-```
-
-Executor откажется, если нет `approved` перед `apply_requested`, finding не
-`suspected_infected`/`confirmed_infected`, management channel не проверен,
-allowlist/block ranges пустые, host finding не совпадает с executor host для
-local apply, containment policy возвращает blocker или Windows Firewall plan
-содержит blockers.
-
-`--execute-local` разрешён только для отдельного lab Windows host, где заранее
-проверены:
-
- доступ с admin jump host;
- доступ к AWatch/Velociraptor management адресам;
- rollback command;
- out-of-band доступ, если firewall rule ошибочен;
- TTL и оператор, ответственный за возврат.
-
-Не использовать широкие блокировки `Any`/`LocalSubnet`: Windows Firewall
-block-правила могут перекрыть allow-правила и отрезать управление.
-
-## 8. Когда можно расширять real containment executor
-
-Только после выполнения условий:
-
- есть lab host;
- подтвержден management allowlist;
- есть rollback command;
- есть TTL rollback;
- есть audit log;
- `plan`, `apply`, `verify`, `rollback` покрыты тестами;
- auto-containment для серверов остается disabled.
-
-## 9. Проверки перед commit
-
-```bash
-cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian
-python3 scripts/public_secret_pattern_check.py
-bash -n scripts/containment_shadow_smoke.sh
-bash scripts/containment_shadow_smoke.sh
-git diff --check
-
-cd adk-rust
-export CARGO_TARGET_DIR=/home/igor/.cache/detmir-adk-rust-target
-cargo fmt --all --check
-cargo test -p containment-engine
-cargo clippy -p containment-engine --all-targets -- -D warnings
-```
@@ -1,146 +0,0 @@
-# AWatch-rus containment policy
-
-Дата: 2026-06-25.
-
-Этот документ описывает безопасную политику автоматической/полуавтоматической
-изоляции рабочих станций. Containment нужен для быстрого ограничения
-распространения заражения, но не является автоматическим лечением,
-remediation, EDR/XDR или сертифицированной СЗИ.
-
-## Default posture
-
-По умолчанию containment выключен:
-
-```text
-AW_CONTAINMENT_ENABLED=false
-AW_CONTAINMENT_MODE=shadow
-```
-
-`shadow` означает: система рассчитывает рекомендацию и audit, но не меняет
-firewall, pfSense, AD, VLAN, маршруты или состояние рабочих станций.
-
-## Policy file
-
-Default path:
-
-```text
-/etc/activitywatch/containment-policy.json
-```
-
-Repo example:
-
-```text
-configs/containment-policy.example.json
-```
-
-Критичные поля:
-
- `enabled`: глобальный opt-in;
- `mode`: `shadow`, `manual_approval`, `auto`;
- `default_ttl_minutes`: срок quarantine до rollback/review;
- `require_admin_channel_check`: запрещает блокировку, если управляемый канал
-  не проверен;
- `allow_auto_for_servers`: по умолчанию `false`;
- `allowed_actions`: whitelist containment-действий;
- `management_allowlist`: каналы, которые должны оставаться доступными;
- `minimum_high_signals_for_auto`: минимальный порог high/critical signals.
-
-## Safety rules
-
- Не включать `auto` до успешного shadow burn-in.
- Не включать auto-containment для серверов и domain controllers.
- Не запускать containment без rollback record.
- Не запускать containment, если будет потерян admin/management channel.
- Не применять широкие AD/OU/domain actions.
- Не удалять файлы, registry keys или процессы как часть containment.
- Не заявлять, что containment гарантированно остановил заражение.
-
-## Decision threshold
-
-Automatic quarantine допускается только если:
-
- host role is `workstation`;
- host не входит в critical infrastructure denylist;
- есть один `critical` signal или несколько `high` signals;
- management-channel precheck passed;
- action есть в `allowed_actions`;
- rollback record создан успешно.
-
-## Security Finding Inbox handoff
-
-Security Finding Inbox (`docs/SECURITY_FINDING_INBOX_RU.md`) является входной
-очередью для подозрительных рабочих станций. Он хранит findings и workflow
-events в ClickHouse, показывает их в DetMir Portal. Портал не выполняет
-containment самостоятельно.
-
-Workflow `apply_requested` означает только операторский запрос на применение.
-Фактическое применение идет через отдельный процесс
-`security-finding-inbox executor`, который повторно проверяет `approved`,
-запускает `containment-engine decide`, строит Windows Firewall plan, затем
-выполняет `apply`, `verify` и при ошибке `rollback`. Реальная мутация firewall
-разрешена только на целевой Windows-станции при `--execute-local`,
-`--confirm-execute YES` и совпадении `--executor-host` с finding host.
-
-## Current implementation status
-
-Реализован первый безопасный слой:
-
- Rust CLI `containment-engine`;
- strict JSON policy/finding parsing;
- `disabled`, `shadow`, `manual_approval`, `auto` decision states;
- server/unknown host roles refused for auto mode by default;
- `would_mutate=false` for current implementation;
- separate Windows Firewall executor interface:
-  `plan`, `apply`, `verify`, `rollback`;
- Windows Firewall executor defaults to dry-run command generation unless
-  `--execute-local` and explicit confirmation are used.
-
-pfSense/AD/VLAN mutation paths are not implemented.
-
-## Windows Firewall executor
-
-Executor input example:
-
-```text
-configs/windows-firewall-containment-request.example.json
-```
-
-The executor is deliberately separate from decision making:
-
-```bash
-containment-engine windows-firewall plan \
-  --request configs/windows-firewall-containment-request.example.json \
-  --pretty > /tmp/windows-firewall-plan.json
-
-containment-engine windows-firewall apply \
-  --plan /tmp/windows-firewall-plan.json \
-  --confirm-apply YES \
-  --pretty
-
-containment-engine windows-firewall verify \
-  --plan /tmp/windows-firewall-plan.json \
-  --pretty
-
-containment-engine windows-firewall rollback \
-  --plan /tmp/windows-firewall-plan.json \
-  --confirm-rollback YES \
-  --pretty
-```
-
-Without `--execute-local`, `apply` and `rollback` return generated PowerShell
-commands and `would_mutate=false`.
-
-With `--execute-local`, execution is allowed only on a Windows host and only
-after explicit confirmation. On non-Windows hosts the executor fails closed.
-
-## Windows Firewall guardrails
-
- `management_allowlist` is mandatory.
- `blocked_remote_addresses` must be explicit IPs/subnets.
- Broad block targets such as `Any`, `*`, `LocalSubnet`, `Internet`,
-  `Intranet` are refused.
- The executor does not change Windows Firewall profile defaults.
- The executor does not disable interfaces, routes, users, services or
-  processes.
- Every plan includes rollback through `Remove-NetFirewallRule -Group ...`.
- A successful dry-run is not evidence that the workstation has been isolated.
@@ -0,0 +1,695 @@
+# DetMir/AWatch-rus: hardline resilience hardening
+
+Документ фиксирует реализованные и проверенные шаги по доведению живого
+контура до fail-closed уровня. Он не заменяет production runbook; здесь только
+изменения, влияющие на отказоустойчивость.
+
+## 2026-06-30: crash-test readiness gate and healthd route boundary
+
+Статус: implemented in repo, deployed on live AW server, verified by manual
+crash test.
+
+Что прогонялось:
+
+- baseline `check-aw-full.sh`, SQLite hot-path plan, disk/headroom, RDP guard;
+- bounded parallel load на `/api/0/info`,
+  `/aw-worktime-sessions_SHARKON2025/events?limit=100`,
+  `aw-detmir-web-category_SHARKON2025` и Worktime API;
+- controlled restart: `aw-worktime-api`, `activitywatch-server`,
+  `AWatchRusCollectorGuard`;
+- gateway/ClickHouse/Grafana reachability checks;
+- live `scripts/detmir_resilience_check.sh --live` on AW server.
+
+Что найдено:
+
+- `systemctl is-active activitywatch-server` не равен полной готовности API:
+  сразу после `systemctl restart activitywatch-server` первый `/api/0/info`
+  мог уйти в 15 секунд timeout, затем API стабилизировался и hot-path
+  `/events?limit=100` отвечал быстро;
+- `aw-dlp-case-management.service` оставался active при disabled DLP profile;
+- `aw-rus-healthd.service` падал из-за TCP timeout с AW server до
+  `192.168.100.19:5985/3389`, хотя фактическая RDP/WinRM проверка с
+  admin/VPN side и bucket freshness были зелёными;
+- SQLite hot-path index
+  `events_bucketrow_starttime_desc_index` присутствовал и использовался,
+  `TEMP B-TREE` для worktime event query не строился.
+
+Что изменено:
+
+- `scripts/detmir_resilience_check.sh --live` теперь использует readiness-loop
+  для `/api/0/info`, проверяет worktime hot path, Worktime API rows/degraded
+  state, SQLite hot-path index/plan и disabled-state optional DLP/Loki units;
+- `aw-rus-healthd-rust` получил fail-closed параметр
+  `AW_RUS_HEALTH_RDP_TCP_REQUIRED` / `--rdp-tcp-required`;
+- default/example остаётся `true`; в DetMir production выставлено
+  `false`, потому что server-side TCP до RDP сейчас является route/ACL
+  boundary, а не authoritative proof of collector health;
+- active drift `aw-dlp-case-management.service` остановлен, unit оставлен
+  disabled для штатного будущего включения DLP contour.
+
+Live verification:
+
+- `check-aw-full.sh`: `FRESH=8`, `STALE=0`, `DEAD=0`;
+- targeted load after stabilization:
+  `info_p2/p4/p8/p12` по `24/24` HTTP 200,
+  worktime events `40/40` HTTP 200,
+  web category bucket `40/40` HTTP 200,
+  Worktime today `30/30` HTTP 200;
+- `AWatchRusCollectorGuard` restart: service `Running`, `GUARD_CHILDREN=1`,
+  collector process layout unchanged;
+- `aw-rus-healthd.service`: `status=0/SUCCESS`, `ok=11`, `warn=3`, `fail=0`;
+- `scripts/detmir_resilience_check.sh --live` after fixes:
+  readiness, hot path, Worktime API, SQLite index, optional DLP and Loki checks
+  pass; Hayabusa quarantine warning remains informational evidence to review.
+
+Safety guardrails:
+
+- no AW bucket schema, API, UI or Workforce business logic changed;
+- GitHub/Grafana/ClickHouse are still validation/visibility surfaces, not
+  Russian registry release evidence;
+- DLP remains optional/reconnectable, not removed.
+
+## 2026-06-25: optional DLP runtime off switch and statistics
+
+Статус: implemented in repo, deployed, live disable verified on 2026-06-25.
+
+Проблема:
+
+- DLP runtime может создавать избыточную нагрузку на InfluxDB, Grafana,
+  ClickHouse и AW server при включенных aggregator/exporter/case/report
+  pipeline;
+- простая остановка DLP units раньше приводила бы к ложным красным health,
+  readiness и contour checks.
+
+Что добавлено:
+
+- `AW_DLP_ENABLED=false` для AW server runtime;
+- `DETMIR_DLP_ENABLED=false` для управляющего DetMir contour check;
+- `dlp-health-check` возвращает штатный `dlp:mode=disabled`;
+- `detmir-dlp` не выполняет SSH health probe при disabled mode;
+- `detmir-check`, `check-aw-full`, `check-aw-data` пропускают DLP buckets при
+  disabled mode;
+- `detmir-readiness` не требует DLP Influx write и DLP systemd units при
+  disabled mode;
+- `scripts/detmir_dlp_runtime_control.sh` собирает JSON-срез DLP units/buckets
+  и выполняет controlled `disable|enable`.
+- live `disable` сохраняет отдельные evidence-снимки `current`,
+  `pre_disable` и `disabled` в
+  `/var/lib/activitywatch/health/dlp-runtime-history/`.
+
+Safety guardrails:
+
+- ActivityWatch server, worktime, Hayabusa, 1C/ClickHouse core не отключаются;
+- historical DLP buckets/evidence не удаляются;
+- disabled-state не заявляет, что DLP проверки выполнены;
+- это не claim замены DLP/SIEM/EDR и не удаление DLP-функциональности.
+
+Runbook:
+
+- [DLP_OPTIONAL_RUNTIME_RU.md](DLP_OPTIONAL_RUNTIME_RU.md).
+
+Live verification 2026-06-25:
+
+- before disable, active DLP runtime units were present:
+  `aw-dlp-influx-exporter.timer`, `activitywatch-dlp-aggregator.timer`,
+  DLP report/integration timers, policy/case services and
+  `detmir-portal-evidence.service`;
+- after disable, active/enabled DLP units: `0/0`;
+- `AW_DLP_ENABLED=false`, `AW_DLP_INFLUX_ENABLED=false`,
+  `AW_DLP_DISABLED_REASON=operator_disabled_to_reduce_influx_grafana_clickhouse_load`;
+- `dlp-health-check` and `detmir-dlp` both returned `dlp:mode=disabled`;
+- `check-aw-full` reported DLP buckets as `SKIPPED`;
+- ActivityWatch core remained active:
+  `activitywatch-server`, `aw-worktime-api`.
+
+Residual non-DLP findings from the same check:
+
+- RDP-side collectors require separate recovery: AFK/window/worktime buckets
+  were stale;
+- server-side WinRM reachability to `192.168.100.18:5985` was unavailable;
+- `aw-rus-healthd.service` was already failed and is tracked separately from
+  this DLP runtime disable.
+
+## 2026-06-24: Hayabusa poison-package isolation
+
+Статус: implemented locally, unit-tested, deployed on AW server.
+
+Проблема:
+
+- один битый zip в `/opt/hayabusa/inbox/incoming` мог остановить весь
+  Hayabusa pipeline;
+- `aw-hayabusa-drop.path` после повторных падений мог упереться в systemd
+  start-limit;
+- восстановление требовало ручного переноса bad zip в quarantine.
+
+Что изменено:
+
+- `aw-hayabusa-autoprocess-rust` проверяет drop zip до `accept`;
+- corrupt/empty/unsafe zip и битые sidecar-файлы не попадают в рабочий inbox;
+- bad drop package переносится в `/opt/hayabusa/quarantine/drop/...` вместе с
+  `.meta.json`, `.caseid`, optional `.sha256` и `reason.json`;
+- `aw-hayabusa process-inbox` больше не abort'ит весь batch из-за одного
+  incoming package;
+- failed incoming package переносится в
+  `/opt/hayabusa/quarantine/incoming/...` с partial staging payload и
+  `reason.json`, если пакет остался в incoming;
+- пакеты, уже архивированные wrapper'ом как `failed-no-evtx` или
+  `failed-analysis`, остаются в штатном archive/intake manifest для
+  расследования.
+
+Safety guardrails:
+
+- quarantine не удаляет evidence;
+- replay выполняется только после re-export или явного восстановления пакета;
+- один poison archive не должен мешать обработке остальных zip;
+- operational failures инфраструктуры (`aw-hayabusa` отсутствует, права,
+  broken runtime) остаются красными и не маскируются как успешная обработка.
+
+Проверки:
+
+```bash
+cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian
+bash -n aw-server/hayabusa/aw-hayabusa.sh
+
+cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian/adk-rust
+export CARGO_TARGET_DIR=/home/igor/.cache/detmir-adk-rust-target
+cargo test -p hayabusa-tools
+```
+
+Результат проверки:
+
+- `bash -n aw-server/hayabusa/aw-hayabusa.sh` passed;
+- `cargo test -p hayabusa-tools` passed: 5 tests passed.
+
+Production deployment note:
+
+- после сборки и доставки нового `aw-hayabusa-autoprocess-rust` нужно
+  выполнить live dry-run на empty drop и контролируемый bad-zip test в
+  непроизводственном каталоге или с временным isolated `--drop-dir`;
+- live production queue руками не мутировать без предварительного backup/listing.
+
+Live rollout evidence:
+
+- deployed on AW server on `2026-06-24`;
+- previous `/usr/local/bin/aw-hayabusa` and
+  `/usr/local/bin/aw-hayabusa-autoprocess-rust` were backed up with timestamp
+  suffix;
+- `/usr/local/bin/aw-hayabusa doctor` returned OK;
+- isolated empty-drop dry-run returned `no zip packages in drop dir`;
+- production queue after rollout: `incoming_zip=0`, `DROP_COUNT=0`,
+  `aw-hayabusa-drop.path=active`, `aw-hayabusa-drop.service=inactive`;
+- stale staging residue from `2026-06-20` was moved, not deleted, to
+  `/opt/hayabusa/quarantine/staging-stale-20260624T190739Z/` with
+  `reason.json`;
+- after cleanup: `staged_dirs=0`, `archived_packages=74`,
+  `archived_payloads=74`.
+
+## 2026-06-24: Windows collector guard service child watchdog
+
+Статус: implemented locally, static checks passed, deployed on RDP host.
+
+Проблема:
+
+- Windows service `AWatchRusCollectorGuard` мог оставаться в состоянии
+  `running`, когда дочерний `aw-windows-telemetry.exe collector-guard` уже
+  отсутствовал;
+- SCM recovery не срабатывал, потому что сам service wrapper не падал.
+
+Что изменено:
+
+- `AWatchRusCollectorGuardService.cs` теперь подписывается на `Process.Exited`;
+- при неожиданном выходе child-процесса wrapper делает bounded restart;
+- restart budget: 5 child restarts за 600 секунд, задержка 5 секунд;
+- при исчерпании бюджета wrapper завершает service с ошибкой, чтобы Windows
+  Service Control Manager применил recovery actions;
+- installer включает `sc.exe failureflag <service> 1`, чтобы recovery actions
+  применялись к service failures, а не только к crash-путям;
+- `ActivityWatch Recovery` остаётся fallback/bootstrap задачей и не отключается.
+
+Safety guardrails:
+
+- штатный `Stop-Service`/shutdown выставляет `stopping=true`, поэтому child exit
+  во время остановки не считается аварией;
+- wrapper не меняет collector mode, bucket names, event schema и AW API;
+- service-level recovery ограничен существующим `sc.exe failure` budget.
+
+Проверки:
+
+```powershell
+pwsh -NoProfile -Command '<compile AWatchRusCollectorGuardService.cs through Add-Type>'
+pwsh -NoProfile -Command '<parse install-collector-guard-service.ps1>'
+
+powershell -NoProfile -ExecutionPolicy Bypass -File windows/install-collector-guard-service.ps1
+Get-Service AWatchRusCollectorGuard
+Get-Content C:\ProgramData\AWatch-rus\logs\collector-guard-service.log -Tail 20
+```
+
+Результат локальной проверки:
+
+- `AWatchRusCollectorGuardService.cs` compiled through PowerShell `Add-Type`;
+- `windows/install-collector-guard-service.ps1` parsed with PowerShell parser;
+- live install/restart validation still requires Windows/RDP deployment window.
+
+Live rollout evidence:
+
+- deployed on RDP host on `2026-06-24`;
+- previous service source, installer and exe were backed up under
+  `C:\ProgramData\AWatch-rus\backup\collector-guard-service-20260624T190827Z`;
+- installer completed with `Runtime: rust`, `Mode: enforce`;
+- SCM `failureflag` is enabled:
+  `FAILURE_ACTIONS_ON_NONCRASH_FAILURES: TRUE`;
+- controlled fault-injection killed only the child
+  `aw-windows-telemetry.exe collector-guard`;
+- wrapper observed child exit, attempted bounded restarts, SCM recovery restarted
+  wrapper after budget exhaustion, and child stabilized;
+- final validation after one guard loop: service `Running`, `CHILD_COUNT=1`,
+  child `aw-windows-telemetry.exe`, latest rust guard cycle `status=ok`.
+
+Live validation после деплоя:
+
+- убить только child `aw-windows-telemetry.exe collector-guard`;
+- убедиться, что service остаётся running и child перезапущен;
+- повторить child crash больше 5 раз за 600 секунд в тестовом окне;
+- убедиться, что service перешёл через SCM recovery, а не остался
+  `running/no child`.
+
+## 2026-06-24: contour resilience check
+
+Статус: implemented locally, shell syntax/repo-mode passed, live AW server
+check passed.
+
+Проблема:
+
+- отдельные исправления легко потерять при deploy/drift;
+- CI не проверял, что poison-package isolation и child watchdog реально
+  присутствуют в коде и документации;
+- live-проверки должны оставаться read-only и не маскировать production сбой.
+
+Что добавлено:
+
+- `scripts/detmir_resilience_check.sh`;
+- `--repo` режим для CI-safe проверки hardening-файлов, паттернов и docs;
+- `--live` режим для read-only проверки локального AW/Hayabusa host:
+  `activitywatch-server`, `aw-worktime-api`, AW `/api/0/info`, failed systemd
+  units, Hayabusa `incoming/drop/quarantine`, SQLite DB/WAL size;
+- `RUN_RESILIENCE_CHECK=1` hook в `scripts/run_awatch_contour_check.sh`;
+- `DETMIR_RESILIENCE_STRICT_SECRETS=1` режим, который fail'ит literal
+  `ansible_password`/`ansible_become_password` в private inventory без вывода
+  значений.
+
+Safety guardrails:
+
+- check не рестартует сервисы, не двигает очереди, не пишет в production dirs;
+- secret check печатает только факт наличия literal assignments, не значения;
+- live mode запускается явно через `--live` или `--all`;
+- GitHub/public CI может использовать только `--repo`.
+
+Secret handling update 2026-06-30:
+
+- literal `ansible_password` и `ansible_become_password` удалены из локального
+  `ansible/inventory.ini`;
+- `aw_server` читает SSH/sudo secrets из `AW_SSH_PASSWORD` и
+  `AW_SUDO_PASSWORD`;
+- `proxmox` читает SSH/sudo secrets из `AW_PROXMOX_SSH_PASSWORD` и
+  `AW_PROXMOX_SUDO_PASSWORD`, с fallback на `AW_SSH_PASSWORD` /
+  `AW_SUDO_PASSWORD`;
+- `aw_windows` читает WinRM secret из `AW_WINRM_PASSWORD`;
+- `inventory.example.ini` больше не содержит placeholder password-поля.
+
+Проверки:
+
+```bash
+bash -n scripts/detmir_resilience_check.sh
+bash scripts/detmir_resilience_check.sh --repo
+```
+
+Результат локальной проверки:
+
+- shell syntax passed for `scripts/detmir_resilience_check.sh`;
+- shell syntax passed for `scripts/run_awatch_contour_check.sh`;
+- repo-mode passed with `ok=15`, `fail=0`;
+- repo-mode reported one WARN: literal Ansible password assignments appear to
+  exist in `ansible/inventory.ini`; values are not printed, and
+  `DETMIR_RESILIENCE_STRICT_SECRETS=1` converts this to fail for private
+  contour gates.
+
+Live AW server result:
+
+- `bash /tmp/detmir_resilience_check.sh --live` passed on AW server;
+- result: `ok=9`, `warn=1`, `fail=0`;
+- WARN is expected after this rollout: one quarantine `reason.json` exists for
+  the moved stale Hayabusa staging residue.
+
+## 2026-06-24: live drift fixes after full contour re-check
+
+Статус: deployed and verified live.
+
+Что было найдено:
+
+- ClickHouse container was healthy by direct SQL checks, but Docker Compose did
+  not define a container `HEALTHCHECK`; because of that
+  `aw-1c-clickhouse-health.service` failed with
+  `docker healthcheck is not configured`.
+- `detmir-auto` used the default public gateway URL for portal checks when
+  `/etc/detmir/detmir-check.env` did not set `DETMIR_PORTAL_URL`; protected
+  public `/readyz`, `/version` and `/metrics` returned legitimate `401`.
+- `detmir-portal-prewarm.service` had `curl --max-time 60`, but a cold
+  `/api/reports` build on the live contour can take more than 60 seconds.
+- `aw-rus-healthd-rust` used the default 20 second wrapper timeout; under
+  concurrent checks `dlp-health-check --json` could be killed mid-output and be
+  reported as `invalid JSON output`.
+
+Что изменено:
+
+- `clickhouse-1c/docker-compose.yml` now defines a ClickHouse client
+  `HEALTHCHECK`, deployed to `/opt/activitywatch/clickhouse-1c/docker-compose.yml`;
+- production `/etc/detmir/detmir-check.env` now contains
+  `DETMIR_PORTAL_URL=http://127.0.0.1:8720` and
+  `DETMIR_GATEWAY_HOST=127.0.0.1`;
+- `ops/systemd/detmir-portal-prewarm.service` is now tracked in the repo and
+  deployed with `curl --max-time 180` and `TimeoutStartSec=210`;
+- production `/etc/activitywatch/aw-server.env` and
+  `aw-server/aw-server.env.example` now set
+  `AW_RUS_HEALTH_WRAPPER_TIMEOUT_SECONDS=90`.
+
+Verification:
+
+- `check-aw-full.sh`: `FRESH=8`, `STALE=0`, `DEAD=0`;
+- `detmir-check` through the production env file: `ok=true`,
+  `service_failures=0`;
+- `detmir-auto.service`, `awatch-contour-daily-check.service`,
+  `awatch-contour-weekly-check.service`: `status=0/SUCCESS`;
+- `detmir-portal-prewarm.service`: `status=0/SUCCESS`;
+- `aw-1c-clickhouse-health.service`: `status=0/SUCCESS`, Docker state
+  `(healthy)`;
+- `aw-rus-healthd.service`: `status=0/SUCCESS`, failed systemd units on
+  AW server and Proxmox are zero.
+
+## 2026-06-25: portal cold-start prewarm after service restart
+
+Статус: deployed and verified live at the time, then superseded by the
+fail-soft hot-path boundary below.
+
+Что было найдено:
+
+- после ручного `systemctl restart detmir-portal` первый
+  `/api/reports?role=manager` может выполнять холодный расчет дольше 120 секунд;
+- `detmir-portal-prewarm.timer` держит cache теплым каждые 30 минут, но не
+  запускается немедленно при ручном рестарте портала.
+- одного prewarm недостаточно, если каждый пользовательский `/api/reports`
+  заново запускает тяжелую генерацию отчета.
+
+Что изменено:
+
+- добавлен tracked drop-in
+  `ops/systemd/detmir-portal.service.d/30-prewarm-after-start.conf`;
+- production drop-in `/etc/systemd/system/detmir-portal.service.d/30-prewarm-after-start.conf`
+  запускает `detmir-portal-prewarm.service` через `systemctl --no-block` после
+  каждого старта портала;
+- prewarm остается best-effort: портал стартует независимо, а тяжелый
+  `/api/reports` прогревается в фоне.
+- в `detmir-portal` добавлен short-lived in-process report cache с TTL 120
+  секунд и защитой от stampede: первый report-запрос строит payload, следующие
+  report endpoints в окне TTL отдают тот же payload без повторной генерации.
+- в `/metrics` добавлены отдельные счетчики report-cache:
+  `awatch_report_requests_total`, `awatch_report_cache_hits_total`,
+  `awatch_report_cache_misses_total`. Старый
+  `awatch_reports_generated_total` остается счетчиком успешно завершенных
+  тяжелых генераций отчета, а не счетчиком HTTP-запросов.
+
+Verification:
+
+- `/healthz`: `200`;
+- `/readyz`: `200`, `status=ready`;
+- prewarm after restart: `status=0/SUCCESS`;
+- cold `/api/reports?role=manager` after expired cache: `200`, около `63s`;
+- warm `/api/reports?role=manager`: `200`, около `0.34..0.35s` в трех
+  последовательных запросах;
+- `awatch_reports_generated_total` не вырос после трех warm report-запросов;
+- `awatch_report_requests_total` растет на report endpoints, а
+  `awatch_report_cache_hits_total` растет на warm cache-запросах;
+- во время cold/prewarm сборки `awatch_report_requests_total` показывает
+  входящие report-запросы до ожидания cache lock, а
+  `awatch_reports_generated_total` растет только после готового payload;
+- `workforce_operations.summary` и `workforce_operations.rows` доступны в JSON;
+- browser smoke: блок `Операционная загрузка` отрисован, строки сотрудников
+  видны, console errors/warnings отсутствуют.
+
+Superseded note:
+
+- restart-triggered external prewarm reduced warm-cache latency, but it also
+  kept a heavy full-report job coupled to service restart;
+- after the DLP/hot-path phase 1 change, the preferred production behavior is
+  immediate `warming`/`STALE` API response from the portal itself, not a
+  mandatory heavy `ExecStartPost` prewarm after every restart;
+- legacy drop-ins
+  `/etc/systemd/system/detmir-portal.service.d/20-prod-timeout.conf` and
+  `/etc/systemd/system/detmir-portal.service.d/30-prewarm-after-start.conf`
+  are now treated as stale deployment residue and are removed by
+  `ansible/deploy_detmir_portal.yml`.
+
+## 2026-06-25: current state and first DLP hot-path boundary
+
+Статус: phase 1 implemented, targeted Rust tests passed, deployed once on the
+DetMir portal host and API-smoke verified. Follow-up production cleanup of stale
+restart-prewarm drop-ins is pending until DetMir VPN handshake is stable again.
+
+Фактический runtime:
+
+- production `detmir-portal` binary:
+  `653b22b0fbf29a22f7de42ade7b689490b1de16fa07e785e4e0efd3078e7a3bc`;
+- deploy command used:
+  `ansible-playbook -i inventory.ini deploy_detmir_portal.yml --limit proxmox -e detmir_portal_bind_override=0.0.0.0:8720 -e detmir_portal_dlp_module_enabled_override=false`;
+- `/healthz`: `status=ok` after deploy;
+- `/readyz`: `status=ready` after deploy;
+- `/api/reports`: `ok=true`, `cache_status=warming`,
+  `modules.dlp.enabled=false`, `modules.dlp.hot_path=false`;
+- `/api/operator`: `cache_status=warming`, `summary.severity=STALE`,
+  `modules.dlp.status=disabled`, `incidents=0`;
+- server log: `/api/operator` returned `200` with `latency_ms=49`;
+- browser smoke after restart: `loadStatus=STALE`, progress `100%`,
+  `LOADING=false`, `EMPTY=false`, `ERROR=false`.
+
+Что это означает:
+
+- первичное зависание портала устранено на уровне UX/cache/stale fallback;
+- `/api/operator` no longer waits for the cold full snapshot and can return a
+  bounded `warming` payload;
+- тяжелая генерация полного отчета/snapshot все еще может быть дорогой во время
+  cold/prewarm;
+- DLP/security enrichment has a first runtime boundary out of the Workforce hot
+  path: phase 1 used `DETMIR_PORTAL_DLP_MODULE_ENABLED=false`; the current
+  DetMir production default keeps DLP runtime disabled/`core_only`, while
+  `light` remains an explicit operator re-enable profile after resource check;
+- текущее состояние зафиксировано отдельно:
+  `docs/DETMIR_CURRENT_STATE_RU.md`.
+
+Архитектурное решение для следующего шага:
+
+- Workforce core должен оставаться быстрым и доступным без DLP;
+- DLP evidence, endpoint signals, screenshots, case review, heavy correlation
+  and forensics enrichment должны стать optional module;
+- prewarm не должен обязательно выполнять heavy DLP path;
+- Security/Forensics views при отключенной DLP должны показывать disabled-state,
+  а не ломать portal readiness.
+
+Реализованная первая граница:
+
+- CLI/env flag: `--dlp-module-enabled` /
+  `DETMIR_PORTAL_DLP_MODULE_ENABLED`;
+- DetMir production default после resource hardening: `false` / `core_only`,
+  чтобы обычный deploy/recovery не возвращал DLP нагрузку на Proxmox, AW,
+  ClickHouse, InfluxDB и Grafana;
+- `light` допускается только как явное operator re-enable действие после
+  resource check; при `light` основной portal snapshot не читает тяжелые
+  incident/case/review/audit DLP state, а evidence/case/exporter path остается
+  выключенным;
+- Ansible deploy parameter:
+  `detmir_portal_dlp_module_enabled_override`.
+
+Проверено локально:
+
+- `cargo test -p detmir-portal --locked`;
+- `cargo clippy -p detmir-portal --all-targets --locked -- -D warnings`.
+
+Deployment cleanup status:
+
+- `ansible/deploy_detmir_portal.yml` now removes stale restart-prewarm drop-ins:
+  `20-prod-timeout.conf` and `30-prewarm-after-start.conf`;
+- repeat production deploy of that cleanup is pending because the DetMir
+  `pfSense-gate-UDP4-1194-vpn_prog10-config` tunnel later failed TLS handshake
+  to `178.178.98.83:1194`;
+- do not claim final production prewarm cleanup until
+  `systemctl cat detmir-portal` no longer shows `ExecStartPost` prewarm.
+
+Ограничения:
+
+- это не удаление DLP collectors;
+- это не claim, что production DLP decoupling уже завершен без live smoke;
+- это не registry release evidence;
+- GitHub/GitHub Actions не являются primary registry build contour.
+
+## 2026-06-30: DLP disabled/core_only default, load guard and rollback
+
+Статус: implemented in repository defaults/scripts/docs, deployed on live
+DetMir contour and verified manually.
+
+Что изменено:
+
+- DetMir production defaults переведены в `AW_DLP_ENABLED=false` и
+  `AW_DLP_PROFILE=core_only`;
+- `aw_dlp_enabled=false`, `aw_dlp_influx_enabled=false`;
+- lightweight collector остается подключаемым, но не стартует по умолчанию;
+- heavy DLP component flags в production defaults остаются выключены;
+- `detmir_portal_dlp_module_enabled_override=false` показывает честный
+  disabled-state в портале без heavy evidence/case path;
+- добавлен `scripts/detmir_dlp_load_guard.sh`;
+- `detmir-dlp-load-guard.timer` контролирует load/RAM/iowait и при перегрузе
+  переводит DLP в `core_only`;
+- Ansible DLP tasks больше не имеют DLP-heavy default `true`;
+- `scripts/detmir_dlp_runtime_control.sh` получил профили
+  `core_only`, `light`, `on_demand`, `full`;
+- перед каждым `set-profile` сохраняется rollback-снимок systemd
+  active/enabled состояния DLP units;
+- `rollback` восстанавливает предыдущее состояние DLP units без изменения
+  retention и без запуска Loki CT.
+
+Эксплуатационная позиция:
+
+- Loki CT отключён намеренно для снижения нагрузки на Proxmox VM/LXC;
+- Loki не является обязательной зависимостью Workforce/Worktime/AW core;
+- DLP не удалён: lightweight-сбор нужен для UEBA, а тяжелый runtime не должен
+  возвращаться обычным deploy/recovery;
+- Hayabusa/Velociraptor findings остаются отдельным optional security layer
+  через Security Finding Inbox / ClickHouse и не требуют Loki.
+
+Runbook:
+
+- `docs/DLP_RESOURCE_PROFILES_RU.md`;
+- `docs/DLP_OPTIONAL_RUNTIME_RU.md`.
+
+## 2026-06-24: fail-closed timeout hardening after manual live run
+
+Статус: implemented locally, targeted Rust tests passed, deployed and verified
+live.
+
+Что было найдено ручным прогоном:
+
+- при деградации `activitywatch-server` запросы `/api/0/buckets` и отдельные
+  bucket event endpoints могли занимать 15-30 секунд;
+- `detmir-check` мог зависнуть без общего дедлайна, а штатные
+  daily/weekly checks оставались в `activating`;
+- timeout в `detmir-check` убивал shell, но мог оставить `detmir-dlp`/`ssh`
+  хвост, который удерживал stdout pipe;
+- `detmir-dlp` не имел собственного SSH timeout;
+- прямой `dlp-health-check --json` на AW server мог зависать дольше ожиданий;
+- `aw-worktime-autoheal-rust` считал ошибкой timeout чтения response body после
+  POST backfill, хотя ActivityWatch уже мог применить запись.
+
+Что изменено:
+
+- `detmir-check` получил общий watchdog
+  `DETMIR_CHECK_OVERALL_TIMEOUT_SECONDS` и env-настройки
+  `DETMIR_SERVICE_TIMEOUT_SECONDS`, `DETMIR_BUCKET_TIMEOUT_SECONDS`,
+  `DETMIR_DLP_TIMEOUT_SECONDS`;
+- production `/etc/detmir/detmir-check.env` настроен на:
+  `DETMIR_SERVICE_TIMEOUT_SECONDS=35`,
+  `DETMIR_BUCKET_TIMEOUT_SECONDS=35`,
+  `DETMIR_DLP_TIMEOUT_SECONDS=120`,
+  `DETMIR_CHECK_OVERALL_TIMEOUT_SECONDS=300`;
+- `detmir-check` и `detmir-auto` убивают timed-out child process group, чтобы
+  не оставлять shell/SSH/DLP хвосты;
+- `detmir-dlp` получил bounded SSH timeout и больше не выносит SSH child в
+  отдельную process group, чтобы parent timeout мог убить всю ветку;
+- `dlp-health-check` получил общий self-timeout
+  `AW_DLP_HEALTH_OVERALL_TIMEOUT_SECONDS` с default 120 секунд;
+- `aw-worktime-autoheal-rust` для POST events проверяет HTTP status и не читает
+  response body, потому что body не нужен для backfill evidence.
+
+Safety guardrails:
+
+- изменения не меняют AW API schema, bucket names, UI или product workflow;
+- timeout failure остается красным, но больше не оставляет активные процессы и
+  lock poisoning;
+- production timeouts расширены только до фактической live latency, общий
+  deadline остается bounded;
+- remote DLP и worktime autoheal не публикуют secrets/PII в logs сверх уже
+  существующих operational identifiers.
+
+Проверки:
+
+```bash
+cargo test --manifest-path adk-rust/Cargo.toml \
+  -p detmir-check -p detmir-auto -p detmir-dlp -p dlp-health-check \
+  -p worktime-autoheal
+
+cargo build --manifest-path adk-rust/Cargo.toml --release \
+  -p detmir-check -p detmir-auto -p detmir-dlp -p dlp-health-check \
+  -p worktime-autoheal
+```
+
+Live verification:
+
+- `dlp-health-check --json`: `ok=22`, `warn=0`, `fail=0`, elapsed 17s;
+- `aw-worktime-autoheal.service`: success, posted `afk=28`, `win=28`;
+- `aw-rus-healthd.service`: success, `ok=13`, `warn=1`, `fail=0`;
+- `detmir-check` through production env: `rc=0`, elapsed 19s;
+- `detmir-auto.service`: `rc=0`, elapsed 56s, bucket `dead=0`, `stale=0`,
+  `ok=8`;
+- `awatch-contour-daily-check.service`: `rc=0`, elapsed 14s;
+- `awatch-contour-weekly-check.service`: `rc=0`, elapsed 136s;
+- `check-aw-full.sh`: `FRESH=8`, `STALE=0`, `DEAD=0`;
+- final AW/PVE failed systemd units: `0`;
+- final RDP guard: service `Running`, 13 telemetry processes, last guard cycles
+  `status=ok problems=0`.
+
+## 2026-06-30: manual collection and analysis smoke after DLP light enablement
+
+Статус: partially green, live fixes applied, one external reachability blocker
+remains.
+
+Ручной прогон подтвердил:
+
+- `activitywatch-server` and `aw-worktime-api` are active;
+- Worktime API `/reports/worktime/today` returns current data for 4 users;
+- DetMir portal `/portal` renders through browser and no frontend console error
+  was observed for the tested portal pages;
+- `/api/manager` returns OK after restoring the portal timeout to 25 seconds;
+- `/api/operator` returns current collection/DLP/Grafana/1C/worktime blocks;
+- Security Finding Inbox is reachable for `security`/`admin` role headers and
+  returns ClickHouse backend `status=ok`, `open_count=0`;
+- DLP light warehouse is present on the portal host and DLP checks show OK in
+  the operator card;
+- Grafana backend is reachable directly at `10.10.10.11:3000/api/health`.
+
+Live fixes applied:
+
+- removed stale systemd drop-in
+  `/etc/systemd/system/detmir-portal.service.d/10-detmir-check-env.conf`;
+- restored `/etc/detmir-portal.env` timeout to
+  `DETMIR_PORTAL_TIMEOUT_SECONDS=25`;
+- updated `/etc/detmir/detmir-check.env` for the current light profile:
+  `DETMIR_DLP_ENABLED=true` and `DETMIR_DISABLE_DLP_HEALTH_CHECK=true`;
+- updated `/var/lib/detmir-ai/latest-run` to the fresh 2026-06-30
+  `detmir-check` JSON so the portal no longer displays the stale 2026-06-25
+  collection snapshot;
+- updated Ansible to remove the stale portal timeout override during deploy.
+
+Remaining live blocker:
+
+- `detmir-check` still fails by design because RDP host `192.168.100.19`
+  responds to ICMP, but TCP `22` and `5985` time out from the DetMir contour;
+- `awatch-contour-daily-check.service` therefore remains failed with
+  `service_failures=2`;
+- this is not an AW-server, Worktime API, DLP warehouse, ClickHouse, or portal
+  rendering failure. It is the current RDP control/reachability failure.
+
+Grafana note:
+
+- Browser access to Grafana through the gateway is protected by Basic Auth and
+  the current certificate chain is not trusted by the Playwright browser when
+  opened by IP/DNS in this run;
+- direct backend health check is green:
+  `http://10.10.10.11:3000/api/health -> 200`;
+- gateway returns `401` without credentials, which is expected for the
+  protected dashboard entrypoint.
@@ -4,6 +4,12 @@ Explainable Workforce KPI отвечает на вопрос: почему по
 активности. Слой предназначен для руководителя, ИБ и администратора, но не
 является HR-оценкой сотрудника и не использует ML/LLM.

+Смежный, но отдельный contract по операционной загрузке описан в
+[WORKFORCE_OPERATIONS_MODEL_RU.md](WORKFORCE_OPERATIONS_MODEL_RU.md). KPI
+объясняет процент активности, а Workforce Operations показывает загрузку,
+простои, перегруз, дисциплину процесса, достоверность данных и рекомендуемое
+ручное действие.
+
 ## API

 Endpoint:
@@ -102,6 +108,10 @@ Security и Forensics не получают Workforce Dashboard через `/api
 Раздел содержит KPI score, confidence, coverage, факторы, warnings и
 рекомендации.

+Блок `Операционная загрузка` в портале использует другой payload:
+`workforce_operations`. Он не заменяет explainable KPI и не должен
+интерпретироваться как автоматическая HR-оценка.
+
 ## Ограничения Pilot v1

 - Это не ML и не LLM.
@@ -83,6 +83,11 @@ gateway:
 /d/detmir-rdp-user-activity/detmir3a-rabota-pol-zovatelej-v-rdp?orgId=1&from=now-7d&to=now&timezone=browser&var-host=SHARKON2025&refresh=5m
 ```

+`var-host=SHARKON2025` здесь является stable logical host id, а не требованием
+к физическому Windows `COMPUTERNAME`. При переименовании RDP-сервера dashboard
+должен продолжать смотреть на тот же logical id до отдельной planned migration.
+См. `docs/WINDOWS_LOGICAL_HOST_ID_RU.md`.
+
 В портале он доступен как кнопка `Графики сотрудников`.

 Не включайте `[auth.anonymous]` для решения этой задачи: это откроет Grafana на
@@ -1,813 +0,0 @@
-# Low-cost Sigma/Hayabusa/Velociraptor containment addon
-
-Дата: 2026-06-25.
-
-Цель: добавить в AWatch-rus дешевый, воспроизводимый и отключаемый слой
-security containment + forensics для организаций без зрелого SIEM/EDR. Главный
-смысл модуля - быстро ограничить дальнейшее распространение заражения или
-подозрительной активности с рабочей станции, сохранив управляемый канал
-расследования и восстановления.
-
-Это дополнение не делает AWatch-rus сертифицированной DLP/SIEM/EDR/XDR/СЗИ и
-не заменяет штатные средства защиты. Автоматическая блокировка здесь означает
-policy-approved containment/quarantine, а не автоматическое лечение системы.
-
-## Upstream basis
-
- Hayabusa: fast Windows event log forensics timeline generator and threat
-  hunting tool, written in Rust, using Sigma-compatible Hayabusa rules.
- Hayabusa supports single-host/live analysis, offline analysis of collected
-  logs, and enterprise-wide use through a Velociraptor artifact.
- Hayabusa outputs timeline/results suitable for CSV, JSON/JSONL and HTML
-  reports.
- `Windows.Hayabusa.Monitoring` in Velociraptor Curated Sigma is an artifact
-  intended to triage a Windows host and is based on `Windows.Sigma.BaseEvents`.
- Velociraptor is an endpoint visibility and collection tool using VQL
-  artifacts. Its normal deployment is server + clients, but it also supports
-  offline collectors and command-line artifact execution.
-
-Primary references:
-
- https://github.com/Yamato-Security/hayabusa
- https://github.com/Yamato-Security/hayabusa/wiki/About-Hayabusa
- https://github.com/Yamato-Security/hayabusa-rules
- https://sigma.velocidex.com/docs/artifacts/windows.hayabusa.monitoring/
- https://github.com/Velocidex/velociraptor
- https://docs.velociraptor.app/docs/deployment/
-
-## Product positioning
-
-Рабочее название модуля:
-
-```text
-AWatch-rus Low-Cost Containment Pack
-```
-
-Назначение:
-
- быстро получить полезный containment + DFIR/threat-hunting слой там, где
-  нет SIEM/EDR;
- автоматически или полуавтоматически изолировать подозрительно зараженную
-  рабочую станцию от критичных сегментов;
- сохранить минимальный управляемый канал: AWatch-rus/Velociraptor server,
-  администраторский jump/VPN, DNS/NTP при необходимости;
- запускать Hayabusa/Sigma-анализ EVTX и Velociraptor artifact collection;
- давать владельцу и администратору понятные findings, timeline и evidence;
- связывать findings с AWatch-rus cases и operator/forensics views;
- оставаться optional и выключаемым без деградации Workforce core.
-
-Запрещенные claims:
-
- не писать, что это SIEM replacement;
- не писать, что это DLP replacement;
- не писать, что это EDR/XDR;
- не писать, что это сертифицированная СЗИ;
- не писать, что автоматическое remediation включено;
- не писать, что automatic containment гарантированно остановит заражение;
- не писать, что threat detection ML/LLM-based;
- не писать, что найденные события являются доказанной атакой без ручной
-  проверки.
-
-Допустимая формулировка:
-
-```text
-Optional low-cost containment, security analytics and forensics layer based on
-open-source Hayabusa/Sigma/Velociraptor workflows.
-```
-
-## Containment objective
-
-Модуль должен отвечать на вопрос:
-
-```text
-Как максимально быстро ограничить рабочую станцию, которая выглядит зараженной,
-чтобы она не заражала соседние машины и не продолжала утечку/распространение?
-```
-
-Необходимо разделять:
-
- `suspected_infected` - есть правила/сигналы/аномалии, достаточные для
-  карантина по политике организации;
- `confirmed_infected` - есть ручное подтверждение администратора/ИБ;
- `contained` - станция технически ограничена;
- `released` - карантин снят вручную или по документированному rollback.
-
-Containment actions должны быть обратимыми, журналируемыми и ограниченными по
-blast radius. По умолчанию допускается `shadow` или `manual_approval`; fully
-automatic quarantine включается только отдельным флагом и только после
-allowlist/rollback проверки.
-
-## Architecture
-
-### Modes
-
-1. `disabled`
-   - default для conservative deployment;
-   - все readiness checks возвращают disabled-state;
-   - Workforce/ActivityWatch core не зависит от модуля.
-
-2. `hayabusa_offline`
-   - текущий базовый режим;
-   - Windows scheduled task экспортирует EVTX zip;
-   - серверный `aw-hayabusa-drop.path` принимает package;
-   - `aw-hayabusa-autoprocess` валидирует zip, process-inbox, quarantine.
-
-3. `velociraptor_offline_collector`
-   - для бедных/малых контуров без постоянно работающего Velociraptor server;
-   - AWatch-rus собирает/хранит signed offline collector bundle;
-   - запуск collector выполняется вручную или scheduled task;
-   - результаты импортируются как artifact bundle.
-
-4. `velociraptor_server_clients`
-   - optional managed mode;
-   - Linux server рядом с AW/Proxmox или отдельной VM;
-   - Windows clients ставятся только явным Ansible-флагом;
-   - используется для управляемого запуска `Windows.Hayabusa.Monitoring`.
-
-5. `containment_shadow`
-   - decision engine считает, что сделал бы, но ничего не блокирует;
-   - безопасный default для пилота;
-   - используется для настройки правил и false-positive анализа.
-
-6. `containment_manual_approval`
-   - система формирует containment recommendation;
-   - администратор подтверждает действие в CLI/портале;
-   - все действия пишутся в audit trail.
-
-7. `containment_auto`
-   - система сама применяет заранее разрешенные quarantine-действия;
-   - включается только явным флагом;
-   - требует allowlist, rollback TTL и проверку сохранения admin channel.
-
-### Boundaries
-
-Core remains:
-
- ActivityWatch server;
- Workforce reports;
- RDP/window/AFK/worktime collectors;
- 1C/ClickHouse analytics;
- portal health/readiness;
- Hayabusa drop quarantine hardening.
-
-Optional containment/forensics layer:
-
- Hayabusa binary and rules;
- Sigma/Hayabusa curated rules cache;
- Velociraptor binary/config/artifacts;
- Velociraptor clients/offline collectors;
- artifact result import;
- findings summary and case links;
- containment decision engine;
- containment executor for approved channels.
-
-Containment channels:
-
- Windows host firewall quarantine:
-  allow only AWatch-rus/Velociraptor server, DNS/NTP if required, and admin
-  jump/VPN;
- pfSense/network gateway block:
-  block workstation IP/MAC from lateral/internal segments, keep management
-  exception;
- switch/VLAN quarantine when supported:
-  move port/client to quarantine VLAN through explicit integration;
- Windows local containment:
-  stop risky shares/services, disable outbound SMB/RDP to peers, collect
-  evidence;
- Active Directory actions, if configured:
-  disable only the workstation account or user session by policy, never broad
-  OU/domain actions by default.
-
-Non-goals:
-
- deleting malware;
- cleaning registry/files;
- killing arbitrary processes based on weak signal;
- disabling domain-wide accounts;
- blocking servers/shared infrastructure automatically;
- hiding the host from administrators.
-
-No hot-path dependency:
-
- portal first screen must not wait for Velociraptor;
- Workforce reports must not query Velociraptor;
- readiness must not fail when module is disabled;
- heavy artifact execution must be timer/manual/background only.
-
-## Proposed configuration
-
-Ansible group vars:
-
-```yaml
-aw_forensics_pack_enabled: false
-aw_hayabusa_enabled: true
-aw_hayabusa_rules_enabled: true
-aw_hayabusa_rules_version: "pinned"
-aw_hayabusa_rules_update_enabled: false
-
-aw_velociraptor_enabled: false
-aw_velociraptor_mode: "disabled" # disabled|offline_collector|server_clients
-aw_velociraptor_version: "pinned"
-aw_velociraptor_server_bind_host: "127.0.0.1"
-aw_velociraptor_public_enabled: false
-aw_velociraptor_artifact_pack_enabled: true
-aw_velociraptor_hayabusa_artifact_enabled: true
-
-aw_forensics_store_raw_artifacts: false
-aw_forensics_raw_retention_days: 7
-aw_forensics_result_retention_days: 90
-aw_forensics_max_parallel_jobs: 1
-aw_forensics_max_job_minutes: 30
-aw_forensics_cpu_quota_pct: 25
-aw_forensics_io_nice: true
-
-aw_containment_enabled: false
-aw_containment_mode: "shadow" # shadow|manual_approval|auto
-aw_containment_default_ttl_minutes: 60
-aw_containment_require_admin_channel_check: true
-aw_containment_allow_auto_for_servers: false
-aw_containment_allowed_actions:
-  - windows_firewall_quarantine
-  - pfsense_host_block
-aw_containment_management_allowlist:
-  - "aw_server"
-  - "velociraptor_server"
-  - "admin_jump_host"
-```
-
-Runtime env:
-
-```text
-AW_FORENSICS_PACK_ENABLED=false
-AW_HAYABUSA_ENABLED=true
-AW_VELOCIRAPTOR_ENABLED=false
-AW_VELOCIRAPTOR_MODE=disabled
-AW_FORENSICS_STORE_RAW_ARTIFACTS=false
-AW_CONTAINMENT_ENABLED=false
-AW_CONTAINMENT_MODE=shadow
-```
-
-## Data flow
-
-### Existing Hayabusa path
-
-```text
-Windows EVTX export
-  -> zip + sidecars
-  -> /opt/activitywatch/aw-rus-ops/drop
-  -> aw-hayabusa-autoprocess
-  -> validate package
-  -> accept/process-inbox
-  -> result_dir/latest-intake.json
-  -> case link / portal summary
-  -> quarantine on bad package
-```
-
-### New Velociraptor path
-
-```text
-Velociraptor artifact run
-  -> Windows.Hayabusa.Monitoring / custom artifact
-  -> Velociraptor result export
-  -> AWatch-rus import directory
-  -> schema validation
-  -> derived findings JSON/SQLite
-  -> optional case link
-  -> portal forensics summary
-```
-
-### Containment path
-
-```text
-Finding/signals
-  -> confidence and policy evaluation
-  -> containment decision record
-  -> admin-channel precheck
-  -> shadow/manual/auto execution
-  -> verify containment
-  -> case/audit record
-  -> TTL/rollback queue
-```
-
-Raw artifacts and derived results must be separated:
-
- raw EVTX/result bundles: restricted evidence storage;
- derived findings: sanitized AWatch-rus views;
- operator notes/case links: case database;
- public/demo exports: no raw hostnames, users, IPs, paths or secrets.
-
-## Security and privacy guardrails
-
- Store no secrets in repo, docs, demo data or screenshots.
- Do not commit generated Velociraptor config with private keys/client secrets.
- Do not expose Velociraptor GUI publicly by default.
- Default server bind should be loopback or private VPN-only address.
- Require explicit operator action for client deployment.
- Require retention policy for raw artifacts.
- Require redaction for export/demo packs.
- Require audit log for artifact imports, deletes and case links.
- Treat Velociraptor outputs as untrusted input: validate schema, size, paths
-  and timestamps before import.
- Never execute arbitrary downloaded artifacts without pinning/checksums.
- Never run containment if management channel would be lost.
- Never auto-contain servers unless explicitly allowed and tested.
- Always create rollback record before applying a block.
- Always include TTL or manual release path.
- Always log who/what triggered containment, which signals were used and which
-  network paths remain allowed.
-
-## Containment decision model
-
-Inputs:
-
- high/critical Hayabusa/Sigma rule hits;
- suspicious Windows event sequence from Velociraptor artifact;
- AWatch-rus endpoint signals such as mass file changes, unusual process/file
-  behavior, DLP/security signal spikes;
- administrator manual flag.
-
-Decision fields:
-
-```json
-{
-  "host": "HOST",
-  "host_role": "workstation",
-  "state": "suspected_infected",
-  "confidence": "medium|high|critical",
-  "signals": ["hayabusa:rule-id", "velociraptor:artifact"],
-  "recommended_action": "windows_firewall_quarantine",
-  "mode": "shadow|manual_approval|auto",
-  "ttl_minutes": 60,
-  "management_channel_checked": true,
-  "rollback_plan_id": "opaque-id"
-}
-```
-
-Minimum threshold for automatic quarantine:
-
- host role is workstation;
- host is not in denylist of critical infrastructure;
- at least one critical signal or multiple high-confidence signals;
- management channel precheck passed;
- containment action is in allowlist;
- rollback record successfully written.
-
-## Current implementation status
-
-Implemented first safe layer:
-
- Rust CLI `containment-engine`;
- strict JSON parsing for policy/finding input;
- example files:
-  `configs/containment-policy.example.json`,
-  `configs/containment-finding.example.json`,
-  `configs/windows-firewall-containment-request.example.json`;
- disabled-by-default Ansible/env configuration;
- `shadow`, `manual_approval` and `auto` decision states;
- automatic containment refused for non-workstation roles by default;
- `would_mutate=false` in current implementation;
- Windows Firewall executor interface:
-  `plan`, `apply`, `verify`, `rollback`;
- Windows Firewall dry-run generates PowerShell `New-NetFirewallRule`,
-  `Get-NetFirewallRule` and `Remove-NetFirewallRule` commands;
- Windows Firewall execution is fail-closed without explicit confirmation and
-  `--execute-local`;
- Security Finding Inbox:
-  ClickHouse schema, Rust ingest CLI, Hayabusa/Velociraptor source adapters,
-  portal page `Подозрительные станции` and separate executor process for
-  approved `apply_requested` workflow;
- smoke script:
-  `bash scripts/containment_shadow_smoke.sh`;
- operator/policy docs:
-  `docs/CONTAINMENT_OPERATOR_RUNBOOK_RU.md`,
-  `docs/CONTAINMENT_POLICY_RU.md`.
-
-Not implemented yet:
-
- production-verified Windows Firewall mutation on lab/real workstations;
- real pfSense alias/table mutation;
- AD/VLAN executor;
- TTL rollback service;
- portal containment action execution. The current portal records workflow
-  events only and does not mutate firewall/network state; mutation is reserved
-  for `security-finding-inbox executor` with explicit local Windows
-  confirmation.
-
-## Codex implementation plan
-
-### Phase 0. Architecture and docs only
-
-Files:
-
- `docs/LOW_COST_SIGMA_HAYABUSA_VELOCIRAPTOR_ADDON_RU.md`;
- `docs/PROJECT_STATUS_RU.md`;
- `docs/REGISTRY_FUNCTIONAL_SCOPE_RU.md`;
- `README.md`.
-
-Tasks:
-
- record addon scope and non-goals;
- document upstream references and license/supply-chain review requirement;
- state that module is planned/optional until implemented;
- keep forbidden SIEM/DLP/СЗИ claims blocked.
-
-Acceptance:
-
- docs mention optional low-cost containment/forensics layer;
- no runtime/API/UI/product code change;
- secret scan and diff check pass.
-
-### Phase 1. Inventory current Hayabusa implementation
-
-Files:
-
- `aw-server/hayabusa/README.md`;
- `aw-server/hayabusa/aw-hayabusa.sh`;
- `adk-rust/crates/hayabusa-tools/`;
- `windows/export-evtx-for-hayabusa.ps1`;
- `windows/export-upload-hayabusa-to-aw-server.ps1`;
- `ansible/deploy_aw_server.yml`;
- `ansible/deploy_aw_windows.yml`.
-
-Tasks:
-
- document installed binaries, units, timers, directories and retention;
- verify current drop/inbox/quarantine behavior;
- add a manifest file for current Hayabusa server bundle;
- add a read-only status command if missing.
-
-Acceptance:
-
- `aw-hayabusa doctor` remains green;
- bad zip quarantine behavior remains intact;
- no change to DLP disabled runtime state.
-
-### Phase 2. Supply-chain manifest and pinned downloads
-
-New files:
-
- `third_party/forensics/manifest.json`;
- `scripts/prepare_forensics_binaries.sh`;
- `docs/FORENSICS_SUPPLY_CHAIN_RU.md`.
-
-Tasks:
-
- define pinned versions for Hayabusa, Hayabusa rules and Velociraptor;
- define SHA256 checksums and source URLs;
- support offline cache directory;
- fail closed if checksum mismatch;
- never auto-update rules in production unless explicitly enabled.
-
-Acceptance:
-
- dry-run prints planned downloads only;
- checksum verification works on cached fixture;
- no network required for deploy when cache exists.
-
-### Phase 3. Optional Velociraptor server install
-
-New/changed files:
-
- `ansible/group_vars/all.yml`;
- `ansible/group_vars/all.example.yml`;
- `ansible/deploy_aw_server.yml`;
- `ops/systemd/velociraptor.service`;
- `docs/VELOCIRAPTOR_DEPLOYMENT_RU.md`.
-
-Tasks:
-
- add `aw_velociraptor_enabled=false` default;
- install Velociraptor binary only when enabled;
- generate config only on target host, not in repo;
- bind to loopback/private address by default;
- store datastore under `/var/lib/velociraptor`;
- store config under `/etc/velociraptor`;
- add systemd service with resource limits;
- avoid public exposure unless explicitly configured.
-
-Acceptance:
-
- disabled mode creates no running service;
- enabled mode installs service and returns local health;
- generated config is not committed;
- Ansible syntax check passes.
-
-### Phase 4. Velociraptor client/offline collector packaging
-
-Files:
-
- `ansible/deploy_aw_windows.yml`;
- `windows/ActivityWatch.Windows.Common.psm1`;
- `windows/validate-deployment.ps1`;
- optional `windows/install-velociraptor-client.ps1`.
-
-Tasks:
-
- add explicit deployment mode:
-  `disabled|offline_collector|client_service`;
- package client installer/offline collector from pinned binary/config;
- install client service only when explicitly enabled;
- keep scheduled/manual offline collector for low-cost mode;
- log to `C:\ProgramData\AWatch-rus\logs\velociraptor-*.log`;
- include service/task checks in validation only when enabled.
-
-Acceptance:
-
- disabled mode leaves Windows host untouched;
- offline collector can run and produce an export bundle;
- service mode reports healthy enrollment without exposing credentials.
-
-### Phase 5. Hayabusa/Sigma artifact integration
-
-Files:
-
- `third_party/forensics/artifacts/`;
- `scripts/import_velociraptor_artifact_pack.sh`;
- `docs/HAYABUSA_SIGMA_RULES_RU.md`.
-
-Tasks:
-
- import/prepare `Windows.Hayabusa.Monitoring` artifact pack;
- document mapping to Hayabusa rules;
- create curated profile:
-  `low-cost-default`, `incident`, `full`;
- add noisy-rule tuning file;
- require version metadata in every run.
-
-Acceptance:
-
- artifact pack import is reproducible;
- rules profile can be listed without running collection;
- config supports small-host low-resource default.
-
-### Phase 6. AWatch-rus result import
-
-Prefer Rust.
-
-New crate or extension:
-
- `adk-rust/crates/forensics-importer`;
-  or extend `adk-rust/crates/hayabusa-tools`.
-
-Tasks:
-
- import Hayabusa JSON/JSONL/CSV summary;
- import Velociraptor artifact result export;
- normalize to derived finding schema:
-  `source`, `host`, `time`, `rule`, `level`, `mitre`, `summary`,
-  `evidence_ref`, `case_id`, `tool_version`, `rules_version`;
- reject oversized, malformed and path-traversal payloads;
- write derived SQLite/JSON under `/var/lib/activitywatch/forensics`;
- do not copy raw artifacts unless `AW_FORENSICS_STORE_RAW_ARTIFACTS=true`.
-
-Acceptance:
-
- unit tests cover malformed JSON, oversized file, path traversal, empty result;
- fixture import produces stable output;
- raw-sensitive data is not rendered in default portal view.
-
-### Phase 7. Containment control plane
-
-Prefer Rust.
-
-New crate or extension:
-
- `adk-rust/crates/containment-engine`;
-  or extend `adk-rust/crates/forensics-importer` with a separate module.
-
-Tasks:
-
- define containment decision schema and audit log;
- add policy file:
-  `/etc/activitywatch/containment-policy.json`;
- add host role model:
-  `workstation|server|domain_controller|unknown`;
- add safe defaults:
-  `enabled=false`, `mode=shadow`, server auto-containment disabled;
- implement decision evaluation from imported findings;
- implement dry-run/shadow output;
- implement manual approval queue;
- implement rollback record format.
-
-Acceptance:
-
- unit tests cover workstation/server/unknown host roles;
- automatic action is refused for server/unknown role by default;
- no action runs if management channel precheck fails;
- shadow mode produces audit record and does not mutate host/network.
-
-### Phase 8. Containment executors
-
-Executor targets:
-
- Windows firewall quarantine through PowerShell/Rust Windows helper;
- pfSense alias/table block through explicit API/SSH integration;
- optional switch/VLAN integration only behind feature flag.
-
-Tasks:
-
- implement executor interface:
-  `plan`, `apply`, `verify`, `rollback`;
- first implemented executor: Windows Firewall explicit management allowlist
-  plus explicit block ranges, without broad `Any`/`LocalSubnet` block and
-  without default firewall profile changes;
- apply pfSense host block using IP/MAC only after current lease/identity
-  verification;
- store rollback before mutation;
- add TTL-based rollback timer;
- add emergency release command.
-
-Acceptance:
-
- fixture mode shows exact firewall/pfSense plan;
- apply refuses empty allowlist;
- verify confirms blocked lateral path and allowed management path;
- rollback restores previous rules;
- logs contain no secrets.
-
-### Phase 9. Portal and API integration
-
-Files:
-
- `adk-rust/crates/detmir-portal/`;
- `docs/PORTAL_API_CONTRACTS_RU.md`;
- `docs/DETMIR_CURRENT_STATE_RU.md`.
-
-Tasks:
-
- add optional forensics module state:
-  `disabled|not_configured|ready|degraded`;
- show derived findings count, latest run, severity histogram;
- show containment state:
-  `disabled|shadow|recommended|contained|rollback_pending|released`;
- show clear action buttons only for authorized admin/security roles;
- link to case/evidence only by opaque ID;
- do not block Workforce first screen;
- do not include raw artifacts in frontend payload.
-
-Acceptance:
-
- with module disabled, portal shows disabled-state and remains fast;
- with fixture findings, portal renders summary;
- with fixture containment recommendation, portal renders action state without
-  applying action;
- Playwright smoke confirms no endless loading and no raw sensitive fields.
-
-### Phase 10. Health/readiness/checks
-
-Files:
-
- `adk-rust/crates/detmir-check/`;
- `adk-rust/crates/detmir-readiness/`;
- `scripts/detmir-full-diagnostics/aw-contour-diag.sh`;
- `scripts/aw-contour-diag.sh`;
- `check-aw-full.sh`.
-
-Tasks:
-
- add optional forensics status checks;
- disabled mode must be OK/Skipped, not fail;
- add optional containment status checks;
- enabled mode checks:
-  Velociraptor service, artifact pack, latest run age, importer health,
-  queue/quarantine counts, containment executor health;
- add resource pressure checks for long-running scans.
-
-Acceptance:
-
- disabled mode produces `forensics:mode=disabled`;
- disabled containment mode produces `containment:mode=disabled`;
- enabled mode fails closed on stale/broken artifact importer;
- containment auto mode fails closed if rollback store or admin-channel precheck
-  is unavailable;
- checks do not restart services unless explicit autoheal mode exists.
-
-### Phase 11. Runtime safety and resource budgets
-
-Files:
-
- systemd units/timers;
- Ansible vars;
- docs runbooks.
-
-Tasks:
-
- enforce `Nice`, `IOSchedulingClass`, CPU quota and timeout for heavy scans;
- serialize jobs through lock file;
- add cancellation/timeout behavior;
- quarantine failed artifact runs;
- keep `aw-server-rust`, worktime API, ClickHouse and portal out of the scan
-  critical path.
- enforce containment mutation lock so two block/unblock actions cannot race.
-
-Acceptance:
-
- two concurrent scan requests do not run two heavy jobs;
- timeout leaves a clear failed run record;
- core health remains green under disabled mode.
- rollback timer is tested and idempotent.
-
-### Phase 12. Documentation and operator runbooks
-
-New docs:
-
- `docs/VELOCIRAPTOR_DEPLOYMENT_RU.md`;
- `docs/FORENSICS_SUPPLY_CHAIN_RU.md`;
- `docs/FORENSICS_OPERATOR_RUNBOOK_RU.md`;
- `docs/FORENSICS_RETENTION_POLICY_RU.md`;
- `docs/FORENSICS_PRIVACY_GUARDRAILS_RU.md`.
- `docs/CONTAINMENT_OPERATOR_RUNBOOK_RU.md`;
- `docs/CONTAINMENT_POLICY_RU.md`.
-
-Tasks:
-
- describe installation modes;
- describe offline collector workflow;
- describe artifact run, import, case link and cleanup;
- describe forbidden data in screenshots/demo packs;
- document rollback and disable commands.
- describe quarantine policy, management allowlist, manual approval, emergency
-  release and TTL rollback.
-
-Acceptance:
-
- admin can install disabled/offline/server modes from docs;
- admin can test shadow containment safely before auto mode;
- docs clearly say GitHub/public demo is not evidence storage;
- no claim of SIEM/DLP/EDR/СЗИ replacement.
-
-### Phase 13. Tests and gates
-
-Required checks:
-
-```bash
-python3 scripts/public_secret_pattern_check.py
-bash -n scripts/prepare_forensics_binaries.sh
-ansible-playbook -i ansible/inventory.ini ansible/deploy_aw_server.yml --syntax-check
-ansible-playbook -i ansible/inventory.ini ansible/deploy_aw_windows.yml --syntax-check
-
-cd adk-rust
-export CARGO_TARGET_DIR=/home/igor/.cache/detmir-adk-rust-target
-cargo fmt --all --check
-cargo test -p hayabusa-tools
-cargo test -p forensics-importer
-cargo test -p containment-engine
-cargo clippy -p hayabusa-tools -p forensics-importer -p containment-engine --all-targets -- -D warnings
-
-cd ..
-git diff --check
-```
-
-Manual/live checks:
-
- disabled mode on clean install;
- Hayabusa current drop-zone smoke;
- Velociraptor offline collector fixture run;
- Velociraptor server health if enabled;
- containment shadow run with fixture critical finding;
- manual approval containment in isolated lab host;
- rollback verification;
- portal browser smoke with module disabled and with fixture findings;
- no public exposure of Velociraptor GUI unless explicitly configured.
-
-## Codex guardrails
-
-Codex must not:
-
- change Workforce core behavior while adding this module;
- re-enable heavy DLP runtime by accident;
- expose Velociraptor or Hayabusa outputs publicly;
- commit generated secrets, private configs or raw evidence;
- auto-block hosts before policy, allowlist, rollback and admin-channel checks
-  exist;
- auto-block servers/domain infrastructure by default;
- claim completed integration before live/manual evidence exists;
- change Rust/API/UI runtime outside the planned files without documenting why.
-
-Codex should:
-
- start with docs/config disabled mode;
- implement supply-chain pinning before service deployment;
- prefer Rust for import/validation/parsing;
- treat containment as a separate audited control plane, not as generic
-  remediation;
- keep PowerShell only for Windows install/run wrappers;
- add small fixtures and negative tests before live deployment;
- update project status after each successfully verified phase.
-
-## Expected result
-
-After implementation AWatch-rus should have:
-
- installed/pinned Hayabusa and rules workflow;
- optional bundled Velociraptor server/client/offline collector modes;
- reproducible artifact pack handling for `Windows.Hayabusa.Monitoring`;
- derived findings importer into AWatch-rus forensics views;
- policy-controlled automated/manual quarantine of suspected infected
-  workstations;
- rollback and emergency release path for every containment action;
- disabled-by-default safety;
- resource-bounded scans;
- clear runbooks for poor/small organizations;
- honest positioning as low-cost containment, security analytics and forensics, not
-  SIEM/DLP/EDR/СЗИ.
@@ -19,6 +19,8 @@
 ## Workforce сценарий

 - Отображается индекс активности и объяснение факторов.
+- Отображается блок `Операционная загрузка`: загрузка, простой, перегруз,
+  дисциплина процесса и достоверность данных.
 - Доступно сравнение подразделений и ответственных.
 - Видны тренды daily, weekly и monthly, если данные есть.
 - Отдельно показываются признаки перегрузки и недозагрузки.
@@ -46,6 +46,51 @@ React/Tauri-интерфейса без переписывания backend-ло
 - `GET /api/readiness/latest` - готовность системы;
 - `GET /api/workforce/policy/explain` - объяснение расчёта показателей.

+`GET /api/reports` должен сохранять additive payload `workforce_operations`.
+Это основной contract для экрана руководителя по загрузке, простоям, перегрузу,
+дисциплине процесса и достоверности данных. Клиент должен читать:
+
+- `workforce_operations.summary`;
+- `workforce_operations.rows`;
+- `workforce_operations.model`;
+- `workforce_operations.rows[].load_status`;
+- `workforce_operations.rows[].idle_status`;
+- `workforce_operations.rows[].discipline_status`;
+- `workforce_operations.rows[].data_confidence`;
+- `workforce_operations.rows[].recommended_action`.
+
+Подробная семантика статусов:
+[WORKFORCE_OPERATIONS_MODEL_RU.md](WORKFORCE_OPERATIONS_MODEL_RU.md).
+
+`GET /api/reports` также публикует additive payload `modules.dlp`.
+Клиент должен трактовать его как runtime capability, а не как claim
+сертифицированной DLP:
+
+- `modules.dlp.enabled`;
+- `modules.dlp.status`;
+- `modules.dlp.hot_path`;
+- `modules.dlp.note`.
+
+Если `modules.dlp.enabled=false`, Workforce UI должен продолжать работу и
+показывать DLP/Security/Forensics как disabled или not configured, не превращая
+это в ошибку основного рабочего экрана.
+
+`GET /api/operator` также публикует additive runtime-state поля для первичного
+экрана:
+
+- `cache_status`;
+- `modules.dlp.enabled`;
+- `modules.dlp.status`;
+- `modules.dlp.hot_path`;
+- `modules.dlp.note`;
+- `summary.severity`;
+- `summary.blocks`.
+
+Если `cache_status=warming`, клиент должен показать bounded stale/warming
+state и не держать бесконечный loading indicator. Если
+`modules.dlp.enabled=false`, operator screen должен считать DLP disabled-state
+допустимым состоянием, а не ошибкой Workforce core.
+
 ## Что не меняется

 - HTML-портал не удаляется.
@@ -50,6 +50,13 @@ Security layer:

 Это не полноценная SIEM и не сертифицированная DLP.

+Heavy DLP processing is not part of the required Workforce hot path. DLP
+endpoint signals, screenshots, evidence review, heavy correlation and forensics
+enrichment are treated as optional/deployment-specific modules. If the DLP
+module is disabled or not configured, core Workforce reports and portal
+readiness must remain available and the Security/Forensics views must show an
+honest disabled/not configured state.
+
 ## Forensics Core

 Forensics layer:
@@ -68,6 +75,7 @@ Optional addons and deployment-specific directions:

 - pfSense;
 - 1C;
+- DLP endpoint signals and evidence workflow;
 - AD/LDAP;
 - SIEM/syslog;
 - external storage;
@@ -1,279 +0,0 @@
-# Security Finding Inbox
-
-Дата: 2026-06-25.
-
-Security Finding Inbox - это очередь подозрительных рабочих станций для
-связки Hayabusa/Sigma, Velociraptor, AWatch context и ручных ИБ-сигналов.
-Очередь нужна для контролируемого процесса:
-
-```text
-finding -> triage -> decide -> plan -> approve -> apply_requested -> executor -> verify/rollback
-```
-
-Важно: портал inbox сам не применяет Windows Firewall, pfSense, AD или VLAN
-изменения. Он фиксирует findings и workflow-события. Реальное применение
-делается отдельным процессом `security-finding-inbox executor`, который
-вызывает `containment-engine windows-firewall plan/apply/verify/rollback`.
-По умолчанию executor работает безопасно: dry-run/fail-closed, без локального
-изменения firewall.
-
-## Компоненты
-
- ClickHouse schema:
-  `clickhouse-1c/security/security_finding_inbox.sql`
- normalized finding example:
-  `configs/security/security-finding.example.json`
- ingest/workflow CLI:
-  `adk-rust/crates/security-finding-inbox`
- executor CLI:
-  `security-finding-inbox executor`
- portal API:
-  `/api/security/findings`
-  `/api/security/findings/workflow`
- portal page:
-  `Подозрительные станции`
-
-## ClickHouse tables
-
-`security_findings`
-
- normalized finding records;
- source: `hayabusa`, `sigma`, `velociraptor`, `awatch`, `manual`, `dlp`;
- states: `new`, `suspected_infected`, `confirmed_infected`, `contained`,
-  `released`, `false_positive`;
- recommended action remains a recommendation, not a mutation.
-
-`security_finding_workflow_events`
-
- append-only workflow audit;
- event types: `decide_requested`, `plan_requested`, `approved`,
-  `apply_requested`, `verify_requested`, `rollback_requested`, `rejected`,
-  `false_positive`, plus executor audit events:
-  `executor_plan_ready`, `executor_apply_succeeded`,
-  `executor_apply_failed`, `executor_verify_succeeded`,
-  `executor_verify_failed`, `executor_refused`,
-  `executor_rollback_succeeded`, `executor_rollback_failed`;
- portal writes only workflow events.
-
-`security_finding_inbox`
-
- latest-state view for portal/dashboard;
- filters released/rejected/false-positive rows out of the active queue.
-
-## Ingest
-
-Build:
-
-```bash
-cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian
-export CARGO_TARGET_DIR=/home/igor/.cache/detmir-adk-rust-target
-cargo build --manifest-path adk-rust/Cargo.toml -p security-finding-inbox
-```
-
-Validate sample:
-
-```bash
-security-finding-inbox validate \
-  --input configs/security/security-finding.example.json
-```
-
-Dry-run ingest:
-
-```bash
-security-finding-inbox ingest \
-  --input configs/security/security-finding.example.json \
-  --dry-run
-```
-
-Apply schema and ingest into ClickHouse:
-
-```bash
-security-finding-inbox ingest \
-  --input configs/security/security-finding.example.json \
-  --clickhouse-url http://10.10.10.2:8123 \
-  --database analytics_1c \
-  --user "$CLICKHOUSE_USER" \
-  --password "$CLICKHOUSE_PASSWORD" \
-  --apply-schema
-```
-
-The CLI accepts a single JSON object, JSON array, or JSONL.
-
-### Real Hayabusa source
-
-После `aw-hayabusa process-inbox` реальный источник находится в
-`/opt/hayabusa/state/latest-intake.json`. CLI читает `report_dir`, анализирует
-`timeline.jsonl`, logon summaries и строит normalized finding:
-
-```bash
-security-finding-inbox ingest-hayabusa \
-  --intake /opt/hayabusa/state/latest-intake.json \
-  --min-severity medium \
-  --clickhouse-url http://127.0.0.1:8123 \
-  --database analytics_1c
-```
-
-Для автоматического подключения Hayabusa drop/autoprocess:
-
-```bash
-AW_SECURITY_FINDING_INBOX_ENABLED=true
-AW_SECURITY_FINDING_INBOX_BIN=/usr/local/bin/security-finding-inbox
-AW_SECURITY_FINDING_INBOX_MIN_SEVERITY=medium
-```
-
-`AW_SECURITY_FINDING_INBOX_REQUIRED=false` оставляет forensic pipeline живым,
-если ClickHouse или inbox CLI временно недоступны. В `true`-режиме ошибка
-ingest считается operational failure.
-
-### Real Velociraptor source
-
-Velociraptor artifact JSON/JSONL можно загрузить через generic adapter:
-
-```bash
-security-finding-inbox ingest-velociraptor-json \
-  --input /path/to/velociraptor-artifact.jsonl \
-  --default-severity high \
-  --clickhouse-url http://127.0.0.1:8123 \
-  --database analytics_1c
-```
-
-Adapter ищет стандартные поля `Hostname`, `Artifact`, `Severity`, `Message`,
-`User`, `IP`. Если формат артефакта отличается, используйте normalized
-`security-finding-inbox ingest --input ...`.
-
-## Portal workflow
-
-Open:
-
-```text
-DetMir Portal -> Подозрительные станции
-```
-
-The page shows:
-
- host/user/IP/department;
- severity/confidence/score;
- source/rule;
- state and latest workflow status;
- recommended action;
- workflow buttons.
-
-Portal buttons record only workflow events:
-
- `decide`: request decision calculation;
- `plan`: request containment plan;
- `approve`: operator approval record;
- `apply`: request to perform apply outside the portal;
- `rollback`: rollback request record.
-
-The portal does not run `containment-engine`, PowerShell, firewall commands or
-network changes.
-
-## Executor handoff
-
-Executor читает из ClickHouse только те findings, где:
-
- последний workflow event: `apply_requested`;
- status: `apply_pending`;
- ранее есть `approved`;
- еще нет `executor_apply_succeeded`, `executor_apply_failed`,
-  `executor_refused` или rollback terminal event.
-
-Dry-run executor:
-
-```bash
-security-finding-inbox executor \
-  --once \
-  --dry-run \
-  --containment-engine-bin /usr/local/bin/containment-engine \
-  --policy /etc/activitywatch/containment-policy.json \
-  --management-allowlist 10.10.10.10,10.10.10.11 \
-  --blocked-remote-addresses 10.10.20.0/24,10.10.30.0/24
-```
-
-Linux systemd example for central dry-run/polling mode:
-
-```text
-ops/systemd/aw-security-finding-executor.service
-```
-
-Real local Windows apply is allowed only when all conditions are true:
-
- executor runs on the target Windows workstation;
- `--execute-local` is set;
- `--confirm-execute YES` is set;
- `--executor-host` or local `COMPUTERNAME` matches finding `host`;
- containment policy returns `manual_approval_required` or `auto_ready`;
- management allowlist and blocked remote ranges are explicit;
- generated Windows Firewall plan has no blockers.
-
-Example on the target Windows host:
-
-```powershell
-security-finding-inbox.exe executor `
-  --once `
-  --execute-local `
-  --confirm-execute YES `
-  --executor-host HOST-EXAMPLE `
-  --containment-engine-bin C:\ProgramData\AWatch-rus\containment-engine.exe `
-  --policy C:\ProgramData\AWatch-rus\containment-policy.json `
-  --management-allowlist 10.10.10.10,10.10.10.11 `
-  --blocked-remote-addresses 10.10.20.0/24,10.10.30.0/24
-```
-
-Executor writes `executor_*` workflow events back into ClickHouse. It does not
-update or delete source findings.
-
-## Manual containment handoff
-
-After a finding is approved:
-
-1. Build or review a containment policy/finding.
-2. Run:
-
-```bash
-containment-engine decide \
-  --policy /etc/activitywatch/containment-policy.json \
-  --finding /path/to/finding.json \
-  --pretty
-```
-
-3. Build Windows Firewall request with explicit management allowlist.
-4. Run:
-
-```bash
-containment-engine windows-firewall plan \
-  --request /path/to/windows-firewall-request.json \
-  --pretty > /tmp/fw-plan.json
-```
-
-5. Confirm `blockers=[]`.
-6. Dry-run:
-
-```bash
-containment-engine windows-firewall apply \
-  --plan /tmp/fw-plan.json \
-  --confirm-apply YES \
-  --pretty
-```
-
-7. Real apply only on the target Windows host:
-
-```powershell
-containment-engine.exe windows-firewall apply `
-  --plan C:\Temp\fw-plan.json `
-  --confirm-apply YES `
-  --execute-local `
-  --pretty
-```
-
-## Guardrails
-
- Do not place raw employee logs, secrets, passwords or customer identifiers in
-  findings.
- Do not treat `apply_requested` as successful containment.
- Do not run broad `Any`/`LocalSubnet` firewall blocks.
- Do not enable automatic action for servers/domain controllers.
- Keep GitHub/portal evidence separate from Russian registry release evidence.
- Keep DLP optional: Hayabusa/Velociraptor findings can continue while heavy DLP
-  runtime is disabled.
@@ -31,7 +31,7 @@ journalctl -u aw-hayabusa-drop.service -n 80 --no-pager
 curl -fsS http://127.0.0.1:5602/api/0/dlp/cases/30
 ```

-Ожидаемо: `drop` и `incoming` пустые, `latest-intake.json` имеет `status=ok`, `host=<stable-aw-logical-host-id>`, а `LastTaskResult` Windows-задачи равен `0`. Для текущего DetMir production historical logical id может оставаться `SHARKON2025`, даже если физический `COMPUTERNAME` RDP-сервера изменён.
+Ожидаемо: `drop` и `incoming` пустые, `latest-intake.json` имеет `status=ok`, `host=SHARKON2025`, а `LastTaskResult` Windows-задачи равен `0`.

 ## Что получает оператор

@@ -1,21 +0,0 @@
-[Unit]
-Description=AWatch-rus Security Finding Inbox executor
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-EnvironmentFile=-/etc/activitywatch/aw-server.env
-ExecStart=/usr/local/bin/security-finding-inbox executor \
-  --poll-seconds 30 \
-  --dry-run
-Restart=on-failure
-RestartSec=10
-NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=full
-ProtectHome=true
-ReadWritePaths=/var/lib/activitywatch /var/lock
-
-[Install]
-WantedBy=multi-user.target
@@ -0,0 +1,15 @@
+[Unit]
+Description=DetMir portal report cache prewarm
+After=network-online.target detmir-portal.service
+Wants=network-online.target detmir-portal.service
+
+[Service]
+Type=oneshot
+User=igor
+Group=igor
+Environment=no_proxy=localhost,127.0.0.1,10.10.10.2
+Environment=NO_PROXY=localhost,127.0.0.1,10.10.10.2
+ExecStart=/usr/bin/curl -fsS --max-time 180 http://127.0.0.1:8720/api/reports -o /dev/null
+TimeoutStartSec=210
+Nice=19
+IOSchedulingClass=idle
@@ -0,0 +1,12 @@
+[Unit]
+Description=Pre-warm DetMir portal report cache every 30 minutes
+
+[Timer]
+OnBootSec=5min
+OnUnitActiveSec=30min
+AccuracySec=1min
+Persistent=true
+Unit=detmir-portal-prewarm.service
+
+[Install]
+WantedBy=timers.target
@@ -0,0 +1,2 @@
+[Service]
+ExecStartPost=/bin/systemctl --no-block start detmir-portal-prewarm.service
@@ -1,98 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-ENGINE="${CONTAINMENT_ENGINE_BIN:-}"
-POLICY="${1:-$ROOT_DIR/configs/containment-policy.example.json}"
-FINDING="${2:-$ROOT_DIR/configs/containment-finding.example.json}"
-FIREWALL_REQUEST="${3:-$ROOT_DIR/configs/windows-firewall-containment-request.example.json}"
-TMP_DIR="$(mktemp -d /tmp/containment-shadow-smoke.XXXXXX)"
-trap 'rm -rf "$TMP_DIR"' EXIT
-
-if [[ -z "$ENGINE" ]]; then
-  for candidate in \
-    "${CARGO_TARGET_DIR:-}/debug/containment-engine" \
-    "${CARGO_TARGET_DIR:-}/release/containment-engine" \
-    "$ROOT_DIR/adk-rust/target/debug/containment-engine" \
-    "$ROOT_DIR/adk-rust/target/release/containment-engine" \
-    "/usr/local/bin/containment-engine"; do
-    if [[ -n "$candidate" && -x "$candidate" ]]; then
-      ENGINE="$candidate"
-      break
-    fi
-  done
-fi
-
-if [[ -z "$ENGINE" ]]; then
-  printf 'containment-engine binary not found. Build: cargo build --manifest-path adk-rust/Cargo.toml -p containment-engine\n' >&2
-  exit 2
-fi
-
-validate_payload() {
-  local expected_status="$1"
-  python3 -c '
-import json
-import sys
-
-expected_status = sys.argv[1]
-payload = json.load(sys.stdin)
-if payload.get("would_mutate") is not False:
-    raise SystemExit("containment smoke failed: would_mutate must be false")
-status = payload.get("decision_status")
-if status != expected_status:
-    raise SystemExit(f"containment smoke failed: expected {expected_status!r}, got {status!r}")
-print(f"containment_shadow_smoke=ok status={status}")
-' "$expected_status"
-}
-
-disabled_out="$("$ENGINE" decide --policy "$POLICY" --finding "$FINDING" --pretty)"
-printf '%s\n' "$disabled_out"
-validate_payload "disabled" <<<"$disabled_out"
-
-shadow_policy="$TMP_DIR/containment-policy-shadow.json"
-python3 - "$POLICY" "$shadow_policy" <<'PY'
-import json
-import sys
-
-payload = json.load(open(sys.argv[1], encoding="utf-8"))
-payload["enabled"] = True
-payload["mode"] = "shadow"
-json.dump(payload, open(sys.argv[2], "w", encoding="utf-8"), ensure_ascii=False, indent=2)
-PY
-
-shadow_out="$("$ENGINE" decide --policy "$shadow_policy" --finding "$FINDING" --pretty)"
-printf '%s\n' "$shadow_out"
-validate_payload "shadow_recommended" <<<"$shadow_out"
-
-firewall_plan="$TMP_DIR/windows-firewall-plan.json"
-"$ENGINE" windows-firewall plan --request "$FIREWALL_REQUEST" --pretty >"$firewall_plan"
-cat "$firewall_plan"
-
-python3 - "$firewall_plan" <<'PY'
-import json
-import sys
-
-payload = json.load(open(sys.argv[1], encoding="utf-8"))
-if payload.get("executor") != "windows_firewall":
-    raise SystemExit("firewall smoke failed: executor must be windows_firewall")
-if payload.get("blockers"):
-    raise SystemExit(f"firewall smoke failed: unexpected blockers {payload['blockers']!r}")
-if not payload.get("apply_commands") or not payload.get("rollback_commands"):
-    raise SystemExit("firewall smoke failed: apply/rollback commands must exist")
-print("windows_firewall_plan_smoke=ok")
-PY
-
-firewall_apply_out="$("$ENGINE" windows-firewall apply --plan "$firewall_plan" --confirm-apply YES --pretty)"
-printf '%s\n' "$firewall_apply_out"
-
-python3 -c '
-import json
-import sys
-
-payload = json.load(sys.stdin)
-if payload.get("execution_status") != "dry_run_commands_ready":
-    raise SystemExit("firewall apply smoke failed: expected dry_run_commands_ready")
-if payload.get("would_mutate") is not False:
-    raise SystemExit("firewall apply smoke failed: dry-run must not mutate")
-print("windows_firewall_apply_dry_run_smoke=ok")
-' <<<"$firewall_apply_out"
@@ -1,110 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-BIN="${SECURITY_FINDING_INBOX_BIN:-}"
-SAMPLE="${1:-$ROOT_DIR/configs/security/security-finding.example.json}"
-TMP_DIR="$(mktemp -d /tmp/security-finding-inbox-smoke.XXXXXX)"
-trap 'rm -rf "$TMP_DIR"' EXIT
-
-if [[ -z "$BIN" ]]; then
-  for candidate in \
-    "${CARGO_TARGET_DIR:-}/debug/security-finding-inbox" \
-    "${CARGO_TARGET_DIR:-}/release/security-finding-inbox" \
-    "$ROOT_DIR/adk-rust/target/debug/security-finding-inbox" \
-    "$ROOT_DIR/adk-rust/target/release/security-finding-inbox" \
-    "/usr/local/bin/security-finding-inbox"; do
-    if [[ -n "$candidate" && -x "$candidate" ]]; then
-      BIN="$candidate"
-      break
-    fi
-  done
-fi
-
-if [[ -z "$BIN" ]]; then
-  printf 'security-finding-inbox binary not found. Build: cargo build --manifest-path adk-rust/Cargo.toml -p security-finding-inbox\n' >&2
-  exit 2
-fi
-
-"$BIN" schema | grep -q 'CREATE TABLE IF NOT EXISTS analytics_1c.security_findings'
-"$BIN" validate --input "$SAMPLE" | python3 -c '
-import json
-import sys
-payload = json.load(sys.stdin)
-assert payload["ok"] is True
-assert payload["rows"] == 1
-assert payload["finding_ids"][0].startswith("sf-")
-print("security_finding_validate=ok")
-'
-
-"$BIN" ingest --input "$SAMPLE" --dry-run | python3 -c '
-import json
-import sys
-payload = json.load(sys.stdin)
-assert payload["ok"] is True
-assert payload["dry_run"] is True
-assert payload["rows"] == 1
-print("security_finding_ingest_dry_run=ok")
-'
-
-mkdir -p "$TMP_DIR/hayabusa-report"
-cat >"$TMP_DIR/hayabusa-report/timeline.jsonl" <<'EOF'
-{"Level":"high","RuleTitle":"PowerShell Credential Dump","Timestamp":"2026-06-25T10:00:00Z"}
-{"Level":"crit","RuleTitle":"Suspicious Credential Access","Timestamp":"2026-06-25T10:01:00Z"}
-EOF
-cat >"$TMP_DIR/hayabusa-report/logon-summary-failed.csv" <<'EOF'
-header
-1
-2
-EOF
-cat >"$TMP_DIR/latest-intake.json" <<EOF
-{
-  "host": "HOST-EXAMPLE",
-  "status": "ok",
-  "intake_id": "smoke-intake-001",
-  "package_path": "$TMP_DIR/HOST-EXAMPLE.zip",
-  "sha256": "demo",
-  "report_dir": "$TMP_DIR/hayabusa-report"
-}
-EOF
-"$BIN" ingest-hayabusa --intake "$TMP_DIR/latest-intake.json" --min-severity low --dry-run | python3 -c '
-import json
-import sys
-payload = json.load(sys.stdin)
-assert payload["ok"] is True
-assert payload["dry_run"] is True
-assert payload["rows"] == 1
-print("security_finding_hayabusa_ingest_dry_run=ok")
-'
-
-cat >"$TMP_DIR/velociraptor.jsonl" <<'EOF'
-{"Hostname":"HOST-EXAMPLE","Artifact":"Windows.Hayabusa.Monitoring","Severity":"high","Message":"Velociraptor smoke finding","User":"user-example"}
-EOF
-"$BIN" ingest-velociraptor-json --input "$TMP_DIR/velociraptor.jsonl" --dry-run | python3 -c '
-import json
-import sys
-payload = json.load(sys.stdin)
-assert payload["ok"] is True
-assert payload["dry_run"] is True
-assert payload["rows"] == 1
-print("security_finding_velociraptor_ingest_dry_run=ok")
-'
-
-"$BIN" workflow \
-  --finding-id sf-demo \
-  --event-type approved \
-  --actor smoke \
-  --comment "dry-run approval" \
-  --dry-run | python3 -c '
-import json
-import sys
-payload = json.load(sys.stdin)
-assert payload["ok"] is True
-assert payload["dry_run"] is True
-assert payload["event_type"] == "approved"
-print("security_finding_workflow_dry_run=ok")
-'
-
-"$BIN" executor --help >/dev/null
-printenv SECURITY_FINDING_INBOX_SKIP_EXECUTOR_SMOKE >/dev/null 2>&1 || \
-  printf 'security_finding_executor_cli=ok\n'