Add project resolution for registry submission

.github/CODEOWNERS

@@ -1,48 +1 @@
-# AWatch-rus CODEOWNERS
-#
-# Ownership is used for review routing and engineering accountability.
-# It does not certify security, legal readiness, performance or fitness for
-# production use. Contributors remain responsible for the safety of their
-# submissions.
-
-# Repository default owner.
-* @igor04091968 @rachkovii68-bisness
-
-# Rust workspace and crates.
-/adk-rust/ @igor04091968 @rachkovii68-bisness
-**/Cargo.toml @igor04091968 @rachkovii68-bisness
-**/Cargo.lock @igor04091968 @rachkovii68-bisness
-**/*.rs @igor04091968 @rachkovii68-bisness
-
-# Operational scripts and automation.
-/scripts/ @igor04091968 @rachkovii68-bisness
-
-# Product documentation, demo material and screenshots.
-/docs/ @igor04091968 @rachkovii68-bisness
-/docs/demo/ @igor04091968 @rachkovii68-bisness
-/docs/screenshots/ @igor04091968 @rachkovii68-bisness
-/docs/assets/screenshots/ @igor04091968 @rachkovii68-bisness
-
-# Registry-readiness evidence and policy documents.
-/docs/registry/ @igor04091968 @rachkovii68-bisness
-
-# GitHub public mirror validation metadata and governance controls.
-/.github/workflows/ @igor04091968 @rachkovii68-bisness
-/.github/workflows/ci.yml @igor04091968 @rachkovii68-bisness
-/.github/workflows/security.yml @igor04091968 @rachkovii68-bisness
-/.github/workflows/coverage.yml @igor04091968 @rachkovii68-bisness
-/.github/pull_request_template.md @igor04091968 @rachkovii68-bisness
-/.github/ISSUE_TEMPLATE/ @igor04091968 @rachkovii68-bisness
-/.github/CODEOWNERS @igor04091968 @rachkovii68-bisness
-/docs/BRANCH_PROTECTION_POLICY_RU.md @igor04091968 @rachkovii68-bisness
-/docs/BRANCH_PROTECTION_EVIDENCE_RU.md @igor04091968 @rachkovii68-bisness
-/docs/PR_REVIEW_WORKFLOW_RU.md @igor04091968 @rachkovii68-bisness
-/docs/PR_REVIEW_EVIDENCE_RU.md @igor04091968 @rachkovii68-bisness
-
-# Ansible deployment automation.
-/ansible/ @igor04091968 @rachkovii68-bisness
-
-# Security and contribution governance.
-/SECURITY.md @igor04091968 @rachkovii68-bisness
-/CONTRIBUTING.md @igor04091968 @rachkovii68-bisness
-/deny.toml @igor04091968 @rachkovii68-bisness
+* @igor04091968

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,42 +0,0 @@
-name: Bug report
-description: Report a reproducible defect with sanitized evidence.
-title: "fix: "
-labels: ["bug"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Do not publish secrets, tokens, private keys, personal data, real employee logs or customer evidence. Use demo/anonymized evidence.
-  - type: textarea
-    id: summary
-    attributes:
-      label: Summary
-      description: What is broken?
-    validations:
-      required: true
-  - type: textarea
-    id: steps
-    attributes:
-      label: Reproduction steps
-      description: Minimal steps using sanitized data.
-    validations:
-      required: true
-  - type: textarea
-    id: expected
-    attributes:
-      label: Expected behavior
-    validations:
-      required: true
-  - type: textarea
-    id: actual
-    attributes:
-      label: Actual behavior
-    validations:
-      required: true
-  - type: textarea
-    id: evidence
-    attributes:
-      label: Sanitized evidence
-      description: Logs, screenshots or output with secrets and personal data removed.
-    validations:
-      required: false

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,42 +0,0 @@
-name: Feature request
-description: Request a capability without using customer or employee data.
-title: "feat: "
-labels: ["enhancement"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Do not publish secrets, personal data, real employee logs or non-anonymized customer evidence.
-  - type: textarea
-    id: problem
-    attributes:
-      label: Problem
-      description: What user or operator problem should this solve?
-    validations:
-      required: true
-  - type: textarea
-    id: proposal
-    attributes:
-      label: Proposed behavior
-      description: Describe the desired behavior conservatively.
-    validations:
-      required: true
-  - type: dropdown
-    id: area
-    attributes:
-      label: Area
-      options:
-        - Workforce
-        - Security analytics
-        - Forensics
-        - Registry-readiness
-        - Install/deployment
-        - Documentation
-    validations:
-      required: true
-  - type: textarea
-    id: evidence
-    attributes:
-      label: Demo/anonymized evidence
-    validations:
-      required: false

.github/ISSUE_TEMPLATE/registry_readiness_task.yml

@@ -1,29 +0,0 @@
-name: Registry-readiness task
-description: Track registry-readiness documentation, evidence or process gaps.
-title: "docs(registry): "
-labels: ["registry-readiness", "documentation"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Do not claim legal completion of registry registration. Do not publish secrets, personal data, real employee logs or private infrastructure credentials.
-  - type: textarea
-    id: scope
-    attributes:
-      label: Scope
-      description: What registry-readiness gap is being tracked?
-    validations:
-      required: true
-  - type: textarea
-    id: evidence
-    attributes:
-      label: Required evidence
-      description: List sanitized evidence or documents needed.
-    validations:
-      required: true
-  - type: textarea
-    id: remaining
-    attributes:
-      label: Remaining gaps
-    validations:
-      required: false

.github/ISSUE_TEMPLATE/security_hardening_task.yml

@@ -1,30 +0,0 @@
-name: Security hardening task
-description: Track hardening without exposing sensitive data.
-title: "chore(security): "
-labels: ["security", "hardening"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Do not publish exploits, secrets, private keys, tokens, personal data, real employee logs or customer evidence.
-  - type: textarea
-    id: hardening
-    attributes:
-      label: Hardening target
-      description: What should be hardened?
-    validations:
-      required: true
-  - type: textarea
-    id: risk
-    attributes:
-      label: Risk addressed
-      description: Explain the risk without sensitive details.
-    validations:
-      required: true
-  - type: textarea
-    id: validation
-    attributes:
-      label: Validation
-      description: Checks or evidence required.
-    validations:
-      required: true

.github/pull_request_template.md

@@ -1,58 +1,13 @@
 ## Summary
 
-Describe what changed and why.
+- what changed
+- why it changed
+- risk and rollback notes
 
-## Impact
+## Checklist
 
-- Runtime impact: `none / changed / not applicable`
-- API impact: `none / changed / not applicable`
-- UI impact: `none / changed / not applicable`
-- Documentation impact: `none / changed / not applicable`
-- Rollback impact: `none / documented / not applicable`
-- Evidence impact: `none / registry docs updated / release evidence required`
-
-## Validation
-
-List commands executed. Use `skipped: <reason>` when a check requires a live
-stand or unavailable tool.
-
-## Review Checklist
-
-- [ ] Linked issue is provided, or the PR explains why no issue is applicable.
-- [ ] Runtime/API/UI impact is stated.
-- [ ] Registry claims are checked and remain conservative.
-- [ ] Secrets, PII, employee logs and customer identifiers are absent.
-- [ ] Tests/checks executed are listed, or skipped checks have reasons.
-- [ ] Evidence docs are updated when the change affects governance, registry
-      readiness or release evidence.
-- [ ] GitHub Actions are public validation only, not registry release evidence.
-- [ ] I checked that this PR does not publish secrets, tokens, passwords,
-      private keys, recovery codes or live credentials.
-- [ ] I checked that this PR does not publish personal data, real employee data,
-      customer logs or customer infrastructure identifiers.
-- [ ] I checked registry claims: no completed registry submission, no
-      FSTEC/FSB certification claim, no SIEM/DLP replacement claim.
-- [ ] I ran relevant checks or documented why a check was skipped.
-- [ ] I stated runtime/API/UI impact.
-- [ ] I stated documentation impact.
-- [ ] I stated smoke-test result or why smoke testing is not applicable.
-- [ ] I stated rollback and evidence impact.
-- [ ] I checked that GitHub Actions remains public mirror validation only.
-- [ ] I checked that registry release evidence still requires the Russian
-      build-runner.
-
-## Registry / Public Mirror Scope
-
-- GitHub is public mirror validation only.
-- Primary registry release evidence must be produced on the Russian
-  build-runner.
-- Update `docs/registry/` when registry-readiness behavior or evidence changes.
-
-## Safety
-
-- No secrets, tokens, passwords or private keys.
-- No personal data.
-- No real employee logs.
-- No customer evidence unless anonymized.
-- No unsupported claims about certification, DLP/SIEM replacement or legal
-  registry completion.
+- [ ] No real secrets or credentials committed
+- [ ] Server-side scripts validated (`bash -n`)
+- [ ] PowerShell scripts validated (`Invoke-ScriptAnalyzer`)
+- [ ] Docs updated (full paths and runbook steps)
+- [ ] Rollback steps documented

.github/workflows/ci.yml

@@ -1,114 +1,70 @@
-name: CI
-
-# GitHub Actions is public mirror validation only.
-# Primary registry release evidence must be produced on Russian build-runner.
+name: shell-and-powershell-ci
 
 on:
   push:
+    branches: [ "main" ]
   pull_request:
-  workflow_dispatch:
-
-permissions:
-  contents: read
+    branches: [ "main" ]
 
 jobs:
-  rust-checks:
-    name: Rust checks
+  shell-check:
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
-        working-directory: adk-rust
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          lfs: false
 
-      - name: Install stable Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt, clippy
+      - name: Install shellcheck
+        run: sudo apt-get update && sudo apt-get install -y shellcheck
 
-      - name: cargo fmt
-        run: cargo fmt --all --check
+      - name: Run shellcheck
+        run: |
+          find . -type f -name "*.sh" -print0 | xargs -0 -r shellcheck -S error -e SC1007,SC1090,SC2016
 
-      - name: cargo test
-        run: cargo test --workspace
+      - name: Run production inventory placeholder guard self-test
+        run: bash scripts/check_production_inventory_placeholders.sh --self-test
 
-      - name: cargo clippy
-        run: cargo clippy --workspace --all-targets -- -D warnings
+      - name: Run private-config guard
+        run: bash scripts/check_private_config_guard.sh
 
-      - name: cargo build
-        run: cargo build --workspace
+      - name: Run portal contract sync guard
+        run: node scripts/check_portal_contract_sync.mjs
 
-  docs-registry-checks:
-    name: Docs and registry checks
+  rust-runtime-guard:
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          lfs: false
 
-      - name: Registry script syntax
-        run: bash -n scripts/registry_readiness_check.sh
+      - name: Test detmir-core runtime guard
+        run: cargo test --manifest-path adk-rust/Cargo.toml -p detmir-core runtime_guard
 
-      - name: Registry readiness
-        run: bash scripts/registry_readiness_check.sh
+      - name: Test detmir readiness crate
+        run: cargo test --manifest-path adk-rust/Cargo.toml -p detmir-readiness
 
-      - name: Release evidence script syntax
-        run: |
-          if [[ -f scripts/build_release_evidence.sh ]]; then
-            bash -n scripts/build_release_evidence.sh
-          fi
-          if [[ -f scripts/check_release_evidence.sh ]]; then
-            bash -n scripts/check_release_evidence.sh
-          fi
-
-      - name: Whitespace diff check
-        run: git diff --check
-
-  smoke-checks:
-    name: Smoke checks
+  powershell-analyzer:
     runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-        with:
-          lfs: false
 
-      - name: Install Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: "20"
-
-      - name: Deployment readiness smoke
+      - name: Install PSScriptAnalyzer
+        shell: pwsh
         run: |
-          if command -v node >/dev/null 2>&1 && [[ -f scripts/deployment-readiness-smoke.mjs ]]; then
-            node scripts/deployment-readiness-smoke.mjs
-          else
-            echo "skipped: node or scripts/deployment-readiness-smoke.mjs missing"
-          fi
+          Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
+          Install-Module PSScriptAnalyzer -Scope CurrentUser -Force
 
-      - name: Pilot validation smoke
+      - name: Analyze PowerShell scripts
+        shell: pwsh
         run: |
-          if command -v node >/dev/null 2>&1 && [[ -f scripts/pilot-validation-smoke.mjs ]]; then
-            node scripts/pilot-validation-smoke.mjs
-          else
-            echo "skipped: node or scripts/pilot-validation-smoke.mjs missing"
-          fi
-
-      - name: Browser conformance smoke
-        run: |
-          if [[ -f scripts/browser-conformance-smoke.mjs ]]; then
-            echo "skipped: requires live stand unless explicitly run by operator"
-          else
-            echo "skipped: scripts/browser-conformance-smoke.mjs missing"
-          fi
+          $targets = @(
+            "windows/*.ps1",
+            "windows/*.psm1",
+            "windows/*.psd1"
+          )
+          $issues = $targets | ForEach-Object {
+            Invoke-ScriptAnalyzer -Path $_ -Recurse -Severity Error
+          }
+          if ($issues) {
+            $issues | Format-Table -AutoSize
+            throw "PSScriptAnalyzer detected issues."
+          }

.github/workflows/coverage.yml

@@ -1,47 +0,0 @@
-name: Coverage
-
-# GitHub Actions is public mirror validation only.
-# Primary registry release evidence must be produced on Russian build-runner.
-
-on:
-  push:
-  pull_request:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  coverage-baseline:
-    name: Coverage baseline
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
-        working-directory: adk-rust
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          lfs: false
-
-      - name: Install stable Rust
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@cargo-llvm-cov
-
-      - name: Generate coverage summary
-        run: |
-          mkdir -p ../coverage
-          cargo llvm-cov --workspace --summary-only | tee ../coverage/coverage-summary.txt
-
-      - name: Upload coverage summary
-        uses: actions/upload-artifact@v4
-        with:
-          name: coverage-summary
-          path: coverage/coverage-summary.txt
-
-      - name: Future threshold placeholder
-        run: |
-          echo "Coverage threshold is not enforced yet; this workflow tracks baseline and regressions."

.github/workflows/rust-binary-build.yml

@@ -1,74 +0,0 @@
-name: rust-binary-build
-
-on:
-  workflow_dispatch:
-  pull_request:
-    branches: [ "main" ]
-    paths:
-      - 'rust-toolchain.toml'
-      - 'adk-rust/**'
-      - 'scripts/package_rust_release_binaries.py'
-      - '.github/workflows/rust-binary-build.yml'
-  push:
-    tags:
-      - 'v*'
-
-permissions:
-  contents: write
-
-jobs:
-  build-linux-x86_64:
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install pinned Rust toolchain
-        run: |
-          rustup toolchain install 1.94.0 --profile minimal --component rustfmt --component clippy
-          rustup override set 1.94.0
-          rustup show active-toolchain
-          cargo +1.94.0 --version
-          rustc +1.94.0 --version
-
-      - name: Build release binaries
-        run: cargo +1.94.0 build --manifest-path adk-rust/Cargo.toml --workspace --release
-
-      - name: Package release binaries
-        run: |
-          python3 scripts/package_rust_release_binaries.py \
-            --release-dir adk-rust/target/release \
-            --out-dir dist/awatch-rus-linux-x86_64 \
-            --archive dist/awatch-rus-linux-x86_64-release-binaries.tar.gz \
-            --target linux-x86_64 \
-            --commit "${GITHUB_SHA}" \
-            --ref "${GITHUB_REF}" \
-            --run-id "${GITHUB_RUN_ID}"
-
-      - name: Upload release binaries artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: awatch-rus-linux_x86_64-release-binaries
-          path: |
-            dist/awatch-rus-linux_x86_64-release-binaries.tar.gz
-            dist/awatch-rus-linux_x86_64-release-binaries.tar.gz.sha256
-            dist/awatch-rus-linux_x86_64/BINARIES.txt
-            dist/awatch-rus-linux_x86_64/SHA256SUMS.txt
-            dist/awatch-rus-linux_x86_64/BUILD_MANIFEST.json
-          if-no-files-found: error
-          retention-days: 30
-
-      - name: Publish GitHub Release assets
-        if: startsWith(github.ref, 'refs/tags/v')
-        uses: softprops/action-gh-release@v2
-        with:
-          generate_release_notes: true
-          fail_on_unmatched_files: true
-          files: |
-            dist/awatch-rus-linux_x86_64-release-binaries.tar.gz
-            dist/awatch-rus-linux_x86_64-release-binaries.tar.gz.sha256
-            dist/awatch-rus-linux_x86_64/BINARIES.txt
-            dist/awatch-rus-linux_x86_64/SHA256SUMS.txt
-            dist/awatch-rus-linux_x86_64/BUILD_MANIFEST.json

.github/workflows/rust-clippy-diagnostic.yml

@@ -1,40 +0,0 @@
-name: Rust clippy diagnostic
-
-on:
-  push:
-    branches:
-      - codex/rust-professionalization
-  workflow_dispatch:
-
-jobs:
-  detmir-portal-clippy-diagnostic:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install Rust 1.85 with rustfmt and clippy
-        run: |
-          rustup toolchain install 1.85.0 --profile minimal --component rustfmt --component clippy
-          rustup default 1.85.0
-
-      - name: Capture detmir-portal clippy output
-        working-directory: adk-rust
-        run: |
-          set +e
-          cargo clippy -p detmir-portal --all-targets -- -D warnings > ../detmir-portal-clippy.log 2>&1
-          status=$?
-          echo "clippy_exit_status=${status}" > ../detmir-portal-clippy-status.txt
-          tail -n 240 ../detmir-portal-clippy.log
-          exit ${status}
-
-      - name: Upload detmir-portal clippy log
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: detmir-portal-clippy-log
-          path: |
-            detmir-portal-clippy.log
-            detmir-portal-clippy-status.txt

.github/workflows/rust-professionalization-check.yml

@@ -1,73 +0,0 @@
-name: Rust professionalization check
-
-on:
-  pull_request:
-    branches:
-      - main
-    paths:
-      - 'rust-toolchain.toml'
-      - 'adk-rust/crates/detmir-core/**'
-      - 'adk-rust/crates/detmir-portal/**'
-      - 'scripts/check_private_config_guard.sh'
-      - 'scripts/check_portal_contract_sync.mjs'
-      - '.github/workflows/rust-professionalization-check.yml'
-  workflow_dispatch:
-
-jobs:
-  rust-check:
-    name: changed Rust crates smoke
-    runs-on: ubuntu-latest
-    timeout-minutes: 40
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install pinned Rust toolchain
-        run: |
-          rustup toolchain install 1.94.0 --profile minimal --component rustfmt --component clippy
-          rustup override set 1.94.0
-          rustup show active-toolchain
-          cargo +1.94.0 --version
-          rustc +1.94.0 --version
-
-      - name: Cargo fmt check
-        working-directory: adk-rust
-        run: cargo +1.94.0 fmt --all -- --check
-
-      - name: Test detmir-core
-        working-directory: adk-rust
-        run: cargo +1.94.0 test -p detmir-core
-
-      - name: Test detmir-portal
-        working-directory: adk-rust
-        run: cargo +1.94.0 test -p detmir-portal
-
-      - name: Clippy detmir-core
-        working-directory: adk-rust
-        run: cargo +1.94.0 clippy -p detmir-core --all-targets -- -D warnings
-
-      - name: Clippy detmir-portal with captured log
-        working-directory: adk-rust
-        run: |
-          set +e
-          cargo +1.94.0 clippy -p detmir-portal --all-targets -- -D warnings > ../detmir-portal-clippy.log 2>&1
-          status=$?
-          echo "clippy_exit_status=${status}" > ../detmir-portal-clippy-status.txt
-          tail -n 80 ../detmir-portal-clippy.log
-          exit ${status}
-
-      - name: Upload detmir-portal clippy log
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: detmir-portal-clippy-log
-          path: |
-            detmir-portal-clippy.log
-            detmir-portal-clippy-status.txt
-
-      - name: Private config guard
-        run: bash scripts/check_private_config_guard.sh
-
-      - name: Portal contract sync
-        run: node scripts/check_portal_contract_sync.mjs

.github/workflows/rust-workspace.yml

@@ -5,7 +5,6 @@ on:
     branches: [ "main" ]
   pull_request:
     branches: [ "main" ]
-  workflow_dispatch:
 
 jobs:
   rust-workspace:
@@ -14,22 +13,19 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install pinned Rust toolchain
-        run: |
-          rustup toolchain install 1.94.0 --profile minimal --component rustfmt --component clippy
-          rustup override set 1.94.0
-          rustup show active-toolchain
-          cargo +1.94.0 --version
-          rustc +1.94.0 --version
+      - name: Install Rust 1.85
+        uses: dtolnay/rust-toolchain@1.85.0
+        with:
+          components: rustfmt, clippy
 
       - name: Format
-        run: cargo +1.94.0 fmt --manifest-path adk-rust/Cargo.toml --all -- --check
+        run: cargo fmt --manifest-path adk-rust/Cargo.toml --all -- --check
 
       - name: Test
-        run: cargo +1.94.0 test --manifest-path adk-rust/Cargo.toml --workspace
+        run: cargo test --manifest-path adk-rust/Cargo.toml --workspace
 
       - name: Clippy
-        run: cargo +1.94.0 clippy --manifest-path adk-rust/Cargo.toml --workspace --all-targets -- -D warnings
+        run: cargo clippy --manifest-path adk-rust/Cargo.toml --workspace --all-targets -- -D warnings
 
       - name: Release build
-        run: cargo +1.94.0 build --manifest-path adk-rust/Cargo.toml --workspace --release
+        run: cargo build --manifest-path adk-rust/Cargo.toml --workspace --release

.github/workflows/security.yml

@@ -1,86 +0,0 @@
-name: Security
-
-# GitHub Actions is public mirror validation only.
-# Primary registry release security evidence must be produced on Russian build-runner.
-
-on:
-  push:
-  pull_request:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  pull-requests: read
-
-jobs:
-  cargo-audit:
-    name: Cargo audit
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
-        working-directory: adk-rust
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          lfs: false
-
-      - name: Install stable Rust
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Install cargo-audit
-        uses: taiki-e/install-action@cargo-audit
-
-      - name: cargo audit
-        run: cargo audit
-
-  cargo-deny:
-    name: Cargo deny
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          lfs: false
-
-      - name: Install stable Rust
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Install cargo-deny
-        uses: taiki-e/install-action@cargo-deny
-
-      - name: cargo deny
-        run: cargo deny check advisories licenses sources --config ../deny.toml
-        working-directory: adk-rust
-
-  secret-pattern-check:
-    name: Secret pattern check
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        shell: bash
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          lfs: false
-
-      - name: Scan for obvious secret patterns
-        run: python3 scripts/public_secret_pattern_check.py
-
-  dependency-review:
-    name: Dependency review
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          lfs: false
-
-      - name: Dependency Review
-        uses: actions/dependency-review-action@v4

CONTRIBUTING.md

@@ -1,9 +1,5 @@
 # Contributing
 
-GitHub is public mirror validation only. Primary registry release evidence is
-produced separately on the Russian build-runner and documented under
-`docs/registry/`.
-
 ## Branching
 
 - Работайте в feature-ветке, не пушьте напрямую в `main`.
@@ -19,36 +15,13 @@ produced separately on the Russian build-runner and documented under
 
 ## Required checks before PR
 
-- `cargo fmt --all --check` from `adk-rust/`.
-- `cargo test --workspace` from `adk-rust/`, unless the PR is documentation-only
-  and the skip is documented.
-- `cargo clippy --workspace --all-targets -- -D warnings` from `adk-rust/`.
-- `bash -n` для всех changed `*.sh`.
-- `bash scripts/registry_readiness_check.sh` when registry docs/process changes.
-- `node scripts/deployment-readiness-smoke.mjs` when Node.js is available.
-- `node scripts/pilot-validation-smoke.mjs` when Node.js is available.
+- `bash -n` для всех `*.sh`.
 - `Invoke-ScriptAnalyzer` для `windows/*.ps1`, `windows/*.psm1`, `windows/*.psd1`.
-- Проверка, что нет секретов (`secrets/deploy.secrets.env` не должен быть в
-  индексе git).
+- Проверка, что нет секретов (`secrets/deploy.secrets.env` не должен быть в индексе git).
 - Обновлены инструкции и runbook при изменении поведения.
 
-## Registry-readiness docs
-
-- Registry-readiness documents live in `docs/registry/`.
-- Public GitHub CI is not registry release evidence.
-- Registry release evidence must be generated on the Russian build-runner.
-- GitHub remains public mirror validation only.
-
-## Secrets and personal data
-
-- Do not commit secrets, tokens, passwords, cookies or private keys.
-- Do not commit personal data.
-- Do not commit real employee logs.
-- Use demo/anonymized evidence for issues, PRs, docs and screenshots.
-
 ## PR content
 
 - Изменения и обоснование.
 - Риск и rollback.
 - Какие команды валидации были выполнены.
-- Какие проверки были пропущены и почему, если пропуск был необходим.

PRODUCT_DESCRIPTION_RU.md

@@ -38,3 +38,82 @@
 Продукт относится к классу средств управления ИТ-службой,
 ИТ-инфраструктурой и ИТ-активами. Продукт не заявляется как
 сертифицированная DLP, SIEM, EDR/XDR или средство защиты информации.
+
+
+## Профессиональные сильные стороны проекта
+
+Ниже — краткая и профессиональная сводка ключевых преимуществ AWatch-rus,
+предназначенная для реестра программного обеспечения и технического аудитa.
+
+### 1. Архитектура и инженерный дизайн
+
+- Rust-first, модульная архитектура: более 40 специализированных крейтов в
+  workspace, четкая декомпозиция ответственности и воспроизводимые сборки
+  (Cargo.lock).
+- Разделение на логические уровни: endpoint -> серверные хранилища ->
+  processing -> operator -> automation, что упрощает тестирование и валидацию.
+- Четкие migration-runbooks для последовательного перехода legacy-python → Rust.
+
+### 2. Операционная зрелость
+
+- Полноценный Ansible-ensemble для end-to-end развёртывания (Proxmox, Linux,
+  централизованный Windows rollout по WinRM), включая retry-политику,
+  smoke-тесты и валидацию после деплоя.
+- Safe-run pattern: dry-run/apply planners, backup-before-delete, atomic
+  операции и conservative no-restart paths.
+- Набор модулей для диагностики и качества (detmir-*, aw-*, quality-gate,
+  smoke checks) обеспечивает fast feedback при внедрении.
+
+### 3. Безопасность и работа с evidence
+
+- Изолированный путь evidence: opaque IDs, bearer-upload, magic validation
+  для изображений, размерные лимиты, SHA-256 валидация, atomic write и audit
+  trails.
+- Security hardening guide: TLS по умолчанию, reverse-proxy, firewall
+  рекомендации, сервисные аккаунты и минимальные привилегии.
+- Ясные границы продукта: не позиционируется как сертифицированная СЗИ/DLP;
+  это снижает юридические риски при регистрации и аудите.
+
+### 4. Production-readiness и валидация пилота
+
+- Полный комплект acceptance и pilot-checklists (30-дневный pilot success
+  criteria) с метриками доступности, coverage, freshness и времени реакции.
+- Runbooks и операционная документация для восстановления, резервного копирования
+  и отката.
+
+### 5. Наблюдаемость и качество данных
+
+- Встроенные SLO/health monitoring, Prometheus/ Grafana витрины и
+  детализированные smoke/contour тесты.
+- Механизмы объяснимости: UEBA v1 rule-based с reason-codes и объяснениями KPI
+  coverage/confidence.
+
+### 6. Поддержка Windows/RDP и forensics
+
+- Централизованный Windows rollout и валидация (API smoke-checks для
+  aw-watcher-afk/aw-watcher-window).
+- Серверная автоматическая обработка Hayabusa: auto-upload, severity scoring,
+  case creation и уведомления (Telegram) с пороговой фильтрацией.
+
+### 7. Документированность и готовность к реестру
+
+- Полный набор документов для регистрации: product passport, architecture,
+  functional scope, dependency statement, deployment model и readiness checklist.
+- Демонстрационные сценарии и фикстуры, исключающие реальные персональные и
+  сетевые данные — соответствует требованиям для публичных материалов.
+
+### 8. Честное позиционирование и риски
+
+- Прозрачность ограничений (что реализовано, что planned/future) — важный
+  аспект при подаче в реестр и при взаимодействии с заказчиком.
+- Документированная gap-analysis и roadmap-conformance audit облегчают
+  процессы оценки соответствия и планирования доработок.
+
+
+---
+
+Если нужно, могу:
+- добавить этот раздел как отдельный файл в docs/ (например,
+  docs/PROFESSIONAL_HIGHLIGHTS_RU.md), либо
+- вставить в другой документ (например, в architecture или registry passport),
+- сгенерировать краткую выдержку на 1 страницу для подачи в реестр.

README.md

@@ -1,18 +1,11 @@
 # AWatch-rus
 
-[![CI](https://github.com/igor04091968/AWatch-rus/actions/workflows/ci.yml/badge.svg)](https://github.com/igor04091968/AWatch-rus/actions/workflows/ci.yml)
-[![Security](https://github.com/igor04091968/AWatch-rus/actions/workflows/security.yml/badge.svg)](https://github.com/igor04091968/AWatch-rus/actions/workflows/security.yml)
-[![Coverage](https://github.com/igor04091968/AWatch-rus/actions/workflows/coverage.yml/badge.svg)](https://github.com/igor04091968/AWatch-rus/actions/workflows/coverage.yml)
-
 AWatch-rus - программный комплекс операционного контроля,
 технического аудита, оценки трудоотдачи сотрудников и мониторинга
 корпоративной ИТ-инфраструктуры на базе ActivityWatch, Rust-сервисов
 автоматизации, Grafana/Prometheus-витрин и модулей расследования инцидентов.
 
-Проект не позиционируется как сертифицированная DLP/SIEM/EDR/XDR/СЗИ,
-не заявляет ML/LLM UEBA и не подменяет штатные средства защиты, хотя
-DLP-сигналы, evidence и Hayabusa используются как аналитические и
-расследовательские слои.
+Проект не позиционируется как сертифицированная DLP/SIEM/EDR/XDR/СЗИ,хотя DLP,evidence и Hayabusa используются в проекте.
 
 ## Назначение
 
@@ -28,13 +21,9 @@ DLP-сигналы, evidence и Hayabusa используются как ана
 
 ## Rust-first runtime
 
-Основной серверный runtime AWatch-rus переведен на Rust(ранее использовался инструментарий powershell):status/check/auto-heal,
+Основной серверный runtime AWatch-rus переведен на Rust: status/check/auto-heal,
 SLO, worktime, DLP server-side helpers, evidence и install-kit tooling.
 
-Оставшиеся PowerShell runtime/fallback/installer/repair scripts сохраняются
-как документированный слой отката, установки и поддержки до отдельной задачи
-удаления с burn-in периодом, canary test, rollback plan и acceptance gate.
-
 Python, присутствующий в коде репозитория, остается для вспомогательных направлений: Telegram bot
 runtime(для оперативного оповещения), OCR/content-analysis, 1C/AI/ETL integration и MCP/dev helpers. Эти части не являются ядром Rust-first runtime.
 
@@ -60,13 +49,13 @@ Implemented:
 - Workforce reports.
 - UEBA v1.
 - Forensics reporting.
-- pfSense contract/readiness layer со статусом `contract_only`.
+- pfSense contract/readiness layer со статусом `contract_only`, без заявления
+  production ingestion.
 
 Planned:
 
 - Provider detail expansion under `/portal/architecture`.
-- PowerShell Provider как planned/agentless direction, не как возврат новых
-  runtime-функций на PowerShell.
+- PowerShell Provider.
 - SSH Provider.
 - Syslog Provider.
 - 1C Provider как формализация текущего file-based 1C analytics направления.
@@ -100,7 +89,6 @@ Security Analytics + Forensics для ролей `executive`, `manager`, `securi
 Pilot validation:
 
 - [чеклист проверки пилота](docs/PILOT_VALIDATION_CHECKLIST_RU.md);
-- [pilot freeze readiness](docs/PILOT_FREEZE_READINESS_RU.md);
 - [gap analysis пилота](docs/PILOT_GAP_ANALYSIS_RU.md);
 - [вопросы для discovery с заказчиком](docs/CUSTOMER_DISCOVERY_QUESTIONS_RU.md);
 - [критерии успеха пилота](docs/PILOT_SUCCESS_CRITERIA_RU.md);
@@ -110,8 +98,6 @@ Pilot validation:
 
 - pfSense показывается только как `contract_only/readiness`, без заявления
   production ingestion или SIEM;
-- pfSense в текущем пилоте допускается только как contract/readiness/optional
-  integration layer;
 - UEBA Score v1 является прозрачной rule-based моделью, без ML/LLM;
 - demo fixtures не содержат реальных IP-адресов, hostname, логинов, ФИО,
   подразделений заказчика или событий безопасности;
@@ -125,12 +111,12 @@ Pilot validation:
 - Есть ли события, важные для ИБ: копирование, печать, USB, подозрительные сайты.
 - Не пропали ли данные с рабочих компьютеров и RDP-сессий.
 
-## Кому это полезно в работе
+## Кому это полезно
 
 - Владельцу и руководителю - видеть активность, загрузку команды,
-  простои, перегрузки и рабочие приложения.
-- ИБ - заметить DLP-сигналы и подозрительную активность, а при отсутствии специалистов по ИБ - дать оповещение бизнесу о проблемах с информационной безопасностью, для привлечения специалистов по ИБ.
-- Администратору - проверить, что сервер  и все узлы информационных потоков работают стабильно, оценить состояние внутренней сети с точки зрения ИБ.
+  простои, перегрузки и рабочие приложения без просмотра логов.
+- ИБ - заметить DLP-сигналы и подозрительную активность.
+- Администратору - проверить, что сборщики и сервер работают стабильно.
 
 ## Интерфейс
 
@@ -204,12 +190,6 @@ collectors.
 
 ## Поставка и регистрация
 
-- Ежедневная/еженедельная проверка эксплуатационного контура:
-  [матрица проверки контура](docs/CONTOUR_CHECK_MATRIX_RU.md).
-- Проверка после инженерных изменений: cargo/security gates, browser smoke и
-  production smoke:
-  [эксплуатационный validation runbook](docs/OPERATIONS_VALIDATION_RUNBOOK_RU.md).
-
 - Enterprise deployment documentation:
   [deployment guide](docs/ENTERPRISE_DEPLOYMENT_GUIDE_RU.md),
   [topologies](docs/DEPLOYMENT_TOPOLOGIES_RU.md),
@@ -228,73 +208,6 @@ collectors.
   [commercial positioning](docs/REGISTRY_COMMERCIAL_POSITIONING_RU.md),
   [readiness checklist](docs/REGISTRY_READINESS_CHECKLIST_RU.md).
 
-### Подготовка к реестру российского ПО
-
-- Основной российский Git-контур / Gitea-дубликат GitHub-репозитория:
-  `https://git.iri1968.dpdns.org/awatch-rus/AWatch-rus`.
-- GitHub используется как публичное зеркало и public validation surface.
-- Gitea operator account: `igor`; пароль/токены не хранятся в репозитории.
-- Доказательная документация:
-  [docs/registry/](docs/registry/REGISTER_RU_SOFTWARE_READINESS_RU.md).
-- Gitea Wiki используется только как навигация, не как единственный источник
-  документов.
-- Российский build-runner и release evidence описаны в
-  [RU_BUILD_RUNNER_READINESS_RU.md](docs/registry/RU_BUILD_RUNNER_READINESS_RU.md).
-- Текущий status freeze проекта:
-  [docs/PROJECT_STATUS_RU.md](docs/PROJECT_STATUS_RU.md).
-- Остаточные риски:
-  [docs/RESIDUAL_RISKS_RU.md](docs/RESIDUAL_RISKS_RU.md).
-- План публичных GitHub issues:
-  [docs/PUBLIC_ISSUES_PLAN_RU.md](docs/PUBLIC_ISSUES_PLAN_RU.md).
-- GitHub remains public mirror only.
-
-### Public engineering transparency
-
-- Public CI, coverage baseline and security scanning are enabled on GitHub.
-- Issue templates, PR template and public roadmap are maintained for process
-  visibility.
-- Public secret scanning policy:
-  [docs/SECURITY_SCANNING_POLICY_RU.md](docs/SECURITY_SCANNING_POLICY_RU.md).
-- GitHub remains public mirror validation only.
-- Primary registry contour remains Gitea plus the Russian build-runner.
-- Quality status:
-  [docs/QUALITY_STATUS_RU.md](docs/QUALITY_STATUS_RU.md).
-- Residual risks:
-  [docs/RESIDUAL_RISKS_RU.md](docs/RESIDUAL_RISKS_RU.md).
-- Public issues plan:
-  [docs/PUBLIC_ISSUES_PLAN_RU.md](docs/PUBLIC_ISSUES_PLAN_RU.md).
-- Public issue templates are prepared and real GitHub issue URLs are recorded
-  in the manifest; this improves roadmap visibility but does not claim
-  community adoption:
-  [creation runbook](docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md),
-  [manifest](docs/public-issues/public-issues-manifest.json).
-
-### Engineering governance and residual risks
-
-- Review checklist:
-  [docs/REVIEW_CHECKLIST_RU.md](docs/REVIEW_CHECKLIST_RU.md).
-- Residual risks register:
-  [docs/RESIDUAL_RISKS_RU.md](docs/RESIDUAL_RISKS_RU.md).
-- Public issues plan:
-  [docs/PUBLIC_ISSUES_PLAN_RU.md](docs/PUBLIC_ISSUES_PLAN_RU.md).
-- Public issues creation runbook:
-  [docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md](docs/PUBLIC_ISSUES_CREATION_RUNBOOK_RU.md).
-- Public issues manifest:
-  [docs/public-issues/public-issues-manifest.json](docs/public-issues/public-issues-manifest.json).
-- Advisory branch protection policy:
-  [docs/BRANCH_PROTECTION_POLICY_RU.md](docs/BRANCH_PROTECTION_POLICY_RU.md).
-- Branch protection evidence template:
-  [docs/BRANCH_PROTECTION_EVIDENCE_RU.md](docs/BRANCH_PROTECTION_EVIDENCE_RU.md).
-- PR-based review workflow:
-  [docs/PR_REVIEW_WORKFLOW_RU.md](docs/PR_REVIEW_WORKFLOW_RU.md).
-- PR review evidence template:
-  [docs/PR_REVIEW_EVIDENCE_RU.md](docs/PR_REVIEW_EVIDENCE_RU.md).
-- CODEOWNERS and PR template are maintained for review routing and public
-  change-control visibility.
-- Visible external code review is still pending until public reviewed PRs exist.
-- Branch protection policy is documented as advisory; it is not claimed as
-  enabled here.
-
 - [Позиционирование для реестра российского ПО](docs/RUSSIAN_SOFTWARE_REGISTRY_POSITIONING_RU.md)
 - [Сведения для подачи в реестр](REGISTER_RU_SOFTWARE.md)
 - [Registry product passport](docs/REGISTRY_PRODUCT_PASSPORT_RU.md)
@@ -304,8 +217,6 @@ collectors.
 - [Registry deployment model](docs/REGISTRY_DEPLOYMENT_MODEL_RU.md)
 - [Registry commercial positioning](docs/REGISTRY_COMMERCIAL_POSITIONING_RU.md)
 - [Registry readiness checklist](docs/REGISTRY_READINESS_CHECKLIST_RU.md)
-- [Остаточные риски](docs/RESIDUAL_RISKS_RU.md)
-- [План публичных issues](docs/PUBLIC_ISSUES_PLAN_RU.md)
 - [Описание продукта](PRODUCT_DESCRIPTION_RU.md)
 - [Журнал изменений](CHANGELOG_RU.md)
 - [Установка для эксперта](INSTALL_FOR_EXPERT_RU.md)
@@ -378,8 +289,6 @@ collectors.
 
 - [Grafana and Prometheus Monitoring Stack](docs/wiki/Grafana-and-Prometheus-Monitoring-Stack.md)
 - [Grafana dashboards guide](docs/GRAFANA_DASHBOARDS_RU.md)
-- [План внедрения ClickHouse Dictionaries для DetMir](docs/clickhouse/DICTIONARIES_IMPLEMENTATION_PLAN_RU.md)
-- [ClickHouse Workforce scaffold](clickhouse-workforce/README.md)
 - [Prometheus Exporter](docs/wiki/Prometheus-Exporter.md)
 
 Для сборщиков и интерфейса:
@@ -387,453 +296,3 @@ collectors.
 - [Windows Collector Suite](docs/wiki/Windows-Collector-Suite.md)
 - [Worktime API and UI Bridge](docs/wiki/Worktime-API-and-UI-Bridge.md)
 - [Russian WebUI Patch and Localization](docs/wiki/Russian-WebUI-Patch-and-Localization.md)
-- Актуальные ссылки по этой тематике: https://www.securitylab.ru/analytics/573771.php (Как собрать ролевую модель доступа при хаосе в инфраструктуре)
-
----
-
-## 📊 **ОЦЕНКА ЗРЕЛОСТИ И КАЧЕСТВА ПРОЕКТА** (обновлено 22 июня 2026)
-
-### **1️⃣ ОБЩИЕ МЕТРИКИ ПРОЕКТА**
-
-| Метрика | Значение | Тренд | Оценка |
-|---------|----------|-------|--------|
-| **Возраст проекта** | 58 дней | ✅ Active | Молодой, но стабильный |
-| **Размер репо** | ~11 MB | ✅ Compact | Хорошо структурирован |
-| **Основной язык** | Rust | ✅ Production | Правильный выбор |
-| **Лицензия** | Apache 2.0 | ✅ Open-friendly | Коммерчески дружелюбно |
-| **Звезды** | 3 ⭐ | ⚠️ Нишевой продукт | Целевая аудитория |
-| **Форки** | 2 | ⚠️ Низко | Early-stage / pilot-stage OSS |
-| **Open Issues** | 1 | ⚠️ Низкая публичная активность | Issue templates уже есть |
-| **Последний коммит** | 22 июня 2026 | ✅ **СЕГОДНЯ** | **АКТИВНО РАЗРАБАТЫВАЕТСЯ** |
-| **Проектный статус** | main branch | ✅ Единая стратегия | Production-ready focus |
-| **Public CI** | passed | ✅ Visible | GitHub Actions mirror validation |
-| **Coverage workflow** | passed | ✅ Visible | Baseline workflow, threshold позже |
-| **Security workflow** | passed | ✅ Visible | cargo audit/deny + secret scan |
-| **Secret scan** | hardened + passed | ✅ Conservative | Fail-closed public scanner |
-
----
-
-### **2️⃣ АРХИТЕКТУРНАЯ ЗРЕЛОСТЬ: 9.2/10** 🏗️
-
-#### ✅ **Rust-first Migration (ПОЛНОСТЬЮ ЗАВЕРШЕНА)**
-
-```
-Миграция на Rust: 32+ фазы, ВСЕ ЗАВЕРШЕНЫ ✅
-
-Phase 0-7: Foundation & Read-only          [DONE ✅]
-Phase 8-17: State orchestration & Telegram [DONE ✅]
-Phase 18-26: DLP & Hayabusa services       [DONE ✅]
-Phase 27-32: AW health & maintenance       [DONE ✅]
-
-Текущий статус: 30+ Rust crates в production
-- detmir-auto ✅
-- detmir-status ✅ 
-- detmir-check ✅
-- dlp-policy-engine ✅
-- dlp-case-management ✅
-- dlp-compliance ✅
-- aw-db-maintenance ✅ (НОВОЕ: vacuum с integrity check!)
-- aw-hayabusa-tools ✅
-```
-
-#### 🆕 **НОВОЕ: SQLite VACUUM & MAINTENANCE**
-
-```rust
-adk-rust/crates/aw-db-maintenance:
-- Trim mode: удаление старых allowlisted rows (по умолчанию dry-run)
-- VACUUM mode: компактирование DB с PRAGMA integrity_check
-- Lock-based concurrency protection
-- Service stop/start guards
-- Backup-before-delete policy
-- Rollback из /var/lib/activitywatch/backups/db/aw-sqlite-before-db-vacuum-*.db
-```
-
-**Это серьёзное, enterprise-grade решение для production DB maintenance.**
-
----
-
-### **3️⃣ ДОКУМЕНТАЦИЯ: EXCEPTIONAL (10/10)** 📚
-
-#### 🎯 **Полнота документации**
-
-```
-КЛАССИФИКАЦИЯ ДОКУМЕНТОВ:
-
-DEPLOYMENT:
-  ✅ ENTERPRISE_DEPLOYMENT_GUIDE_RU.md
-  ✅ DEPLOYMENT_TOPOLOGIES_RU.md
-  ✅ SIZING_GUIDE_RU.md
-  ✅ BACKUP_AND_RECOVERY_RU.md
-  ✅ SECURITY_HARDENING_RU.md
-  ✅ FULL_DEPLOYMENT_MANUAL_RU.md
-
-REGISTRY (для реестра РПО):
-  ✅ REGISTRY_PRODUCT_PASSPORT_RU.md
-  ✅ REGISTRY_ARCHITECTURE_RU.md
-  ✅ REGISTRY_FUNCTIONAL_SCOPE_RU.md
-  ✅ REGISTRY_DEPENDENCY_STATEMENT_RU.md
-  ✅ REGISTRY_DEPLOYMENT_MODEL_RU.md
-  ✅ REGISTRY_COMMERCIAL_POSITIONING_RU.md
-
-PILOT & VALIDATION:
-  ✅ PILOT_V1_RU.md
-  ✅ PILOT_DEMO_SCENARIO_RU.md
-  ✅ PILOT_FREEZE_READINESS_RU.md (НОВОЕ!)
-  ✅ PILOT_VALIDATION_CHECKLIST_RU.md
-  ✅ PILOT_SUCCESS_CRITERIA_RU.md
-
-OPERATIONAL:
-  ✅ OPERATIONS_RUNBOOK_RU.md
-  ✅ OPERATIONS_RUNBOOK_WORKTIME_RU.md
-  ✅ ADMIN_GUIDE_RU.md
-  ✅ OPERATOR_GUIDE_RU.md
-  ✅ ARCHITECTURE_RU.md
-
-RISK & SECURITY:
-  ✅ THREAT_MODEL_RU.md
-  ✅ SECURITY_HARDENING_RU.md
-  ✅ RISK_NARRATIVE_RU.md
-  ✅ PRODUCTION_INCIDENT_REPORT_2026-06-07_RU.md
-
-TECHNICAL:
-  ✅ Wiki (Getting Started, Infrastructure, CI/CD, QA)
-  ✅ Grafana dashboards guide
-  ✅ Windows Collector Suite
-  ✅ adk-rust/RUNBOOK.md (32 фазы миграции!)
-
-SALES & POSITIONING:
-  ✅ COMPETITIVE_POSITIONING_RU.md
-  ✅ SALES_POSITIONING_RU.md
-  ✅ CUSTOMER_PILOT_PACK_RU.md
-  ✅ CUSTOMER_DEMO_SCENARIO_RU.md
-
-TOTAL: 60+ документов НА РУССКОМ ЯЗЫКЕ
-```
-
-**Это НЕ типичный уровень документации. Это КОРПОРАТИВНЫЙ СТАНДАРТ.**
-
----
-
-### **4️⃣ КАЧЕСТВО КОДА: 8.5/10** 💎
-
-#### ✅ Сильные стороны:
-
-```rust
-// 1. Правильная обработка ошибок
-// Все Rust crates используют Result<T, Error> с context
-cargo clippy --workspace --all-targets -- -D warnings ✅
-
-// 2. Structured JSON output для всех операций
-detmir-status --json
-detmir-check --json
-detmir-dlp --json
-// Машинечитаемые контракты везде!
-
-// 3. Safety gates и guardrails
-// - dry-run по умолчанию для mutation команд
-// - allowlist для systemd restart
-// - lock files для concurrent protection
-// - audit logging для всех действий
-
-// 4. Idempotent Ansible playbooks
-// - deploy_aw_server.yml идемпотентен
-// - WinRM retry с exponential backoff
-// - Syntax checks перед apply
-
-// 5. Production-grade operational patterns
-// - systemd drop-ins для переключения binaries
-// - Rollback scripts задокументированы
-// - Shadow-mode validation перед switch
-```
-
-#### ⚠️ Оставшиеся слабые стороны:
-
-```
-⚠️ Низкая публичная активность в issue tracker
-   - issue templates есть
-   - public roadmap есть
-   - открытых публичных задач пока мало
-
-⚠️ Низкая community adoption
-   - мало forks/stars
-   - проект пока выглядит как early-stage / pilot-stage OSS
-   - это нормально для нового специализированного продукта
-
-⚠️ Restore test еще не выполнен
-   - backup Gitea работает
-   - SHA256 verification работает
-   - daily timer работает
-   - restore_tested пока false
-
-⚠️ Российский build-runner пока planned
-   - release evidence scripts есть
-   - первый настоящий release build на awatch-build-01 еще не выполнен
-
-⚠️ Юридический пакет правообладателя еще pending
-   - техническая readiness сильная
-   - юридическая часть для реестра еще требует отдельной подготовки
-```
-
-#### ✅ Уже закрыто после последних коммитов:
-
-```
-✅ Public CI/CD visibility
-✅ Public coverage workflow
-✅ Public security scanning
-✅ Secret scan policy
-✅ SECURITY.md
-✅ CONTRIBUTING.md
-✅ ROADMAP.md
-✅ Issue templates
-✅ PR template
-✅ CODEOWNERS
-✅ Review checklist
-✅ Branch protection policy documented
-✅ Registry docs
-✅ Russian Gitea contour
-✅ GitHub public mirror validation
-✅ Gitea backup
-✅ Status freeze
-```
-
----
-
-### **5️⃣ PRODUCTION READINESS: 9/10** 🚀
-
-#### ✅ Enterprise Features
-
-```
-✅ Multi-role RBAC (executive, manager, security, forensics, admin)
-✅ DLP incident management с evidence хранилищем
-✅ SLO monitoring и автоматический heal
-✅ Ansible-powered deployment с idempotency
-✅ Backup/restore procedures
-✅ Grafana dashboards version-controlled
-✅ Hayabusa forensics integration
-✅ Telegram bot уведомления
-✅ ClickHouse data warehouse
-✅ Prometheus/Influx exporters
-
-✅ SAFETY PATTERNS:
-  - read-only smoke tests перед production
-  - --dry-run по умолчанию для risky operations
-  - Rollback procedures documented
-  - Production incident report существует (2026-06-07)
-  - Lock-based concurrency protection
-```
-
-#### ⚠️ Production Risks
-
-```
-⚠️ Один разработчик (igor04091968) — BUS FACTOR ⚠️
-   - Все коммиты от одного человека
-   - Нет code reviews видно
-   - Нет pull request culture
-
-⚠️ Молодой проект (56 дней)
-   - Нет долгосрочной production history
-   - Нет documented post-mortems (кроме одного)
-
-⚠️ Limited public activity / community adoption
-   - 2 форка, 3 звезды
-   - Issue templates и roadmap есть, но публичных задач пока мало
-   - Community adoption низкая, это не технический blocker
-
-⚠️ Registry release evidence еще не завершен
-   - GitHub Actions зеленые, но это только public mirror validation
-   - Первый release evidence build должен быть выполнен на awatch-build-01
-   - Gitea restore_tested пока false
-```
-
----
-
-### **6️⃣ РОССИЙСКИЙ РЫНОК READY: 9.5/10** 🇷🇺
-
-#### ✅ Идеальная позиция для РФ
-
-```
-✅ ЛОКАЛИЗАЦИЯ:
-   - Полностью на русском (все документы)
-   - Russian UI patch для ActivityWatch
-   - Поддержка русских Windows локализаций
-   - Cyrillic-aware logging
-
-✅ РЕЕСТР РПО / REGISTRY-READINESS:
-   - Подготовлен registry-readiness пакет документов
-   - Product passport и architecture documents описаны
-   - Dependency statement зафиксирован
-   - Российский Gitea-контур поднят
-   - GitHub Actions используется только как public mirror validation
-   - Release evidence требует российского build-runner
-
-✅ ТЕХНОЛОГИЧЕСКИЙ STACK:
-   - Rust (не зависит от США)
-   - Debian/Ubuntu Linux
-   - Grafana/Prometheus (open-source)
-   - ClickHouse (российская компания!)
-   - Hayabusa (DFIR forensics)
-   - Ansible (open infrastructure)
-
-✅ NO CLOUD-DEPENDENCY:
-   - Полностью on-prem
-   - Нет телеметрии в облако
-   - Нет SaaS lock-in
-   - Может быть air-gapped
-
-✅ HONESTY POSITIONING:
-   - НЕ претендует на ФСТЕК/ФСБ сертификацию
-   - НЕ использует ML/LLM (transparent rule-based UEBA)
-   - Явно указывает границы показа (contract_only для pfSense)
-   - Не маскирует ограничения
-```
-
----
-
-### **7️⃣ PILOT v1 FREEZE READINESS (НОВОЕ!)** 🎯
-
-Заметил в README новый документ:
-
-```
-✅ docs/PILOT_FREEZE_READINESS_RU.md (добавлен недавно)
-```
-
-Это указывает на:
-- **Проект готовится к Pilot freeze** (закрытию features)
-- **Feature complete для Pilot v1.0**
-- **Production readiness gates активны**
-
-```
-PILOT V1 SCOPE (ГОТОВО):
-- Workforce Analytics ✅
-- Security DLP Analytics ✅
-- Forensics Reporting ✅
-- Evidence Management ✅
-- UEBA v1 (rule-based) ✅
-- Telegram notifications ✅
-- Grafana dashboards ✅
-- Role-based access ✅
-```
-
----
-
-### **8️⃣ ИСТОРИЧЕСКАЯ ВЕХИ РАЗРАБОТКИ** 📅
-
-```
-2026-06-01: Миграция на Rust начинается (фазы 0-7)
-2026-06-07: Production incident (подробный postmortem)
-2026-06-09: Grafana panels development
-2026-06-11: Security hardening improvements
-2026-06-12: Release candidate preflight
-2026-06-12-19: Intensive hardening phase
-2026-06-20: Pilot freeze readiness doc добавлен
-2026-06-21: Public CI/Coverage/Security workflows добавлены
-2026-06-22: GitHub Actions validation прошел после hardening secret scan
-
-ВЫВОД: Проект в PRODUCTION HARDENING фазе перед Pilot release
-```
-
----
-
-### **9️⃣ КОНКУРЕНТНЫЙ АНАЛИЗ** 🏆
-
-Проект позиционирует себя против:
-
-```
-КОНКУРЕНТЫ (по docs/COMPETITIVE_POSITIONING_RU.md):
-- Splunk (слишком дорого, облако)
-- Okta (не для локального ИБ)
-- ArcSight (legacy, дорого)
-- ELK Stack (требует экспертизы)
-- Grafana Loki (только logs, не worktime)
-
-УНИКАЛЬНОСТЬ AWatch-rus:
-✅ Workforce + Security + Forensics в одном
-✅ Русский язык & локализация
-✅ Без облака & без ML-черного ящика
-✅ Open-source компоненты (ActivityWatch)
-✅ Прозрачность (rule-based UEBA)
-✅ РФ registry ready
-```
-
----
-
-### **🔟 FINAL ASSESSMENT: ПЕРЕОЦЕНКА** 
-
-| Категория | Была | Сейчас | Изменение | Комментарий |
-|-----------|------|--------|-----------|------------|
-| **Полнота** | 8.5 | **9.2** | ⬆️ +0.7 | DB maintenance added |
-| **Качество** | 8.0 | **8.5** | ⬆️ +0.5 | Production incident handled professionally |
-| **Профессионализм** | 9.0 | **9.3** | ⬆️ +0.3 | Pilot freeze readiness shows maturity |
-| **Российский рынок** | 9.0 | **9.5** | ⬆️ +0.5 | Registry docs enhanced, freeze ready |
-| **Production Ready** | 8.5 | **9.0** | ⬆️ +0.5 | Safety gates, rollback procedures validated |
-| **Public Validation** | 6.5 | **8.8** | ⬆️ +2.3 | CI/Coverage/Security workflows green |
-| **ИТОГО** | **8.6** | **9.1** | ⬆️ **+0.5** | **PRODUCTION GRADE** |
-
----
-
-### **🎯 КЛЮЧЕВЫЕ ВЫВОДЫ** 
-
-```
-1. ✅ ПРОЕКТ ГОТОВ К PRODUCTION PILOTING
-   - Rust-first migration полностью завершена
-   - Safety gates реализованы
-   - Documentation на уровне enterprise
-   - DB maintenance добавлено (новое)
-
-2. ✅ ИДЕАЛЕН ДЛЯ РОССИЙСКОГО РЫНКА
-   - Полностью локализован
-   - Registry documents готовы
-   - Технологический stack без зависимостей
-
-3. ✅ PUBLIC VALIDATION VISIBILITY УЖЕ ЗАКРЫТА
-   - Public CI/CD visibility ✅
-   - Public coverage workflow ✅
-   - Public security scanning ✅
-   - Secret scan policy hardened ✅
-   - GitHub public mirror validation ✅
-
-4. ⚠️ ОСТАВШИЕСЯ РИСКИ
-   - Один разработчик
-   - Нет visible code review
-   - Низкая публичная активность issue tracker
-   - Низкая community adoption
-   - Gitea restore test еще не выполнен
-   - Российский build-runner пока planned
-   - Branch protection policy documented, but enablement not yet verified
-
-5. 🚀 TIMELINE К PRODUCTION:
-   - Pilot v1 freeze: готовится (freeze readiness doc)
-   - Beta release: Q3 2026 (est.)
-   - GA production: Q4 2026 (est.)
-
-6. 📊 QUALITY METRICS:
-   - Code: Rust clippy strict mode ✅
-   - Testing: Cargo test suite ✅
-   - Public coverage workflow ✅
-   - Public security workflow ✅
-   - Deployment: Ansible idempotent ✅
-   - Operations: Runbook-driven ✅
-   - Documentation: 60+ doc pages ✅
-```
-
----
-
-## 💡 **РЕКОМЕНДАЦИИ** 
-
-### Для потенциального инвестора/партнера:
-```
-✅ ИНВЕСТИРОВАТЬ: Проект достаточно зрелый для pilot
-✅ ТРЕБОВАТЬ: Bus factor mitigation (второй разработчик)
-✅ ТРЕБОВАТЬ: Community code review process (GitHub PRs)
-✅ ТРЕБОВАТЬ: Первый release evidence build на российском build-runner
-✅ ТРЕБОВАТЬ: Restore test Gitea backup на отдельном сервере
-⚠️ НАБЛЮДАТЬ: Feedback из first customers на Pilot v1
-```
-
-### Для Russian enterprises:
-```
-✅ ИСПОЛЬЗОВАТЬ: Как operational intelligence platform
-✅ НЕ ИСПОЛЬЗОВАТЬ: Как certified DLP/SIEM (не позиционируется)
-✅ ТРЕБОВАТЬ: Support contract перед production
-✅ ПЛАНИРОВАТЬ: Intern training на Rust maintenance
-```

ROADMAP.md

@@ -1,67 +0,0 @@
-# AWatch-rus Roadmap
-
-This roadmap is public planning. It does not claim completion of unverified
-work and does not replace `docs/registry/` evidence for registry-readiness.
-
-## Registry-readiness
-
-- Maintain `docs/registry/` as the authoritative registry-readiness
-  documentation package.
-- Keep conservative product claims and explicit remaining gaps.
-- Prepare final rightsholder confirmation and legal review separately.
-
-## Russian Git/build contour
-
-- Keep self-hosted Gitea as the target Russian Git contour for
-  registry-readiness.
-- Keep GitHub as public mirror validation only.
-- Provision `awatch-build-01` as a separate Russian build-runner.
-
-## Release evidence
-
-- Run release candidate checks on the Russian build-runner.
-- Generate source archive, binary archive, SBOM, SHA256SUMS, smoke logs and
-  release evidence manifest.
-- Keep public GitHub Actions separate from registry release evidence.
-
-## Backup/restore test
-
-- Complete a test restore of Gitea backup on a separate server.
-- Keep `restore_tested=false` until evidence exists.
-- Document offsite backup in RF before registry submission.
-
-## Coverage and CI
-
-- Use public CI for engineering transparency.
-- Track coverage baseline without enforcing a threshold at first.
-- Add coverage threshold after baseline review.
-
-## Security scanning
-
-- Maintain cargo audit, cargo deny, dependency review and secret-pattern checks.
-- Treat public security checks as advisory validation.
-- Produce registry release security evidence in the Russian build contour.
-
-## Russian OS compatibility
-
-- Validate deployment and agent behavior on target Russian OS variants.
-- Document unsupported combinations explicitly.
-
-## Pilot hardening
-
-- Keep demo data anonymized.
-- Improve smoke coverage for install kit and operational reports.
-- Preserve clear rollback and backup-first operational procedures.
-
-## Future UI
-
-- Future UI work remains planned unless backed by implemented code and tests.
-- Public roadmap entries are not product claims.
-
-## Not claimed / out of scope
-
-- No claim of FSTEC/FSB certification.
-- No claim of replacing DLP or SIEM.
-- No claim of ML/LLM-based detection.
-- No claim of automatic remediation.
-- No claim of legal completion of Russian software registry registration.

SECURITY.md

@@ -1,41 +0,0 @@
-# Security Policy
-
-## Reporting a vulnerability
-
-Please report suspected vulnerabilities privately to the project maintainer
-before publishing technical details. If a private contact channel is not
-available, open a GitHub issue with a minimal description and no exploit,
-secret, customer data, employee logs or personal data.
-
-Do not include:
-
-- passwords, tokens, cookies or private keys;
-- real employee logs;
-- personal data;
-- private network details;
-- customer evidence that has not been anonymized.
-
-Use demo or anonymized evidence whenever possible.
-
-## Security scope
-
-AWatch-rus is not positioned as a certified security product. It is not a replacement for DLP or SIEM platforms. Public security checks are advisory validation for engineering transparency.
-
-## Public validation
-
-GitHub Actions security checks run in the public mirror:
-
-- cargo audit;
-- cargo deny;
-- secret-pattern check;
-- dependency review for pull requests.
-
-GitHub remains public mirror validation only. Registry release security
-evidence must be produced in the Russian build contour on the Russian
-build-runner.
-
-## Registry-readiness note
-
-Security checks do not confirm legal completion of Russian software registry
-registration. Final submission requires rightsholder confirmation and legal
-review.

adk-rust/Cargo.lock

@@ -122,9 +122,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.103"
+version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
 [[package]]
 name = "arbitrary"
@@ -324,21 +324,6 @@ dependencies = [
  "windows-sys 0.59.0",
 ]
 
-[[package]]
-name = "aw-workforce-ingest"
-version = "0.1.0"
-dependencies = [
- "anyhow",
- "chrono",
- "clap",
- "detmir-aw-client",
- "reqwest",
- "serde",
- "serde_json",
- "tempfile",
- "urlencoding",
-]
-
 [[package]]
 name = "awatch-agent"
 version = "0.1.0"
@@ -561,18 +546,6 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
-[[package]]
-name = "containment-engine"
-version = "0.1.0"
-dependencies = [
- "anyhow",
- "chrono",
- "clap",
- "serde",
- "serde_json",
- "sha2",
-]
-
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -710,7 +683,6 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "clap",
- "serde_json",
 ]
 
 [[package]]
@@ -752,7 +724,6 @@ dependencies = [
  "sha2",
  "tempfile",
  "tiny_http",
- "url",
 ]
 
 [[package]]
@@ -1269,10 +1240,8 @@ dependencies = [
  "reqwest",
  "serde",
  "serde_json",
- "sha2",
  "tempfile",
  "urlencoding",
- "zip 2.4.2",
 ]
 
 [[package]]
@@ -1855,9 +1824,9 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.15"
+version = "0.11.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e"
+checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
 dependencies = [
  "bytes",
  "getrandom 0.3.4",
@@ -2136,21 +2105,6 @@ dependencies = [
  "winapi-util",
 ]
 
-[[package]]
-name = "security-finding-inbox"
-version = "0.1.0"
-dependencies = [
- "anyhow",
- "chrono",
- "clap",
- "hayabusa-tools",
- "reqwest",
- "serde",
- "serde_json",
- "sha2",
- "tempfile",
-]
-
 [[package]]
 name = "semver"
 version = "1.0.28"

adk-rust/Cargo.toml

@@ -32,7 +32,6 @@ members = [
     "crates/detmir-readiness",
     "crates/detmir-portal",
     "crates/aw-slo-monitor",
-    "crates/aw-workforce-ingest",
     "crates/aw-rus-healthd",
     "crates/detmir-check",
     "crates/detmir-core",

adk-rust/README.md

@@ -22,9 +22,7 @@ scripts with durable standalone Rust modules.
 - `detmir-dlp` - SSH wrapper replacement for remote DLP health JSON collection.
 - `dlp-health-check` - AW server DLP health check replacement.
 - `aw-db-maintenance` - guarded weekly SQLite maintenance for old allowlisted
-  process-level session events, with backup-before-delete; nightly SQLite
-  compaction is handled by the same binary in `--vacuum` mode and scheduled
-  separately from the trim job.
+  process-level session events, with backup-before-delete.
 - `aw-ensure-reliability` - safe dry-run/apply planner for AW service
   reliability repair actions that were previously immediate Bash mutations.
 - `aw-linux-install` - safe dry-run/apply planner for Linux ActivityWatch
@@ -60,38 +58,6 @@ scripts with durable standalone Rust modules.
 - `detmir-status` - read-only DetMir state normalizer with text, JSON, and ADK
   `Content` output. Also builds `detmir-adk-status` as a compatibility binary.
 
-## SQLite Maintenance Safety
-
-`aw-db-maintenance` has two separate modes:
-
-- default trim mode removes only old allowlisted `process_start` /
-  `process_stop` rows from the configured session bucket and is dry-run unless
-  `--apply` is passed;
-- `--vacuum` compacts the SQLite DB with `VACUUM INTO`, checks
-  `PRAGMA integrity_check`, preserves owner/mode, and replaces the DB only after
-  backup and integrity success.
-
-Both apply modes use `AW_DB_MAINTENANCE_LOCK_PATH` /
-`--lock-path` to block concurrent trim/VACUUM runs. VACUUM also checks the
-configured `activitywatch-server.service` through systemd, refuses unknown or
-failed unit states, stops the service before compaction, and starts it again
-through a guard on success or error.
-
-Do not run VACUUM during business hours, active incident response, evidence
-collection, active backup/restore, or when the ActivityWatch service/unit state
-is unclear. Rollback is replacing the SQLite DB from
-`/var/lib/activitywatch/backups/db/aw-sqlite-before-db-vacuum-*.db` while
-`activitywatch-server.service` is stopped, then starting the service and
-checking `aw-db-health`/`detmir-status`.
-
-The Ansible deploy installs the VACUUM unit files but does not enable the
-nightly timer unless `aw_db_vacuum_timer_enabled=true` is set explicitly.
-Disable it with:
-
-```bash
-systemctl disable --now aw-db-vacuum.timer
-```
-
 ## Migration Runbook
 
 Use `RUNBOOK.md` as the operational plan for replacing Python and shell modules

adk-rust/RUNBOOK.md

@@ -1118,45 +1118,6 @@ systemctl is-active tsj-guardian-bot tsj-guardian-watchdog gost-tg
       (`sqlite.db=359.6MiB`, WAL `4.0MiB`, session rows `174`, recent process
       events `0`, latest `eventType=logon`), DetMir status OK with
       `dlp_counts={ok:22,warn:0,fail:0}`, `ok_for_operator=true`.
-35.2. `[done]` Закрепить nightly VACUUM для AW SQLite:
-    - `aw-db-maintenance` получил отдельный `--vacuum` режим; weekly trim
-      остается отдельной задачей и не смешивается с compaction;
-    - добавлены `aw-server/aw-db-vacuum.service` и
-      `aw-server/aw-db-vacuum.timer`;
-    - timer schedule: `OnCalendar=*-*-* 02:10:00`,
-      `RandomizedDelaySec=10m`, `Persistent=true`; Ansible не включает timer
-      без явного opt-in `aw_db_vacuum_timer_enabled=true`;
-    - если opt-in не задан, `deploy_aw_server.yml` оставляет unit-файлы на
-      сервере, но держит `aw-db-vacuum.timer` в `disabled/stopped`;
-    - nightly job перед VACUUM останавливает `activitywatch-server.service`,
-      делает rollback backup SQLite DB, выполняет `VACUUM INTO`, проверяет
-      `PRAGMA integrity_check`, сохраняет владельца и режим файла и
-      поднимает server обратно;
-    - apply-режимы weekly trim и nightly VACUUM используют общий lock
-      `/run/aw-db-maintenance.lock`, поэтому одновременный запуск завершается
-      fail-closed без записи в SQLite;
-    - VACUUM нельзя запускать в рабочее время, во время активного
-      расследования/снятия доказательств, backup/restore, неизвестного
-      состояния `activitywatch-server.service` или если уже есть maintenance
-      lock;
-    - dry-run проверки:
-      `aw-db-maintenance --vacuum --json` и обычный
-      `aw-db-maintenance --json`; они не создают backup и не пишут в DB;
-    - включить timer явно:
-      `ansible-playbook -i inventory.ini deploy_aw_server.yml -e aw_db_vacuum_timer_enabled=true`;
-    - отключить timer:
-      `systemctl disable --now aw-db-vacuum.timer`;
-    - rollback: остановить `activitywatch-server.service`, заменить
-      `/var/lib/activitywatch/aw-server-rust/sqlite.db` из последнего
-      `/var/lib/activitywatch/backups/db/aw-sqlite-before-db-vacuum-*.db`,
-      вернуть владельца/режим, запустить service, проверить `aw-db-health` и
-      `detmir-status`;
-    - local gates: `cargo fmt --all -- --check`, `cargo test --workspace`,
-      `cargo clippy --workspace --all-targets -- -D warnings`,
-      `cargo build --workspace --release`, systemd unit verify,
-      `ansible-playbook -i inventory.ini deploy_aw_server.yml --syntax-check`,
-      `scripts/check_detmir_rust_release_artifacts.sh`,
-      `scripts/quality-gate.sh`;
 36. `[done]` Устранить blocker полного AW server deploy на Influx token:
     - проблема: `deploy_aw_server.yml` падал на assert
       `aw_worktime_influx_enabled=true`, потому что локальные env

adk-rust/crates/aw-db-maintenance/src/main.rs

@@ -1,7 +1,5 @@
-use std::fs::{self, OpenOptions};
-use std::io::Write;
+use std::fs;
 use std::path::{Path, PathBuf};
-use std::process::Command;
 use std::time::Duration;
 
 use anyhow::{Context, Result, bail};
@@ -14,8 +12,6 @@ use serde_json::Value;
 const DEFAULT_DB_PATH: &str = "/var/lib/activitywatch/aw-server-rust/sqlite.db";
 const DEFAULT_BACKUP_DIR: &str = "/var/lib/activitywatch/backups/db";
 const DEFAULT_HOST: &str = "HOST-EXAMPLE";
-const DEFAULT_SERVICE_UNIT: &str = "activitywatch-server.service";
-const DEFAULT_LOCK_PATH: &str = "/run/aw-db-maintenance.lock";
 const ALLOWED_EVENT_TYPES: &[&str] = &["process_start", "process_stop"];
 
 #[derive(Debug, Parser)]
@@ -42,19 +38,6 @@ struct Cli {
     #[arg(long)]
     apply: bool,
 
-    #[arg(long)]
-    vacuum: bool,
-
-    #[arg(
-        long,
-        default_value = DEFAULT_SERVICE_UNIT,
-        env = "AW_DB_MAINTENANCE_SERVICE_UNIT"
-    )]
-    service_unit: String,
-
-    #[arg(long, default_value = DEFAULT_LOCK_PATH, env = "AW_DB_MAINTENANCE_LOCK_PATH")]
-    lock_path: PathBuf,
-
     #[arg(long)]
     json: bool,
 }
@@ -73,52 +56,9 @@ struct Report {
     planned_delete_rows: usize,
     deleted_rows: usize,
     backup_created: bool,
-    lock_path: String,
     skipped_reason: Option<String>,
 }
 
-#[derive(Debug, Serialize)]
-struct VacuumReport {
-    apply: bool,
-    generated_at_utc: String,
-    db_path: String,
-    service_unit: String,
-    service_was_active: bool,
-    service_restarted: bool,
-    backup_path: Option<String>,
-    backup_created: bool,
-    lock_path: String,
-    db_size_before_bytes: Option<u64>,
-    vacuumed_path: Option<String>,
-    vacuumed_size_bytes: Option<u64>,
-    integrity_check: Option<String>,
-    replaced_db: bool,
-    skipped_reason: Option<String>,
-}
-
-struct VacuumResult {
-    backup_path: PathBuf,
-    vacuumed_path: PathBuf,
-    db_size_before_bytes: u64,
-    vacuumed_size_bytes: u64,
-    integrity_check: String,
-}
-
-struct ServiceGuard {
-    unit: String,
-    was_active: bool,
-    restored: bool,
-}
-
-struct TempFileGuard {
-    path: PathBuf,
-    keep: bool,
-}
-
-struct LockFileGuard {
-    path: PathBuf,
-}
-
 fn main() {
     let code = match run() {
         Ok(code) => code,
@@ -132,20 +72,11 @@ fn main() {
 
 fn run() -> Result<i32> {
     let cli = Cli::parse();
-    if cli.vacuum {
-        let report = build_vacuum_report(&cli)?;
-        if cli.json {
-            println!("{}", serde_json::to_string_pretty(&report)?);
-        } else {
-            print_vacuum_text(&report);
-        }
+    let report = build_report(&cli)?;
+    if cli.json {
+        println!("{}", serde_json::to_string_pretty(&report)?);
     } else {
-        let report = build_report(&cli)?;
-        if cli.json {
-            println!("{}", serde_json::to_string_pretty(&report)?);
-        } else {
-            print_text(&report);
-        }
+        print_text(&report);
     }
     Ok(0)
 }
@@ -185,15 +116,10 @@ fn build_report(cli: &Cli) -> Result<Report> {
     let mut backup_file = None;
     let mut backup_created = false;
     let mut deleted = 0;
-    let _lock_guard = if cli.apply && planned > 0 {
-        Some(LockFileGuard::acquire(&cli.lock_path)?)
-    } else {
-        None
-    };
     if cli.apply && planned > 0 {
         fs::create_dir_all(&cli.backup_dir)
             .with_context(|| format!("create backup dir {}", cli.backup_dir.display()))?;
-        let backup = backup_path(&cli.backup_dir, "aw-sqlite-before-db-maintenance");
+        let backup = backup_path(&cli.backup_dir);
         copy_sqlite_via_backup(&cli.db_path, &backup)?;
         backup_file = Some(backup);
         backup_created = true;
@@ -213,60 +139,6 @@ fn build_report(cli: &Cli) -> Result<Report> {
     ))
 }
 
-fn build_vacuum_report(cli: &Cli) -> Result<VacuumReport> {
-    if !cli.db_path.exists() {
-        return Ok(vacuum_report(
-            cli,
-            false,
-            None,
-            false,
-            false,
-            false,
-            None,
-            None,
-            None,
-            None,
-            Some("database not found".to_string()),
-        ));
-    }
-
-    if !cli.apply {
-        return Ok(vacuum_report(
-            cli,
-            false,
-            Some(file_size(&cli.db_path)?),
-            false,
-            false,
-            false,
-            None,
-            None,
-            None,
-            None,
-            Some("dry-run".to_string()),
-        ));
-    }
-
-    let _lock_guard = LockFileGuard::acquire(&cli.lock_path)?;
-    let mut service_guard = ServiceGuard::stop_if_active(&cli.service_unit)?;
-    let service_was_active = service_guard.was_active;
-    let result = vacuum_sqlite_db(&cli.db_path, &cli.backup_dir)?;
-    let service_restarted = service_guard.restore()?;
-
-    Ok(vacuum_report(
-        cli,
-        true,
-        Some(result.db_size_before_bytes),
-        true,
-        service_was_active,
-        service_restarted,
-        Some(result.backup_path),
-        Some(result.vacuumed_path),
-        Some(result.vacuumed_size_bytes),
-        Some(result.integrity_check),
-        None,
-    ))
-}
-
 #[allow(clippy::too_many_arguments)]
 fn base_report(
     cli: &Cli,
@@ -292,40 +164,6 @@ fn base_report(
         planned_delete_rows,
         deleted_rows,
         backup_created,
-        lock_path: cli.lock_path.display().to_string(),
-        skipped_reason,
-    }
-}
-
-#[allow(clippy::too_many_arguments)]
-fn vacuum_report(
-    cli: &Cli,
-    apply: bool,
-    db_size_before_bytes: Option<u64>,
-    backup_created: bool,
-    service_was_active: bool,
-    service_restarted: bool,
-    backup_path: Option<PathBuf>,
-    vacuumed_path: Option<PathBuf>,
-    vacuumed_size_bytes: Option<u64>,
-    integrity_check: Option<String>,
-    skipped_reason: Option<String>,
-) -> VacuumReport {
-    VacuumReport {
-        apply,
-        generated_at_utc: Utc::now().to_rfc3339_opts(SecondsFormat::Secs, true),
-        db_path: cli.db_path.display().to_string(),
-        service_unit: cli.service_unit.clone(),
-        service_was_active,
-        service_restarted,
-        backup_path: backup_path.map(|path| path.display().to_string()),
-        backup_created,
-        lock_path: cli.lock_path.display().to_string(),
-        db_size_before_bytes,
-        vacuumed_path: vacuumed_path.map(|path| path.display().to_string()),
-        vacuumed_size_bytes,
-        integrity_check,
-        replaced_db: apply && skipped_reason.is_none(),
         skipped_reason,
     }
 }
@@ -399,256 +237,13 @@ fn delete_events(conn: &Connection, ids: &[i64], chunk_size: usize) -> Result<us
     Ok(deleted)
 }
 
-fn backup_path(backup_dir: &Path, prefix: &str) -> PathBuf {
+fn backup_path(backup_dir: &Path) -> PathBuf {
     backup_dir.join(format!(
-        "{}-{}.db",
-        prefix,
+        "aw-sqlite-before-db-maintenance-{}.db",
         Utc::now().format("%Y%m%dT%H%M%SZ")
     ))
 }
 
-fn vacuum_sqlite_db(db_path: &Path, backup_dir: &Path) -> Result<VacuumResult> {
-    fs::create_dir_all(backup_dir)
-        .with_context(|| format!("create backup dir {}", backup_dir.display()))?;
-    let db_size_before_bytes = file_size(db_path)?;
-    let backup_path = backup_path(backup_dir, "aw-sqlite-before-db-vacuum");
-    copy_sqlite_via_backup(db_path, &backup_path)?;
-    let vacuumed_path = vacuumed_path(db_path)?;
-    let mut vacuum_cleanup = TempFileGuard::new(vacuumed_path.clone());
-    vacuum_into(db_path, &vacuumed_path)?;
-    preserve_sqlite_metadata(db_path, &vacuumed_path)?;
-    let vacuumed_size_bytes = file_size(&vacuumed_path)?;
-    let integrity_check = integrity_check(&vacuumed_path)?;
-    remove_sqlite_sidecars(db_path)?;
-    fs::rename(&vacuumed_path, db_path).with_context(|| {
-        format!(
-            "replace {} with {}",
-            db_path.display(),
-            vacuumed_path.display()
-        )
-    })?;
-    vacuum_cleanup.disarm();
-    Ok(VacuumResult {
-        backup_path,
-        vacuumed_path,
-        db_size_before_bytes,
-        vacuumed_size_bytes,
-        integrity_check,
-    })
-}
-
-fn vacuum_into(src: &Path, dst: &Path) -> Result<()> {
-    let conn = open_connection(src, true)?;
-    let sql = format!("VACUUM INTO {}", sqlite_string_literal(dst));
-    conn.execute_batch(&sql)
-        .with_context(|| format!("VACUUM INTO {}", dst.display()))
-}
-
-fn integrity_check(path: &Path) -> Result<String> {
-    let conn = open_connection(path, false)?;
-    let result: String = conn.query_row("PRAGMA integrity_check", [], |row| row.get(0))?;
-    if result != "ok" {
-        bail!("integrity_check failed for {}: {result}", path.display());
-    }
-    Ok(result)
-}
-
-fn remove_sqlite_sidecars(db_path: &Path) -> Result<()> {
-    for suffix in ["-wal", "-shm", "-journal"] {
-        let sidecar = sqlite_sidecar_path(db_path, suffix)?;
-        match fs::remove_file(&sidecar) {
-            Ok(()) => {}
-            Err(err) if err.kind() == std::io::ErrorKind::NotFound => {}
-            Err(err) => return Err(err).with_context(|| format!("remove {}", sidecar.display())),
-        }
-    }
-    Ok(())
-}
-
-fn sqlite_sidecar_path(db_path: &Path, suffix: &str) -> Result<PathBuf> {
-    let file_name = db_path
-        .file_name()
-        .and_then(|value| value.to_str())
-        .context("database path must have a file name")?;
-    Ok(db_path.with_file_name(format!("{file_name}{suffix}")))
-}
-
-fn vacuumed_path(db_path: &Path) -> Result<PathBuf> {
-    let file_name = db_path
-        .file_name()
-        .and_then(|value| value.to_str())
-        .context("database path must have a file name")?;
-    Ok(db_path.with_file_name(format!(
-        "{file_name}.vacuumed-{}",
-        Utc::now().format("%Y%m%dT%H%M%SZ")
-    )))
-}
-
-fn file_size(path: &Path) -> Result<u64> {
-    Ok(fs::metadata(path)
-        .with_context(|| format!("stat {}", path.display()))?
-        .len())
-}
-
-fn sqlite_string_literal(path: &Path) -> String {
-    format!("'{}'", path.display().to_string().replace('\'', "''"))
-}
-
-fn preserve_sqlite_metadata(src: &Path, dst: &Path) -> Result<()> {
-    let metadata = fs::metadata(src).with_context(|| format!("stat {}", src.display()))?;
-    let permissions = metadata.permissions();
-    fs::set_permissions(dst, permissions)
-        .with_context(|| format!("preserve permissions for {}", dst.display()))?;
-    #[cfg(unix)]
-    {
-        use std::os::unix::fs::MetadataExt;
-
-        let dst_metadata = fs::metadata(dst).with_context(|| format!("stat {}", dst.display()))?;
-        if dst_metadata.uid() != metadata.uid() || dst_metadata.gid() != metadata.gid() {
-            let status = Command::new("chown")
-                .arg(format!("{}:{}", metadata.uid(), metadata.gid()))
-                .arg(dst)
-                .status()
-                .context("run chown for vacuumed SQLite DB")?;
-            if !status.success() {
-                bail!("chown failed for {}", dst.display());
-            }
-        }
-    }
-    Ok(())
-}
-
-fn systemctl_is_active(unit: &str) -> Result<bool> {
-    let load_state = systemctl_load_state(unit)?;
-    if load_state != "loaded" {
-        bail!("refusing SQLite VACUUM because systemd unit {unit} load_state={load_state:?}");
-    }
-    let output = Command::new("systemctl")
-        .args(["is-active", unit])
-        .output()
-        .with_context(|| format!("systemctl is-active {unit}"))?;
-    let state = String::from_utf8_lossy(&output.stdout).trim().to_string();
-    if output.status.success() && state == "active" {
-        return Ok(true);
-    }
-    if output.status.code() == Some(3) && state == "inactive" {
-        return Ok(false);
-    }
-    let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
-    bail!(
-        "refusing SQLite VACUUM because systemctl is-active {unit} returned state={state:?}, status={}, stderr={stderr:?}",
-        output.status
-    );
-}
-
-fn systemctl_load_state(unit: &str) -> Result<String> {
-    let output = Command::new("systemctl")
-        .args(["show", "-p", "LoadState", "--value", unit])
-        .output()
-        .with_context(|| format!("systemctl show LoadState {unit}"))?;
-    let state = String::from_utf8_lossy(&output.stdout).trim().to_string();
-    if output.status.success() && !state.is_empty() {
-        return Ok(state);
-    }
-    let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
-    bail!(
-        "refusing SQLite VACUUM because systemctl show LoadState {unit} failed with status={}, stderr={stderr:?}",
-        output.status
-    );
-}
-
-fn systemctl_action(action: &str, unit: &str) -> Result<()> {
-    let status = Command::new("systemctl")
-        .args([action, unit])
-        .status()
-        .with_context(|| format!("systemctl {action} {unit}"))?;
-    if status.success() {
-        Ok(())
-    } else {
-        bail!("systemctl {action} {unit} failed with status {status}");
-    }
-}
-
-impl ServiceGuard {
-    fn stop_if_active(unit: &str) -> Result<Self> {
-        let was_active = systemctl_is_active(unit)?;
-        if was_active {
-            systemctl_action("stop", unit)?;
-        }
-        Ok(Self {
-            unit: unit.to_string(),
-            was_active,
-            restored: !was_active,
-        })
-    }
-
-    fn restore(&mut self) -> Result<bool> {
-        if self.was_active && !self.restored {
-            systemctl_action("start", &self.unit)?;
-            self.restored = true;
-        }
-        Ok(self.was_active)
-    }
-}
-
-impl Drop for ServiceGuard {
-    fn drop(&mut self) {
-        if self.was_active && !self.restored {
-            let _ = systemctl_action("start", &self.unit);
-        }
-    }
-}
-
-impl TempFileGuard {
-    fn new(path: PathBuf) -> Self {
-        Self { path, keep: false }
-    }
-
-    fn disarm(&mut self) {
-        self.keep = true;
-    }
-}
-
-impl Drop for TempFileGuard {
-    fn drop(&mut self) {
-        if !self.keep {
-            let _ = fs::remove_file(&self.path);
-        }
-    }
-}
-
-impl LockFileGuard {
-    fn acquire(path: &Path) -> Result<Self> {
-        if let Some(parent) = path.parent() {
-            fs::create_dir_all(parent)
-                .with_context(|| format!("create lock parent {}", parent.display()))?;
-        }
-        let mut file = match OpenOptions::new().write(true).create_new(true).open(path) {
-            Ok(file) => file,
-            Err(err) if err.kind() == std::io::ErrorKind::AlreadyExists => {
-                bail!("maintenance lock already exists: {}", path.display());
-            }
-            Err(err) => return Err(err).with_context(|| format!("create lock {}", path.display())),
-        };
-        writeln!(
-            file,
-            "pid={} generated_at_utc={}",
-            std::process::id(),
-            Utc::now().to_rfc3339_opts(SecondsFormat::Secs, true)
-        )
-        .with_context(|| format!("write lock {}", path.display()))?;
-        Ok(Self {
-            path: path.to_path_buf(),
-        })
-    }
-}
-
-impl Drop for LockFileGuard {
-    fn drop(&mut self) {
-        let _ = fs::remove_file(&self.path);
-    }
-}
-
 fn print_text(report: &Report) {
     println!(
         "aw-db-maintenance: {}",
@@ -660,7 +255,6 @@ fn print_text(report: &Report) {
     println!("planned_delete_rows: {}", report.planned_delete_rows);
     println!("deleted_rows: {}", report.deleted_rows);
     println!("backup_created: {}", report.backup_created);
-    println!("lock_path: {}", report.lock_path);
     if let Some(path) = &report.backup_path {
         println!("backup_path: {path}");
     }
@@ -669,38 +263,6 @@ fn print_text(report: &Report) {
     }
 }
 
-fn print_vacuum_text(report: &VacuumReport) {
-    println!(
-        "aw-db-vacuum: {}",
-        if report.apply { "apply" } else { "dry-run" }
-    );
-    println!("db_path: {}", report.db_path);
-    println!("service_unit: {}", report.service_unit);
-    println!("service_was_active: {}", report.service_was_active);
-    println!("service_restarted: {}", report.service_restarted);
-    println!("backup_created: {}", report.backup_created);
-    println!("lock_path: {}", report.lock_path);
-    if let Some(path) = &report.backup_path {
-        println!("backup_path: {path}");
-    }
-    if let Some(size) = report.db_size_before_bytes {
-        println!("db_size_before_bytes: {size}");
-    }
-    if let Some(path) = &report.vacuumed_path {
-        println!("vacuumed_path: {path}");
-    }
-    if let Some(size) = report.vacuumed_size_bytes {
-        println!("vacuumed_size_bytes: {size}");
-    }
-    if let Some(check) = &report.integrity_check {
-        println!("integrity_check: {check}");
-    }
-    println!("replaced_db: {}", report.replaced_db);
-    if let Some(reason) = &report.skipped_reason {
-        println!("skipped_reason: {reason}");
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -728,9 +290,6 @@ mod tests {
             retention_days: 7,
             chunk_size: 100,
             apply: false,
-            vacuum: false,
-            service_unit: DEFAULT_SERVICE_UNIT.to_string(),
-            lock_path: dir.path().join("maintenance.lock"),
             json: true,
         };
         let report = build_report(&cli).unwrap();
@@ -753,9 +312,6 @@ mod tests {
             retention_days: 7,
             chunk_size: 1,
             apply: true,
-            vacuum: false,
-            service_unit: DEFAULT_SERVICE_UNIT.to_string(),
-            lock_path: dir.path().join("maintenance.lock"),
             json: true,
         };
         let report = build_report(&cli).unwrap();
@@ -765,73 +321,6 @@ mod tests {
         assert_eq!(count_events(&db), 1);
     }
 
-    #[test]
-    fn vacuum_apply_compacts_database_and_preserves_rows() {
-        let dir = tempfile::tempdir().unwrap();
-        let db = dir.path().join("sqlite.db");
-        create_vacuum_fixture_db(&db);
-
-        let before = file_size(&db).unwrap();
-        let result = vacuum_sqlite_db(&db, dir.path()).unwrap();
-        let after = file_size(&db).unwrap();
-
-        assert!(result.vacuumed_size_bytes < result.db_size_before_bytes);
-        assert!(after < before);
-        assert_eq!(result.integrity_check, "ok");
-        assert!(result.backup_path.exists());
-        assert_eq!(count_rows(&db), 32);
-    }
-
-    #[test]
-    fn vacuum_dry_run_skips_mutation() {
-        let dir = tempfile::tempdir().unwrap();
-        let db = dir.path().join("sqlite.db");
-        create_vacuum_fixture_db(&db);
-        let cli = Cli {
-            db_path: db.clone(),
-            backup_dir: dir.path().join("backups"),
-            session_bucket: None,
-            host: None,
-            retention_days: 7,
-            chunk_size: 100,
-            apply: false,
-            vacuum: true,
-            service_unit: DEFAULT_SERVICE_UNIT.to_string(),
-            lock_path: dir.path().join("maintenance.lock"),
-            json: true,
-        };
-        let report = build_vacuum_report(&cli).unwrap();
-        assert!(!report.backup_created);
-        assert!(!report.replaced_db);
-        assert_eq!(report.skipped_reason.as_deref(), Some("dry-run"));
-        assert_eq!(count_rows(&db), 32);
-    }
-
-    #[test]
-    fn apply_refuses_when_lock_exists() {
-        let dir = tempfile::tempdir().unwrap();
-        let db = dir.path().join("aw.db");
-        create_fixture_db(&db);
-        let lock_path = dir.path().join("maintenance.lock");
-        fs::write(&lock_path, "busy").unwrap();
-        let cli = Cli {
-            db_path: db.clone(),
-            backup_dir: dir.path().join("backups"),
-            session_bucket: Some("aw-session-events_TEST".to_string()),
-            host: None,
-            retention_days: 7,
-            chunk_size: 1,
-            apply: true,
-            vacuum: false,
-            service_unit: DEFAULT_SERVICE_UNIT.to_string(),
-            lock_path,
-            json: true,
-        };
-        let err = build_report(&cli).unwrap_err().to_string();
-        assert!(err.contains("maintenance lock already exists"));
-        assert_eq!(count_events(&db), 3);
-    }
-
     fn create_fixture_db(path: &Path) {
         let conn = Connection::open(path).unwrap();
         conn.execute_batch(
@@ -861,34 +350,10 @@ mod tests {
         .unwrap();
     }
 
-    fn create_vacuum_fixture_db(path: &Path) {
-        let conn = Connection::open(path).unwrap();
-        conn.execute_batch(
-            "create table items (id integer primary key autoincrement, payload text);",
-        )
-        .unwrap();
-        let payload = "x".repeat(4096);
-        for _ in 0..64 {
-            conn.execute("insert into items (payload) values (?1)", [&payload])
-                .unwrap();
-        }
-        for id in 1..=32 {
-            conn.execute("delete from items where id = ?1", [id])
-                .unwrap();
-        }
-    }
-
     fn count_events(path: &Path) -> i64 {
         Connection::open(path)
             .unwrap()
             .query_row("select count(*) from events", [], |row| row.get(0))
             .unwrap()
     }
-
-    fn count_rows(path: &Path) -> i64 {
-        Connection::open(path)
-            .unwrap()
-            .query_row("select count(*) from items", [], |row| row.get(0))
-            .unwrap()
-    }
 }

adk-rust/crates/aw-rus-healthd/src/main.rs

@@ -6,7 +6,7 @@ use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
 use std::time::{Duration, Instant};
 
-use anyhow::{Context, Result, anyhow};
+use anyhow::{Context, Result};
 use chrono::{DateTime, Duration as ChronoDuration, SecondsFormat, Utc};
 use clap::Parser;
 use detmir_core::{exit_codes, parse_utc_rfc3339};
@@ -25,10 +25,10 @@ struct Cli {
     #[arg(long, default_value = "http://127.0.0.1:5610")]
     worktime_api: String,
 
-    #[arg(long, default_value = "")]
+    #[arg(long, default_value = "198.51.100.18")]
     rdp_host: String,
 
-    #[arg(long, default_value = "")]
+    #[arg(long, default_value = "HOST-EXAMPLE")]
     rdp_hostname: String,
 
     #[arg(long, default_value = "/var/lib/activitywatch/health")]
@@ -61,9 +61,6 @@ struct Cli {
     #[arg(long, default_value_t = 3.0)]
     tcp_timeout_seconds: f64,
 
-    #[arg(long, default_value_t = true)]
-    rdp_tcp_required: bool,
-
     #[arg(long)]
     json: bool,
 }
@@ -132,10 +129,6 @@ impl Cli {
                 self.tcp_timeout_seconds,
             );
         }
-        if !cli_arg_present("--rdp-tcp-required") {
-            self.rdp_tcp_required =
-                env_bool_default("AW_RUS_HEALTH_RDP_TCP_REQUIRED", self.rdp_tcp_required);
-        }
         self
     }
 }
@@ -228,42 +221,9 @@ fn env_f64(name: &str, fallback: f64) -> f64 {
 }
 
 fn env_bool(name: &str) -> bool {
-    env_bool_default(name, false)
-}
-
-fn env_bool_default(name: &str, fallback: bool) -> bool {
     env_string(name)
-        .map(|value| match value.to_ascii_lowercase().as_str() {
-            "1" | "true" | "yes" | "on" => true,
-            "0" | "false" | "no" | "off" => false,
-            _ => fallback,
-        })
-        .unwrap_or(fallback)
-}
-
-fn validate_cli_config(cli: &Cli) -> Result<()> {
-    validate_prod_host("rdp_host", &cli.rdp_host)?;
-    validate_prod_host("rdp_hostname", &cli.rdp_hostname)?;
-    Ok(())
-}
-
-fn validate_prod_host(name: &str, value: &str) -> Result<()> {
-    let value = value.trim();
-    if value.is_empty() {
-        return Err(anyhow!("invalid config {name}: value is empty"));
-    }
-    let lowered = value.to_ascii_lowercase();
-    if lowered == "host-example"
-        || lowered.ends_with(".example")
-        || lowered.starts_with("192.0.2.")
-        || lowered.starts_with("198.51.100.")
-        || lowered.starts_with("203.0.113.")
-    {
-        return Err(anyhow!(
-            "invalid config {name}: placeholder/documentation host is not allowed"
-        ));
-    }
-    Ok(())
+        .map(|value| matches!(value.to_ascii_lowercase().as_str(), "1" | "true" | "yes"))
+        .unwrap_or(false)
 }
 
 fn load_env_file(path: &Path) {
@@ -721,16 +681,6 @@ fn normalize_aw_api_base(aw_server: &str) -> String {
     }
 }
 
-fn tcp_check_status(ok: bool, required: bool) -> &'static str {
-    if ok {
-        "ok"
-    } else if required {
-        "fail"
-    } else {
-        "warn"
-    }
-}
-
 fn validation_check(report: &mut ReportBuilder, validation_dir: &Path, max_age_seconds: i64) {
     let Some(path) = latest_validation_report(validation_dir) else {
         report.add(
@@ -862,18 +812,15 @@ fn run(cli: &Cli) -> Result<HealthReport> {
 
     for (port, label) in [(5985_u16, "winrm"), (3389_u16, "rdp")] {
         let (ok, message) = tcp_connect(&cli.rdp_host, port, cli.tcp_timeout_seconds);
-        let status = tcp_check_status(ok, cli.rdp_tcp_required);
         report.add(
             format!("tcp:{label}"),
-            status,
+            if ok { "ok" } else { "fail" },
             if ok {
                 message
-            } else if cli.rdp_tcp_required {
-                format!("unreachable: {message}")
             } else {
-                format!("optional unreachable: {message}")
+                format!("unreachable: {message}")
             },
-            json!({"host": cli.rdp_host, "port": port, "required": cli.rdp_tcp_required}),
+            json!({"host": cli.rdp_host, "port": port}),
         );
     }
 
@@ -1002,7 +949,6 @@ fn run(cli: &Cli) -> Result<HealthReport> {
 
 fn main() -> Result<()> {
     let cli = Cli::parse().apply_env();
-    validate_cli_config(&cli)?;
     let report = run(&cli)?;
     let json_text = serde_json::to_string_pretty(&report)? + "\n";
     let text = render_text(&report) + "\n";
@@ -1083,20 +1029,4 @@ mod tests {
             "http://127.0.0.1:5600/api/0"
         );
     }
-
-    #[test]
-    fn optional_rdp_tcp_downgrades_unreachable_to_warn() {
-        assert_eq!(tcp_check_status(false, true), "fail");
-        assert_eq!(tcp_check_status(false, false), "warn");
-        assert_eq!(tcp_check_status(true, false), "ok");
-    }
-
-    #[test]
-    fn healthd_rejects_placeholder_hosts() {
-        assert!(validate_prod_host("rdp_host", "192.168.100.19").is_ok());
-        assert!(validate_prod_host("rdp_hostname", "SHARKON2025").is_ok());
-        assert!(validate_prod_host("rdp_host", "198.51.100.18").is_err());
-        assert!(validate_prod_host("rdp_hostname", "HOST-EXAMPLE").is_err());
-        assert!(validate_prod_host("rdp_host", "").is_err());
-    }
 }

adk-rust/crates/aw-windows-telemetry/src/main.rs

@@ -6,7 +6,7 @@ use std::{
     io::{BufRead, BufReader, Write},
     path::{Path, PathBuf},
     process::Command,
-    sync::{Arc, Mutex, mpsc},
+    sync::mpsc,
     time::{Duration, SystemTime},
 };
 
@@ -16,7 +16,7 @@ use chrono::{DateTime, Timelike, Utc};
 use clap::{Parser, Subcommand};
 use notify::{Event, EventKind, RecommendedWatcher, RecursiveMode, Watcher, event::RenameMode};
 use regex::Regex;
-use reqwest::{StatusCode, blocking::Client};
+use reqwest::blocking::Client;
 use serde::{Deserialize, Serialize};
 use serde_json::{Map, Value, json};
 use sha2::{Digest, Sha256};
@@ -29,6 +29,7 @@ const DEFAULT_DLP_STATE: &str = r"C:\ProgramData\AWatch-rus\dlp-evidence-sync-st
 const DEFAULT_DLP_TOKEN: &str = r"C:\ProgramData\AWatch-rus\dlp-evidence-upload-token.txt";
 const DEFAULT_REMOTE_ROOT: &str = "/opt/activitywatch/clickhouse-1c/landing";
 const DEFAULT_SSH_KEY: &str = r"C:\ProgramData\AWatch-rus\ssh\awops_ed25519";
+const DEFAULT_REGISTRY_WORKBOOK: &str = r"E:\USER1\СПИСОК ПРЕДПРИЯТИЙ И ИХ РАСПРЕДЕЛЕНИЕ.xlsx";
 
 #[derive(Parser)]
 #[command(about = "AWatch-rus Windows telemetry uploader without PowerShell runtime wrappers")]
@@ -458,7 +459,8 @@ fn run_file1c_upload_inner(args: &mut File1cUpload, log_path: &Path) -> Result<(
     if args.registry_workbook_path.is_none() {
         args.registry_workbook_path = json_string(automation, &["registryWorkbookPath"])
             .filter(|v| !v.trim().is_empty())
-            .map(PathBuf::from);
+            .map(PathBuf::from)
+            .or_else(|| Some(PathBuf::from(DEFAULT_REGISTRY_WORKBOOK)));
     }
 
     let scp = system32_path("OpenSSH\\scp.exe");
@@ -1462,10 +1464,13 @@ fn ensure_aw_bucket(
     hostname: &str,
 ) -> Result<()> {
     let url = format!("{}/buckets/{bucket_id}", api_base.trim_end_matches('/'));
-    if let Ok(response) = client.get(&url).send() {
-        if aw_bucket_status_accepts_existing(response.status()) {
-            return Ok(());
-        }
+    if client
+        .get(&url)
+        .send()
+        .map(|response| response.status().is_success())
+        .unwrap_or(false)
+    {
+        return Ok(());
     }
     let response = client
         .post(&url)
@@ -1476,7 +1481,7 @@ fn ensure_aw_bucket(
         }))
         .send()
         .with_context(|| format!("POST {url}"))?;
-    if !aw_bucket_status_accepts_existing(response.status()) {
+    if !response.status().is_success() {
         bail!(
             "bucket create failed {} status={}",
             bucket_id,
@@ -1486,10 +1491,6 @@ fn ensure_aw_bucket(
     Ok(())
 }
 
-fn aw_bucket_status_accepts_existing(status: StatusCode) -> bool {
-    status.is_success() || status == StatusCode::NOT_MODIFIED
-}
-
 fn append_file_ops_log(runtime: &FileOpsRuntime, message: &str) -> Result<()> {
     if !runtime.local_logs_enabled {
         return Ok(());
@@ -1600,7 +1601,6 @@ struct RustCollectorRuntime {
     rules_path: PathBuf,
     policy_path: PathBuf,
     incident_screenshot_enabled: bool,
-    ensured_buckets: Arc<Mutex<HashSet<String>>>,
 }
 
 #[derive(Debug, Default, Clone, Serialize)]
@@ -1614,10 +1614,6 @@ struct ForegroundWindowContext {
     window_handle: isize,
 }
 
-fn has_foreground_context(context: &ForegroundWindowContext) -> bool {
-    context.process_id != 0 || !context.app.trim().is_empty() || !context.title.trim().is_empty()
-}
-
 #[derive(Debug, Clone)]
 struct WebCategoryRule {
     name: String,
@@ -1745,19 +1741,17 @@ fn run_browser_domains_collector(args: BrowserDomainsCollector) -> Result<()> {
     loop {
         let context = foreground_window_context();
         let mut loop_failed = false;
-        if has_foreground_context(&context) {
-            match send_browser_window_event(&runtime, &context) {
-                Ok(()) => events_sent = events_sent.saturating_add(1),
-                Err(err) => {
-                    loop_failed = true;
-                    record_collector_send_failure(
-                        &runtime,
-                        &mut problems,
-                        &mut send_failures,
-                        "browser window heartbeat",
-                        &err,
-                    );
-                }
+        match send_browser_window_event(&runtime, &context) {
+            Ok(()) => events_sent = events_sent.saturating_add(1),
+            Err(err) => {
+                loop_failed = true;
+                record_collector_send_failure(
+                    &runtime,
+                    &mut problems,
+                    &mut send_failures,
+                    "browser window heartbeat",
+                    &err,
+                );
             }
         }
         match send_browser_category_health(&runtime, &context, events_sent) {
@@ -2047,7 +2041,6 @@ fn build_rust_collector_runtime(
         rules_path,
         policy_path,
         incident_screenshot_enabled,
-        ensured_buckets: Arc::new(Mutex::new(HashSet::new())),
     })
 }
 
@@ -3130,7 +3123,14 @@ fn send_collector_aw_event(
         return Ok(());
     }
     let client = Client::builder().timeout(Duration::from_secs(15)).build()?;
-    ensure_runtime_aw_bucket(runtime, &client, bucket_id, client_name, bucket_type)?;
+    ensure_aw_bucket(
+        &client,
+        &runtime.api_base,
+        bucket_id,
+        client_name,
+        bucket_type,
+        &runtime.hostname,
+    )?;
     let url = format!(
         "{}/buckets/{bucket_id}/heartbeat?pulsetime={}",
         runtime.api_base.trim_end_matches('/'),
@@ -3151,37 +3151,6 @@ fn send_collector_aw_event(
     Ok(())
 }
 
-fn ensure_runtime_aw_bucket(
-    runtime: &RustCollectorRuntime,
-    client: &Client,
-    bucket_id: &str,
-    client_name: &str,
-    bucket_type: &str,
-) -> Result<()> {
-    if runtime
-        .ensured_buckets
-        .lock()
-        .map(|cache| cache.contains(bucket_id))
-        .unwrap_or(false)
-    {
-        return Ok(());
-    }
-
-    ensure_aw_bucket(
-        client,
-        &runtime.api_base,
-        bucket_id,
-        client_name,
-        bucket_type,
-        &runtime.hostname,
-    )?;
-
-    if let Ok(mut cache) = runtime.ensured_buckets.lock() {
-        cache.insert(bucket_id.to_string());
-    }
-    Ok(())
-}
-
 fn collector_state(
     schema: &str,
     runtime: &RustCollectorRuntime,
@@ -6008,7 +5977,7 @@ Connect=File="E:\Bases\Org\Base1";
 ID=skip
 Connect=Srvr="srv";Ref="x";
 "#;
-        let items = parse_v8i_text(text, "fixture-user", Path::new("ibases.v8i"));
+        let items = parse_v8i_text(text, "user1", Path::new("ibases.v8i"));
         assert_eq!(items.len(), 1);
         assert_eq!(items[0].infobase, "База 1");
         assert_eq!(items[0].base_id.as_deref(), Some("abc-123"));
@@ -6056,17 +6025,6 @@ Connect=Srvr="srv";Ref="x";
         assert_eq!(value.get("ok").and_then(Value::as_bool), Some(true));
     }
 
-    #[test]
-    fn bucket_status_accepts_only_success_or_not_modified() {
-        assert!(aw_bucket_status_accepts_existing(StatusCode::OK));
-        assert!(aw_bucket_status_accepts_existing(StatusCode::NO_CONTENT));
-        assert!(aw_bucket_status_accepts_existing(StatusCode::NOT_MODIFIED));
-        assert!(!aw_bucket_status_accepts_existing(StatusCode::NOT_FOUND));
-        assert!(!aw_bucket_status_accepts_existing(
-            StatusCode::SERVICE_UNAVAILABLE
-        ));
-    }
-
     #[test]
     fn dlp_evidence_sync_accepts_only_dlp_screenshot_names() {
         assert!(is_dlp_evidence_screenshot_name(
@@ -6106,19 +6064,6 @@ Connect=Srvr="srv";Ref="x";
         assert!(normalize_browser_url("new tab").is_none());
     }
 
-    #[test]
-    fn foreground_context_requires_real_window_signal() {
-        assert!(!has_foreground_context(&ForegroundWindowContext::default()));
-        assert!(has_foreground_context(&ForegroundWindowContext {
-            process_id: 1000,
-            ..ForegroundWindowContext::default()
-        }));
-        assert!(has_foreground_context(&ForegroundWindowContext {
-            title: "1C".to_string(),
-            ..ForegroundWindowContext::default()
-        }));
-    }
-
     #[test]
     fn dlp_block_is_suppressed_without_native_enforce() {
         let policy = dlp_policy_from_value(
@@ -6238,7 +6183,7 @@ SERVICE_NAME: AWatchRusCollectorGuard
 
     #[test]
     fn file_operations_queue_token_is_filename_safe() {
-        let token = queue_name_token(r"DOMAIN\operator", 3);
+        let token = queue_name_token(r"DOMAIN\Администратор", 3);
         assert!(token.ends_with("-s3"));
         assert!(!token.contains('\\'));
         assert!(

adk-rust/crates/aw-workforce-ingest/Cargo.toml

@@ -1,18 +0,0 @@
-[package]
-name = "aw-workforce-ingest"
-version = "0.1.0"
-edition.workspace = true
-rust-version.workspace = true
-license.workspace = true
-publish.workspace = true
-
-[dependencies]
-anyhow.workspace = true
-chrono.workspace = true
-clap.workspace = true
-detmir-aw-client.workspace = true
-reqwest.workspace = true
-serde.workspace = true
-serde_json.workspace = true
-tempfile.workspace = true
-urlencoding.workspace = true

adk-rust/crates/aw-workforce-ingest/src/main.rs

@@ -1,10 +0,0 @@
-fn main() {
-    let code = match aw_workforce_ingest::run_from_args() {
-        Ok(()) => 0,
-        Err(err) => {
-            eprintln!("{err:#}");
-            1
-        }
-    };
-    std::process::exit(code);
-}

adk-rust/crates/check-aw-full/src/main.rs

@@ -7,9 +7,9 @@ use clap::Parser;
 use reqwest::blocking::Client;
 use serde_json::Value;
 
-const DEFAULT_SERVER: &str = "http://10.10.10.13:5600";
-const DEFAULT_HOST: &str = "SHARKON2025";
-const DEFAULT_RDP_HOST: &str = "192.168.100.19";
+const DEFAULT_SERVER: &str = "http://192.0.2.13:5600";
+const DEFAULT_HOST: &str = "HOST-EXAMPLE";
+const DEFAULT_RDP_HOST: &str = "198.51.100.18";
 const BUCKETS: &[(&str, &str)] = &[
     ("aw-watcher-afk", "AFK watcher"),
     ("aw-watcher-window", "Window watcher"),
@@ -38,9 +38,6 @@ struct Cli {
 
     #[arg(long)]
     no_color: bool,
-
-    #[arg(long, default_value_t = true)]
-    dlp_enabled: bool,
 }
 
 #[derive(Debug, Clone)]
@@ -122,37 +119,7 @@ fn main() {
 }
 
 fn run() -> Result<i32> {
-    let mut cli = Cli::parse();
-    if cli.server == DEFAULT_SERVER {
-        if let Some(value) = env_nonempty("CHECK_AW_FULL_SERVER")
-            .or_else(|| env_nonempty("AW_SMOKE_AW_SERVER"))
-            .or_else(|| env_nonempty("AW_SERVER"))
-        {
-            cli.server = value;
-        }
-    }
-    if cli.host == DEFAULT_HOST {
-        if let Some(value) = env_nonempty("CHECK_AW_FULL_HOST")
-            .or_else(|| env_nonempty("AW_SMOKE_SOURCE_HOSTNAME"))
-            .or_else(|| env_nonempty("AW_LOGICAL_HOST_ID"))
-            .or_else(|| env_nonempty("AW_MONITORED_WINDOWS_HOSTNAME"))
-        {
-            cli.host = value;
-        }
-    }
-    if cli.rdp_host == DEFAULT_RDP_HOST {
-        if let Some(value) = env_nonempty("CHECK_AW_FULL_RDP_HOST")
-            .or_else(|| env_nonempty("AW_SMOKE_WINDOWS_HOST"))
-            .or_else(|| env_nonempty("AW_WINDOWS_HOST"))
-        {
-            cli.rdp_host = value;
-        }
-    }
-    if let Some(value) =
-        env_nonempty("AW_DLP_ENABLED").or_else(|| env_nonempty("DETMIR_DLP_ENABLED"))
-    {
-        cli.dlp_enabled = parse_env_flag(&value);
-    }
+    let cli = Cli::parse();
     let server = cli.server.trim_end_matches('/').to_string();
     let colors = Colors::new(!cli.no_color && std::env::var_os("NO_COLOR").is_none());
     let timeout = Duration::from_secs(cli.timeout_seconds.max(1));
@@ -215,11 +182,7 @@ fn run() -> Result<i32> {
     );
 
     let mut rows = Vec::new();
-    for (bucket, label) in BUCKETS
-        .iter()
-        .copied()
-        .filter(|(bucket, _)| cli.dlp_enabled || !bucket.starts_with("aw-dlp-"))
-    {
+    for (bucket, label) in BUCKETS {
         let row = read_bucket_row(&client, &server, &cli.host, bucket, label, now, &context);
         println!(
             "  {:<42} {:<8} {:<20} {}",
@@ -230,15 +193,6 @@ fn run() -> Result<i32> {
         );
         rows.push(row);
     }
-    if !cli.dlp_enabled {
-        println!(
-            "  {:<42} {:<8} {:<20} {}",
-            "DLP buckets",
-            "-",
-            "disabled",
-            colors.paint(colors.cyan, "SKIPPED")
-        );
-    }
     println!();
 
     println!(
@@ -376,12 +330,7 @@ fn read_bucket_row(
             status: BucketStatus::Unknown,
         };
     };
-    let effective_ts = if bucket == "aw-watcher-afk" {
-        bucket_metadata_end(client, server, &bucket_full).unwrap_or(ts)
-    } else {
-        ts
-    };
-    let age_sec = (now - effective_ts).num_seconds().max(0);
+    let age_sec = (now - ts).num_seconds().max(0);
     BucketRow {
         label,
         last_id,
@@ -458,15 +407,6 @@ fn latest_event(client: &Client, server: &str, bucket: &str) -> Result<Option<Va
     Ok(value.as_array().and_then(|items| items.first()).cloned())
 }
 
-fn bucket_metadata_end(client: &Client, server: &str, bucket: &str) -> Option<DateTime<Utc>> {
-    let url = format!("{server}/api/0/buckets/{bucket}");
-    let value = get_json(client, &url).ok()?;
-    value
-        .pointer("/metadata/end")
-        .and_then(Value::as_str)
-        .and_then(parse_ts)
-}
-
 fn get_json(client: &Client, url: &str) -> Result<Value> {
     client
         .get(url)
@@ -483,7 +423,7 @@ fn check_cors(client: &Client, server: &str) -> u16 {
     let url = format!("{server}/api/0/settings/");
     client
         .get(&url)
-        .header("Origin", server)
+        .header("Origin", "http://192.0.2.13:5600")
         .send()
         .map(|response| response.status().as_u16())
         .unwrap_or(0)
@@ -526,17 +466,6 @@ fn json_value_to_string(value: &Value) -> String {
     }
 }
 
-fn env_nonempty(name: &str) -> Option<String> {
-    std::env::var(name).ok().filter(|value| !value.is_empty())
-}
-
-fn parse_env_flag(value: &str) -> bool {
-    matches!(
-        value.trim().to_ascii_lowercase().as_str(),
-        "1" | "true" | "yes" | "on"
-    )
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;

adk-rust/crates/detmir-check/src/main.rs

@@ -1,7 +1,6 @@
-use std::io::Read;
 use std::net::{SocketAddr, TcpStream};
-use std::process::{Command, Stdio};
-use std::time::{Duration, Instant};
+use std::process::Command;
+use std::time::Duration;
 
 use anyhow::{Context, Result};
 use chrono::{DateTime, SecondsFormat, Utc};
@@ -9,7 +8,7 @@ use clap::Parser;
 use detmir_aw_client::ActivityWatchClient;
 use detmir_core::{exit_codes, now_utc_rfc3339};
 use reqwest::blocking::Client;
-use reqwest::header::{AUTHORIZATION, HeaderMap, HeaderName, HeaderValue};
+use reqwest::header::{HeaderMap, HeaderName, HeaderValue};
 use serde::Serialize;
 use serde_json::Value;
 
@@ -41,12 +40,6 @@ struct Cli {
     #[arg(long, default_value = DEFAULT_HOSTNAME)]
     hostname: String,
 
-    #[arg(long, default_value = DEFAULT_GATEWAY_HOST)]
-    gateway_host: String,
-
-    #[arg(long, default_value = "https://127.0.0.1")]
-    portal_url: String,
-
     #[arg(long, default_value_t = 5)]
     service_timeout_seconds: u64,
 
@@ -82,18 +75,6 @@ struct Cli {
 
     #[arg(long, default_value = "")]
     clickhouse_password: String,
-
-    #[arg(long, default_value = "detmir-dlp")]
-    dlp_command: String,
-
-    #[arg(long, default_value_t = 45)]
-    dlp_timeout_seconds: u64,
-
-    #[arg(long, default_value_t = false)]
-    disable_dlp_health_check: bool,
-
-    #[arg(long, default_value_t = false)]
-    disable_portal_check: bool,
 }
 
 #[derive(Debug, Clone, Copy)]
@@ -179,20 +160,6 @@ fn env_or_default(name: &str, default: &str) -> String {
         .unwrap_or_else(|| default.to_string())
 }
 
-fn env_flag_enabled(name: &str) -> bool {
-    std::env::var(name)
-        .ok()
-        .map(|value| parse_env_flag(&value))
-        .unwrap_or(false)
-}
-
-fn parse_env_flag(value: &str) -> bool {
-    matches!(
-        value.trim().to_ascii_lowercase().as_str(),
-        "1" | "true" | "yes" | "on"
-    )
-}
-
 fn bucket_specs(hostname: &str) -> Vec<BucketSpec> {
     vec![
         BucketSpec {
@@ -257,20 +224,6 @@ fn build_headers(items: &[(&str, &str)]) -> Result<HeaderMap> {
     Ok(headers)
 }
 
-fn portal_headers(args: &Cli) -> HeaderMap {
-    let mut headers = build_headers(&[("Host", args.gateway_host.as_str())]).unwrap_or_default();
-    if let Some(value) = std::env::var("DETMIR_PORTAL_AUTH_HEADER")
-        .ok()
-        .map(|value| value.trim().to_string())
-        .filter(|value| !value.is_empty())
-    {
-        if let Ok(value) = HeaderValue::from_str(&value) {
-            headers.insert(AUTHORIZATION, value);
-        }
-    }
-    headers
-}
-
 fn fetch_text(
     url: &str,
     timeout: Duration,
@@ -305,7 +258,6 @@ fn fetch_text(
 fn service_checks(args: &Cli) -> Vec<ServiceCheck> {
     let timeout = Duration::from_secs(args.service_timeout_seconds);
     let one_c_url = args.one_c_url.trim_end_matches('/');
-    let portal_url = args.portal_url.trim_end_matches('/');
     let services = [
         (
             "aw-info",
@@ -333,10 +285,10 @@ fn service_checks(args: &Cli) -> Vec<ServiceCheck> {
         ),
         (
             "gateway-healthz",
-            format!("{portal_url}/healthz"),
+            "https://127.0.0.1/healthz".to_string(),
             true,
             true,
-            portal_headers(args),
+            build_headers(&[("Host", DEFAULT_GATEWAY_HOST)]).unwrap_or_default(),
         ),
     ];
 
@@ -381,185 +333,12 @@ fn service_checks(args: &Cli) -> Vec<ServiceCheck> {
     if !args.disable_grafana_check {
         checks.push(grafana_data_check(args));
     }
-    if !args.disable_portal_check {
-        checks.extend(portal_checks(args));
-    }
     if security_events_clickhouse_enabled(args) {
         checks.push(clickhouse_security_events_check(args));
     }
-    if !args.disable_dlp_health_check {
-        checks.push(dlp_health_check(args));
-    }
     checks
 }
 
-fn portal_checks(args: &Cli) -> Vec<ServiceCheck> {
-    let base = args.portal_url.trim_end_matches('/');
-    [
-        ("portal-healthz", "/healthz", true),
-        ("portal-readyz", "/readyz", true),
-        ("portal-version", "/version", true),
-        ("portal-metrics", "/metrics", true),
-    ]
-    .into_iter()
-    .map(|(name, path, required)| {
-        let url = format!("{base}{path}");
-        let headers = portal_headers(args);
-        match fetch_text(
-            &url,
-            Duration::from_secs(args.service_timeout_seconds),
-            true,
-            headers,
-            2,
-        ) {
-            Ok(raw) => {
-                let payload = serde_json::from_str::<Value>(&raw).unwrap_or_else(|_| {
-                    Value::String(raw.lines().next().unwrap_or("").to_string())
-                });
-                ServiceCheck {
-                    name: name.to_string(),
-                    required,
-                    ok: true,
-                    url: Some(url),
-                    payload: Some(payload),
-                    error: None,
-                }
-            }
-            Err(err) => ServiceCheck {
-                name: name.to_string(),
-                required,
-                ok: false,
-                url: Some(url),
-                payload: None,
-                error: Some(err.to_string()),
-            },
-        }
-    })
-    .collect()
-}
-
-fn dlp_health_check(args: &Cli) -> ServiceCheck {
-    let name = "aw-dlp-health".to_string();
-    match run_shell_command_timeout(
-        &args.dlp_command,
-        Duration::from_secs(args.dlp_timeout_seconds),
-    ) {
-        Ok(output) if output.timed_out => ServiceCheck {
-            name,
-            required: true,
-            ok: false,
-            url: None,
-            payload: None,
-            error: Some(format!(
-                "DLP health command timed out after {} seconds",
-                args.dlp_timeout_seconds
-            )),
-        },
-        Ok(output) => {
-            let payload = serde_json::from_str::<Value>(&output.stdout).unwrap_or_else(|_| {
-                Value::String(output.stdout.lines().next().unwrap_or("").to_string())
-            });
-            let ok = output.code == Some(0);
-            ServiceCheck {
-                name,
-                required: true,
-                ok,
-                url: None,
-                payload: Some(payload),
-                error: if ok {
-                    None
-                } else {
-                    Some(format!(
-                        "DLP health command exited with {:?}: {}",
-                        output.code,
-                        sanitize_command_stderr(&output.stderr)
-                    ))
-                },
-            }
-        }
-        Err(err) => ServiceCheck {
-            name,
-            required: true,
-            ok: false,
-            url: None,
-            payload: None,
-            error: Some(format!("cannot execute DLP health command: {err:#}")),
-        },
-    }
-}
-
-#[derive(Debug)]
-struct CommandOutput {
-    code: Option<i32>,
-    stdout: String,
-    stderr: String,
-    timed_out: bool,
-}
-
-fn run_shell_command_timeout(command: &str, timeout: Duration) -> Result<CommandOutput> {
-    let mut child = Command::new("/bin/sh")
-        .arg("-lc")
-        .arg(command)
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped())
-        .spawn()
-        .with_context(|| format!("failed to spawn command: {command}"))?;
-    let started = Instant::now();
-    loop {
-        if let Some(status) = child.try_wait().context("command wait failed")? {
-            return read_command_output(child, status.code(), false);
-        }
-        if started.elapsed() >= timeout {
-            let _ = child.kill();
-            let _ = child.wait();
-            return read_command_output(child, None, true);
-        }
-        std::thread::sleep(Duration::from_millis(100));
-    }
-}
-
-fn read_command_output(
-    mut child: std::process::Child,
-    code: Option<i32>,
-    timed_out: bool,
-) -> Result<CommandOutput> {
-    let mut stdout = String::new();
-    let mut stderr = String::new();
-    if let Some(mut pipe) = child.stdout.take() {
-        pipe.read_to_string(&mut stdout)
-            .context("failed to read command stdout")?;
-    }
-    if let Some(mut pipe) = child.stderr.take() {
-        pipe.read_to_string(&mut stderr)
-            .context("failed to read command stderr")?;
-    }
-    Ok(CommandOutput {
-        code,
-        stdout,
-        stderr,
-        timed_out,
-    })
-}
-
-fn sanitize_command_stderr(stderr: &str) -> String {
-    let trimmed = stderr.trim();
-    if trimmed.is_empty() {
-        return "no stderr".to_string();
-    }
-    trimmed
-        .lines()
-        .take(3)
-        .map(|line| {
-            if line.chars().count() > 240 {
-                format!("{}...", line.chars().take(240).collect::<String>())
-            } else {
-                line.to_string()
-            }
-        })
-        .collect::<Vec<_>>()
-        .join(" | ")
-}
-
 fn security_events_clickhouse_enabled(args: &Cli) -> bool {
     args.security_events_backend
         .trim()
@@ -998,8 +777,6 @@ fn main() -> Result<()> {
     args.one_c_url = env_or_default("DETMIR_ONE_C_URL", &args.one_c_url);
     args.rdp_host = env_or_default("DETMIR_RDP_HOST", &args.rdp_host);
     args.hostname = env_or_default("DETMIR_HOSTNAME", &args.hostname);
-    args.gateway_host = env_or_default("DETMIR_GATEWAY_HOST", &args.gateway_host);
-    args.portal_url = env_or_default("DETMIR_PORTAL_URL", &args.portal_url);
     args.grafana_check_json = env_or_default("DETMIR_GRAFANA_CHECK_JSON", &args.grafana_check_json);
     args.security_events_backend =
         env_or_default("SECURITY_EVENTS_BACKEND", &args.security_events_backend);
@@ -1007,13 +784,6 @@ fn main() -> Result<()> {
     args.clickhouse_database = env_or_default("CLICKHOUSE_DATABASE", &args.clickhouse_database);
     args.clickhouse_user = env_or_default("CLICKHOUSE_USER", &args.clickhouse_user);
     args.clickhouse_password = env_or_default("CLICKHOUSE_PASSWORD", &args.clickhouse_password);
-    args.dlp_command = env_or_default("DETMIR_DLP_COMMAND", &args.dlp_command);
-    if env_flag_enabled("DETMIR_DISABLE_DLP_HEALTH_CHECK") {
-        args.disable_dlp_health_check = true;
-    }
-    if env_flag_enabled("DETMIR_DISABLE_PORTAL_CHECK") {
-        args.disable_portal_check = true;
-    }
 
     let report = build_report(&args)?;
     if args.json {
@@ -1085,16 +855,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn env_flag_accepts_true_values_only() {
-        assert!(parse_env_flag("true"));
-        assert!(parse_env_flag("1"));
-        assert!(parse_env_flag("yes"));
-        assert!(parse_env_flag("on"));
-        assert!(!parse_env_flag("0"));
-        assert!(!parse_env_flag("false"));
-    }
-
     #[test]
     fn clickhouse_database_identifier_rejects_injection() {
         assert_eq!(

adk-rust/crates/detmir-core/src/lib.rs

@@ -1,37 +1,19 @@
-#![deny(unsafe_op_in_unsafe_fn)]
-
-//! Shared production primitives for AWatch-rus.
-//!
-//! This crate intentionally stays small and dependency-light. It contains the
-//! status, exit-code and runtime-configuration guardrails that are reused by
-//! operational binaries and health/check tooling. Keep business-specific portal,
-//! DLP or workforce logic out of this crate.
-
 use std::fmt;
 
 use anyhow::{Context, Result};
 use chrono::{DateTime, SecondsFormat, Utc};
 use serde::{Deserialize, Serialize};
 
-/// Normalized health/check status used by CLI tools, probes and JSON payloads.
-///
-/// CONTRACT: serialized values are uppercase and must remain stable because
-/// deployment scripts, smoke checks and dashboards can key off these strings.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "UPPERCASE")]
 pub enum StatusLevel {
-    /// Component is healthy and the check passed.
     Ok,
-    /// Component works, but a risk or degraded condition needs attention.
     Warn,
-    /// Component check failed or a required dependency is unavailable.
     Fail,
-    /// Component did not provide enough information for a reliable status.
     Unknown,
 }
 
 impl StatusLevel {
-    /// Return the stable uppercase representation used in human and JSON output.
     pub fn as_str(self) -> &'static str {
         match self {
             Self::Ok => "OK",
@@ -41,10 +23,6 @@ impl StatusLevel {
         }
     }
 
-    /// Map status to the process exit code expected by operational checks.
-    ///
-    /// CONTRACT: `WARN` exits as a failed check rather than success so that
-    /// automation does not silently ignore degraded production state.
     pub fn exit_code(self) -> i32 {
         match self {
             Self::Ok => exit_codes::OK,
@@ -70,39 +48,23 @@ impl From<&str> for StatusLevel {
     }
 }
 
-/// Stable process exit codes for AWatch-rus operational binaries.
-///
-/// CONTRACT: keep these numeric values stable. Shell scripts, systemd units,
-/// smoke tests and runbooks can depend on them.
 pub mod exit_codes {
-    /// Successful execution.
     pub const OK: i32 = 0;
-    /// Unexpected runtime or IO error.
     pub const ERROR: i32 = 1;
-    /// Health/check policy failed or returned a degraded status.
     pub const CHECK_FAILED: i32 = 2;
-    /// A safety policy denied a requested action.
     pub const POLICY_DENIED: i32 = 3;
 }
 
-/// Return the current UTC timestamp in compact RFC3339/Zulu format.
 pub fn now_utc_rfc3339() -> String {
     Utc::now().to_rfc3339_opts(SecondsFormat::Secs, true)
 }
 
-/// Parse an RFC3339 timestamp and normalize it to UTC.
 pub fn parse_utc_rfc3339(value: &str) -> Result<DateTime<Utc>> {
     DateTime::parse_from_rfc3339(value)
         .with_context(|| format!("invalid RFC3339 timestamp: {value}"))
         .map(|ts| ts.with_timezone(&Utc))
 }
 
-/// Runtime configuration guardrails.
-///
-/// SECURITY: these helpers are deliberately conservative. They reject empty,
-/// documentation, TEST-NET and common placeholder values before a component is
-/// allowed to run in production mode. This prevents demo-safe examples from
-/// accidentally becoming live runtime configuration.
 pub mod runtime_guard {
     use anyhow::{Result, bail};
 
@@ -120,11 +82,6 @@ pub mod runtime_guard {
         "PASSWORD",
     ];
 
-    /// Return true when a value looks like a public/demo placeholder.
-    ///
-    /// RATIONALE: AWatch-rus documentation intentionally uses TEST-NET ranges
-    /// and HOST-EXAMPLE markers. Production binaries should fail closed when
-    /// such values reach runtime configuration.
     pub fn is_runtime_placeholder(value: &str) -> bool {
         let trimmed = value.trim();
         if trimmed.is_empty() {
@@ -149,7 +106,6 @@ pub mod runtime_guard {
             || (normalized.starts_with('<') && normalized.ends_with('>'))
     }
 
-    /// Return true when a value is unsafe for a secret-like configuration field.
     pub fn is_secret_placeholder(value: &str) -> bool {
         is_runtime_placeholder(value)
             || matches!(
@@ -158,10 +114,6 @@ pub mod runtime_guard {
             )
     }
 
-    /// Ensure a required runtime value is not empty or demo-only.
-    ///
-    /// SECURITY: callers should invoke this before opening network connections,
-    /// starting ingestion or enabling exporters in production mode.
     pub fn ensure_runtime_value(name: &str, value: &str, context: &str) -> Result<()> {
         if is_runtime_placeholder(value) {
             bail!("{name} contains an empty/example/TEST-NET value while {context}");
@@ -169,7 +121,6 @@ pub mod runtime_guard {
         Ok(())
     }
 
-    /// Ensure a required secret is not empty or an obvious placeholder.
     pub fn ensure_secret_value(name: &str, value: &str, context: &str) -> Result<()> {
         if is_secret_placeholder(value) {
             bail!("{name} contains an empty/example secret value while {context}");
@@ -177,7 +128,6 @@ pub mod runtime_guard {
         Ok(())
     }
 
-    /// Ensure an iterator of runtime values is non-empty and production-safe.
     pub fn ensure_runtime_values<'a>(
         name: &str,
         values: impl IntoIterator<Item = &'a String>,
@@ -194,12 +144,6 @@ pub mod runtime_guard {
         Ok(())
     }
 
-    /// Validate a complete InfluxDB exporter configuration block.
-    ///
-    /// CONTRACT: when an exporter is enabled, URL, org, bucket, token and host
-    /// list must all be real runtime values. A partial/demo exporter config is
-    /// more dangerous than a disabled exporter because it creates false
-    /// confidence in monitoring readiness.
     pub fn ensure_influx_runtime_config(
         prefix: &str,
         url: &str,

adk-rust/crates/detmir-portal/Cargo.toml

@@ -18,11 +18,6 @@ serde_json.workspace = true
 serde_yaml.workspace = true
 sha2.workspace = true
 tiny_http.workspace = true
-url.workspace = true
 
 [dev-dependencies]
 tempfile.workspace = true
-
-[lints.clippy]
-comparison_chain = "allow"
-search_is_some = "allow"

adk-rust/crates/detmir-portal/src/api_contracts.rs

@@ -1,57 +0,0 @@
-//! Portal API contract summary payload.
-//!
-//! CONTRACT: this module describes stable public API routes exposed by the
-//! current Rust HTML/HTMX portal and future clients. Keep changes additive
-//! unless the OpenAPI/TypeScript contracts are updated in the same PR.
-
-use serde_json::{Value, json};
-
-pub(crate) fn api_contract_summary() -> Value {
-    json!({
-        "ok": true,
-        "contract_version": "2026-06-06.pilot-v1",
-        "generated_by": "detmir-portal",
-        "api_base": "/api",
-        "compatibility": {
-            "policy": "additive",
-            "main_ui": "rust-server-rendered-html-htmx-compatible",
-            "unknown_fields": "clients must ignore unknown fields",
-            "nullable_fields": "clients must tolerate null and missing optional fields",
-            "forbidden_ui_stacks": ["dioxus", "react", "tauri", "electron"]
-        },
-        "targets": ["rust-html", "htmx-compatible"],
-        "artifacts": {
-            "openapi": "/api/contracts/openapi.json",
-            "typescript": "/api/contracts/typescript.d.ts"
-        },
-        "stable_endpoints": [
-            {"method": "GET", "path": "/healthz", "purpose": "process liveness without external dependency checks"},
-            {"method": "GET", "path": "/readyz", "purpose": "local readiness and contract-only dependency status"},
-            {"method": "GET", "path": "/version", "purpose": "safe build and schema version metadata"},
-            {"method": "GET", "path": "/metrics", "purpose": "Prometheus metrics without high-cardinality labels"},
-            {"method": "GET", "path": "/api/health", "purpose": "light service health"},
-            {"method": "GET", "path": "/api/contracts", "purpose": "contract index"},
-            {"method": "GET", "path": "/api/contracts/openapi.json", "purpose": "OpenAPI contract"},
-            {"method": "GET", "path": "/api/contracts/typescript.d.ts", "purpose": "TypeScript declarations"},
-            {"method": "GET", "path": "/api/operator", "purpose": "portal overview data"},
-            {"method": "GET", "path": "/api/reports", "purpose": "management report payload"},
-            {"method": "GET", "path": "/api/executive", "purpose": "executive role payload"},
-            {"method": "GET", "path": "/api/workforce", "purpose": "workforce role payload"},
-            {"method": "GET", "path": "/api/security", "purpose": "security role payload"},
-            {"method": "GET", "path": "/api/forensics", "purpose": "forensics role payload"},
-            {"method": "GET", "path": "/api/ueba", "purpose": "rule-based UEBA score v1"},
-            {"method": "GET", "path": "/api/pfsense", "purpose": "pfSense readiness contracts and demo fixtures"},
-            {"method": "GET", "path": "/api/incidents", "purpose": "incident and DLP evidence summary"},
-            {"method": "GET", "path": "/api/cases", "purpose": "case list"},
-            {"method": "POST", "path": "/api/incident-review", "purpose": "manual candidate review status"},
-            {"method": "POST", "path": "/api/cases", "purpose": "manual case creation"},
-            {"method": "GET", "path": "/api/investigation-pack/{candidate_id}", "purpose": "candidate investigation pack"},
-            {"method": "GET", "path": "/api/dlp/evidence", "purpose": "DLP evidence list"},
-            {"method": "GET", "path": "/api/readiness/latest", "purpose": "latest readiness status"},
-            {"method": "GET", "path": "/api/workforce/policy/explain", "purpose": "workforce policy explanation"},
-            {"method": "GET", "path": "/api/workforce/kpi/explain", "purpose": "rule-based Workforce KPI explanation"},
-            {"method": "GET", "path": "/api/risk/narrative", "purpose": "rule-based executive risk narrative"},
-            {"method": "GET", "path": "/api/actions", "purpose": "rule-based executive action center"}
-        ]
-    })
-}

adk-rust/crates/detmir-portal/src/command_runner.rs

@@ -1,26 +0,0 @@
-//! External command execution helpers for the portal.
-//!
-//! CONTRACT: these helpers are intentionally small and side-effect explicit.
-//! They preserve stdout/stderr error text because readiness verification APIs
-//! expose command failure diagnostics to operators.
-
-use std::path::Path;
-use std::process::Command;
-
-pub(crate) fn run_in_dir(dir: &Path, command: &mut Command) -> std::result::Result<(), String> {
-    let output = command
-        .current_dir(dir)
-        .output()
-        .map_err(|err| format!("run command in {}: {err}", dir.display()))?;
-    if output.status.success() {
-        Ok(())
-    } else {
-        Err(format!(
-            "{}{}",
-            String::from_utf8_lossy(&output.stdout),
-            String::from_utf8_lossy(&output.stderr)
-        )
-        .trim()
-        .to_string())
-    }
-}

adk-rust/crates/detmir-portal/src/http_response.rs

@@ -1,127 +0,0 @@
-//! HTTP response helpers for the portal.
-//!
-//! CONTRACT: this module owns response serialization, headers, request-id /
-//! correlation-id propagation and response metrics logging. It must not change
-//! routes, payload schemas, MIME types or UI contents.
-
-use std::fs;
-use std::path::Path;
-
-use anyhow::{Context, Result, anyhow};
-use serde::Serialize;
-use tiny_http::{Header, Request, Response, StatusCode};
-
-use crate::production::{http_request_metadata, log_http_request, record_http_metric};
-use crate::screenshot_basename;
-
-pub(crate) fn respond_json<T: Serialize>(request: Request, value: &T) -> Result<()> {
-    let body = serde_json::to_string_pretty(value)?;
-    respond_text(
-        request,
-        StatusCode(200),
-        &body,
-        "application/json; charset=utf-8",
-    )
-}
-
-pub(crate) fn respond_json_status<T: Serialize>(
-    request: Request,
-    status: StatusCode,
-    value: &T,
-) -> Result<()> {
-    let body = serde_json::to_string_pretty(value)?;
-    respond_text(request, status, &body, "application/json; charset=utf-8")
-}
-
-pub(crate) fn respond_text(
-    request: Request,
-    status: StatusCode,
-    body: &str,
-    content_type: &str,
-) -> Result<()> {
-    let metadata = http_request_metadata(&request);
-    record_http_metric(&metadata, status);
-    log_http_request(&metadata, status, body.len());
-    let response = Response::from_string(body.to_string())
-        .with_status_code(status)
-        .with_header(header("Content-Type", content_type)?)
-        .with_header(header("Cache-Control", "no-store")?)
-        .with_header(header("X-Request-Id", &metadata.request_id)?)
-        .with_header(header("X-Correlation-Id", &metadata.correlation_id)?);
-    request.respond(response).map_err(|err| anyhow!("{err}"))
-}
-
-pub(crate) fn respond_text_download(
-    request: Request,
-    status: StatusCode,
-    body: &str,
-    content_type: &str,
-    download_name: &str,
-) -> Result<()> {
-    let metadata = http_request_metadata(&request);
-    record_http_metric(&metadata, status);
-    log_http_request(&metadata, status, body.len());
-    let response = Response::from_string(body.to_string())
-        .with_status_code(status)
-        .with_header(header("Content-Type", content_type)?)
-        .with_header(header("Cache-Control", "no-store")?)
-        .with_header(header("X-Request-Id", &metadata.request_id)?)
-        .with_header(header("X-Correlation-Id", &metadata.correlation_id)?)
-        .with_header(header(
-            "Content-Disposition",
-            &format!(
-                "attachment; filename=\"{}\"",
-                download_name.replace('"', "")
-            ),
-        )?);
-    request.respond(response).map_err(|err| anyhow!("{err}"))
-}
-
-pub(crate) fn respond_file(
-    request: Request,
-    path: &Path,
-    content_type: &str,
-    download_name: Option<&str>,
-) -> Result<()> {
-    let data = fs::read(path).with_context(|| format!("read {}", path.display()))?;
-    let metadata = http_request_metadata(&request);
-    record_http_metric(&metadata, StatusCode(200));
-    log_http_request(&metadata, StatusCode(200), data.len());
-    let mut response = Response::from_data(data)
-        .with_status_code(StatusCode(200))
-        .with_header(header("Content-Type", content_type)?)
-        .with_header(header("Cache-Control", "no-store")?)
-        .with_header(header("X-Request-Id", &metadata.request_id)?)
-        .with_header(header("X-Correlation-Id", &metadata.correlation_id)?);
-    if let Some(name) = download_name.and_then(screenshot_basename) {
-        response = response.with_header(header(
-            "Content-Disposition",
-            &format!("attachment; filename=\"{}\"", name.replace('"', "")),
-        )?);
-    }
-    request.respond(response).map_err(|err| anyhow!("{err}"))
-}
-
-pub(crate) fn safe_download_stem(value: &str) -> String {
-    let stem = value
-        .chars()
-        .map(|ch| {
-            if ch.is_ascii_alphanumeric() || matches!(ch, '-' | '_' | '.') {
-                ch
-            } else {
-                '_'
-            }
-        })
-        .take(96)
-        .collect::<String>();
-    if stem.is_empty() {
-        "candidate".to_string()
-    } else {
-        stem
-    }
-}
-
-fn header(name: &str, value: &str) -> Result<Header> {
-    Header::from_bytes(name.as_bytes(), value.as_bytes())
-        .map_err(|_| anyhow!("invalid header {name}: {value}"))
-}

adk-rust/crates/detmir-portal/src/path_query.rs

@@ -1,54 +0,0 @@
-//! URL path and query parsing helpers for the portal.
-//!
-//! CONTRACT: these helpers are routing glue. Keep accepted URL shapes stable
-//! because API handlers and the HTML portal depend on them.
-
-pub(crate) fn normalize_path(url: &str) -> String {
-    let path = url.split('?').next().unwrap_or("/");
-    let path = path.strip_prefix("/portal").unwrap_or(path);
-    if path.is_empty() {
-        "/".to_string()
-    } else {
-        path.to_string()
-    }
-}
-
-pub(crate) fn query_flag(url: &str, key: &str) -> bool {
-    let Some(query) = url.split_once('?').map(|(_, query)| query) else {
-        return false;
-    };
-    query.split('&').any(|pair| {
-        let (name, value) = pair.split_once('=').unwrap_or((pair, "1"));
-        name == key && matches!(value, "1" | "true" | "yes" | "on")
-    })
-}
-
-pub(crate) fn query_param(url: &str, key: &str) -> Option<String> {
-    let query = url.split_once('?').map(|(_, query)| query)?;
-    query.split('&').find_map(|pair| {
-        let (name, value) = pair.split_once('=').unwrap_or((pair, ""));
-        (name == key && !value.is_empty()).then(|| value.to_string())
-    })
-}
-
-pub(crate) fn parse_investigation_pack_path(path: &str) -> Option<String> {
-    path.strip_prefix("/api/investigation-pack/")
-        .map(str::trim)
-        .filter(|value| !value.is_empty() && !value.contains('/'))
-        .map(ToString::to_string)
-}
-
-pub(crate) fn parse_case_path(path: &str) -> Option<String> {
-    path.strip_prefix("/api/cases/")
-        .map(str::trim)
-        .filter(|value| !value.is_empty() && !value.contains('/'))
-        .map(ToString::to_string)
-}
-
-pub(crate) fn parse_case_status_path(path: &str) -> Option<String> {
-    path.strip_prefix("/api/cases/")
-        .and_then(|value| value.strip_suffix("/status"))
-        .map(str::trim)
-        .filter(|value| !value.is_empty() && !value.contains('/'))
-        .map(ToString::to_string)
-}

adk-rust/crates/detmir-portal/src/portal_roles.rs

@@ -1,77 +0,0 @@
-//! Portal role model and access-scope contract.
-//!
-//! CONTRACT: role aliases, serialized values and allowed scopes are part of
-//! the portal API/security boundary. Keep changes explicit and covered by
-//! existing role-gate tests in `main.rs`.
-
-use serde::Serialize;
-
-#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)]
-#[serde(rename_all = "snake_case")]
-pub(crate) enum PortalRole {
-    Executive,
-    Manager,
-    Security,
-    Forensics,
-    Admin,
-}
-
-impl PortalRole {
-    pub(crate) fn parse(value: &str) -> Option<Self> {
-        match value.trim().to_ascii_lowercase().as_str() {
-            "executive" | "owner" | "rukovoditel" | "руководитель" => {
-                Some(Self::Executive)
-            }
-            "manager" | "workforce" | "руководитель_подразделения" => {
-                Some(Self::Manager)
-            }
-            "security" | "ib" | "soc" | "безопасность" => Some(Self::Security),
-            "forensics" | "investigation" | "расследования" => Some(Self::Forensics),
-            "admin" | "operations" | "operator" | "эксплуатация" => Some(Self::Admin),
-            _ => None,
-        }
-    }
-
-    pub(crate) fn as_str(self) -> &'static str {
-        match self {
-            Self::Executive => "executive",
-            Self::Manager => "manager",
-            Self::Security => "security",
-            Self::Forensics => "forensics",
-            Self::Admin => "admin",
-        }
-    }
-
-    pub(crate) fn label_ru(self) -> &'static str {
-        match self {
-            Self::Executive => "Руководитель",
-            Self::Manager => "Руководитель подразделения",
-            Self::Security => "Безопасность",
-            Self::Forensics => "Расследования",
-            Self::Admin => "Администратор",
-        }
-    }
-
-    pub(crate) fn allowed_scopes(self) -> &'static [&'static str] {
-        match self {
-            Self::Executive => &["executive", "workforce"],
-            Self::Manager => &["executive", "workforce"],
-            Self::Security => &["security", "incidents", "ueba", "pfsense"],
-            Self::Forensics => &["forensics", "incidents", "ueba"],
-            Self::Admin => &[
-                "executive",
-                "workforce",
-                "security",
-                "forensics",
-                "incidents",
-                "ueba",
-                "pfsense",
-                "admin",
-            ],
-        }
-    }
-
-    pub(crate) fn can_access(self, scope: &str) -> bool {
-        self.allowed_scopes().contains(&scope)
-    }
-}

adk-rust/crates/detmir-portal/src/production/health.rs

@@ -1,8 +1,3 @@
-//! Liveness probe payload.
-//!
-//! CONTRACT: `/healthz` is intentionally shallow. It proves that the portal
-//! process can answer HTTP, while dependency checks belong to `/readyz`.
-
 use serde_json::{Value, json};
 
 use crate::now;

adk-rust/crates/detmir-portal/src/production/limits.rs

@@ -1,17 +1,9 @@
-//! Configuration and request-bound validation for production portal routes.
-//!
-//! RATIONALE: the portal can aggregate reports, evidence and external service
-//! payloads. Query and body limits keep pilot installations responsive and make
-//! expensive report routes fail closed instead of exhausting memory or blocking
-//! the single-process runtime.
-
 use std::collections::BTreeSet;
 
 use anyhow::{Result, anyhow};
 use chrono::NaiveDate;
 use serde_json::{Value, json};
 use tiny_http::StatusCode;
-use url::Url;
 
 use crate::{
     Cli, MAX_ALLOWED_PAGE_SIZE, MAX_ALLOWED_REPORT_DATE_RANGE_DAYS, MAX_ALLOWED_REQUEST_BODY_BYTES,
@@ -38,10 +30,6 @@ pub(crate) fn validate_portal_config(args: &Cli) -> Result<()> {
     if port == 0 {
         return Err(anyhow!("invalid config port: expected 1..65535"));
     }
-
-    // RATIONALE: page and date limits protect heavy report endpoints while
-    // preserving monthly pilot reporting. Hard upper bounds prevent accidental
-    // production overrides from turning the portal into an unbounded exporter.
     if args.max_page_size == 0 || args.max_page_size > MAX_ALLOWED_PAGE_SIZE {
         return Err(anyhow!(
             "invalid config max_page_size: expected 1..={MAX_ALLOWED_PAGE_SIZE}"
@@ -78,15 +66,6 @@ pub(crate) fn validate_portal_config(args: &Cli) -> Result<()> {
             "invalid config max_request_body_bytes: expected 1024..={MAX_ALLOWED_REQUEST_BODY_BYTES}"
         ));
     }
-    validate_runtime_url("worktime_url", &args.worktime_url)?;
-    validate_runtime_url("one_c_url", &args.one_c_url)?;
-    validate_probe_command("status_cmd", &args.status_cmd)?;
-    validate_probe_command("check_cmd", &args.check_cmd)?;
-    validate_probe_command("failed_units_cmd", &args.failed_units_cmd)?;
-
-    // SECURITY: environment and module names can reach metrics/log labels.
-    // Restrict them to short ASCII tokens to avoid label injection and runaway
-    // cardinality from free-form deployment names.
     if !is_safe_environment_name(&args.environment) {
         return Err(anyhow!(
             "invalid config environment: use 1..32 chars from A-Z, a-z, 0-9, _, -"
@@ -118,46 +97,6 @@ pub(crate) fn validate_portal_config(args: &Cli) -> Result<()> {
     Ok(())
 }
 
-fn validate_runtime_url(name: &str, value: &str) -> Result<()> {
-    let url = Url::parse(value).map_err(|err| anyhow!("invalid config {name}: {err}"))?;
-    if !matches!(url.scheme(), "http" | "https") {
-        return Err(anyhow!("invalid config {name}: expected http or https URL"));
-    }
-    let Some(host) = url.host_str() else {
-        return Err(anyhow!("invalid config {name}: missing host"));
-    };
-    if is_placeholder_host(host) {
-        return Err(anyhow!(
-            "invalid config {name}: placeholder/documentation host is not allowed in production"
-        ));
-    }
-    Ok(())
-}
-
-fn is_placeholder_host(host: &str) -> bool {
-    let host = host.trim().to_ascii_lowercase();
-    host.is_empty()
-        || host == "host-example"
-        || host.ends_with(".example")
-        || host.starts_with("192.0.2.")
-        || host.starts_with("198.51.100.")
-        || host.starts_with("203.0.113.")
-}
-
-fn validate_probe_command(name: &str, command: &str) -> Result<()> {
-    let command = command.trim();
-    if command.is_empty() {
-        return Err(anyhow!("invalid config {name}: command is empty"));
-    }
-    let forbidden = ['\n', '\r', '\0', ';', '|', '&', '<', '>', '`'];
-    if command.contains("$(") || command.chars().any(|ch| forbidden.contains(&ch)) {
-        return Err(anyhow!(
-            "invalid config {name}: shell control operators are not allowed"
-        ));
-    }
-    Ok(())
-}
-
 fn is_safe_environment_name(value: &str) -> bool {
     let value = value.trim();
     !value.is_empty()
@@ -276,7 +215,6 @@ mod tests {
             slow_request_log_ms: DEFAULT_SLOW_REQUEST_LOG_MS,
             environment: "test".to_string(),
             enabled_modules: "executive,workforce,security,forensics,admin".to_string(),
-            dlp_module_enabled: true,
             state_dir: dir.join("state"),
             dlp_db_path: dir.join("dlp.sqlite"),
             evidence_root: dir.to_path_buf(),
@@ -286,7 +224,7 @@ mod tests {
             json_smoke: false,
             evidence_only: false,
             evidence_upload_token: None,
-            telemetry_api_key: "dummy".to_string(),
+            telemetry_api_key: "test-key".to_string(),
             telemetry_store_path: dir.join("telemetry.jsonl"),
             expected_nodes_path: dir.join("expected_nodes.json"),
             security_events_backend: "disabled".to_string(),
@@ -340,39 +278,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn config_validation_rejects_placeholder_endpoints_and_shell_operators() {
-        let dir = tempfile::tempdir().unwrap();
-        let args = test_cli(dir.path());
-
-        let mut invalid = args.clone();
-        invalid.worktime_url = "http://192.0.2.13:5610".to_string();
-        assert!(
-            validate_portal_config(&invalid)
-                .unwrap_err()
-                .to_string()
-                .contains("placeholder")
-        );
-
-        let mut invalid = args.clone();
-        invalid.one_c_url = "http://198.51.100.2:8710".to_string();
-        assert!(
-            validate_portal_config(&invalid)
-                .unwrap_err()
-                .to_string()
-                .contains("placeholder")
-        );
-
-        let mut invalid = args.clone();
-        invalid.check_cmd = "detmir-check --json; curl http://127.0.0.1".to_string();
-        assert!(
-            validate_portal_config(&invalid)
-                .unwrap_err()
-                .to_string()
-                .contains("shell control")
-        );
-    }
-
     #[test]
     fn query_limits_reject_page_size_and_report_range() {
         let dir = tempfile::tempdir().unwrap();

adk-rust/crates/detmir-portal/src/production/logging.rs

@@ -1,10 +1,3 @@
-//! Structured HTTP access logging for the portal runtime.
-//!
-//! CONTRACT: logs are emitted as single-line JSON to stderr so systemd/journald,
-//! container runtimes and log forwarders can parse them without scraping free
-//! text. Do not log raw request bodies, secrets, evidence bytes or personal
-//! payloads here.
-
 use serde_json::{Value, json};
 use tiny_http::StatusCode;
 
@@ -28,10 +21,6 @@ pub(crate) fn log_http_request(
     } else {
         Value::Null
     };
-
-    // SECURITY: include routing/correlation fields, but do not include query
-    // values, request body, headers or tokens. Those can contain employee data,
-    // screenshots, evidence references or API keys.
     eprintln!(
         "{}",
         json!({

adk-rust/crates/detmir-portal/src/production/metrics.rs

@@ -1,9 +1,3 @@
-//! In-process Prometheus-style metrics for the portal.
-//!
-//! CONTRACT: metric names and label keys are part of the operational contract
-//! used by dashboards and smoke checks. Additive metrics are allowed; renaming
-//! existing metrics requires synchronized dashboard/documentation changes.
-
 use std::collections::BTreeMap;
 use std::fmt::Write as FmtWrite;
 use std::sync::{Mutex, OnceLock};
@@ -34,10 +28,6 @@ struct HttpMetricValue {
 #[derive(Clone, Debug, Default)]
 struct PortalMetrics {
     http: BTreeMap<HttpMetricKey, HttpMetricValue>,
-    report_requests_total: u64,
-    report_cache_hits_total: u64,
-    report_cache_misses_total: u64,
-    report_cache_stale_hits_total: u64,
     reports_generated_total: u64,
     ingestion_records_total: u64,
     ingestion_rejected_total: u64,
@@ -74,32 +64,6 @@ pub(crate) fn record_report_generated() {
     }
 }
 
-pub(crate) fn record_report_request() {
-    if let Ok(mut metrics) = portal_metrics().lock() {
-        metrics.report_requests_total = metrics.report_requests_total.saturating_add(1);
-    }
-}
-
-pub(crate) fn record_report_cache_hit() {
-    if let Ok(mut metrics) = portal_metrics().lock() {
-        metrics.report_cache_hits_total = metrics.report_cache_hits_total.saturating_add(1);
-    }
-}
-
-pub(crate) fn record_report_cache_stale_hit() {
-    if let Ok(mut metrics) = portal_metrics().lock() {
-        metrics.report_cache_hits_total = metrics.report_cache_hits_total.saturating_add(1);
-        metrics.report_cache_stale_hits_total =
-            metrics.report_cache_stale_hits_total.saturating_add(1);
-    }
-}
-
-pub(crate) fn record_report_cache_miss() {
-    if let Ok(mut metrics) = portal_metrics().lock() {
-        metrics.report_cache_misses_total = metrics.report_cache_misses_total.saturating_add(1);
-    }
-}
-
 pub(crate) fn record_ingestion_accepted() {
     if let Ok(mut metrics) = portal_metrics().lock() {
         metrics.ingestion_records_total = metrics.ingestion_records_total.saturating_add(1);
@@ -179,26 +143,6 @@ pub(crate) fn render_prometheus_metrics(args: &Cli) -> String {
         .ok();
     }
     for (name, help, value) in [
-        (
-            "awatch_report_requests_total",
-            "Report payload requests handled by the portal cache layer",
-            metrics.report_requests_total,
-        ),
-        (
-            "awatch_report_cache_hits_total",
-            "Report payload requests served from the in-process cache",
-            metrics.report_cache_hits_total,
-        ),
-        (
-            "awatch_report_cache_misses_total",
-            "Report payload requests that triggered report regeneration",
-            metrics.report_cache_misses_total,
-        ),
-        (
-            "awatch_report_cache_stale_hits_total",
-            "Report payload requests served from stale cache while refresh runs",
-            metrics.report_cache_stale_hits_total,
-        ),
         (
             "awatch_reports_generated_total",
             "Reports generated by the portal",
@@ -235,7 +179,5 @@ pub(crate) fn render_prometheus_metrics(args: &Cli) -> String {
 }
 
 fn prom_escape(value: &str) -> String {
-    // SECURITY: metric label values are route/module tokens, but escaping keeps
-    // the endpoint safe if future callers pass proxy-derived values.
     value.replace('\\', "\\\\").replace('"', "\\\"")
 }

adk-rust/crates/detmir-portal/src/production/mod.rs

@@ -1,14 +1,3 @@
-//! Production-facing portal runtime support.
-//!
-//! This module groups the cross-cutting concerns that must stay consistent
-//! across all portal routes: health/readiness/version contracts, query and
-//! configuration limits, structured logging, Prometheus-style metrics and
-//! request correlation metadata.
-//!
-//! CONTRACT: keep this module free from role-specific business rendering. It is
-//! the operational boundary around the portal, not the workforce/security report
-//! implementation itself.
-
 pub(crate) mod health;
 pub(crate) mod limits;
 pub(crate) mod logging;
@@ -22,8 +11,7 @@ pub(crate) use limits::{is_limited_api_route, validate_api_query_limits, validat
 pub(crate) use logging::log_http_request;
 pub(crate) use metrics::{
     record_http_metric, record_ingestion_accepted, record_ingestion_rejected,
-    record_report_cache_hit, record_report_cache_miss, record_report_cache_stale_hit,
-    record_report_generated, record_report_request, render_prometheus_metrics,
+    record_report_generated, render_prometheus_metrics,
 };
 pub(crate) use readiness::build_readyz;
 pub(crate) use request_context::{http_request_metadata, mark_request_started};

adk-rust/crates/detmir-portal/src/production/readiness.rs

@@ -1,10 +1,3 @@
-//! Readiness probe payload.
-//!
-//! CONTRACT: `/readyz` checks whether the portal is safe to receive normal
-//! traffic. It must remain conservative: configuration errors and broken state
-//! storage make the process `not_ready`; optional integrations can report
-//! `disabled`, `not_required` or `contract_only` without failing the whole probe.
-
 use std::path::Path;
 
 use serde_json::{Value, json};

adk-rust/crates/detmir-portal/src/production/request_context.rs

@@ -1,8 +1,3 @@
-//! Request correlation and route classification for portal observability.
-//!
-//! CONTRACT: generated route names must not expose volatile identifiers such as
-//! case IDs, candidate IDs or evidence IDs; use route templates instead.
-
 use std::cell::RefCell;
 use std::sync::atomic::{AtomicU64, Ordering};
 use std::time::{Instant, SystemTime, UNIX_EPOCH};
@@ -78,7 +73,7 @@ fn request_header(request: &Request, name: &str) -> Option<String> {
     request
         .headers()
         .iter()
-        .find(|header| header.field.as_str().as_str().eq_ignore_ascii_case(name))
+        .find(|header| header.field.to_string().eq_ignore_ascii_case(name))
         .map(|header| header.value.as_str().to_string())
 }
 

adk-rust/crates/detmir-portal/src/production/version.rs

@@ -1,8 +1,3 @@
-//! Build/version probe payload.
-//!
-//! CONTRACT: `/version` is used by smoke tests, runbooks and release evidence.
-//! Keep field names stable and add new fields only in a backward-compatible way.
-
 use serde_json::{Value, json};
 
 use crate::{Cli, PORTAL_SCHEMA_VERSION};

adk-rust/crates/detmir-portal/src/readiness_api.rs

@@ -1,112 +0,0 @@
-//! Readiness API payload helpers for the portal.
-//!
-//! CONTRACT: these helpers expose existing readiness bundle/status/verify
-//! payloads. Keep file names, JSON fields and verification commands stable
-//! unless the customer readiness contract is updated in the same PR.
-
-use std::fs;
-use std::path::Path;
-use std::process::Command;
-
-use anyhow::{Context, Result};
-use serde_json::{Value, json};
-
-use crate::command_runner::run_in_dir;
-use crate::{Cli, now};
-
-pub(crate) fn readiness_latest(args: &Cli) -> Value {
-    read_json_file(
-        &args
-            .readiness_bundle_dir
-            .join("detmir-readiness-latest.json"),
-    )
-    .unwrap_or_else(|err| {
-        json!({
-            "ok": false,
-            "generated_at_utc": now(),
-            "error": err.to_string(),
-        })
-    })
-}
-
-pub(crate) fn readiness_bundle(args: &Cli) -> Value {
-    let dir = &args.readiness_bundle_dir;
-    let status = read_json_file(&dir.join("detmir-readiness-status.json")).unwrap_or_else(|err| {
-        json!({
-            "ok": false,
-            "error": err.to_string(),
-        })
-    });
-    let latest_dir = fs::read_to_string(dir.join("latest-dir.txt"))
-        .unwrap_or_default()
-        .trim()
-        .to_string();
-    let artifacts = [
-        "detmir-readiness-latest.json",
-        "detmir-readiness-act.md",
-        "detmir-readiness-act.html",
-        "sha256sums.txt",
-        "sha256sums.txt.sig",
-        "public-key.pem",
-        "detmir-readiness-status.json",
-        "detmir-readiness.prom",
-    ]
-    .into_iter()
-    .filter_map(|name| {
-        let path = dir.join(name);
-        path.metadata().ok().map(|meta| {
-            json!({
-                "name": name,
-                "bytes": meta.len(),
-                "available": true,
-            })
-        })
-    })
-    .collect::<Vec<_>>();
-    json!({
-        "ok": status.get("ok").and_then(Value::as_bool).unwrap_or(false),
-        "generated_at_utc": now(),
-        "bundle_dir": dir.display().to_string(),
-        "latest_archive_dir": latest_dir,
-        "status": status,
-        "artifacts": artifacts,
-    })
-}
-
-pub(crate) fn readiness_verify(args: &Cli) -> Value {
-    let dir = &args.readiness_bundle_dir;
-    let checksum = run_in_dir(
-        dir,
-        Command::new("sha256sum").arg("-c").arg("sha256sums.txt"),
-    );
-    let sig_path = dir.join("sha256sums.txt.sig");
-    let pub_path = dir.join("public-key.pem");
-    let signature = if sig_path.is_file() && pub_path.is_file() {
-        run_in_dir(
-            dir,
-            Command::new("openssl")
-                .arg("dgst")
-                .arg("-sha256")
-                .arg("-verify")
-                .arg("public-key.pem")
-                .arg("-signature")
-                .arg("sha256sums.txt.sig")
-                .arg("sha256sums.txt"),
-        )
-    } else {
-        Err("signature files are not available".to_string())
-    };
-    json!({
-        "ok": checksum.is_ok() && signature.is_ok(),
-        "generated_at_utc": now(),
-        "checksum_verified": checksum.is_ok(),
-        "signature_verified": signature.is_ok(),
-        "checksum_error": checksum.err(),
-        "signature_error": signature.err(),
-    })
-}
-
-fn read_json_file(path: &Path) -> Result<Value> {
-    let text = fs::read_to_string(path).with_context(|| format!("read {}", path.display()))?;
-    serde_json::from_str(&text).with_context(|| format!("parse {}", path.display()))
-}

adk-rust/crates/detmir-portal/src/role_access.rs

@@ -1,52 +0,0 @@
-//! Portal role extraction and access-denial helpers.
-//!
-//! CONTRACT: role aliases, role envelope fields and forbidden response shape
-//! are part of the portal security boundary. Keep changes explicit and covered
-//! by role-gate tests.
-
-use anyhow::Result;
-use serde_json::{Value, json};
-use tiny_http::{Request, StatusCode};
-
-use crate::path_query::query_param;
-use crate::portal_roles::PortalRole;
-use crate::respond_json_status;
-
-pub(crate) fn portal_role_from_request(request: &Request, url: &str) -> PortalRole {
-    query_param(url, "role")
-        .as_deref()
-        .and_then(PortalRole::parse)
-        .or_else(|| {
-            request
-                .headers()
-                .iter()
-                .find(|header| header.field.equiv("X-AWatch-Role"))
-                .and_then(|header| PortalRole::parse(header.value.as_str()))
-        })
-        .unwrap_or(PortalRole::Executive)
-}
-
-pub(crate) fn role_envelope(role: PortalRole, scope: &str) -> Value {
-    json!({
-        "role": role.as_str(),
-        "role_label": role.label_ru(),
-        "scope": scope,
-        "allowed_scopes": role.allowed_scopes(),
-        "server_enforced": true,
-    })
-}
-
-pub(crate) fn respond_forbidden(request: Request, role: PortalRole, scope: &str) -> Result<()> {
-    respond_json_status(
-        request,
-        StatusCode(403),
-        &json!({
-            "ok": false,
-            "error": "forbidden",
-            "message": format!("Роль {} не имеет доступа к контуру {scope}", role.label_ru()),
-            "role": role.as_str(),
-            "scope": scope,
-            "server_enforced": true,
-        }),
-    )
-}

adk-rust/crates/detmir-portal/src/snapshot_cache.rs

@@ -1,125 +0,0 @@
-//! Snapshot cache helpers for the portal request path.
-//!
-//! CONTRACT: this module only owns short-lived in-process cache behavior.
-//! It must not change snapshot payloads, source collection, API routes or
-//! business calculations.
-
-use std::collections::BTreeMap;
-use std::sync::{Arc, Mutex};
-use std::thread;
-use std::time::{Duration, Instant};
-
-use crate::{Cli, HealthResponse, Snapshot, build_health, build_snapshot, now};
-
-const SNAPSHOT_CACHE_TTL: Duration = Duration::from_secs(120);
-
-pub(crate) type SnapshotCache = Arc<Mutex<SnapshotCacheState>>;
-
-#[derive(Clone, Debug, Default)]
-pub(crate) struct SnapshotCacheState {
-    pub(crate) entry: Option<CachedSnapshot>,
-    pub(crate) refresh_in_progress: bool,
-}
-
-#[derive(Clone, Debug)]
-pub(crate) struct CachedSnapshot {
-    created: Instant,
-    snapshot: Snapshot,
-}
-
-pub(crate) fn new_snapshot_cache() -> SnapshotCache {
-    Arc::new(Mutex::new(SnapshotCacheState::default()))
-}
-
-pub(crate) fn clone_snapshot_cache(cache: &SnapshotCache) -> SnapshotCache {
-    Arc::clone(cache)
-}
-
-pub(crate) fn cached_snapshot(args: &Cli, cache: &SnapshotCache) -> Snapshot {
-    {
-        let guard = cache.lock().expect("snapshot cache mutex poisoned");
-        if let Some(cached) = guard.entry.as_ref() {
-            if cached.created.elapsed() <= SNAPSHOT_CACHE_TTL {
-                return cached.snapshot.clone();
-            }
-        }
-    }
-
-    let snapshot = build_snapshot(args);
-    let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
-    guard.entry = Some(CachedSnapshot {
-        created: Instant::now(),
-        snapshot: snapshot.clone(),
-    });
-    guard.refresh_in_progress = false;
-    snapshot
-}
-
-pub(crate) fn cached_snapshot_or_refresh(args: &Cli, cache: &SnapshotCache) -> Option<Snapshot> {
-    let mut should_spawn = false;
-    let mut snapshot_to_return = None;
-    {
-        let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
-        if let Some(cached) = guard.entry.as_ref() {
-            let snapshot = cached.snapshot.clone();
-            if cached.created.elapsed() <= SNAPSHOT_CACHE_TTL {
-                return Some(snapshot);
-            }
-            if !guard.refresh_in_progress {
-                guard.refresh_in_progress = true;
-                should_spawn = true;
-            }
-            snapshot_to_return = Some(snapshot);
-        } else if !guard.refresh_in_progress {
-            guard.refresh_in_progress = true;
-            should_spawn = true;
-        }
-    }
-
-    if should_spawn {
-        spawn_snapshot_refresh(args.clone(), clone_snapshot_cache(cache));
-    }
-    snapshot_to_return
-}
-
-fn spawn_snapshot_refresh(args: Cli, cache: SnapshotCache) {
-    thread::spawn(move || {
-        let result =
-            std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| build_snapshot(&args)));
-        let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
-        match result {
-            Ok(snapshot) => {
-                guard.entry = Some(CachedSnapshot {
-                    created: Instant::now(),
-                    snapshot,
-                });
-            }
-            Err(_) => {
-                eprintln!("detmir-portal snapshot cache refresh panicked");
-            }
-        }
-        guard.refresh_in_progress = false;
-    });
-}
-
-pub(crate) fn build_fast_health(cache: &SnapshotCache) -> HealthResponse {
-    match cache.try_lock() {
-        Ok(guard) => guard
-            .entry
-            .as_ref()
-            .map(|cached| build_health(&cached.snapshot))
-            .unwrap_or_else(lightweight_health),
-        Err(_) => lightweight_health(),
-    }
-}
-
-fn lightweight_health() -> HealthResponse {
-    let mut sources = BTreeMap::new();
-    sources.insert("portal".to_string(), true);
-    HealthResponse {
-        ok: true,
-        generated_at_utc: now(),
-        version: env!("CARGO_PKG_VERSION").to_string(),
-        sources,
-    }
-}

adk-rust/crates/detmir-portal/src/static_assets.rs

@@ -1,11 +0,0 @@
-//! Static portal assets and generated API contract text.
-//!
-//! CONTRACT: this module only exposes embedded static files. Do not change
-//! file contents, MIME handling, routes or API contracts from here.
-
-pub(crate) const INDEX_HTML: &str = include_str!("static/index.html");
-pub(crate) const ARCHITECTURE_HTML: &str = include_str!("static/architecture.html");
-pub(crate) const APP_CSS: &str = include_str!("static/app.css");
-pub(crate) const APP_JS: &str = include_str!("static/app.js");
-pub(crate) const API_CONTRACT_OPENAPI: &str = include_str!("contracts/openapi.json");
-pub(crate) const API_CONTRACT_TYPESCRIPT: &str = include_str!("contracts/typescript.d.ts");

adk-rust/crates/detmir-portal/src/telemetry_ingest.rs

@@ -1,185 +0,0 @@
-//! Telemetry ingest API for Rust endpoint/agent diagnostics.
-//!
-//! CONTRACT: this module owns `/api/telemetry` authentication, request-body
-//! validation and JSONL append semantics. Keep accepted fields, status codes,
-//! metrics counters and response shape stable unless telemetry contracts are
-//! updated in the same PR.
-
-use std::fs;
-use std::fs::OpenOptions;
-use std::io::Write;
-
-use anyhow::{Context, Result, anyhow};
-use serde_json::{Value, json};
-use tiny_http::{Request, StatusCode};
-
-use crate::production::{record_ingestion_accepted, record_ingestion_rejected};
-use crate::{
-    Cli, is_payload_too_large, now, read_limited_body, respond_json, respond_json_status,
-    respond_payload_too_large,
-};
-
-pub(crate) fn telemetry_authorized(request: &Request, args: &Cli) -> bool {
-    let expected = args.telemetry_api_key.trim();
-    if expected.is_empty() || expected == "change-me" {
-        return false;
-    }
-    let actual = request
-        .headers()
-        .iter()
-        .find(|header| header.field.equiv("x-api-key"))
-        .map(|header| header.value.as_str().trim().to_string())
-        .or_else(|| bearer_token(request));
-    actual
-        .as_deref()
-        .filter(|value| !value.is_empty())
-        .map(|value| constant_time_eq(value.as_bytes(), expected.as_bytes()))
-        .unwrap_or(false)
-}
-
-pub(crate) fn bearer_token(request: &Request) -> Option<String> {
-    request
-        .headers()
-        .iter()
-        .find(|header| header.field.equiv("Authorization"))
-        .map(|header| header.value.as_str().trim())
-        .and_then(|value| value.strip_prefix("Bearer "))
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-        .map(ToString::to_string)
-}
-
-pub(crate) fn constant_time_eq(left: &[u8], right: &[u8]) -> bool {
-    if left.len() != right.len() {
-        return false;
-    }
-    let mut diff = 0_u8;
-    for (a, b) in left.iter().zip(right.iter()) {
-        diff |= a ^ b;
-    }
-    diff == 0
-}
-
-pub(crate) fn handle_telemetry_ingest(mut request: Request, args: &Cli) -> Result<()> {
-    if !telemetry_authorized(&request, args) {
-        record_ingestion_rejected();
-        return respond_json_status(
-            request,
-            StatusCode(401),
-            &json!({
-                "ok": false,
-                "error": "telemetry api key is missing or invalid"
-            }),
-        );
-    }
-    let telemetry_limit = args.max_request_body_bytes.min(1024 * 1024);
-    let body = match read_limited_body(&mut request, telemetry_limit) {
-        Ok(body) => body,
-        Err(err) if is_payload_too_large(&err) => {
-            record_ingestion_rejected();
-            return respond_payload_too_large(request);
-        }
-        Err(err) => return Err(err),
-    };
-    let response = apply_telemetry_ingest(args, &body);
-    match response {
-        Ok(response) => {
-            record_ingestion_accepted();
-            respond_json(request, &response)
-        }
-        Err(err) => {
-            record_ingestion_rejected();
-            respond_json_status(
-                request,
-                StatusCode(400),
-                &json!({
-                    "ok": false,
-                    "error": err.to_string()
-                }),
-            )
-        }
-    }
-}
-
-pub(crate) fn apply_telemetry_ingest(args: &Cli, body: &str) -> Result<Value> {
-    let payload: Value =
-        serde_json::from_str(body).map_err(|err| anyhow!("invalid telemetry JSON: {err}"))?;
-    validate_telemetry_payload(&payload)?;
-    let received_at_utc = now();
-    let envelope = json!({
-        "received_at_utc": received_at_utc,
-        "prototype": true,
-        "record": payload,
-    });
-    if let Some(parent) = args.telemetry_store_path.parent() {
-        fs::create_dir_all(parent).with_context(|| format!("create {}", parent.display()))?;
-    }
-    let mut file = OpenOptions::new()
-        .create(true)
-        .append(true)
-        .open(&args.telemetry_store_path)
-        .with_context(|| format!("open {}", args.telemetry_store_path.display()))?;
-    writeln!(file, "{}", serde_json::to_string(&envelope)?)
-        .with_context(|| format!("append {}", args.telemetry_store_path.display()))?;
-    Ok(json!({
-        "ok": true,
-        "prototype": true,
-        "stored": "file-backed-jsonl",
-        "received_at_utc": received_at_utc,
-    }))
-}
-
-pub(crate) fn validate_telemetry_payload(payload: &Value) -> Result<()> {
-    let Some(object) = payload.as_object() else {
-        return Err(anyhow!("telemetry payload must be a JSON object"));
-    };
-    for field in [
-        "agent_id",
-        "hostname",
-        "os_name",
-        "os_version",
-        "platform",
-        "username",
-        "timestamp",
-        "uptime_seconds",
-        "cpu_usage_percent",
-        "memory_total",
-        "memory_used",
-        "active_sessions",
-        "rdp_sessions",
-        "ssh_sessions",
-        "processes",
-        "network_interfaces",
-        "network_connections",
-        "workforce_activity",
-        "security_events",
-        "collector_version",
-    ] {
-        if !object.contains_key(field) {
-            return Err(anyhow!("telemetry field is missing: {field}"));
-        }
-    }
-    for field in [
-        "active_sessions",
-        "rdp_sessions",
-        "ssh_sessions",
-        "processes",
-        "network_interfaces",
-        "network_connections",
-        "security_events",
-    ] {
-        if payload.get(field).and_then(Value::as_array).is_none() {
-            return Err(anyhow!("telemetry field must be an array: {field}"));
-        }
-    }
-    if payload
-        .get("workforce_activity")
-        .and_then(Value::as_object)
-        .is_none()
-    {
-        return Err(anyhow!(
-            "telemetry field must be an object: workforce_activity"
-        ));
-    }
-    Ok(())
-}

adk-rust/crates/detmir-portal/src/workforce_kpi_explain.rs

@@ -549,7 +549,6 @@ mod tests {
         };
         Snapshot {
             generated_at_utc: "2026-06-07T10:00:00Z".to_string(),
-            dlp_module_enabled: true,
             detmir_status: SourceStatus {
                 ok: true,
                 status: "OK".to_string(),

adk-rust/crates/detmir-readiness/src/main.rs

@@ -18,9 +18,7 @@ const DEFAULT_AW_ENV_FILE: &str = "/etc/activitywatch/aw-server.env";
 const DEFAULT_GRAFANA_ENV_FILE: &str = "/etc/detmir-grafana-check.env";
 const DEFAULT_GRAFANA_URL: &str = "http://127.0.0.1:3000";
 const DEFAULT_GRAFANA_DATASOURCE_UID: &str = "influxdb_aw";
-const DEFAULT_SYSTEMD_SERVICES: &str =
-    "activitywatch-server,aw-worktime-api,aw-worktime-influx-exporter.timer";
-const DEFAULT_DLP_SYSTEMD_SERVICES: &str = "aw-dlp-influx-exporter.timer";
+const DEFAULT_SYSTEMD_SERVICES: &str = "activitywatch-server,aw-worktime-api,aw-worktime-influx-exporter.timer,aw-dlp-influx-exporter.timer";
 const DEFAULT_RETENTION_DAYS: i64 = 30;
 
 #[derive(Debug, Parser)]
@@ -220,26 +218,14 @@ fn run(cli: &Cli) -> Result<Report> {
     let mut checks = Vec::new();
     let worktime = influx_config(&aw_env, "AW_WORKTIME_INFLUX");
     let dlp = influx_config(&aw_env, "AW_DLP_INFLUX");
-    let dlp_enabled = env_bool(&aw_env, "AW_DLP_ENABLED", true);
 
     checks.push(check_influx_env(&worktime, cli.allow_disabled_influx));
-    if dlp_enabled {
-        checks.push(check_influx_env(&dlp, cli.allow_disabled_influx));
-    } else {
-        checks.push(warn(
-            "env:AW_DLP_INFLUX",
-            "DLP Influx runtime disabled by AW_DLP_ENABLED=false",
-            json!({"enabled": false, "mode": "disabled"}),
-        ));
-    }
+    checks.push(check_influx_env(&dlp, cli.allow_disabled_influx));
 
     if cli.skip_systemd {
         checks.push(warn("systemd", "systemd checks skipped", json!({})));
     } else {
-        checks.extend(check_systemd_services(&systemd_services_for_mode(
-            &cli.systemd_services,
-            dlp_enabled,
-        )));
+        checks.extend(check_systemd_services(&cli.systemd_services));
     }
 
     if cli.skip_influx_write {
@@ -250,15 +236,7 @@ fn run(cli: &Cli) -> Result<Report> {
         ));
     } else {
         checks.push(check_influx_write(&client, "worktime", &worktime));
-        if dlp_enabled {
-            checks.push(check_influx_write(&client, "dlp", &dlp));
-        } else {
-            checks.push(warn(
-                "influx:write:dlp",
-                "DLP write probe skipped because DLP is disabled",
-                json!({"enabled": false, "mode": "disabled"}),
-            ));
-        }
+        checks.push(check_influx_write(&client, "dlp", &dlp));
     }
 
     if cli.skip_grafana {
@@ -292,7 +270,7 @@ fn run(cli: &Cli) -> Result<Report> {
         git_commit: cli.git_commit.clone(),
         counts,
         checks,
-        limitations: build_limitations(cli, dlp_enabled),
+        limitations: build_limitations(cli),
     })
 }
 
@@ -360,20 +338,6 @@ fn split_csv(value: &str) -> Vec<String> {
         .collect()
 }
 
-fn systemd_services_for_mode(csv: &str, dlp_enabled: bool) -> String {
-    let mut services = split_csv(csv);
-    if dlp_enabled {
-        for service in split_csv(DEFAULT_DLP_SYSTEMD_SERVICES) {
-            if !services.iter().any(|item| item == &service) {
-                services.push(service);
-            }
-        }
-    } else {
-        services.retain(|service| !service.contains("dlp"));
-    }
-    services.into_iter().collect::<Vec<_>>().join(",")
-}
-
 fn hostname() -> String {
     Command::new("hostname")
         .output()
@@ -384,7 +348,7 @@ fn hostname() -> String {
         .unwrap_or_else(|| "unknown".to_string())
 }
 
-fn build_limitations(cli: &Cli, dlp_enabled: bool) -> Vec<String> {
+fn build_limitations(cli: &Cli) -> Vec<String> {
     let mut limitations = Vec::new();
     limitations.push(
         "Проверка подтверждает состояние runtime на момент формирования акта и не заменяет аудит конфигурации, нагрузочное тестирование или приемочные испытания заказчика.".to_string(),
@@ -413,11 +377,6 @@ fn build_limitations(cli: &Cli, dlp_enabled: bool) -> Vec<String> {
                 .to_string(),
         );
     }
-    if !dlp_enabled {
-        limitations.push(
-            "DLP runtime отключен штатно через AW_DLP_ENABLED=false; readiness не считает DLP services/timers и DLP Influx write обязательными.".to_string(),
-        );
-    }
     limitations
 }
 

adk-rust/crates/dlp-influx-exporter/src/main.rs

@@ -1045,7 +1045,7 @@ mod tests {
         assert!(err.contains("AW_DLP_INFLUX_URL"));
 
         config.influx_url = "http://influxdb.internal:8086".to_string();
-        config.influx_token = "dummy".to_string();
+        config.influx_token = "prod-write-token-value".to_string();
         let err = validate_runtime_config(&config).unwrap_err().to_string();
         assert!(err.contains("AW_DLP_INFLUX_HOSTS"));
 

adk-rust/crates/quality-gate/src/main.rs

@@ -285,8 +285,6 @@ fn is_allowed_python_runtime_path(rel: &str) -> bool {
         || rel.starts_with("pfsense/")
         || rel == "proxmox/tsj_guardian_bot.py"
         || rel == "proxmox/test_tsj_guardian_bot.py"
-        || rel == "scripts/package_rust_release_binaries.py"
-        || rel == "scripts/public_secret_pattern_check.py"
 }
 
 fn is_detmir_retired_runtime_path(rel: &str) -> bool {
@@ -346,12 +344,6 @@ mod tests {
         assert!(is_allowed_python_runtime_path(
             "pfsense/pfsense-aw-poller.py"
         ));
-        assert!(is_allowed_python_runtime_path(
-            "scripts/package_rust_release_binaries.py"
-        ));
-        assert!(is_allowed_python_runtime_path(
-            "scripts/public_secret_pattern_check.py"
-        ));
     }
 
     #[test]

adk-rust/crates/worktime-influx-exporter/src/main.rs

@@ -1031,7 +1031,7 @@ mod tests {
         assert!(err.contains("AW_WORKTIME_INFLUX_URL"));
 
         config.influx_url = "http://influxdb.internal:8086".to_string();
-        config.influx_token = "dummy".to_string();
+        config.influx_token = "prod-write-token-value".to_string();
         let err = validate_runtime_config(&config).unwrap_err().to_string();
         assert!(err.contains("AW_WORKTIME_INFLUX_HOSTS"));
 

ansible/deploy_aw_server.yml

@@ -16,25 +16,8 @@
     aw_worktime_classes: "{{ lookup('file', aw_repo_root + '/aw-server/settings/classes-worktime.json') | from_json }}"
     aw_default_views: "{{ lookup('file', aw_repo_root + '/aw-server/settings/views-default.json') | from_json }}"
     aw_rust_release_dir: "{{ (lookup('env', 'CARGO_TARGET_DIR') | default(aw_repo_root + '/adk-rust/target', true)) + '/release' }}"
-    aw_db_vacuum_timer_enabled: false
 
   tasks:
-    - name: Refuse inconsistent DLP resource profile
-      ansible.builtin.assert:
-        that:
-          - aw_dlp_profile | default('core_only') in ['core_only', 'light', 'on_demand', 'full']
-          - (aw_dlp_profile | default('core_only') == 'core_only') or (aw_dlp_enabled | default(false) | bool)
-          - (aw_dlp_enabled | default(false) | bool) or not (
-              aw_dlp_influx_enabled | default(false) | bool
-              or aw_dlp_ioc_enabled | default(false) | bool
-              or aw_dlp_policy_engine_enabled | default(false) | bool
-              or aw_dlp_content_analysis_enabled | default(false) | bool
-              or aw_dlp_integrations_enabled | default(false) | bool
-              or aw_dlp_case_management_enabled | default(false) | bool
-              or aw_dlp_compliance_enabled | default(false) | bool
-            )
-        fail_msg: "Inconsistent DLP profile: keep aw_dlp_enabled=false with all DLP component flags false, or explicitly choose aw_dlp_enabled=true and aw_dlp_profile=light|on_demand|full."
-
     - name: Установить базовые пакеты
       ansible.builtin.apt:
         name:
@@ -94,7 +77,6 @@
         - "{{ aw_server_data_dir }}/backups"
         - "{{ aw_server_data_dir }}/slo"
         - "{{ aw_server_data_dir }}/browser-smoke"
-        - "{{ aw_security_finding_executor_work_dir | default(aw_server_data_dir ~ '/security-finding-executor') }}"
         - "{{ aw_rus_health_state_dir }}"
         - "{{ aw_rus_health_validation_dir }}"
         - "{{ aw_server_log_dir }}"
@@ -125,7 +107,6 @@
         - "{{ aw_server_data_dir }}/backups"
         - "{{ aw_server_data_dir }}/slo"
         - "{{ aw_server_data_dir }}/browser-smoke"
-        - "{{ aw_security_finding_executor_work_dir | default(aw_server_data_dir ~ '/security-finding-executor') }}"
         - "{{ aw_rus_health_state_dir }}"
         - "{{ aw_rus_health_validation_dir }}"
         - "{{ aw_server_log_dir }}"
@@ -608,44 +589,6 @@
             daemon_reload: true
           when: aw_db_maintenance_rust_binary_early.stat.exists | default(false)
 
-        - name: Установить aw-db-vacuum service до Influx проверок
-          ansible.builtin.copy:
-            src: "{{ aw_repo_root }}/aw-server/aw-db-vacuum.service"
-            dest: /etc/systemd/system/aw-db-vacuum.service
-            owner: root
-            group: root
-            mode: "0644"
-          when: aw_db_maintenance_rust_binary_early.stat.exists | default(false)
-
-        - name: Установить aw-db-vacuum timer до Influx проверок
-          ansible.builtin.copy:
-            src: "{{ aw_repo_root }}/aw-server/aw-db-vacuum.timer"
-            dest: /etc/systemd/system/aw-db-vacuum.timer
-            owner: root
-            group: root
-            mode: "0644"
-          when: aw_db_maintenance_rust_binary_early.stat.exists | default(false)
-
-        - name: Включить nightly aw-db-vacuum timer до Influx проверок
-          ansible.builtin.systemd:
-            name: aw-db-vacuum.timer
-            enabled: true
-            state: started
-            daemon_reload: true
-          when:
-            - aw_db_maintenance_rust_binary_early.stat.exists | default(false)
-            - aw_db_vacuum_timer_enabled | bool
-
-        - name: Отключить nightly aw-db-vacuum timer если opt-in не задан
-          ansible.builtin.systemd:
-            name: aw-db-vacuum.timer
-            enabled: false
-            state: stopped
-            daemon_reload: true
-          when:
-            - aw_db_maintenance_rust_binary_early.stat.exists | default(false)
-            - not (aw_db_vacuum_timer_enabled | bool)
-
         - name: Прочитать текущий aw-server.env для сохранения Influx token
           ansible.builtin.slurp:
             path: /etc/activitywatch/aw-server.env
@@ -731,9 +674,7 @@
               - aw_effective_dlp_influx_token | length > 0
               - (aw_effective_dlp_influx_token | string | lower | regex_search('^(change_me|changeme|replace-me|replace_me|token|secret|password|api_key|influx_token|write_token|your_.*|<.*>)$')) is none
             fail_msg: "aw_dlp_influx_enabled=true, но token пуст и в локальном env, и в текущем /etc/activitywatch/aw-server.env. Exporter будет падать и Grafana не получит DLP-ряды."
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_influx_enabled | default(false) | bool
+          when: aw_dlp_influx_enabled | default(false) | bool
 
         - name: Проверить destination для AW worktime Influx exporter
           ansible.builtin.assert:
@@ -765,9 +706,7 @@
               - (aw_dlp_influx_hosts | default('') | string | length) > 0
               - "'WINDOWS_USER_EXAMPLE' not in (aw_dlp_influx_hosts | default('') | string)"
             fail_msg: "aw_dlp_influx_enabled=true, но URL/org/bucket/hosts похожи на public example/TEST-NET значения. Задайте live значения в private inventory/env, не в public repo."
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_influx_enabled | default(false) | bool
+          when: aw_dlp_influx_enabled | default(false) | bool
 
         - name: Записать /etc/activitywatch/aw-server.env перед хотфиксами
           ansible.builtin.copy:
@@ -786,7 +725,7 @@
               AW_SERVER_GROUP={{ aw_server_group }}
               AW_WORKTIME_REPORT_BASE={{ aw_worktime_report_base }}
               AW_WORKTIME_TZ={{ aw_worktime_timezone }}
-              AW_WORKTIME_HOST={{ aw_effective_worktime_host | default(aw_effective_monitored_windows_hostname | default('HOST-EXAMPLE')) }}
+              AW_WORKTIME_HOST={{ aw_effective_worktime_host | default(aw_effective_monitored_windows_hostname | default('SHARKON2025')) }}
               AW_WORKTIME_EVENTS_LIMIT={{ aw_worktime_events_limit | default(5000) }}
               AW_WORKTIME_AW_HTTP_TIMEOUT_SECONDS={{ aw_worktime_aw_http_timeout_seconds | default(6) }}
               AW_WORKTIME_EVENTS_CACHE_TTL_SECONDS={{ aw_worktime_events_cache_ttl_seconds | default(300) }}
@@ -809,7 +748,7 @@
               AW_WORKTIME_INFLUX_URL={{ aw_worktime_influx_url | default('') }}
               AW_WORKTIME_INFLUX_ORG={{ aw_worktime_influx_org | default('proxmox') }}
               AW_WORKTIME_INFLUX_BUCKET={{ aw_worktime_influx_bucket | default('aw_metrics') }}
-              AW_WORKTIME_INFLUX_HOSTS={{ aw_worktime_influx_hosts | default(aw_effective_monitored_windows_hostname | default('HOST-EXAMPLE')) }}
+              AW_WORKTIME_INFLUX_HOSTS={{ aw_worktime_influx_hosts | default('SHARKON2025') }}
               AW_WORKTIME_INFLUX_DAYS={{ aw_worktime_influx_days | default('today,yesterday') }}
               AW_WORKTIME_INFLUX_TOKEN={{ aw_effective_worktime_influx_token | default('') }}
               AW_WORKTIME_MANAGEMENT_HISTORY_DIR={{ aw_worktime_management_history_dir | default(aw_server_data_dir ~ '/worktime-management-history') }}
@@ -820,28 +759,11 @@
               AW_WORKTIME_MANAGER_TREND_DELTA_PCT={{ aw_worktime_manager_trend_delta_pct | default(10) }}
               AW_WORKTIME_MANAGER_OFF_HOURS_THRESHOLD_SECONDS={{ aw_worktime_manager_off_hours_threshold_seconds | default(1800) }}
               AW_WORKTIME_MANAGER_INTERPRETATION_POLICY={{ aw_worktime_interpretation_policy_path | default('/etc/activitywatch/worktime-interpretation-policy.json') }}
-              AW_DLP_ENABLED={{ 'true' if (aw_dlp_enabled | default(false) | bool) else 'false' }}
-              AW_DLP_PROFILE={{ aw_dlp_profile | default('core_only') }}
-              AW_DLP_DISABLED_REASON={{ aw_dlp_disabled_reason | default('') }}
-              AW_DLP_DISABLED_SINCE={{ aw_dlp_disabled_since | default('') }}
-              AW_DLP_GUARD_ENABLED={{ 'true' if (aw_dlp_light_guard_enabled | default(true) | bool) else 'false' }}
-              AW_DLP_GUARD_STATE_DIR={{ aw_dlp_light_guard_state_dir | default(aw_server_data_dir ~ '/health') }}
-              AW_DLP_GUARD_LOAD_RATIO={{ aw_dlp_light_guard_load_ratio | default('1.50') }}
-              AW_DLP_GUARD_MEM_AVAILABLE_PCT_MIN={{ aw_dlp_light_guard_mem_available_pct_min | default('15') }}
-              AW_DLP_GUARD_IOWAIT_PCT_MAX={{ aw_dlp_light_guard_iowait_pct_max | default('20') }}
-              AW_DLP_GUARD_STRIKES_REQUIRED={{ aw_dlp_light_guard_strikes_required | default(3) }}
-              AW_DLP_CONTROL_BIN=/usr/local/bin/detmir-dlp-runtime-control
-              AW_CONTAINMENT_ENABLED={{ 'true' if (aw_containment_enabled | default(false) | bool) else 'false' }}
-              AW_CONTAINMENT_MODE={{ aw_containment_mode | default('shadow') }}
-              AW_CONTAINMENT_POLICY={{ aw_containment_policy_path | default('/etc/activitywatch/containment-policy.json') }}
-              AW_CONTAINMENT_DEFAULT_TTL_MINUTES={{ aw_containment_default_ttl_minutes | default(60) }}
-              AW_CONTAINMENT_REQUIRE_ADMIN_CHANNEL_CHECK={{ 'true' if (aw_containment_require_admin_channel_check | default(true) | bool) else 'false' }}
-              AW_CONTAINMENT_ALLOW_AUTO_FOR_SERVERS={{ 'true' if (aw_containment_allow_auto_for_servers | default(false) | bool) else 'false' }}
-              AW_DLP_INFLUX_ENABLED={{ 'true' if ((aw_dlp_enabled | default(false) | bool) and (aw_dlp_influx_enabled | default(false) | bool)) else 'false' }}
+              AW_DLP_INFLUX_ENABLED={{ 'true' if (aw_dlp_influx_enabled | default(false) | bool) else 'false' }}
               AW_DLP_INFLUX_URL={{ aw_dlp_influx_url | default('') }}
               AW_DLP_INFLUX_ORG={{ aw_dlp_influx_org | default('proxmox') }}
               AW_DLP_INFLUX_BUCKET={{ aw_dlp_influx_bucket | default('aw_metrics') }}
-              AW_DLP_INFLUX_HOSTS={{ aw_dlp_influx_hosts | default(aw_effective_monitored_windows_hostname | default('HOST-EXAMPLE')) }}
+              AW_DLP_INFLUX_HOSTS={{ aw_dlp_influx_hosts | default('SHARKON2025') }}
               AW_DLP_INFLUX_LOOKBACK_DAYS={{ aw_dlp_influx_lookback_days | default(30) }}
               AW_DLP_INFLUX_EVENT_LIMIT={{ aw_dlp_influx_event_limit | default(2000) }}
               AW_DLP_INFLUX_TOKEN={{ aw_effective_dlp_influx_token | default('') }}
@@ -859,7 +781,6 @@
               AW_RUS_HEALTH_SESSION_EVENTS_MAX_AGE_SECONDS={{ aw_rus_health_session_events_max_age_seconds | default(86400) }}
               AW_RUS_HEALTH_GUARD_MAX_AGE_SECONDS={{ aw_rus_health_guard_max_age_seconds | default(300) }}
               AW_RUS_HEALTH_GUARD_REQUIRED={{ 1 if (aw_rus_health_guard_required | default(true) | bool) else 0 }}
-              AW_RUS_HEALTH_RDP_TCP_REQUIRED={{ 'true' if (aw_rus_health_rdp_tcp_required | default(true) | bool) else 'false' }}
               AW_RUS_SLO_STATE_DIR={{ aw_server_data_dir }}/slo
               AW_RUS_SLO_AW_BASE=http://127.0.0.1:5600
               AW_RUS_SLO_WORKTIME_BASE={{ aw_rus_health_worktime_api_base | default('http://127.0.0.1:5610') }}
@@ -877,104 +798,6 @@
               AW_HAYABUSA_TELEGRAM_MIN_SEVERITY={{ aw_hayabusa_telegram_min_severity | default('high') }}
               AW_HAYABUSA_TELEGRAM_BOT_TOKEN={{ aw_hayabusa_telegram_bot_token | default('') }}
               AW_HAYABUSA_TELEGRAM_CHAT_IDS={{ aw_hayabusa_telegram_chat_ids | default('') }}
-              AW_SECURITY_FINDING_INBOX_ENABLED={{ 'true' if (aw_security_finding_inbox_enabled | default(false) | bool) else 'false' }}
-              AW_SECURITY_FINDING_INBOX_REQUIRED={{ 'true' if (aw_security_finding_inbox_required | default(false) | bool) else 'false' }}
-              AW_SECURITY_FINDING_INBOX_BIN={{ aw_security_finding_inbox_bin | default('/usr/local/bin/security-finding-inbox') }}
-              AW_SECURITY_FINDING_INBOX_MIN_SEVERITY={{ aw_security_finding_inbox_min_severity | default('medium') }}
-              AW_SECURITY_FINDING_EXECUTOR_WORK_DIR={{ aw_security_finding_executor_work_dir | default(aw_server_data_dir ~ '/security-finding-executor') }}
-              AW_SECURITY_FINDING_EXECUTOR_LOCK={{ aw_security_finding_executor_lock | default('/var/lock/aw-security-finding-executor.lock') }}
-              AW_CONTAINMENT_ENGINE_BIN={{ aw_containment_engine_bin | default('/usr/local/bin/containment-engine') }}
-              AW_CONTAINMENT_MANAGEMENT_ALLOWLIST={{ aw_containment_management_allowlist | default('') }}
-              AW_CONTAINMENT_BLOCKED_REMOTE_ADDRESSES={{ aw_containment_blocked_remote_addresses | default('') }}
-
-        - name: Установить runtime control для optional DLP контура
-          ansible.builtin.copy:
-            src: "{{ aw_repo_root }}/scripts/detmir_dlp_runtime_control.sh"
-            dest: /usr/local/bin/detmir-dlp-runtime-control
-            owner: root
-            group: root
-            mode: "0755"
-
-        - name: Установить load guard для lightweight DLP контура
-          ansible.builtin.copy:
-            src: "{{ aw_repo_root }}/scripts/detmir_dlp_load_guard.sh"
-            dest: /usr/local/bin/detmir-dlp-load-guard
-            owner: root
-            group: root
-            mode: "0755"
-
-        - name: Установить systemd unit DLP load guard
-          ansible.builtin.copy:
-            dest: /etc/systemd/system/detmir-dlp-load-guard.service
-            owner: root
-            group: root
-            mode: "0644"
-            content: |
-              [Unit]
-              Description=DetMir lightweight DLP load guard
-              After=activitywatch-server.service
-
-              [Service]
-              Type=oneshot
-              EnvironmentFile=-/etc/activitywatch/aw-server.env
-              ExecStart=/usr/local/bin/detmir-dlp-load-guard
-              Nice=10
-              IOSchedulingClass=best-effort
-              IOSchedulingPriority=7
-              TimeoutStartSec=45
-
-        - name: Установить systemd timer DLP load guard
-          ansible.builtin.copy:
-            dest: /etc/systemd/system/detmir-dlp-load-guard.timer
-            owner: root
-            group: root
-            mode: "0644"
-            content: |
-              [Unit]
-              Description=Run DetMir lightweight DLP load guard
-
-              [Timer]
-              OnBootSec=3min
-              OnUnitActiveSec=1min
-              AccuracySec=30s
-              Persistent=false
-
-              [Install]
-              WantedBy=timers.target
-
-        - name: Включить DLP load guard timer
-          ansible.builtin.systemd:
-            name: detmir-dlp-load-guard.timer
-            enabled: true
-            state: started
-            daemon_reload: true
-          when: aw_dlp_light_guard_enabled | default(true) | bool
-
-        - name: Отключить DLP load guard timer, если guard явно выключен
-          ansible.builtin.systemd:
-            name: detmir-dlp-load-guard.timer
-            enabled: false
-            state: stopped
-            daemon_reload: true
-          failed_when: false
-          when: not (aw_dlp_light_guard_enabled | default(true) | bool)
-
-        - name: Создать каталог containment policy
-          ansible.builtin.file:
-            path: "{{ (aw_containment_policy_path | default('/etc/activitywatch/containment-policy.json')) | dirname }}"
-            state: directory
-            owner: root
-            group: root
-            mode: "0755"
-
-        - name: Установить default containment policy, если live policy отсутствует
-          ansible.builtin.copy:
-            src: "{{ aw_repo_root }}/configs/containment-policy.example.json"
-            dest: "{{ aw_containment_policy_path | default('/etc/activitywatch/containment-policy.json') }}"
-            owner: root
-            group: root
-            mode: "0644"
-            force: false
 
         - name: Создать каталог DLP policy engine
           ansible.builtin.file:
@@ -983,9 +806,7 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_policy_engine_enabled | default(false) | bool
+          when: aw_dlp_policy_engine_enabled | default(false) | bool
 
         - name: Установить systemd unit DLP policy engine
           ansible.builtin.copy:
@@ -994,9 +815,7 @@
             owner: root
             group: root
             mode: "0644"
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_policy_engine_enabled | default(false) | bool
+          when: aw_dlp_policy_engine_enabled | default(false) | bool
 
         - name: Проверить локальный Rust DLP policy engine
           ansible.builtin.stat:
@@ -1031,7 +850,7 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when: aw_dlp_content_analysis_enabled | default(false) | bool
+          when: aw_dlp_content_analysis_enabled | default(true) | bool
 
         - name: Скопировать файлы DLP content analysis
           ansible.builtin.copy:
@@ -1040,7 +859,7 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0644"
-          when: aw_dlp_content_analysis_enabled | default(false) | bool
+          when: aw_dlp_content_analysis_enabled | default(true) | bool
 
         - name: Установить wrapper запуска DLP content analysis через virtualenv
           ansible.builtin.copy:
@@ -1049,7 +868,7 @@
             owner: root
             group: root
             mode: "0755"
-          when: aw_dlp_content_analysis_enabled | default(false) | bool
+          when: aw_dlp_content_analysis_enabled | default(true) | bool
 
         - name: Проверить локальный Rust DLP content analyzer
           ansible.builtin.stat:
@@ -1057,7 +876,7 @@
           delegate_to: localhost
           register: dlp_content_analyzer_rust_binary
           become: false
-          when: aw_dlp_content_analysis_enabled | default(false) | bool
+          when: aw_dlp_content_analysis_enabled | default(true) | bool
 
         - name: Установить Rust DLP content analyzer
           ansible.builtin.copy:
@@ -1067,7 +886,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_content_analysis_enabled | default(false) | bool
+            - aw_dlp_content_analysis_enabled | default(true) | bool
             - dlp_content_analyzer_rust_binary.stat.exists | default(false)
 
         - name: Создать virtualenv DLP content analysis
@@ -1075,13 +894,13 @@
             cmd: python3 -m venv /opt/activitywatch/dlp-content-analysis/.venv
           args:
             creates: /opt/activitywatch/dlp-content-analysis/.venv/bin/python
-          when: aw_dlp_content_analysis_enabled | default(false) | bool
+          when: aw_dlp_content_analysis_enabled | default(true) | bool
 
         - name: Установить зависимости DLP content analysis
           ansible.builtin.pip:
             requirements: /opt/activitywatch/dlp-content-analysis/requirements.txt
             virtualenv: /opt/activitywatch/dlp-content-analysis/.venv
-          when: aw_dlp_content_analysis_enabled | default(false) | bool
+          when: aw_dlp_content_analysis_enabled | default(true) | bool
 
         - name: Создать каталог DLP integrations
           ansible.builtin.file:
@@ -1090,9 +909,7 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_integrations_enabled | default(false) | bool
+          when: aw_dlp_integrations_enabled | default(true) | bool
 
         - name: Скопировать файлы DLP integrations
           ansible.builtin.copy:
@@ -1105,9 +922,7 @@
             - cef-config.yaml
             - syslog-forwarder-config.yaml
             - webhook-config.yaml
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_integrations_enabled | default(false) | bool
+          when: aw_dlp_integrations_enabled | default(true) | bool
 
         - name: Создать state каталог DLP integrations
           ansible.builtin.file:
@@ -1116,9 +931,7 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_integrations_enabled | default(false) | bool
+          when: aw_dlp_integrations_enabled | default(true) | bool
 
         - name: Установить systemd unit CEF exporter
           ansible.builtin.copy:
@@ -1127,9 +940,7 @@
             owner: root
             group: root
             mode: "0644"
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_integrations_enabled | default(false) | bool
+          when: aw_dlp_integrations_enabled | default(true) | bool
 
         - name: Установить systemd timer CEF exporter
           ansible.builtin.copy:
@@ -1138,9 +949,7 @@
             owner: root
             group: root
             mode: "0644"
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_integrations_enabled | default(false) | bool
+          when: aw_dlp_integrations_enabled | default(true) | bool
 
         - name: Проверить локальный Rust CEF exporter
           ansible.builtin.stat:
@@ -1148,16 +957,14 @@
           delegate_to: localhost
           register: dlp_cef_exporter_rust_binary
           become: false
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_integrations_enabled | default(false) | bool
+          when: aw_dlp_integrations_enabled | default(true) | bool
 
         - name: Требовать Rust CEF exporter artifact
           ansible.builtin.assert:
             that:
               - dlp_cef_exporter_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-cef-exporter"
-          when: aw_dlp_integrations_enabled | default(false) | bool
+          when: aw_dlp_integrations_enabled | default(true) | bool
 
         - name: Установить Rust CEF exporter
           ansible.builtin.copy:
@@ -1167,7 +974,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_integrations_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(true) | bool
             - dlp_cef_exporter_rust_binary.stat.exists | default(false)
 
         - name: Установить systemd unit syslog forwarder
@@ -1177,7 +984,7 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(false) | bool
+          when: aw_dlp_integrations_enabled | default(true) | bool
 
         - name: Установить systemd timer syslog forwarder
           ansible.builtin.copy:
@@ -1186,7 +993,7 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(false) | bool
+          when: aw_dlp_integrations_enabled | default(true) | bool
 
         - name: Проверить локальный Rust syslog forwarder
           ansible.builtin.stat:
@@ -1194,14 +1001,14 @@
           delegate_to: localhost
           register: dlp_syslog_forwarder_rust_binary
           become: false
-          when: aw_dlp_integrations_enabled | default(false) | bool
+          when: aw_dlp_integrations_enabled | default(true) | bool
 
         - name: Требовать Rust syslog forwarder artifact
           ansible.builtin.assert:
             that:
               - dlp_syslog_forwarder_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-syslog-forwarder"
-          when: aw_dlp_integrations_enabled | default(false) | bool
+          when: aw_dlp_integrations_enabled | default(true) | bool
 
         - name: Установить Rust syslog forwarder
           ansible.builtin.copy:
@@ -1211,7 +1018,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_integrations_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(true) | bool
             - dlp_syslog_forwarder_rust_binary.stat.exists | default(false)
 
         - name: Установить systemd unit webhook sender
@@ -1221,7 +1028,7 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(false) | bool
+          when: aw_dlp_integrations_enabled | default(true) | bool
 
         - name: Установить systemd timer webhook sender
           ansible.builtin.copy:
@@ -1230,7 +1037,7 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(false) | bool
+          when: aw_dlp_integrations_enabled | default(true) | bool
 
         - name: Проверить локальный Rust webhook sender
           ansible.builtin.stat:
@@ -1238,14 +1045,14 @@
           delegate_to: localhost
           register: dlp_webhook_sender_rust_binary
           become: false
-          when: aw_dlp_integrations_enabled | default(false) | bool
+          when: aw_dlp_integrations_enabled | default(true) | bool
 
         - name: Требовать Rust webhook sender artifact
           ansible.builtin.assert:
             that:
               - dlp_webhook_sender_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-webhook-sender"
-          when: aw_dlp_integrations_enabled | default(false) | bool
+          when: aw_dlp_integrations_enabled | default(true) | bool
 
         - name: Установить Rust webhook sender
           ansible.builtin.copy:
@@ -1255,7 +1062,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_integrations_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(true) | bool
             - dlp_webhook_sender_rust_binary.stat.exists | default(false)
 
         - name: Создать каталог DLP case management
@@ -1265,9 +1072,7 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_case_management_enabled | default(false) | bool
+          when: aw_dlp_case_management_enabled | default(true) | bool
 
         - name: Установить systemd unit DLP case management
           ansible.builtin.copy:
@@ -1276,9 +1081,7 @@
             owner: root
             group: root
             mode: "0644"
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_case_management_enabled | default(false) | bool
+          when: aw_dlp_case_management_enabled | default(true) | bool
 
         - name: Проверить локальный Rust DLP case management
           ansible.builtin.stat:
@@ -1286,14 +1089,14 @@
           delegate_to: localhost
           register: aw_dlp_case_management_rust_binary
           become: false
-          when: aw_dlp_case_management_enabled | default(false) | bool
+          when: aw_dlp_case_management_enabled | default(true) | bool
 
         - name: Требовать Rust DLP case management artifact
           ansible.builtin.assert:
             that:
               - aw_dlp_case_management_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-case-management"
-          when: aw_dlp_case_management_enabled | default(false) | bool
+          when: aw_dlp_case_management_enabled | default(true) | bool
 
         - name: Установить Rust DLP case management
           ansible.builtin.copy:
@@ -1303,7 +1106,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_case_management_enabled | default(false) | bool
+            - aw_dlp_case_management_enabled | default(true) | bool
             - aw_dlp_case_management_rust_binary.stat.exists | default(false)
 
         - name: Создать каталоги DLP compliance
@@ -1317,9 +1120,7 @@
             - /opt/activitywatch/dlp-compliance
             - /opt/activitywatch/dlp-compliance/templates
             - "{{ aw_dlp_compliance_report_dir }}"
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_compliance_enabled | default(false) | bool
+          when: aw_dlp_compliance_enabled | default(true) | bool
 
         - name: Скопировать файлы DLP compliance
           ansible.builtin.copy:
@@ -1333,9 +1134,7 @@
             - { src: "templates/pci-dss-report.html", dest: "/opt/activitywatch/dlp-compliance/templates/pci-dss-report.html", mode: "0644" }
             - { src: "report-scheduler.service", dest: "/etc/systemd/system/aw-dlp-report-scheduler.service", mode: "0644" }
             - { src: "report-scheduler.timer", dest: "/etc/systemd/system/aw-dlp-report-scheduler.timer", mode: "0644" }
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_compliance_enabled | default(false) | bool
+          when: aw_dlp_compliance_enabled | default(true) | bool
 
         - name: Проверить локальный Rust DLP compliance
           ansible.builtin.stat:
@@ -1343,18 +1142,14 @@
           delegate_to: localhost
           register: aw_dlp_compliance_rust_binary
           become: false
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_compliance_enabled | default(false) | bool
+          when: aw_dlp_compliance_enabled | default(true) | bool
 
         - name: Требовать Rust DLP compliance artifact
           ansible.builtin.assert:
             that:
               - aw_dlp_compliance_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-compliance"
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_compliance_enabled | default(false) | bool
+          when: aw_dlp_compliance_enabled | default(true) | bool
 
         - name: Установить Rust DLP compliance
           ansible.builtin.copy:
@@ -1364,7 +1159,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_compliance_enabled | default(false) | bool
+            - aw_dlp_compliance_enabled | default(true) | bool
             - aw_dlp_compliance_rust_binary.stat.exists | default(false)
 
         - name: Проверить локальный Rust dlp-admin-cli
@@ -1603,47 +1398,6 @@
             mode: "0755"
           when: dlp_health_check_rust_binary.stat.exists | default(false)
 
-        - name: Проверить локальный Rust containment-engine
-          ansible.builtin.stat:
-            path: "{{ aw_rust_release_dir }}/containment-engine"
-          delegate_to: localhost
-          register: containment_engine_rust_binary
-          become: false
-
-        - name: Установить Rust containment-engine
-          ansible.builtin.copy:
-            src: "{{ aw_rust_release_dir }}/containment-engine"
-            dest: /usr/local/bin/containment-engine
-            owner: root
-            group: root
-            mode: "0755"
-          when: containment_engine_rust_binary.stat.exists | default(false)
-
-        - name: Проверить локальный Rust security-finding-inbox
-          ansible.builtin.stat:
-            path: "{{ aw_rust_release_dir }}/security-finding-inbox"
-          delegate_to: localhost
-          register: security_finding_inbox_rust_binary
-          become: false
-
-        - name: Установить Rust security-finding-inbox
-          ansible.builtin.copy:
-            src: "{{ aw_rust_release_dir }}/security-finding-inbox"
-            dest: /usr/local/bin/security-finding-inbox
-            owner: root
-            group: root
-            mode: "0755"
-          when: security_finding_inbox_rust_binary.stat.exists | default(false)
-
-        - name: Установить systemd unit Security Finding Inbox executor
-          ansible.builtin.copy:
-            src: "{{ aw_repo_root }}/ops/systemd/aw-security-finding-executor.service"
-            dest: /etc/systemd/system/aw-security-finding-executor.service
-            owner: root
-            group: root
-            mode: "0644"
-          notify: Перезагрузить systemd
-
         - name: Проверить локальный Rust AW-RUS healthd
           ansible.builtin.stat:
             path: "{{ aw_rust_release_dir }}/aw-rus-healthd"
@@ -1851,9 +1605,7 @@
             owner: root
             group: root
             mode: "0644"
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_influx_enabled | default(false) | bool
+          when: aw_dlp_influx_enabled | default(false) | bool
 
         - name: Проверить локальный Rust AW DLP Influx exporter
           ansible.builtin.stat:
@@ -1861,18 +1613,14 @@
           delegate_to: localhost
           register: aw_dlp_influx_exporter_rust_binary
           become: false
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_influx_enabled | default(false) | bool
+          when: aw_dlp_influx_enabled | default(false) | bool
 
         - name: Требовать Rust AW DLP Influx exporter artifact
           ansible.builtin.assert:
             that:
               - aw_dlp_influx_exporter_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-influx-exporter"
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_influx_enabled | default(false) | bool
+          when: aw_dlp_influx_enabled | default(false) | bool
 
         - name: Установить Rust AW DLP Influx exporter
           ansible.builtin.copy:
@@ -1892,9 +1640,7 @@
             owner: root
             group: root
             mode: "0644"
-          when:
-            - aw_dlp_enabled | default(false) | bool
-            - aw_dlp_influx_enabled | default(false) | bool
+          when: aw_dlp_influx_enabled | default(false) | bool
 
         - name: Проверить локальный Rust DetMir readiness checker
           ansible.builtin.stat:
@@ -2046,42 +1792,42 @@
             name: aw-dlp-cef-exporter.timer
             enabled: true
             state: restarted
-          when: aw_dlp_integrations_enabled | default(false) | bool
+          when: aw_dlp_integrations_enabled | default(true) | bool
 
         - name: Включить и перезапустить timer syslog forwarder
           ansible.builtin.systemd:
             name: aw-dlp-syslog-forwarder.timer
             enabled: true
             state: restarted
-          when: aw_dlp_integrations_enabled | default(false) | bool
+          when: aw_dlp_integrations_enabled | default(true) | bool
 
         - name: Включить и перезапустить timer webhook sender
           ansible.builtin.systemd:
             name: aw-dlp-webhook-sender.timer
             enabled: true
             state: restarted
-          when: aw_dlp_integrations_enabled | default(false) | bool
+          when: aw_dlp_integrations_enabled | default(true) | bool
 
         - name: Включить и перезапустить DLP case management
           ansible.builtin.systemd:
             name: aw-dlp-case-management.service
             enabled: true
             state: restarted
-          when: aw_dlp_case_management_enabled | default(false) | bool
+          when: aw_dlp_case_management_enabled | default(true) | bool
 
         - name: Включить и перезапустить timer DLP compliance report
           ansible.builtin.systemd:
             name: aw-dlp-report-scheduler.timer
             enabled: true
             state: restarted
-          when: aw_dlp_compliance_enabled | default(false) | bool
+          when: aw_dlp_compliance_enabled | default(true) | bool
 
         - name: Выполнить разовый прогон DLP compliance report
           ansible.builtin.systemd:
             name: aw-dlp-report-scheduler.service
             state: started
           failed_when: false
-          when: aw_dlp_compliance_enabled | default(false) | bool
+          when: aw_dlp_compliance_enabled | default(true) | bool
 
         - name: Включить и перезапустить AW worktime API
           ansible.builtin.systemd:
@@ -2448,11 +2194,6 @@
             mode: "0755"
           when: dlp_aggregator_rust_binary.stat.exists | default(false)
 
-        - name: Удалить stale drop-in, переопределяющий lightweight DLP aggregator
-          ansible.builtin.file:
-            path: /etc/systemd/system/activitywatch-dlp-aggregator.service.d/20-rust-switch.conf
-            state: absent
-
         - name: Установить systemd unit для агрегатора
           ansible.builtin.copy:
             dest: /etc/systemd/system/activitywatch-dlp-aggregator.service
@@ -2461,7 +2202,7 @@
             mode: "0644"
             content: |
               [Unit]
-              Description=ActivityWatch Lightweight DLP Event Aggregator
+              Description=ActivityWatch DLP Event Aggregator
               After=activitywatch-server.service
 
               [Service]
@@ -2471,18 +2212,7 @@
               ExecStart=/usr/local/bin/dlp-aggregator-rust \
                 --aw-url http://127.0.0.1:{{ aw_server_port }}/api/0 \
                 --sqlite-path {{ aw_server_data_dir }}/dlp_warehouse.sqlite \
-                --state-path {{ aw_server_data_dir }}/dlp-aggregator-state.json \
-                --bucket-prefixes {{ aw_dlp_aggregator_bucket_prefixes | default('aw-file-operations_,aw-dlp-incidents_') }} \
-                --lookback-hours {{ aw_dlp_aggregator_lookback_hours | default(2) }} \
-                --overlap-seconds {{ aw_dlp_aggregator_overlap_seconds | default(60) }} \
-                --limit {{ aw_dlp_aggregator_limit | default(500) }} \
-                --timeout {{ aw_dlp_aggregator_timeout_seconds | default(8) }}
-              Nice=10
-              IOSchedulingClass=best-effort
-              IOSchedulingPriority=7
-              CPUQuota={{ aw_dlp_aggregator_cpu_quota | default('10%') }}
-              MemoryMax={{ aw_dlp_aggregator_memory_max | default('256M') }}
-              TimeoutStartSec={{ (aw_dlp_aggregator_timeout_seconds | default(8) | int) + 15 }}
+                --state-path {{ aw_server_data_dir }}/dlp-aggregator-state.json
 
               [Install]
               WantedBy=multi-user.target
@@ -2492,10 +2222,10 @@
             dest: /etc/systemd/system/activitywatch-dlp-aggregator.timer
             content: |
               [Unit]
-              Description=Run ActivityWatch Lightweight DLP Aggregator
+              Description=Run ActivityWatch DLP Aggregator every 5 minutes
 
               [Timer]
-              OnCalendar={{ aw_dlp_aggregator_on_calendar | default('*:3/15:10') }}
+              OnCalendar=*:3/10:10
               AccuracySec=30s
               RandomizedDelaySec=30s
               Persistent=false
@@ -2509,14 +2239,9 @@
             enabled: true
             state: started
             daemon_reload: true
-      when:
-        - aw_dlp_enabled | default(false) | bool
-        - aw_dlp_light_collector_enabled | default(false) | bool
 
     - name: Настроить IOC enrichment из Hayabusa Sigma
-      when:
-        - aw_dlp_enabled | default(false) | bool
-        - aw_dlp_ioc_enabled | default(false) | bool
+      when: aw_dlp_ioc_enabled | default(false) | bool
       block:
         - name: Создать каталог IOC enrichment
           ansible.builtin.file:

ansible/deploy_aw_windows.yml

@@ -18,13 +18,7 @@
     aw_windows_package_version: "v0.13.2"
     aw_windows_package_url: "https://github.com/ActivityWatch/activitywatch/releases/download/v0.13.2/activitywatch-v0.13.2-windows-x86_64.zip"
     aw_windows_package_zip_path: ""
-    # Windows account domain is the physical/local Windows logon domain. It may
-    # change when the RDP server is renamed. Do not use it as the ActivityWatch
-    # bucket identity.
-    aw_windows_domain: ""
-    # Stable ActivityWatch identity used in bucket ids, dashboards and reports.
-    # Keep this stable across Windows/RDP host renames.
-    aw_windows_logical_host_id: ""
+    aw_windows_domain: "SHARKON2025"
     aw_windows_builtin_administrator_name: "Администратор"
     aw_windows_users:
       - Администратор
@@ -149,44 +143,13 @@
               )
           }}
 
-    - name: Получить Windows COMPUTERNAME для account-domain fallback
-      ansible.windows.win_command: powershell.exe -NoProfile -Command "$env:COMPUTERNAME"
-      register: aw_windows_computername_result
-      changed_when: false
-
-    - name: Вычислить effective Windows account domain
-      ansible.builtin.set_fact:
-        aw_windows_domain_effective: >-
-          {{
-            aw_windows_domain
-            if (
-              (aw_windows_domain | default('') | string | length) > 0
-              and (aw_windows_domain | string) != 'HOST-EXAMPLE'
-            )
-            else (aw_windows_computername_result.stdout | trim)
-          }}
-
-    - name: Вычислить effective File1C upload principal
-      ansible.builtin.set_fact:
-        aw_windows_file_1c_auto_upload_run_as_user_effective: >-
-          {{
-            aw_windows_file_1c_auto_upload_run_as_user
-            if (
-              (aw_windows_file_1c_auto_upload_run_as_user | default('') | string | length) > 0
-              and 'HOST-EXAMPLE' not in (aw_windows_file_1c_auto_upload_run_as_user | string)
-              and not ((aw_windows_file_1c_auto_upload_run_as_user | string).startswith('\\'))
-            )
-            else (aw_windows_domain_effective ~ '\\' ~ aw_windows_builtin_administrator_name)
-          }}
-
     - name: Проверить обязательные переменные
       ansible.builtin.assert:
         that:
           - aw_windows_server_host_effective | length > 0
           - aw_windows_server_port is defined
           - aw_windows_server_scheme is defined
-          - aw_windows_domain_effective is defined
-          - aw_windows_domain_effective | string | length > 0
+          - aw_windows_domain is defined
           - aw_windows_builtin_administrator_name is defined
           - aw_windows_builtin_administrator_name | length > 0
           - aw_windows_users_effective | length > 0
@@ -195,25 +158,6 @@
           - (not (aw_windows_file_1c_auto_upload_enabled | bool)) or (aw_windows_file_1c_target_host_effective | length > 0)
         fail_msg: "Не заданы обязательные переменные Windows-развёртывания."
 
-    - name: Вычислить stable ActivityWatch host identity
-      ansible.builtin.set_fact:
-        aw_windows_logical_host_id_effective: >-
-          {{
-            aw_windows_logical_host_id
-            if (
-              (aw_windows_logical_host_id | default('') | string | length) > 0
-              and (aw_windows_logical_host_id | string) != 'HOST-EXAMPLE'
-            )
-            else (
-              aw_windows_hostname_override
-              if (
-                (aw_windows_hostname_override | default('') | string | length) > 0
-                and (aw_windows_hostname_override | string) != 'HOST-EXAMPLE'
-              )
-              else ''
-            )
-          }}
-
     - name: Нормализовать effective флаги collector'ов и smoke-check
       ansible.builtin.set_fact:
         aw_windows_afk_enabled_effective: "{{ (aw_windows_afk_enabled | default(aw_windows_afk_enabled_default)) | bool }}"
@@ -342,7 +286,7 @@
             ServerHost = "{{ aw_windows_server_host_effective }}"
             ServerPort = {{ aw_windows_server_port }}
             Version = "{{ aw_windows_package_version }}"
-            Domain = "{{ aw_windows_domain_effective }}"
+            Domain = "{{ aw_windows_domain }}"
             UserListPath = "{{ aw_windows_deploy_root }}\windows\users.txt"
             InstallRoot = "{{ aw_windows_install_root }}"
             StateRoot = "{{ aw_windows_state_root }}"
@@ -372,7 +316,7 @@
             File1CAutoUploadEnabled = {{ '$true' if (aw_windows_file_1c_auto_upload_enabled | bool) else '$false' }}
             File1CAutoUploadIntervalMinutes = {{ aw_windows_file_1c_auto_upload_interval_minutes | int }}
             File1CAutoUploadTaskName = "{{ aw_windows_file_1c_auto_upload_task_name }}"
-            File1CAutoUploadRunAsUser = "{{ aw_windows_file_1c_auto_upload_run_as_user_effective }}"
+            File1CAutoUploadRunAsUser = "{{ aw_windows_file_1c_auto_upload_run_as_user }}"
             File1CTargetHost = "{{ aw_windows_file_1c_target_host_effective }}"
             File1CTargetUser = "{{ aw_windows_file_1c_target_user }}"
             File1CRegistryWorkbookPath = "{{ aw_windows_file_1c_registry_workbook_path }}"
@@ -392,8 +336,8 @@
           {% endfor %}
           )
           {% endif %}
-          {% if (aw_windows_logical_host_id_effective | default('') | string | length) > 0 %}
-          $params.AwHostname = "{{ aw_windows_logical_host_id_effective }}"
+          {% if (aw_windows_hostname_override | default('') | string | length) > 0 %}
+          $params.AwHostname = "{{ aw_windows_hostname_override }}"
           {% endif %}
           {% if aw_windows_skip_hardening | bool %}
           $params.SkipHardening = $true
@@ -521,7 +465,7 @@
           }
           & "{{ aw_windows_deploy_root }}\windows\install-collector-guard-service.ps1" @guardParams
 
-    - name: Получить Windows hostname для fallback AW smoke-check bucket
+    - name: Получить Windows hostname для AW smoke-check bucket
       when:
         - aw_windows_api_smoke_check_enabled | bool
       ansible.windows.win_command: powershell.exe -NoProfile -Command "$env:COMPUTERNAME"
@@ -537,11 +481,7 @@
           {{
             aw_windows_api_smoke_check_bucket
             if (aw_windows_api_smoke_check_bucket | default('') | string | length) > 0
-            else 'aw-worktime-sessions_' ~ (
-              aw_windows_logical_host_id_effective
-              if (aw_windows_logical_host_id_effective | default('') | string | length) > 0
-              else (aw_windows_hostname_result.stdout | trim)
-            )
+            else 'aw-worktime-sessions_' ~ (aw_windows_hostname_result.stdout | trim)
           }}
 
     - name: Вычислить AW Window smoke-check bucket
@@ -555,11 +495,7 @@
           {{
             aw_windows_api_smoke_check_window_bucket
             if (aw_windows_api_smoke_check_window_bucket | default('') | string | length) > 0
-            else 'aw-watcher-window_' ~ (
-              aw_windows_logical_host_id_effective
-              if (aw_windows_logical_host_id_effective | default('') | string | length) > 0
-              else (aw_windows_hostname_result.stdout | trim)
-            )
+            else 'aw-watcher-window_' ~ (aw_windows_hostname_result.stdout | trim)
           }}
 
     - name: Выполнить AW API smoke-check (worktime bucket должен получать события)

ansible/deploy_detmir_portal.yml

@@ -15,16 +15,8 @@
     detmir_portal_workforce_policy_path: "/etc/detmir-portal-workforce-policy.json"
     detmir_portal_ueba_policy_path: "/etc/detmir-portal-ueba-policy.yaml"
     detmir_portal_readiness_bundle_dir: "{{ detmir_portal_readiness_bundle_dir_override | default('/var/lib/activitywatch/health/readiness-bundle', true) }}"
-    detmir_portal_dlp_module_enabled: "{{ detmir_portal_dlp_module_enabled_override | default(false) }}"
 
   tasks:
-    - name: Refuse inconsistent DetMir portal DLP profile
-      ansible.builtin.assert:
-        that:
-          - detmir_portal_dlp_profile | default('core_only') in ['core_only', 'light', 'on_demand', 'full']
-          - (detmir_portal_dlp_profile | default('core_only') != 'core_only') or not (detmir_portal_dlp_module_enabled | bool)
-        fail_msg: "Inconsistent DetMir portal DLP profile: core_only must keep DETMIR_PORTAL_DLP_MODULE_ENABLED=false."
-
     - name: Check local detmir-portal binary
       ansible.builtin.stat:
         path: "{{ aw_rust_release_dir }}/detmir-portal"
@@ -62,8 +54,6 @@
           DETMIR_PORTAL_UEBA_POLICY_PATH={{ detmir_portal_ueba_policy_path }}
           DETMIR_PORTAL_TIMEOUT_SECONDS=25
           DETMIR_PORTAL_STATE_DIR=/var/lib/detmir-portal
-          DETMIR_PORTAL_DLP_MODULE_ENABLED={{ detmir_portal_dlp_module_enabled | bool | ternary('true', 'false') }}
-          DETMIR_PORTAL_DLP_PROFILE={{ detmir_portal_dlp_profile | default('core_only') }}
           DETMIR_PORTAL_DLP_DB_PATH=/var/lib/activitywatch/dlp_warehouse.sqlite
           DETMIR_PORTAL_EVIDENCE_ROOT=/var/lib/detmir-portal/evidence
           DETMIR_PORTAL_READINESS_BUNDLE_DIR={{ detmir_portal_readiness_bundle_dir }}
@@ -75,65 +65,6 @@
           CLICKHOUSE_USER={{ detmir_clickhouse_user | default('default') }}
           CLICKHOUSE_PASSWORD={{ detmir_clickhouse_password | default('') }}
 
-    - name: Install lightweight DLP warehouse sync helper
-      ansible.builtin.copy:
-        src: "{{ aw_repo_root }}/scripts/detmir_dlp_warehouse_sync.sh"
-        dest: /usr/local/bin/detmir-dlp-warehouse-sync
-        owner: root
-        group: root
-        mode: "0755"
-
-    - name: Install lightweight DLP warehouse sync service
-      ansible.builtin.copy:
-        dest: /etc/systemd/system/detmir-dlp-warehouse-sync.service
-        owner: root
-        group: root
-        mode: "0644"
-        content: |
-          [Unit]
-          Description=Sync lightweight DetMir DLP SQLite warehouse for portal
-          After=network-online.target
-          Wants=network-online.target
-
-          [Service]
-          Type=oneshot
-          Environment=AW_DLP_WAREHOUSE_SOURCE_HOST={{ detmir_portal_dlp_warehouse_source_host | default('igor@10.10.10.13') }}
-          Environment=AW_DLP_WAREHOUSE_SOURCE_PATH={{ detmir_portal_dlp_warehouse_source_path | default('/var/lib/activitywatch/dlp_warehouse.sqlite') }}
-          Environment=AW_DLP_WAREHOUSE_DEST_PATH={{ detmir_portal_dlp_warehouse_dest_path | default('/var/lib/activitywatch/dlp_warehouse.sqlite') }}
-          Environment=AW_DLP_WAREHOUSE_SYNC_STATE_DIR={{ detmir_portal_dlp_warehouse_sync_state_dir | default('/var/lib/activitywatch/health') }}
-          ExecStart=/usr/local/bin/detmir-dlp-warehouse-sync
-          Nice=10
-          IOSchedulingClass=best-effort
-          IOSchedulingPriority=7
-          TimeoutStartSec=60
-
-    - name: Install lightweight DLP warehouse sync timer
-      ansible.builtin.copy:
-        dest: /etc/systemd/system/detmir-dlp-warehouse-sync.timer
-        owner: root
-        group: root
-        mode: "0644"
-        content: |
-          [Unit]
-          Description=Run lightweight DetMir DLP SQLite warehouse sync
-
-          [Timer]
-          OnBootSec=4min
-          OnUnitActiveSec={{ detmir_portal_dlp_warehouse_sync_interval | default('2min') }}
-          AccuracySec=30s
-          Persistent=false
-
-          [Install]
-          WantedBy=timers.target
-
-    - name: Enable lightweight DLP warehouse sync timer
-      ansible.builtin.systemd:
-        name: detmir-dlp-warehouse-sync.timer
-        enabled: true
-        state: started
-        daemon_reload: true
-      when: detmir_portal_dlp_module_enabled | bool
-
     - name: Preserve local ClickHouse security-events settings when available
       ansible.builtin.shell: |
         set -euo pipefail
@@ -186,9 +117,7 @@
         state: absent
       loop:
         - /etc/systemd/system/detmir-portal.service.d/20-timeouts.conf
-        - /etc/systemd/system/detmir-portal.service.d/20-prod-timeout.conf
         - /etc/systemd/system/detmir-portal.service.d/30-warm-cache.conf
-        - /etc/systemd/system/detmir-portal.service.d/30-prewarm-after-start.conf
       register: detmir_portal_stale_overrides
 
     - name: Install initial workforce policy when absent
@@ -245,11 +174,6 @@
           WantedBy=multi-user.target
       register: detmir_portal_service_unit
 
-    - name: Remove stale detmir-portal timeout override
-      ansible.builtin.file:
-        path: /etc/systemd/system/detmir-portal.service.d/10-detmir-check-env.conf
-        state: absent
-
     - name: Reload systemd
       ansible.builtin.systemd:
         daemon_reload: true

ansible/group_vars/all.yml

@@ -33,10 +33,7 @@ aw_worktime_manager_trend_min_points: 3
 aw_worktime_manager_trend_delta_pct: 10
 aw_worktime_manager_off_hours_threshold_seconds: 1800
 aw_worktime_interpretation_policy_path: "/etc/activitywatch/worktime-interpretation-policy.json"
-aw_dlp_profile: "core_only"
-detmir_portal_dlp_profile: "light"
-detmir_portal_dlp_module_enabled_override: true
-aw_dlp_influx_enabled: false
+aw_dlp_influx_enabled: true
 aw_dlp_influx_url: "http://192.0.2.10:8086"
 aw_dlp_influx_org: "proxmox"
 aw_dlp_influx_bucket: "aw_metrics"
@@ -50,7 +47,6 @@ aw_worktime_host: "{{ aw_monitored_windows_hostname }}"
 aw_rus_health_worktime_api_base: "http://127.0.0.1:5610"
 aw_rus_health_state_dir: "{{ aw_server_data_dir }}/health"
 aw_rus_health_validation_dir: "{{ aw_rus_health_state_dir }}/windows-validation"
-aw_rus_health_rdp_tcp_required: false
 aw_hayabusa_auto_case_enabled: true
 aw_hayabusa_auto_case_min_severity: "medium"
 aw_hayabusa_telegram_enabled: true
@@ -69,46 +65,22 @@ aw_server_cors_origins:
 
 aw_apply_worktime_settings: true
 
-aw_dlp_ioc_enabled: false
-aw_dlp_enabled: false
-aw_dlp_disabled_reason: ""
-aw_dlp_disabled_since: ""
-aw_dlp_light_collector_enabled: false
-aw_dlp_light_guard_enabled: true
-aw_dlp_light_guard_load_ratio: "1.50"
-aw_dlp_light_guard_mem_available_pct_min: "15"
-aw_dlp_light_guard_iowait_pct_max: "20"
-aw_dlp_light_guard_strikes_required: 3
-aw_dlp_light_guard_state_dir: "{{ aw_server_data_dir }}/health"
-aw_dlp_aggregator_bucket_prefixes: "aw-file-operations_,aw-dlp-incidents_"
-aw_dlp_aggregator_limit: 500
-aw_dlp_aggregator_lookback_hours: 2
-aw_dlp_aggregator_overlap_seconds: 60
-aw_dlp_aggregator_timeout_seconds: 8
-aw_dlp_aggregator_on_calendar: "*:3/15:10"
-aw_dlp_aggregator_cpu_quota: "10%"
-aw_dlp_aggregator_memory_max: "256M"
-aw_containment_enabled: false
-aw_containment_mode: "shadow"
-aw_containment_policy_path: "/etc/activitywatch/containment-policy.json"
-aw_containment_default_ttl_minutes: 60
-aw_containment_require_admin_channel_check: true
-aw_containment_allow_auto_for_servers: false
+aw_dlp_ioc_enabled: true
 aw_dlp_ioc_workdir: "/opt/activitywatch/dlp-ioc"
 aw_dlp_ioc_rules_zip_url: "https://github.com/Yamato-Security/hayabusa-rules/archive/refs/heads/main.zip"
 aw_dlp_ioc_refresh_on_boot_sec: "5min"
 aw_dlp_ioc_refresh_interval: "6h"
-aw_dlp_policy_engine_enabled: false
+aw_dlp_policy_engine_enabled: true
 aw_dlp_policy_engine_bind_host: "0.0.0.0"
 aw_dlp_policy_engine_port: 5601
 aw_dlp_policy_engine_db_path: "{{ aw_server_data_dir }}/dlp-policy-engine.sqlite"
-aw_dlp_content_analysis_enabled: false
-aw_dlp_integrations_enabled: false
-aw_dlp_case_management_enabled: false
+aw_dlp_content_analysis_enabled: true
+aw_dlp_integrations_enabled: true
+aw_dlp_case_management_enabled: true
 aw_dlp_case_bind_host: "0.0.0.0"
 aw_dlp_case_port: 5602
 aw_dlp_case_db_path: "/opt/activitywatch/dlp-case-management/cases.db"
-aw_dlp_compliance_enabled: false
+aw_dlp_compliance_enabled: true
 aw_dlp_compliance_report_dir: "/opt/activitywatch/dlp-compliance/reports"
 aw_dlp_compliance_template_path: "/opt/activitywatch/dlp-compliance/templates/152-fz-report.html"
 aw_server_post_deploy_health_check_enabled: true

ansible/group_vars/aw_windows.yml

@@ -15,10 +15,6 @@ aw_windows_package_url: "https://github.com/ActivityWatch/activitywatch/releases
 aw_windows_package_zip_path: ""
 
 aw_windows_domain: "HOST-EXAMPLE"
-# Stable ActivityWatch host identity for bucket ids, Grafana variables and
-# ClickHouse workforce keys. This is separate from aw_windows_domain.
-# Production host_vars must override both values explicitly.
-aw_windows_logical_host_id: "HOST-EXAMPLE"
 aw_windows_builtin_administrator_name: "Администратор"
 aw_windows_users:
   - Администратор

ansible/group_vars/pfsense-poller.example.yml

@@ -13,8 +13,8 @@ aw_pfsense_poller_config:
     verify_tls: false
     timeout_seconds: 15
     auth:
-      api_key: "<SET_VIA_ENV>"
-      api_secret: "<SET_VIA_ENV>"
+      api_key: "replace-me"
+      api_secret: "replace-me"
   endpoints:
     - name: "system-status"
       path: "/api/v2/status/system"

ansible/group_vars/windows.example.yml

@@ -14,11 +14,6 @@ aw_windows_package_version: "v0.13.2"
 aw_windows_package_url: "https://github.com/ActivityWatch/activitywatch/releases/download/v0.13.2/activitywatch-v0.13.2-windows-x86_64.zip"
 aw_windows_package_zip_path: ""
 aw_windows_domain: "HOST-EXAMPLE"
-# Stable ActivityWatch host identity for bucket ids and dashboards.
-# This is not necessarily the Windows computer name. Keep it stable across
-# Windows/RDP host renames, and change aw_windows_domain separately when the
-# local Windows logon domain changes.
-aw_windows_logical_host_id: "HOST-EXAMPLE"
 # Localized name of the built-in local Administrator account (SID ending in -500).
 # On the current Russian Windows host this must stay "Администратор";
 # do not replace it with "Administrator" unless the target OS account is actually named that way.
@@ -38,7 +33,7 @@ aw_windows_extra_users: []
 # Единые Windows/RDP пути: те же, что использует InnoSetup.
 aw_windows_install_root: "C:\\Program Files\\AWatch-rus\\bin"
 aw_windows_state_root: "C:\\ProgramData\\AWatch-rus"
-aw_windows_hostname_override: ""  # Legacy alias; prefer aw_windows_logical_host_id.
+aw_windows_hostname_override: ""  # Например: HOST-EXAMPLE
 aw_windows_afk_enabled: true
 aw_windows_window_enabled: true
 aw_windows_file_ops_enabled: true
@@ -79,8 +74,8 @@ aw_windows_legacy_install_root: "C:\\Program Files\\ActivityWatch-Phase2"
 aw_windows_legacy_state_root: "C:\\ProgramData\\ActivityWatch-Phase2"
 aw_windows_migration_report_remote_path: "{{ aw_windows_state_root }}\\aw_migration_ansible.json"
 
-# По умолчанию smoke-check bucket вычисляется как aw-watcher-*_<aw_windows_logical_host_id>.
-# Если logical id не задан, используется физический COMPUTERNAME как fallback.
+# По умолчанию AFK bucket вычисляется как aw-watcher-afk_<COMPUTERNAME>.
+# Задайте явное значение только если watcher пишет в нестандартный bucket.
 aw_windows_api_smoke_check_enabled: true
 aw_windows_api_smoke_check_bucket: ""
 aw_windows_api_smoke_check_limit: 10

ansible/host_vars/rdp-prod.yml

@@ -1,15 +0,0 @@
----
-# Production DetMir keeps SHARKON2025 as the stable ActivityWatch logical host
-# id for historical buckets, Grafana variables and ClickHouse workforce keys.
-# This value is intentionally independent from the physical Windows computer
-# name, which may change during RDP server maintenance.
-aw_windows_logical_host_id: "SHARKON2025"
-aw_windows_hostname_override: "{{ aw_windows_logical_host_id }}"
-
-# Set aw_windows_domain to the current Windows local/domain logon prefix after
-# a server rename. Do not use aw_windows_logical_host_id as a logon domain.
-
-# This host uses aw-windows-telemetry browser-domains-collector as the per-user
-# currentwindow source. The legacy aw-watcher-window process emits no-user
-# duplicate rows in this RDP setup, so keep it disabled for this host.
-aw_windows_window_enabled: false

aw-server/aw-db-vacuum.service

@@ -1,19 +0,0 @@
-[Unit]
-Description=ActivityWatch SQLite nightly VACUUM
-After=activitywatch-server.service
-ConditionPathExists=/usr/local/bin/aw-db-maintenance
-ConditionPathExists=/var/lib/activitywatch/aw-server-rust/sqlite.db
-RequiresMountsFor=/var/lib/activitywatch
-
-[Service]
-Type=oneshot
-EnvironmentFile=-/etc/activitywatch/aw-server.env
-ExecStart=/usr/local/bin/aw-db-maintenance --vacuum --apply --json
-TimeoutStartSec=2h
-SyslogIdentifier=aw-db-vacuum
-StandardOutput=journal
-StandardError=journal
-Nice=10
-IOSchedulingClass=best-effort
-IOSchedulingPriority=7
-UMask=0077

aw-server/aw-db-vacuum.timer

@@ -1,10 +0,0 @@
-[Unit]
-Description=Nightly ActivityWatch SQLite VACUUM
-
-[Timer]
-OnCalendar=*-*-* 02:10:00
-RandomizedDelaySec=10m
-Persistent=true
-
-[Install]
-WantedBy=timers.target

aw-server/aw-server.env.example

@@ -16,7 +16,7 @@ AW_SERVER_GROUP=activitywatch
 AW_SERVER_PUBLIC_HOST=aw-server
 AW_WORKTIME_REPORT_BASE=http://aw-server:5610
 AW_WORKTIME_TZ=Europe/Moscow
-AW_WORKTIME_HOST=HOST-EXAMPLE
+AW_WORKTIME_HOST=SHARKON2025
 AW_WORKTIME_EVENTS_LIMIT=5000
 AW_WORKTIME_AW_HTTP_TIMEOUT_SECONDS=6
 AW_WORKTIME_EVENTS_CACHE_TTL_SECONDS=300
@@ -33,16 +33,6 @@ AW_WORKTIME_MANAGEMENT_WARM_URL=http://127.0.0.1:5610/reports/worktime/managemen
 AW_WORKTIME_MANAGEMENT_WARM_TIMEOUT_SECONDS=70
 
 # DLP IOC Configuration
-AW_DLP_ENABLED=false
-AW_DLP_PROFILE=core_only
-AW_DLP_DISABLED_REASON=detmir_prod_resource_guardrail
-AW_DLP_DISABLED_SINCE=
-AW_CONTAINMENT_ENABLED=false
-AW_CONTAINMENT_MODE=shadow
-AW_CONTAINMENT_POLICY=/etc/activitywatch/containment-policy.json
-AW_CONTAINMENT_DEFAULT_TTL_MINUTES=60
-AW_CONTAINMENT_REQUIRE_ADMIN_CHANNEL_CHECK=true
-AW_CONTAINMENT_ALLOW_AUTO_FOR_SERVERS=false
 AW_DLP_IOC_DIR=/opt/activitywatch/dlp-ioc/output
 
 # DLP Policy Engine Configuration
@@ -60,24 +50,22 @@ AW_HEALTH_CHECK_ENABLED=true
 AW_HEALTH_CHECK_INTERVAL=60
 AW_EXPECT_START_OF_DAY=00:00
 AW_EXPECT_ALWAYS_ACTIVE_PATTERN=aw-watcher-window
-AW_EXPECT_LANDINGPAGE=/#/activity/HOST-EXAMPLE/view/
+AW_EXPECT_LANDINGPAGE=/#/activity/SHARKON2025/view/
 AW_HEALTH_STRICT_FILEOPS=0
 AW_MONITORED_WINDOWS_HOST=<WINDOWS_HOST>
-AW_MONITORED_WINDOWS_HOSTNAME=HOST-EXAMPLE
+AW_MONITORED_WINDOWS_HOSTNAME=SHARKON2025
 AW_RUS_HEALTH_WORKTIME_API=http://127.0.0.1:5610
 AW_RUS_HEALTH_STATE_DIR=/var/lib/activitywatch/health
 AW_RUS_HEALTH_VALIDATION_DIR=/var/lib/activitywatch/health/windows-validation
 AW_RUS_HEALTH_SESSION_EVENTS_MAX_AGE_SECONDS=86400
 AW_RUS_HEALTH_GUARD_MAX_AGE_SECONDS=300
 AW_RUS_HEALTH_GUARD_REQUIRED=1
-AW_RUS_HEALTH_RDP_TCP_REQUIRED=true
-AW_RUS_HEALTH_WRAPPER_TIMEOUT_SECONDS=90
 AW_RUS_SLO_AW_BASE=http://127.0.0.1:5600
 AW_RUS_SLO_WORKTIME_BASE=http://127.0.0.1:5610
 AW_RUS_SLO_TARGET_PERCENT=99.97
 AW_BROWSER_SMOKE_AW_BASE=http://127.0.0.1:5600
 AW_BROWSER_SMOKE_WORKTIME_BASE=http://127.0.0.1:5610
-AW_BROWSER_SMOKE_HOST=HOST-EXAMPLE
+AW_BROWSER_SMOKE_HOST=SHARKON2025
 AW_BROWSER_SMOKE_OUTPUT_DIR=/var/lib/activitywatch/browser-smoke
 AW_BROWSER_SMOKE_KEEP_RUNS=24
 AW_BROWSER_SMOKE_ENGINE=chromium-cli
@@ -91,15 +79,6 @@ AW_HAYABUSA_TELEGRAM_ENABLED=true
 AW_HAYABUSA_TELEGRAM_MIN_SEVERITY=high
 AW_HAYABUSA_TELEGRAM_BOT_TOKEN=
 AW_HAYABUSA_TELEGRAM_CHAT_IDS=
-AW_SECURITY_FINDING_INBOX_ENABLED=false
-AW_SECURITY_FINDING_INBOX_REQUIRED=false
-AW_SECURITY_FINDING_INBOX_BIN=/usr/local/bin/security-finding-inbox
-AW_SECURITY_FINDING_INBOX_MIN_SEVERITY=medium
-AW_SECURITY_FINDING_EXECUTOR_WORK_DIR=/var/lib/activitywatch/security-finding-executor
-AW_SECURITY_FINDING_EXECUTOR_LOCK=/var/lock/aw-security-finding-executor.lock
-AW_CONTAINMENT_ENGINE_BIN=/usr/local/bin/containment-engine
-AW_CONTAINMENT_MANAGEMENT_ALLOWLIST=
-AW_CONTAINMENT_BLOCKED_REMOTE_ADDRESSES=
 
 # Integration Test Configuration
 AW_INTEGRATION_TEST_ENABLED=false

check-aw-full.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 # check-aw-full.sh - Полная проверка ActivityWatch: сервер + RDP-хост
-# Сервер: http://10.10.10.13:5600
-# RDP-хост: 192.168.100.19 (logical host id SHARKON2025)
+# Сервер: 192.0.2.13:5600
+# RDP-хост: 198.51.100.18 (HOST-EXAMPLE)
 
 if [[ "${CHECK_AW_FULL_FORCE_LEGACY:-0}" != "1" ]]; then
   ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -16,17 +16,12 @@ if [[ "${CHECK_AW_FULL_FORCE_LEGACY:-0}" != "1" ]]; then
   done
 fi
 
-SERVER="${CHECK_AW_FULL_SERVER:-${AW_SMOKE_AW_SERVER:-${AW_SERVER:-http://10.10.10.13:5600}}}"
-HOSTNAME_FILTER="${CHECK_AW_FULL_HOST:-${AW_SMOKE_SOURCE_HOSTNAME:-${AW_LOGICAL_HOST_ID:-${AW_MONITORED_WINDOWS_HOSTNAME:-SHARKON2025}}}}"
-RDP_HOST="${CHECK_AW_FULL_RDP_HOST:-${AW_SMOKE_WINDOWS_HOST:-${AW_WINDOWS_HOST:-192.168.100.19}}}"
+SERVER="http://192.0.2.13:5600"
+HOSTNAME_FILTER="HOST-EXAMPLE"
+RDP_HOST="198.51.100.18"
 NOW=$(date -u +%s)
 HOST_INACTIVE=false
 GUARD_HEALTHY=false
-DLP_ENABLED="${AW_DLP_ENABLED:-${DETMIR_DLP_ENABLED:-true}}"
-case "${DLP_ENABLED,,}" in
-  0|false|no|off) DLP_ENABLED=false ;;
-  *) DLP_ENABLED=true ;;
-esac
 
 classify_bucket_age() {
     local bucket="$1"
@@ -105,7 +100,7 @@ echo ""
 # 1. Проверка сервера
 echo -e "${CYAN}--- 1. AW Server ($SERVER) ---${NC}"
 echo -n "  Connectivity... "
-RESP=$(no_proxy='*' curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/info" 2>&1)
+RESP=$(no_proxy=192.0.2.13 curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/info" 2>&1)
 if [ $? -eq 0 ] && echo "$RESP" | jq -e '.version' > /dev/null 2>&1; then
     VERSION=$(echo "$RESP" | jq -r '.version')
     echo -e "  ${GREEN}OK${NC} (aw-server $VERSION)"
@@ -115,7 +110,7 @@ else
 fi
 
 echo -n "  CORS... "
-CORS_RESP=$(no_proxy='*' curl -s --connect-timeout 10 --max-time 15 -o /dev/null -w '%{http_code}' -H "Origin: $SERVER" "$SERVER/api/0/settings/" 2>&1)
+CORS_RESP=$(no_proxy=192.0.2.13 curl -s --connect-timeout 10 --max-time 15 -o /dev/null -w '%{http_code}' -H "Origin: http://192.0.2.13:5600" "$SERVER/api/0/settings/" 2>&1)
 if [ "$CORS_RESP" = "200" ]; then
     echo -e "${GREEN}OK${NC}"
 else
@@ -124,7 +119,7 @@ fi
 echo ""
 
 # 1b. Context for inactive/event-driven classification
-WORKTIME_EVENT_DATA=$(no_proxy='*' curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/aw-worktime-sessions_$HOSTNAME_FILTER/events?limit=1" 2>&1)
+WORKTIME_EVENT_DATA=$(no_proxy=192.0.2.13 curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/aw-worktime-sessions_$HOSTNAME_FILTER/events?limit=1" 2>&1)
 WORKTIME_TS=$(echo "$WORKTIME_EVENT_DATA" | jq -r '.[0].timestamp // ""' 2>/dev/null)
 WORKTIME_ACTIVE=$(echo "$WORKTIME_EVENT_DATA" | jq -r '.[0].data.active // false' 2>/dev/null)
 if [ -n "$WORKTIME_TS" ]; then
@@ -137,7 +132,7 @@ if [ -n "$WORKTIME_TS" ]; then
   fi
 fi
 
-GUARD_EVENT_DATA=$(no_proxy='*' curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/aw-rus-collector-guard_$HOSTNAME_FILTER/events?limit=1" 2>&1)
+GUARD_EVENT_DATA=$(no_proxy=192.0.2.13 curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/aw-rus-collector-guard_$HOSTNAME_FILTER/events?limit=1" 2>&1)
 GUARD_TS=$(echo "$GUARD_EVENT_DATA" | jq -r '.[0].timestamp // ""' 2>/dev/null)
 GUARD_STATUS=$(echo "$GUARD_EVENT_DATA" | jq -r '.[0].data.status // ""' 2>/dev/null)
 GUARD_PROBLEMS=$(echo "$GUARD_EVENT_DATA" | jq -r '([.[0].data.problems[]?] | length) // 0' 2>/dev/null)
@@ -170,12 +165,9 @@ BUCKETS=(
 for entry in "${BUCKETS[@]}"; do
   bucket="${entry%%|*}"
   label="${entry##*|}"
-  if [ "$DLP_ENABLED" = "false" ] && [[ "$bucket" == aw-dlp-* ]]; then
-    continue
-  fi
   bucket_full="${bucket}_${HOSTNAME_FILTER}"
   
-  EVENT_DATA=$(no_proxy='*' curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/$bucket_full/events?limit=1" 2>&1)
+  EVENT_DATA=$(no_proxy=192.0.2.13 curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/$bucket_full/events?limit=1" 2>&1)
   LAST_ID=$(echo "$EVENT_DATA" | jq '.[0].id // 0')
   LAST_TS=$(echo "$EVENT_DATA" | jq -r '.[0].timestamp // "no events"')
   
@@ -208,9 +200,6 @@ for entry in "${BUCKETS[@]}"; do
   
   printf "  %-42s %-8s %-20s %b\n" "$label" "$LAST_ID" "$AGE" "$STATUS"
 done
-if [ "$DLP_ENABLED" = "false" ]; then
-  printf "  %-42s %-8s %-20s %b\n" "DLP buckets" "-" "disabled" "${CYAN}SKIPPED${NC}"
-fi
 echo ""
 
 # 3. Проверка RDP-хоста
@@ -241,11 +230,8 @@ DEAD_COUNT=0
 
 for entry in "${BUCKETS[@]}"; do
   bucket="${entry%%|*}"
-  if [ "$DLP_ENABLED" = "false" ] && [[ "$bucket" == aw-dlp-* ]]; then
-    continue
-  fi
   bucket_full="${bucket}_${HOSTNAME_FILTER}"
-  EVENT_DATA=$(no_proxy='*' curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/$bucket_full/events?limit=1" 2>&1)
+  EVENT_DATA=$(no_proxy=192.0.2.13 curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/$bucket_full/events?limit=1" 2>&1)
   LAST_TS=$(echo "$EVENT_DATA" | jq -r '.[0].timestamp // "no events"')
   
   if [ "$LAST_TS" != "no events" ] && [ -n "$LAST_TS" ]; then

clickhouse-1c/clickhouse/users.d/99-aw-workforce-dict.xml

@@ -1,13 +0,0 @@
-<clickhouse>
-  <users>
-    <aw_workforce_dict>
-      <no_password/>
-      <networks>
-        <ip>127.0.0.1</ip>
-        <ip>::1</ip>
-      </networks>
-      <profile>readonly</profile>
-      <quota>default</quota>
-    </aw_workforce_dict>
-  </users>
-</clickhouse>

clickhouse-1c/docker-compose.yml

@@ -13,7 +13,6 @@ services:
     volumes:
       - clickhouse_1c_data:/var/lib/clickhouse
       - ./clickhouse/init:/docker-entrypoint-initdb.d:ro
-      - ./clickhouse/users.d/99-aw-workforce-dict.xml:/etc/clickhouse-server/users.d/99-aw-workforce-dict.xml:ro
 
 volumes:
   clickhouse_1c_data:

clickhouse-workforce/.env.example

@@ -1,5 +0,0 @@
-CLICKHOUSE_DB=aw_workforce
-CLICKHOUSE_HTTP_BIND=127.0.0.1
-CLICKHOUSE_PORT=8124
-CLICKHOUSE_NATIVE_BIND=127.0.0.1
-CLICKHOUSE_NATIVE_PORT=9001

clickhouse-workforce/.gitignore

@@ -1,2 +0,0 @@
-.env
-.local/

clickhouse-workforce/README.md

@@ -1,155 +0,0 @@
-# ClickHouse Workforce analytics for AWatch-rus / DetMir
-
-Этот каталог содержит воспроизводимый ClickHouse-слой для привязки событий
-AWatch-rus к оргструктуре, классификации приложений и доменов, а также для
-быстрых агрегатов Grafana.
-
-Слой не заменяет `clickhouse-1c/`. Это отдельный контур для workforce/web
-аналитики ActivityWatch-событий.
-
-## Состав
-
-- `docker-compose.yml` - локальный ClickHouse scaffold.
-- `clickhouse/init/00_database.sql` - база `aw_workforce`.
-- `clickhouse/init/01_raw_tables.sql` - нормализованные staging tables для
-  window/browser events.
-- `clickhouse/init/02_dimensions_dictionaries.sql` - dimension tables и
-  ClickHouse Dictionaries.
-- `clickhouse/init/03_materialized_views.sql` - агрегированная таблица и
-  materialized views для Grafana.
-- `clickhouse/init/04_quality_views.sql` - views контроля unknown-зон.
-- `sample/seed_demo.sql` - минимальные demo-данные для smoke-проверки.
-- `sample/seed_sharkon2025_p3.sql` - первая реальная привязка
-  `SHARKON2025/sharkon2025/user1/tsj`.
-- `ops/run_smoke.sh` - локальный smoke для DDL, dictionaries и агрегатов.
-- `ops/aw-workforce-ingest.service` / `.timer` - production timer для
-  инкрементальной загрузки.
-- `ops/aw-workforce-ingest.env.example` - переменные окружения loader-а.
-- `catalog/*.tsv` - управляемые администратором справочники.
-- `ops/apply_catalogs.sh` - полная загрузка справочников, reload dictionaries,
-  опциональный rebuild агрегатов.
-- `ops/report_unknowns.sh` - быстрый отчет top unknown users/processes/domains.
-
-## Быстрый старт
-
-```bash
-cd clickhouse-workforce
-docker compose up -d
-./ops/run_smoke.sh
-```
-
-Локальный scaffold не задает `CLICKHOUSE_USER/PASSWORD` через Docker entrypoint:
-это оставляет штатный dev-доступ ClickHouse без пароля и не ломает
-`SOURCE(CLICKHOUSE(...))` у dictionaries. Файл
-`clickhouse/users.d/99-aw-workforce-local.xml` разрешает HTTP-запросы от Docker
-host, а HTTP/native порты по умолчанию привязаны только к `127.0.0.1`.
-
-Скрипт применяет SQL в правильном порядке, загружает demo seed и проверяет:
-
-- статус dictionaries;
-- наличие hourly aggregate rows;
-- daily productivity view;
-- unknown quality views.
-
-`sample/seed_demo.sql` добавляет демонстрационные строки. Для чистого повтора
-локального smoke пересоздайте volume:
-
-```bash
-docker compose down -v
-docker compose up -d
-./ops/run_smoke.sh
-```
-
-## Production порядок
-
-1. Реальные источники `aw_window_events` и `aw_browser_events` для
-   `SHARKON2025` подтверждены:
-   `docs/clickhouse/AW_WORKFORCE_SOURCES_SHARKON2025_RU.md`.
-2. Настроить ingest из ActivityWatch/exporter в staging tables.
-3. Загрузить `dim_workstation_user`, `dim_application_category`,
-   `dim_domain_category`.
-4. Проверить `system.dictionaries`.
-5. Включить materialized views.
-6. Перевести Grafana на `agg_workforce_productivity_hourly` и
-   `v_workforce_productivity_daily`.
-
-Исправление справочников не пересчитывает старые агрегаты автоматически.
-Для исторических периодов нужен backfill по регламенту из
-`docs/clickhouse/DICTIONARIES_IMPLEMENTATION_PLAN_RU.md`.
-
-## Live ingest P2/P3
-
-Rust loader находится в `adk-rust/crates/aw-workforce-ingest`.
-
-Пример загрузки bounded-окна из живого AW API в локальный ClickHouse:
-
-```bash
-cargo run --manifest-path ../adk-rust/Cargo.toml -p aw-workforce-ingest -- \
-  --aw-url http://10.10.10.13:5600/api/0 \
-  --clickhouse-url http://127.0.0.1:8124 \
-  --host SHARKON2025 \
-  --hours 24 \
-  --json
-```
-
-Применение первой привязки P3:
-
-```bash
-docker exec -i aw-rus-workforce-clickhouse clickhouse-client --multiquery \
-  < sample/seed_sharkon2025_p3.sql
-```
-
-## Production ingest P4
-
-В штатном режиме loader запускается без `--since/--until`: он читает
-`AW_WORKFORCE_STATE_PATH`, берет `last_end - AW_WORKFORCE_OVERLAP_SECONDS`,
-загружает bounded range и атомарно сохраняет новый `last_end`. Повторная
-загрузка overlap-окна не удваивает данные, потому что loader перед вставкой
-проверяет `source_bucket + source_event_id`.
-
-Runtime-файлы:
-
-```bash
-cd clickhouse-workforce
-sudo bash ./ops/bootstrap_runtime.sh
-sudo install -m 0755 ../adk-rust/target/release/aw-workforce-ingest \
-  /usr/local/bin/aw-workforce-ingest
-sudo editor /etc/activitywatch/aw-workforce-ingest.env
-sudo systemctl enable --now aw-workforce-ingest.timer
-```
-
-Ручная production-проверка одного цикла:
-
-```bash
-sudo systemctl start aw-workforce-ingest.service
-sudo journalctl -u aw-workforce-ingest.service -n 80 --no-pager
-```
-
-## Admin workflow справочников P5
-
-Справочники ведутся через `catalog/*.tsv`. Это полный source of truth:
-`ops/apply_catalogs.sh` очищает dimension tables, загружает TSV, reload-ит
-dictionaries и, если нужно, пересобирает агрегаты.
-
-Посмотреть слепые зоны:
-
-```bash
-./ops/report_unknowns.sh
-```
-
-Добавить или изменить категорию:
-
-```bash
-editor catalog/application_categories.tsv
-REBUILD_AGGREGATES=1 ./ops/apply_catalogs.sh
-```
-
-Убрать запись из отчетов без потери аудита: поставить `is_active=0` в TSV и
-запустить:
-
-```bash
-REBUILD_AGGREGATES=1 ./ops/apply_catalogs.sh
-```
-
-Если менялись только future-facing справочники и старые агрегаты пересчитывать
-не нужно, можно запустить без `REBUILD_AGGREGATES=1`.

clickhouse-workforce/admin/rebuild_aggregates.sql

@@ -1,118 +0,0 @@
-TRUNCATE TABLE aw_workforce.agg_workforce_productivity_hourly;
-
-INSERT INTO aw_workforce.agg_workforce_productivity_hourly
-SELECT
-    toStartOfHour(event_time) AS bucket_start,
-    toDate(event_time) AS event_date,
-
-    if(
-        dictGetUInt8OrDefault('aw_workforce.dict_workstation_user', 'is_active', (host_name, user_login), 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'branch', (host_name, user_login), '') != '',
-        dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'branch', (host_name, user_login), 'unknown'),
-        'unknown'
-    ) AS branch,
-    if(
-        dictGetUInt8OrDefault('aw_workforce.dict_workstation_user', 'is_active', (host_name, user_login), 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'department', (host_name, user_login), '') != '',
-        dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'department', (host_name, user_login), 'unknown'),
-        'unknown'
-    ) AS department,
-
-    'desktop' AS activity_type,
-    if(
-        dictGetUInt8OrDefault('aw_workforce.dict_application_category', 'is_active', process_name, 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_application_category', 'category', process_name, '') != '',
-        dictGetStringOrDefault('aw_workforce.dict_application_category', 'category', process_name, 'unknown'),
-        'unknown'
-    ) AS category,
-    if(
-        dictGetUInt8OrDefault('aw_workforce.dict_application_category', 'is_active', process_name, 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_application_category', 'productivity_class', process_name, '') != '',
-        dictGetStringOrDefault('aw_workforce.dict_application_category', 'productivity_class', process_name, 'unknown'),
-        'unknown'
-    ) AS productivity_class,
-
-    toUInt64(sum(duration_sec)) AS duration_sec,
-    toUInt64(count()) AS event_count,
-    toUInt64(sum(if(
-        dictGetUInt8OrDefault('aw_workforce.dict_workstation_user', 'is_active', (host_name, user_login), 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'employee_name', (host_name, user_login), '') != '',
-        0,
-        1
-    ))) AS unknown_subject_events,
-    toUInt64(sum(if(
-        dictGetUInt8OrDefault('aw_workforce.dict_application_category', 'is_active', process_name, 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_application_category', 'category', process_name, '') NOT IN ('', 'unknown'),
-        0,
-        1
-    ))) AS unknown_category_events
-FROM aw_workforce.aw_window_events
-GROUP BY
-    bucket_start,
-    event_date,
-    branch,
-    department,
-    activity_type,
-    category,
-    productivity_class;
-
-INSERT INTO aw_workforce.agg_workforce_productivity_hourly
-WITH
-    lowerUTF8(
-        domain(if(position(url, '://') = 0, concat('http://', url), url))
-    ) AS domain_name
-SELECT
-    toStartOfHour(event_time) AS bucket_start,
-    toDate(event_time) AS event_date,
-
-    if(
-        dictGetUInt8OrDefault('aw_workforce.dict_workstation_user', 'is_active', (host_name, user_login), 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'branch', (host_name, user_login), '') != '',
-        dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'branch', (host_name, user_login), 'unknown'),
-        'unknown'
-    ) AS branch,
-    if(
-        dictGetUInt8OrDefault('aw_workforce.dict_workstation_user', 'is_active', (host_name, user_login), 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'department', (host_name, user_login), '') != '',
-        dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'department', (host_name, user_login), 'unknown'),
-        'unknown'
-    ) AS department,
-
-    'browser' AS activity_type,
-    if(
-        dictGetUInt8OrDefault('aw_workforce.dict_domain_category', 'is_active', domain_name, 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_domain_category', 'category', domain_name, '') != '',
-        dictGetStringOrDefault('aw_workforce.dict_domain_category', 'category', domain_name, 'unknown'),
-        'unknown'
-    ) AS category,
-    if(
-        dictGetUInt8OrDefault('aw_workforce.dict_domain_category', 'is_active', domain_name, 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_domain_category', 'productivity_class', domain_name, '') != '',
-        dictGetStringOrDefault('aw_workforce.dict_domain_category', 'productivity_class', domain_name, 'unknown'),
-        'unknown'
-    ) AS productivity_class,
-
-    toUInt64(sum(duration_sec)) AS duration_sec,
-    toUInt64(count()) AS event_count,
-    toUInt64(sum(if(
-        dictGetUInt8OrDefault('aw_workforce.dict_workstation_user', 'is_active', (host_name, user_login), 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'employee_name', (host_name, user_login), '') != '',
-        0,
-        1
-    ))) AS unknown_subject_events,
-    toUInt64(sum(if(
-        dictGetUInt8OrDefault('aw_workforce.dict_domain_category', 'is_active', domain_name, 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_domain_category', 'category', domain_name, '') NOT IN ('', 'unknown'),
-        0,
-        1
-    ))) AS unknown_category_events
-FROM aw_workforce.aw_browser_events
-WHERE domain_name != ''
-GROUP BY
-    bucket_start,
-    event_date,
-    branch,
-    department,
-    activity_type,
-    category,
-    productivity_class;

clickhouse-workforce/catalog/README.md

@@ -1,43 +0,0 @@
-# Workforce catalogs
-
-Эти TSV-файлы являются source of truth для справочников `aw_workforce`.
-
-## Операции администратора
-
-- Добавить категорию: добавить строку в соответствующий `*.tsv`, поставить
-  `is_active=1`, запустить `ops/apply_catalogs.sh`.
-- Изменить категорию: изменить строку в `*.tsv`, запустить
-  `REBUILD_AGGREGATES=1 ops/apply_catalogs.sh`.
-- Удалить категорию из отчетов: либо удалить строку из `*.tsv`, либо оставить
-  строку для аудита и поставить `is_active=0`, затем запустить
-  `REBUILD_AGGREGATES=1 ops/apply_catalogs.sh`.
-
-`is_active=0` трактуется отчетами как `unknown`: запись остается видимой в
-каталоге, но не используется для обогащения.
-
-## Файлы
-
-- `workstation_users.tsv` - привязка `host_name + user_login` к оргструктуре.
-- `application_categories.tsv` - классификация desktop processes.
-- `domain_categories.tsv` - классификация browser domains.
-
-Формат: `TabSeparatedWithNames`, первая строка - имена колонок. Не используйте
-tab-символы внутри значений.
-
-## Таксономия РФ baseline
-
-Baseline `catalog-ru-20260623` делит домены и приложения на рабочие для РФ
-категории: `1c`, `edo_reporting`, `reporting`, `banking`, `government`,
-`procurement`, `business_reference`, `legal_reference`, `mail`, `office`,
-`pdf`, `browser`, `cloud_docs`, `communication`, `developer`, `admin_tool`,
-`remote_admin`, `security_crypto`, `search`, `maps_reference`, `marketplace`,
-`news`, `social`, `media`, `gaming`, `system`.
-
-Правило ведения: справочник хранит только точные ключи. Для приложений это
-нормализованный `process_name` в нижнем регистре, например `1cv8c.exe`; для
-web - точный host из URL, например `online.sbis.ru`. Wildcard-строки не
-используются, потому что ClickHouse Dictionary выполняет точный lookup.
-
-`productivity_class` держите в одном из значений: `productive`, `neutral`,
-`non_productive`, `unknown`. Для облаков, мессенджеров, AI и внешней почты
-ставьте `risk_level=medium`, если нужна последующая DLP/policy проверка.

clickhouse-workforce/catalog/application_categories.tsv

@@ -1,97 +0,0 @@
-process_name	application_name	vendor	category	productivity_class	risk_level	is_system	source	comment	is_active
-1cv8.exe	1C:Enterprise	1C	1c	productive	low	0	catalog-ru-20260623	1C thick client	1
-1cv8c.exe	1C:Enterprise client	1C	1c	productive	low	0	catalog-ru-20260623	1C current RDP workload	1
-1cv8s.exe	1C:Enterprise starter	1C	1c	productive	low	0	catalog-ru-20260623	1C server or launcher process	1
-1cestart.exe	1C:Enterprise launcher	1C	1c	productive	low	0	catalog-ru-20260623	1C launcher	1
-1cv8u.exe	1C:Enterprise updater	1C	1c	productive	low	0	catalog-ru-20260623	1C updater	1
-sbis.exe	SBIS	SBIS	edo_reporting	productive	low	0	catalog-ru-20260623	EDO and reporting client	1
-sbisplugin.exe	SBIS Plugin	SBIS	edo_reporting	productive	low	0	catalog-ru-20260623	SBIS browser integration	1
-saby.exe	Saby	SBIS	edo_reporting	productive	low	0	catalog-ru-20260623	Saby business client	1
-sabyapps.exe	Saby Apps	SBIS	edo_reporting	productive	low	0	catalog-ru-20260623	Saby desktop apps	1
-diadoc.exe	Diadoc	Kontur	edo_reporting	productive	low	0	catalog-ru-20260623	Electronic document exchange client	1
-kontur.plugin.exe	Kontur Plugin	Kontur	edo_reporting	productive	low	0	catalog-ru-20260623	Kontur browser integration	1
-extern.exe	Kontur Extern	Kontur	edo_reporting	productive	low	0	catalog-ru-20260623	Electronic reporting client	1
-cryptoarm.exe	CryptoARM	Digital Technologies	security_crypto	productive	low	0	catalog-ru-20260623	Crypto signing tool	1
-cryptcp.exe	CryptoPro CryptCP	CryptoPro	security_crypto	productive	low	0	catalog-ru-20260623	CryptoPro command line signing tool	1
-cprocsp.exe	CryptoPro CSP	CryptoPro	security_crypto	productive	low	0	catalog-ru-20260623	CryptoPro CSP utility	1
-certmgr.exe	Certificate Manager	Microsoft	security_crypto	productive	low	0	catalog-ru-20260623	Certificate management	1
-cadesplugin.exe	CAdES Plugin	CryptoPro	security_crypto	productive	low	0	catalog-ru-20260623	Browser crypto plugin	1
-chrome.exe	Google Chrome	Google	browser	neutral	low	0	catalog-ru-20260623	Browser; domains classify productivity	1
-msedge.exe	Microsoft Edge	Microsoft	browser	neutral	low	0	catalog-ru-20260623	Browser; domains classify productivity	1
-browser.exe	Yandex Browser	Yandex	browser	neutral	low	0	catalog-ru-20260623	Browser; domains classify productivity	1
-firefox.exe	Mozilla Firefox	Mozilla	browser	neutral	low	0	catalog-ru-20260623	Browser; domains classify productivity	1
-opera.exe	Opera	Opera	browser	neutral	low	0	catalog-ru-20260623	Browser; domains classify productivity	1
-iexplore.exe	Internet Explorer	Microsoft	browser	neutral	medium	0	catalog-ru-20260623	Legacy browser; domains classify productivity	1
-outlook.exe	Microsoft Outlook	Microsoft	mail	productive	low	0	catalog-ru-20260623	Business mail client	1
-thunderbird.exe	Thunderbird	Mozilla	mail	productive	low	0	catalog-ru-20260623	Mail client	1
-winword.exe	Microsoft Word	Microsoft	office	productive	low	0	catalog-ru-20260623	Office document editor	1
-excel.exe	Microsoft Excel	Microsoft	office	productive	low	0	catalog-ru-20260623	Spreadsheet editor	1
-powerpnt.exe	Microsoft PowerPoint	Microsoft	office	productive	low	0	catalog-ru-20260623	Presentation editor	1
-onenote.exe	Microsoft OneNote	Microsoft	office	productive	low	0	catalog-ru-20260623	Notes and documents	1
-msaccess.exe	Microsoft Access	Microsoft	office	productive	low	0	catalog-ru-20260623	Database office tool	1
-soffice.bin	LibreOffice	The Document Foundation	office	productive	low	0	catalog-ru-20260623	Office suite	1
-soffice.exe	LibreOffice	The Document Foundation	office	productive	low	0	catalog-ru-20260623	Office suite launcher	1
-swriter.exe	LibreOffice Writer	The Document Foundation	office	productive	low	0	catalog-ru-20260623	Office document editor	1
-scalc.exe	LibreOffice Calc	The Document Foundation	office	productive	low	0	catalog-ru-20260623	Spreadsheet editor	1
-simpress.exe	LibreOffice Impress	The Document Foundation	office	productive	low	0	catalog-ru-20260623	Presentation editor	1
-notepad.exe	Notepad	Microsoft	office	neutral	low	0	catalog-ru-20260623	Text editor	1
-notepad++.exe	Notepad++	Notepad++	office	productive	low	0	catalog-ru-20260623	Text and config editor	1
-acrord32.exe	Adobe Acrobat Reader	Adobe	pdf	productive	low	0	catalog-ru-20260623	PDF reader	1
-acrobat.exe	Adobe Acrobat	Adobe	pdf	productive	low	0	catalog-ru-20260623	PDF editor	1
-foxitpdfreader.exe	Foxit PDF Reader	Foxit	pdf	productive	low	0	catalog-ru-20260623	PDF reader	1
-pdfxedit.exe	PDF-XChange Editor	Tracker Software	pdf	productive	low	0	catalog-ru-20260623	PDF editor	1
-7zfm.exe	7-Zip File Manager	7-Zip	archive	productive	low	0	catalog-ru-20260623	Archive manager	1
-7zg.exe	7-Zip GUI	7-Zip	archive	productive	low	0	catalog-ru-20260623	Archive tool	1
-7z.exe	7-Zip CLI	7-Zip	archive	productive	low	0	catalog-ru-20260623	Archive command line tool	1
-winrar.exe	WinRAR	RARLAB	archive	productive	low	0	catalog-ru-20260623	Archive manager	1
-explorer.exe	Windows Explorer	Microsoft	system	neutral	low	1	catalog-ru-20260623	Windows shell and file manager	1
-dwm.exe	Desktop Window Manager	Microsoft	system	neutral	low	1	catalog-ru-20260623	Windows desktop compositor	1
-taskhostw.exe	Task Host	Microsoft	system	neutral	low	1	catalog-ru-20260623	Windows task host	1
-applicationframehost.exe	Application Frame Host	Microsoft	system	neutral	low	1	catalog-ru-20260623	Windows app frame host	1
-startmenuexperiencehost.exe	Start Menu Experience Host	Microsoft	system	neutral	low	1	catalog-ru-20260623	Windows Start menu	1
-searchapp.exe	Windows Search	Microsoft	system	neutral	low	1	catalog-ru-20260623	Windows search UI	1
-systemsettings.exe	Windows Settings	Microsoft	system	neutral	low	1	catalog-ru-20260623	Windows settings	1
-rdpclip.exe	RDP Clipboard	Microsoft	system	neutral	low	1	catalog-ru-20260623	RDP clipboard process	1
-conhost.exe	Console Host	Microsoft	system	neutral	low	1	catalog-ru-20260623	Windows console host	1
-taskmgr.exe	Task Manager	Microsoft	admin_tool	productive	low	1	catalog-ru-20260623	Administrative diagnostics	1
-mmc.exe	Microsoft Management Console	Microsoft	admin_tool	productive	low	1	catalog-ru-20260623	Administrative console	1
-eventvwr.exe	Event Viewer	Microsoft	admin_tool	productive	low	1	catalog-ru-20260623	Administrative diagnostics	1
-services.exe	Windows Services	Microsoft	admin_tool	productive	low	1	catalog-ru-20260623	Service control manager	1
-compmgmtlauncher.exe	Computer Management	Microsoft	admin_tool	productive	low	1	catalog-ru-20260623	Administrative console launcher	1
-regedit.exe	Registry Editor	Microsoft	admin_tool	productive	medium	1	catalog-ru-20260623	Registry editor	1
-cmd.exe	Command Prompt	Microsoft	admin_tool	productive	medium	1	catalog-ru-20260623	Command shell	1
-powershell.exe	Windows PowerShell	Microsoft	admin_tool	productive	medium	1	catalog-ru-20260623	Administrative shell	1
-pwsh.exe	PowerShell	Microsoft	admin_tool	productive	medium	1	catalog-ru-20260623	Administrative shell	1
-windowsterminal.exe	Windows Terminal	Microsoft	admin_tool	productive	medium	0	catalog-ru-20260623	Administrative terminal	1
-wt.exe	Windows Terminal	Microsoft	admin_tool	productive	medium	0	catalog-ru-20260623	Administrative terminal launcher	1
-mstsc.exe	Remote Desktop Connection	Microsoft	remote_admin	productive	low	0	catalog-ru-20260623	RDP client	1
-putty.exe	PuTTY	PuTTY	remote_admin	productive	low	0	catalog-ru-20260623	SSH client	1
-winscp.exe	WinSCP	WinSCP	remote_admin	productive	low	0	catalog-ru-20260623	SFTP and SCP client	1
-filezilla.exe	FileZilla	FileZilla	remote_admin	productive	low	0	catalog-ru-20260623	File transfer client	1
-procexp.exe	Process Explorer	Microsoft	admin_tool	productive	medium	0	catalog-ru-20260623	Advanced diagnostics	1
-procexp64.exe	Process Explorer	Microsoft	admin_tool	productive	medium	0	catalog-ru-20260623	Advanced diagnostics	1
-procmon.exe	Process Monitor	Microsoft	admin_tool	productive	medium	0	catalog-ru-20260623	Advanced diagnostics	1
-procmon64.exe	Process Monitor	Microsoft	admin_tool	productive	medium	0	catalog-ru-20260623	Advanced diagnostics	1
-telegram.exe	Telegram	Telegram	communication	neutral	medium	0	catalog-ru-20260623	Messenger; business use depends on policy	1
-whatsapp.exe	WhatsApp	Meta	communication	neutral	medium	0	catalog-ru-20260623	Messenger; business use depends on policy	1
-teams.exe	Microsoft Teams	Microsoft	communication	productive	low	0	catalog-ru-20260623	Business communication	1
-ms-teams.exe	Microsoft Teams	Microsoft	communication	productive	low	0	catalog-ru-20260623	Business communication	1
-zoom.exe	Zoom	Zoom	communication	productive	low	0	catalog-ru-20260623	Business communication	1
-skype.exe	Skype	Microsoft	communication	neutral	medium	0	catalog-ru-20260623	Messenger	1
-discord.exe	Discord	Discord	social	non_productive	medium	0	catalog-ru-20260623	Social and gaming communication	1
-yandexdisk.exe	Yandex Disk	Yandex	cloud_docs	productive	medium	0	catalog-ru-20260623	Cloud storage; data handling policy applies	1
-yandexdisk2.exe	Yandex Disk	Yandex	cloud_docs	productive	medium	0	catalog-ru-20260623	Cloud storage; data handling policy applies	1
-onedrive.exe	OneDrive	Microsoft	cloud_docs	productive	medium	0	catalog-ru-20260623	Cloud storage; data handling policy applies	1
-dropbox.exe	Dropbox	Dropbox	cloud_docs	neutral	medium	0	catalog-ru-20260623	Cloud storage; data handling policy applies	1
-code.exe	Visual Studio Code	Microsoft	developer	productive	low	0	catalog-ru-20260623	Code editor and admin scripting	1
-devenv.exe	Visual Studio	Microsoft	developer	productive	low	0	catalog-ru-20260623	Development IDE	1
-git.exe	Git	Git	developer	productive	low	0	catalog-ru-20260623	Version control CLI	1
-docker desktop.exe	Docker Desktop	Docker	developer	productive	low	0	catalog-ru-20260623	Container development tool	1
-vlc.exe	VLC	VideoLAN	media	non_productive	medium	0	catalog-ru-20260623	Media player	1
-wmplayer.exe	Windows Media Player	Microsoft	media	non_productive	medium	0	catalog-ru-20260623	Media player	1
-spotify.exe	Spotify	Spotify	media	non_productive	medium	0	catalog-ru-20260623	Music streaming	1
-steam.exe	Steam	Valve	gaming	non_productive	high	0	catalog-ru-20260623	Gaming platform	1
-gamebar.exe	Xbox Game Bar	Microsoft	gaming	non_productive	high	0	catalog-ru-20260623	Gaming overlay	1
-securityhealthsystray.exe	Windows Security	Microsoft	security_crypto	neutral	low	1	catalog-ru-20260623	Windows security UI	1
-avgui.exe	AVG Antivirus	AVG	security_crypto	neutral	low	0	catalog-ru-20260623	Endpoint security UI	1
-avpui.exe	Kaspersky	Kaspersky	security_crypto	neutral	low	0	catalog-ru-20260623	Endpoint security UI	1

clickhouse-workforce/catalog/domain_categories.tsv

@@ -1,128 +0,0 @@
-domain	site_name	category	productivity_class	risk_level	business_allowed	source	comment	is_active
-intranet.local	Internal portal	internal_service	productive	low	1	catalog-ru-20260623	Internal work portal	1
-dbo.sevnb.ru	SEVNB online banking	banking	productive	low	1	catalog-ru-20260623	Banking workflow seen in RDP title stream	1
-sberbank.ru	Sberbank	banking	productive	low	1	catalog-ru-20260623	Russian banking and business services	1
-online.sberbank.ru	Sberbank Online	banking	productive	low	1	catalog-ru-20260623	Russian banking web client	1
-sbi.sberbank.ru	SberBusiness	banking	productive	low	1	catalog-ru-20260623	Sber business banking	1
-business-online.sberbank.ru	SberBusiness	banking	productive	low	1	catalog-ru-20260623	Sber business banking legacy host	1
-vtb.ru	VTB	banking	productive	low	1	catalog-ru-20260623	Russian banking and business services	1
-dbo.vtb.ru	VTB Business Online	banking	productive	low	1	catalog-ru-20260623	VTB business banking	1
-alfabank.ru	Alfa-Bank	banking	productive	low	1	catalog-ru-20260623	Russian banking and business services	1
-ibank.alfabank.ru	Alfa-Bank Business	banking	productive	low	1	catalog-ru-20260623	Alfa business banking	1
-tbank.ru	T-Bank	banking	productive	low	1	catalog-ru-20260623	Russian banking and business services	1
-business.tbank.ru	T-Business	banking	productive	low	1	catalog-ru-20260623	T-Bank business banking	1
-tinkoff.ru	Tinkoff	banking	productive	low	1	catalog-ru-20260623	T-Bank legacy domain	1
-business.tinkoff.ru	Tinkoff Business	banking	productive	low	1	catalog-ru-20260623	T-Bank business legacy domain	1
-tochka.com	Tochka Bank	banking	productive	low	1	catalog-ru-20260623	Business banking	1
-bspb.ru	Bank Saint Petersburg	banking	productive	low	1	catalog-ru-20260623	Russian banking and business services	1
-dbo.bspb.ru	Bank Saint Petersburg Business	banking	productive	low	1	catalog-ru-20260623	Business banking	1
-gazprombank.ru	Gazprombank	banking	productive	low	1	catalog-ru-20260623	Russian banking and business services	1
-bankuralsib.ru	Uralsib	banking	productive	low	1	catalog-ru-20260623	Russian banking and business services	1
-rshb.ru	Russian Agricultural Bank	banking	productive	low	1	catalog-ru-20260623	Russian banking and business services	1
-modulbank.ru	Modulbank	banking	productive	low	1	catalog-ru-20260623	Business banking	1
-gosuslugi.ru	Gosuslugi	government	productive	low	1	catalog-ru-20260623	Russian government services	1
-esia.gosuslugi.ru	ESIA	government	productive	low	1	catalog-ru-20260623	Government authentication	1
-lk.gosuslugi.ru	Gosuslugi account	government	productive	low	1	catalog-ru-20260623	Government services account	1
-nalog.gov.ru	FNS	government	productive	low	1	catalog-ru-20260623	Russian tax service	1
-service.nalog.ru	FNS services	government	productive	low	1	catalog-ru-20260623	Russian tax service portals	1
-egrul.nalog.ru	FNS EGRUL	government	productive	low	1	catalog-ru-20260623	Company registry lookup	1
-pb.nalog.ru	FNS transparent business	government	productive	low	1	catalog-ru-20260623	Tax counterparty lookup	1
-lkfl2.nalog.ru	FNS personal account	government	productive	low	1	catalog-ru-20260623	Tax account	1
-lkul.nalog.ru	FNS legal entity account	government	productive	low	1	catalog-ru-20260623	Tax account for legal entities	1
-fssp.gov.ru	FSSP	government	productive	low	1	catalog-ru-20260623	Bailiff service lookup	1
-rosreestr.gov.ru	Rosreestr	government	productive	low	1	catalog-ru-20260623	Real estate registry	1
-kad.arbitr.ru	Arbitration cases	government	productive	low	1	catalog-ru-20260623	Arbitration case database	1
-my.arbitr.ru	Arbitration e-filing	government	productive	low	1	catalog-ru-20260623	Arbitration electronic filing	1
-sudrf.ru	Courts of Russia	government	productive	low	1	catalog-ru-20260623	Court information	1
-zakupki.gov.ru	Unified procurement	government	productive	low	1	catalog-ru-20260623	State procurement	1
-torgi.gov.ru	Torgi.gov	government	productive	low	1	catalog-ru-20260623	State auctions and property tenders	1
-mos.ru	Mos.ru	government	productive	low	1	catalog-ru-20260623	Moscow city services	1
-cbr.ru	Bank of Russia	government	productive	low	1	catalog-ru-20260623	Central bank reference data	1
-rosstat.gov.ru	Rosstat	government	productive	low	1	catalog-ru-20260623	Statistics and reporting	1
-sfr.gov.ru	Social Fund	government	productive	low	1	catalog-ru-20260623	Social fund services	1
-trudvsem.ru	Trudvsem	government	productive	low	1	catalog-ru-20260623	Labor and vacancies portal	1
-kontur.ru	Kontur	edo_reporting	productive	low	1	catalog-ru-20260623	EDO reporting and business checks	1
-extern.kontur.ru	Kontur Extern	edo_reporting	productive	low	1	catalog-ru-20260623	Electronic reporting	1
-diadoc.kontur.ru	Diadoc	edo_reporting	productive	low	1	catalog-ru-20260623	Electronic document exchange	1
-focus.kontur.ru	Kontur Focus	business_reference	productive	low	1	catalog-ru-20260623	Counterparty checks	1
-normativ.kontur.ru	Kontur Normativ	business_reference	productive	low	1	catalog-ru-20260623	Legal and accounting reference	1
-sbis.ru	SBIS	edo_reporting	productive	low	1	catalog-ru-20260623	EDO reporting and business services	1
-online.sbis.ru	SBIS Online	edo_reporting	productive	low	1	catalog-ru-20260623	EDO reporting portal	1
-saby.ru	Saby	edo_reporting	productive	low	1	catalog-ru-20260623	SBIS/Saby services	1
-ofd.ru	OFD	reporting	productive	low	1	catalog-ru-20260623	Fiscal data operator	1
-ofd.yandex.ru	Yandex OFD	reporting	productive	low	1	catalog-ru-20260623	Fiscal data operator	1
-1-ofd.ru	1-OFD	reporting	productive	low	1	catalog-ru-20260623	Fiscal data operator	1
-sberbank-ast.ru	Sberbank AST	procurement	productive	low	1	catalog-ru-20260623	Electronic trading platform	1
-roseltorg.ru	Roseltorg	procurement	productive	low	1	catalog-ru-20260623	Electronic trading platform	1
-rts-tender.ru	RTS Tender	procurement	productive	low	1	catalog-ru-20260623	Electronic trading platform	1
-fabrikant.ru	Fabrikant	procurement	productive	low	1	catalog-ru-20260623	Electronic trading platform	1
-spark-interfax.ru	SPARK Interfax	business_reference	productive	low	1	catalog-ru-20260623	Counterparty checks	1
-rusprofile.ru	Rusprofile	business_reference	productive	low	1	catalog-ru-20260623	Counterparty checks	1
-checko.ru	Checko	business_reference	productive	low	1	catalog-ru-20260623	Counterparty checks	1
-zachestnyibiznes.ru	Za Chestny Biznes	business_reference	productive	low	1	catalog-ru-20260623	Counterparty checks	1
-list-org.com	List-Org	business_reference	neutral	medium	1	catalog-ru-20260623	Counterparty checks with mixed data quality	1
-garant.ru	Garant	legal_reference	productive	low	1	catalog-ru-20260623	Legal reference system	1
-consultant.ru	ConsultantPlus	legal_reference	productive	low	1	catalog-ru-20260623	Legal reference system	1
-mail.yandex.ru	Yandex Mail	mail	productive	low	1	catalog-ru-20260623	Business mail when used with org account	1
-360.yandex.ru	Yandex 360	mail	productive	low	1	catalog-ru-20260623	Business mail and documents	1
-mail.ru	Mail.ru	mail	neutral	medium	1	catalog-ru-20260623	Mail portal; classify account policy separately if needed	1
-e.mail.ru	Mail.ru webmail	mail	neutral	medium	1	catalog-ru-20260623	Mail.ru webmail	1
-biz.mail.ru	Mail.ru business	mail	productive	low	1	catalog-ru-20260623	Business mail	1
-corp.mail.ru	Mail.ru corporate	mail	productive	low	1	catalog-ru-20260623	Corporate services	1
-gmail.com	Gmail	mail	neutral	medium	1	catalog-ru-20260623	External mail	1
-outlook.office.com	Outlook Web	mail	productive	low	1	catalog-ru-20260623	Business mail	1
-yandex.ru	Yandex	search	neutral	low	1	catalog-ru-20260623	Search portal	1
-ya.ru	Yandex	search	neutral	low	1	catalog-ru-20260623	Search portal	1
-google.com	Google Search	search	neutral	low	1	catalog-ru-20260623	Search portal	1
-2gis.ru	2GIS	maps_reference	productive	low	1	catalog-ru-20260623	Maps and organization reference	1
-maps.yandex.ru	Yandex Maps	maps_reference	productive	low	1	catalog-ru-20260623	Maps and organization reference	1
-dadata.ru	DaData	business_reference	productive	low	1	catalog-ru-20260623	Address and company reference	1
-disk.yandex.ru	Yandex Disk	cloud_docs	productive	medium	1	catalog-ru-20260623	Cloud documents; data handling policy applies	1
-docs.yandex.ru	Yandex Documents	cloud_docs	productive	medium	1	catalog-ru-20260623	Cloud documents; data handling policy applies	1
-cloud.mail.ru	Cloud Mail.ru	cloud_docs	productive	medium	1	catalog-ru-20260623	Cloud storage; data handling policy applies	1
-docs.google.com	Google Docs	cloud_docs	productive	medium	1	catalog-ru-20260623	Cloud documents; data handling policy applies	1
-drive.google.com	Google Drive	cloud_docs	productive	medium	1	catalog-ru-20260623	Cloud storage; data handling policy applies	1
-office.com	Microsoft 365	cloud_docs	productive	medium	1	catalog-ru-20260623	Cloud documents; data handling policy applies	1
-microsoft365.com	Microsoft 365	cloud_docs	productive	medium	1	catalog-ru-20260623	Cloud documents; data handling policy applies	1
-web.telegram.org	Telegram Web	communication	neutral	medium	1	catalog-ru-20260623	Messenger; business use depends on policy	1
-t.me	Telegram links	communication	neutral	medium	1	catalog-ru-20260623	Messenger links	1
-telegram.org	Telegram	communication	neutral	medium	1	catalog-ru-20260623	Messenger	1
-web.whatsapp.com	WhatsApp Web	communication	neutral	medium	1	catalog-ru-20260623	Messenger; business use depends on policy	1
-whatsapp.com	WhatsApp	communication	neutral	medium	1	catalog-ru-20260623	Messenger	1
-teams.microsoft.com	Microsoft Teams	communication	productive	low	1	catalog-ru-20260623	Business communication	1
-meet.google.com	Google Meet	communication	productive	low	1	catalog-ru-20260623	Business communication	1
-zoom.us	Zoom	communication	productive	low	1	catalog-ru-20260623	Business communication	1
-github.com	GitHub	developer	productive	low	1	catalog-ru-20260623	Development and documentation workflow	1
-gitlab.com	GitLab	developer	productive	low	1	catalog-ru-20260623	Development workflow	1
-stackoverflow.com	Stack Overflow	developer	productive	low	1	catalog-ru-20260623	Technical reference	1
-learn.microsoft.com	Microsoft Learn	developer	productive	low	1	catalog-ru-20260623	Technical documentation	1
-docs.microsoft.com	Microsoft Docs	developer	productive	low	1	catalog-ru-20260623	Technical documentation legacy host	1
-microsoft.com	Microsoft	developer	neutral	low	1	catalog-ru-20260623	Vendor documentation and downloads	1
-docker.com	Docker	developer	productive	low	1	catalog-ru-20260623	Developer tooling documentation	1
-software.qnap.com	QNAP Software	work_service	neutral	low	1	catalog-ru-20260623	Vendor software/download portal for admin work	1
-cryptopro.ru	CryptoPro	security_crypto	productive	low	1	catalog-ru-20260623	CryptoPro documentation and downloads	1
-www.cryptopro.ru	CryptoPro	security_crypto	productive	low	1	catalog-ru-20260623	CryptoPro documentation and downloads	1
-chatgpt.com	ChatGPT	ai_assistant	productive	medium	1	catalog-ru-20260623	AI assistant; data handling policy applies	1
-chat.openai.com	ChatGPT legacy	ai_assistant	productive	medium	1	catalog-ru-20260623	AI assistant; data handling policy applies	1
-giga.chat	GigaChat	ai_assistant	productive	medium	1	catalog-ru-20260623	AI assistant; data handling policy applies	1
-alice.yandex.ru	Yandex Alice	ai_assistant	productive	medium	1	catalog-ru-20260623	AI assistant; data handling policy applies	1
-wildberries.ru	Wildberries	marketplace	neutral	medium	1	catalog-ru-20260623	Marketplace; business purchases possible	1
-ozon.ru	Ozon	marketplace	neutral	medium	1	catalog-ru-20260623	Marketplace; business purchases possible	1
-market.yandex.ru	Yandex Market	marketplace	neutral	medium	1	catalog-ru-20260623	Marketplace; business purchases possible	1
-avito.ru	Avito	marketplace	neutral	medium	1	catalog-ru-20260623	Marketplace; business use depends on policy	1
-dns-shop.ru	DNS Shop	marketplace	neutral	medium	1	catalog-ru-20260623	IT and office equipment purchases	1
-citilink.ru	Citilink	marketplace	neutral	medium	1	catalog-ru-20260623	IT and office equipment purchases	1
-vk.com	VK	social	non_productive	medium	0	catalog-ru-20260623	Social network; whitelist business communities separately if needed	1
-ok.ru	Odnoklassniki	social	non_productive	medium	0	catalog-ru-20260623	Social network	1
-dzen.ru	Dzen	news	non_productive	medium	0	catalog-ru-20260623	News/feed portal	1
-rbc.ru	RBC	news	neutral	medium	1	catalog-ru-20260623	Business news; review by department policy	1
-ria.ru	RIA Novosti	news	neutral	medium	1	catalog-ru-20260623	News; review by department policy	1
-lenta.ru	Lenta	news	non_productive	medium	0	catalog-ru-20260623	News/feed portal	1
-youtube.com	YouTube	media	non_productive	medium	0	catalog-ru-20260623	Video platform; business use requires URL-level exception	1
-rutube.ru	Rutube	media	non_productive	medium	0	catalog-ru-20260623	Video platform	1
-vkvideo.ru	VK Video	media	non_productive	medium	0	catalog-ru-20260623	Video platform	1
-music.yandex.ru	Yandex Music	media	non_productive	medium	0	catalog-ru-20260623	Music streaming	1
-kinopoisk.ru	Kinopoisk	media	non_productive	medium	0	catalog-ru-20260623	Entertainment streaming	1
-twitch.tv	Twitch	media	non_productive	high	0	catalog-ru-20260623	Entertainment streaming	1
-example.com	Example Domain	test_reference	neutral	low	0	catalog-ru-20260623	Test/reference domain	1
-unknown.example	Unknown example	test_reference	neutral	low	0	catalog-ru-20260623	Test/reference domain from demo data	1

clickhouse-workforce/catalog/workstation_users.tsv

@@ -1,8 +0,0 @@
-host_name	user_login	user_domain	employee_id	employee_name	department	branch	position	source	is_active
-SHARKON2025	user1	sharkon2025	sharkon2025\\user1	user1	tsj	tsj	RDP user	catalog-p5	1
-SHARKON2025	user4	sharkon2025	sharkon2025\\user4	user4	tsj	tsj	RDP user	catalog-p5	1
-SHARKON2025	user5	sharkon2025	sharkon2025\\user5	user5	tsj	tsj	RDP user	catalog-p5	1
-SHARKON2025	Администратор	sharkon2025	sharkon2025\\Администратор	Администратор	it_admin	tsj	Windows administrator	catalog-p5	1
-SHARKON2025	администратор	sharkon2025	sharkon2025\\Администратор	Администратор	it_admin	tsj	Windows administrator legacy lowercase alias	catalog-p5	1
-ws-001	ivanov	corp	E001	Иванов И.И.	Бухгалтерия	Филиал 1	Бухгалтер	demo	1
-ws-002	petrova	corp	E002	Петрова П.П.	Операционный отдел	Филиал 1	Оператор	demo	1

clickhouse-workforce/clickhouse/init/00_database.sql

@@ -1 +0,0 @@
-CREATE DATABASE IF NOT EXISTS aw_workforce;

clickhouse-workforce/clickhouse/init/01_raw_tables.sql

@@ -1,32 +0,0 @@
-CREATE TABLE IF NOT EXISTS aw_workforce.aw_window_events
-(
-    event_time DateTime,
-    host_name String,
-    user_login String,
-    process_name String,
-    window_title String,
-    duration_sec UInt32,
-    source_bucket LowCardinality(String),
-    source_event_id String,
-    ingested_at DateTime DEFAULT now()
-)
-ENGINE = MergeTree
-PARTITION BY toYYYYMM(event_time)
-ORDER BY (event_time, host_name, user_login, process_name, source_event_id);
-
-CREATE TABLE IF NOT EXISTS aw_workforce.aw_browser_events
-(
-    event_time DateTime,
-    host_name String,
-    user_login String,
-    browser_name String,
-    url String,
-    title String,
-    duration_sec UInt32,
-    source_bucket LowCardinality(String),
-    source_event_id String,
-    ingested_at DateTime DEFAULT now()
-)
-ENGINE = MergeTree
-PARTITION BY toYYYYMM(event_time)
-ORDER BY (event_time, host_name, user_login, browser_name, source_event_id);

clickhouse-workforce/clickhouse/init/02_dimensions_dictionaries.sql

@@ -1,145 +0,0 @@
-CREATE TABLE IF NOT EXISTS aw_workforce.dim_workstation_user
-(
-    host_name String,
-    user_login String,
-    user_domain String,
-
-    employee_id String,
-    employee_name String,
-    department String,
-    branch String,
-    position String,
-
-    source LowCardinality(String),
-    is_active UInt8 DEFAULT 1,
-    updated_at DateTime DEFAULT now()
-)
-ENGINE = ReplacingMergeTree(updated_at)
-ORDER BY (host_name, user_login);
-
-CREATE TABLE IF NOT EXISTS aw_workforce.dim_application_category
-(
-    process_name String,
-
-    application_name String,
-    vendor String,
-    category LowCardinality(String),
-    productivity_class LowCardinality(String),
-    risk_level LowCardinality(String),
-
-    is_system UInt8 DEFAULT 0,
-    is_active UInt8 DEFAULT 1,
-    source LowCardinality(String),
-    comment String,
-    updated_at DateTime DEFAULT now()
-)
-ENGINE = ReplacingMergeTree(updated_at)
-ORDER BY process_name;
-
-CREATE TABLE IF NOT EXISTS aw_workforce.dim_domain_category
-(
-    domain String,
-
-    site_name String,
-    category LowCardinality(String),
-    productivity_class LowCardinality(String),
-    risk_level LowCardinality(String),
-    business_allowed UInt8 DEFAULT 0,
-
-    source LowCardinality(String),
-    comment String,
-    is_active UInt8 DEFAULT 1,
-    updated_at DateTime DEFAULT now()
-)
-ENGINE = ReplacingMergeTree(updated_at)
-ORDER BY domain;
-
-CREATE TABLE IF NOT EXISTS aw_workforce.dim_url_rule
-(
-    rule_id String,
-    domain String,
-    path_pattern String,
-
-    category LowCardinality(String),
-    productivity_class LowCardinality(String),
-    risk_level LowCardinality(String),
-
-    priority UInt16 DEFAULT 100,
-    is_active UInt8 DEFAULT 1,
-    comment String,
-    updated_at DateTime DEFAULT now()
-)
-ENGINE = ReplacingMergeTree(updated_at)
-ORDER BY (domain, priority, rule_id);
-
-DROP DICTIONARY IF EXISTS aw_workforce.dict_workstation_user;
-
-CREATE DICTIONARY aw_workforce.dict_workstation_user
-(
-    host_name String,
-    user_login String,
-    user_domain String,
-
-    employee_id String,
-    employee_name String,
-    department String,
-    branch String,
-    position String,
-    is_active UInt8
-)
-PRIMARY KEY host_name, user_login
-SOURCE(CLICKHOUSE(
-    USER 'aw_workforce_dict'
-    PASSWORD ''
-    DB 'aw_workforce'
-    TABLE 'dim_workstation_user'
-))
-LAYOUT(COMPLEX_KEY_HASHED())
-LIFETIME(MIN 3600 MAX 86400);
-
-DROP DICTIONARY IF EXISTS aw_workforce.dict_application_category;
-
-CREATE DICTIONARY aw_workforce.dict_application_category
-(
-    process_name String,
-
-    application_name String,
-    vendor String,
-    category String,
-    productivity_class String,
-    risk_level String,
-    is_system UInt8,
-    is_active UInt8
-)
-PRIMARY KEY process_name
-SOURCE(CLICKHOUSE(
-    USER 'aw_workforce_dict'
-    PASSWORD ''
-    DB 'aw_workforce'
-    TABLE 'dim_application_category'
-))
-LAYOUT(HASHED())
-LIFETIME(MIN 3600 MAX 86400);
-
-DROP DICTIONARY IF EXISTS aw_workforce.dict_domain_category;
-
-CREATE DICTIONARY aw_workforce.dict_domain_category
-(
-    domain String,
-
-    site_name String,
-    category String,
-    productivity_class String,
-    risk_level String,
-    business_allowed UInt8,
-    is_active UInt8
-)
-PRIMARY KEY domain
-SOURCE(CLICKHOUSE(
-    USER 'aw_workforce_dict'
-    PASSWORD ''
-    DB 'aw_workforce'
-    TABLE 'dim_domain_category'
-))
-LAYOUT(HASHED())
-LIFETIME(MIN 3600 MAX 86400);

clickhouse-workforce/clickhouse/init/03_materialized_views.sql

@@ -1,158 +0,0 @@
-CREATE TABLE IF NOT EXISTS aw_workforce.agg_workforce_productivity_hourly
-(
-    bucket_start DateTime,
-    event_date Date,
-
-    branch LowCardinality(String),
-    department LowCardinality(String),
-
-    activity_type LowCardinality(String),
-    category LowCardinality(String),
-    productivity_class LowCardinality(String),
-
-    duration_sec UInt64,
-    event_count UInt64,
-    unknown_subject_events UInt64,
-    unknown_category_events UInt64
-)
-ENGINE = SummingMergeTree((
-    duration_sec,
-    event_count,
-    unknown_subject_events,
-    unknown_category_events
-))
-PARTITION BY toYYYYMM(event_date)
-ORDER BY (
-    event_date,
-    bucket_start,
-    branch,
-    department,
-    activity_type,
-    productivity_class,
-    category
-);
-
-DROP VIEW IF EXISTS aw_workforce.mv_desktop_productivity_hourly;
-
-CREATE MATERIALIZED VIEW aw_workforce.mv_desktop_productivity_hourly
-TO aw_workforce.agg_workforce_productivity_hourly
-AS
-SELECT
-    toStartOfHour(event_time) AS bucket_start,
-    toDate(event_time) AS event_date,
-
-    if(
-        dictGetUInt8OrDefault('aw_workforce.dict_workstation_user', 'is_active', (host_name, user_login), 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'branch', (host_name, user_login), '') != '',
-        dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'branch', (host_name, user_login), 'unknown'),
-        'unknown'
-    ) AS branch,
-    if(
-        dictGetUInt8OrDefault('aw_workforce.dict_workstation_user', 'is_active', (host_name, user_login), 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'department', (host_name, user_login), '') != '',
-        dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'department', (host_name, user_login), 'unknown'),
-        'unknown'
-    ) AS department,
-
-    'desktop' AS activity_type,
-    if(
-        dictGetUInt8OrDefault('aw_workforce.dict_application_category', 'is_active', process_name, 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_application_category', 'category', process_name, '') != '',
-        dictGetStringOrDefault('aw_workforce.dict_application_category', 'category', process_name, 'unknown'),
-        'unknown'
-    ) AS category,
-    if(
-        dictGetUInt8OrDefault('aw_workforce.dict_application_category', 'is_active', process_name, 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_application_category', 'productivity_class', process_name, '') != '',
-        dictGetStringOrDefault('aw_workforce.dict_application_category', 'productivity_class', process_name, 'unknown'),
-        'unknown'
-    ) AS productivity_class,
-
-    toUInt64(sum(duration_sec)) AS duration_sec,
-    toUInt64(count()) AS event_count,
-    toUInt64(sum(if(
-        dictGetUInt8OrDefault('aw_workforce.dict_workstation_user', 'is_active', (host_name, user_login), 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'employee_name', (host_name, user_login), '') != '',
-        0,
-        1
-    ))) AS unknown_subject_events,
-    toUInt64(sum(if(
-        dictGetUInt8OrDefault('aw_workforce.dict_application_category', 'is_active', process_name, 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_application_category', 'category', process_name, '') NOT IN ('', 'unknown'),
-        0,
-        1
-    ))) AS unknown_category_events
-FROM aw_workforce.aw_window_events
-GROUP BY
-    bucket_start,
-    event_date,
-    branch,
-    department,
-    activity_type,
-    category,
-    productivity_class;
-
-DROP VIEW IF EXISTS aw_workforce.mv_browser_productivity_hourly;
-
-CREATE MATERIALIZED VIEW aw_workforce.mv_browser_productivity_hourly
-TO aw_workforce.agg_workforce_productivity_hourly
-AS
-WITH
-    lowerUTF8(
-        domain(if(position(url, '://') = 0, concat('http://', url), url))
-    ) AS domain_name
-SELECT
-    toStartOfHour(event_time) AS bucket_start,
-    toDate(event_time) AS event_date,
-
-    if(
-        dictGetUInt8OrDefault('aw_workforce.dict_workstation_user', 'is_active', (host_name, user_login), 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'branch', (host_name, user_login), '') != '',
-        dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'branch', (host_name, user_login), 'unknown'),
-        'unknown'
-    ) AS branch,
-    if(
-        dictGetUInt8OrDefault('aw_workforce.dict_workstation_user', 'is_active', (host_name, user_login), 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'department', (host_name, user_login), '') != '',
-        dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'department', (host_name, user_login), 'unknown'),
-        'unknown'
-    ) AS department,
-
-    'browser' AS activity_type,
-    if(
-        dictGetUInt8OrDefault('aw_workforce.dict_domain_category', 'is_active', domain_name, 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_domain_category', 'category', domain_name, '') != '',
-        dictGetStringOrDefault('aw_workforce.dict_domain_category', 'category', domain_name, 'unknown'),
-        'unknown'
-    ) AS category,
-    if(
-        dictGetUInt8OrDefault('aw_workforce.dict_domain_category', 'is_active', domain_name, 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_domain_category', 'productivity_class', domain_name, '') != '',
-        dictGetStringOrDefault('aw_workforce.dict_domain_category', 'productivity_class', domain_name, 'unknown'),
-        'unknown'
-    ) AS productivity_class,
-
-    toUInt64(sum(duration_sec)) AS duration_sec,
-    toUInt64(count()) AS event_count,
-    toUInt64(sum(if(
-        dictGetUInt8OrDefault('aw_workforce.dict_workstation_user', 'is_active', (host_name, user_login), 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_workstation_user', 'employee_name', (host_name, user_login), '') != '',
-        0,
-        1
-    ))) AS unknown_subject_events,
-    toUInt64(sum(if(
-        dictGetUInt8OrDefault('aw_workforce.dict_domain_category', 'is_active', domain_name, 0) = 1
-        AND dictGetStringOrDefault('aw_workforce.dict_domain_category', 'category', domain_name, '') NOT IN ('', 'unknown'),
-        0,
-        1
-    ))) AS unknown_category_events
-FROM aw_workforce.aw_browser_events
-WHERE domain_name != ''
-GROUP BY
-    bucket_start,
-    event_date,
-    branch,
-    department,
-    activity_type,
-    category,
-    productivity_class;

clickhouse-workforce/clickhouse/init/04_quality_views.sql

@@ -1,105 +0,0 @@
-CREATE OR REPLACE VIEW aw_workforce.v_workforce_productivity_daily AS
-SELECT
-    event_date,
-    branch,
-    department,
-    activity_type,
-    category,
-    productivity_class,
-    sum(duration_sec) AS duration_sec,
-    sum(event_count) AS event_count,
-    sum(unknown_subject_events) AS unknown_subject_events,
-    sum(unknown_category_events) AS unknown_category_events
-FROM aw_workforce.agg_workforce_productivity_hourly
-GROUP BY
-    event_date,
-    branch,
-    department,
-    activity_type,
-    category,
-    productivity_class;
-
-CREATE OR REPLACE VIEW aw_workforce.v_workforce_unknown_subjects AS
-SELECT
-    host_name,
-    user_login,
-    count() AS events,
-    sum(duration_sec) AS duration_sec
-FROM aw_workforce.aw_window_events
-WHERE dictGetUInt8OrDefault(
-        'aw_workforce.dict_workstation_user',
-        'is_active',
-        (host_name, user_login),
-        0
-      ) != 1
-   OR dictGetStringOrDefault(
-        'aw_workforce.dict_workstation_user',
-        'employee_name',
-        (host_name, user_login),
-        ''
-      ) = ''
-GROUP BY
-    host_name,
-    user_login
-ORDER BY duration_sec DESC;
-
-CREATE OR REPLACE VIEW aw_workforce.v_workforce_unknown_processes AS
-SELECT
-    process_name,
-    count() AS events,
-    sum(duration_sec) AS duration_sec
-FROM aw_workforce.aw_window_events
-WHERE dictGetUInt8OrDefault(
-        'aw_workforce.dict_application_category',
-        'is_active',
-        process_name,
-        0
-      ) != 1
-   OR dictGetStringOrDefault(
-        'aw_workforce.dict_application_category',
-        'category',
-        process_name,
-        ''
-      ) IN ('', 'unknown')
-GROUP BY process_name
-ORDER BY duration_sec DESC;
-
-CREATE OR REPLACE VIEW aw_workforce.v_workforce_unknown_domains AS
-WITH
-    lowerUTF8(
-        domain(if(position(url, '://') = 0, concat('http://', url), url))
-    ) AS domain_name
-SELECT
-    domain_name,
-    count() AS events,
-    sum(duration_sec) AS duration_sec
-FROM aw_workforce.aw_browser_events
-WHERE domain_name != ''
-  AND (
-      dictGetUInt8OrDefault(
-        'aw_workforce.dict_domain_category',
-        'is_active',
-        domain_name,
-        0
-      ) != 1
-      OR dictGetStringOrDefault(
-        'aw_workforce.dict_domain_category',
-        'category',
-        domain_name,
-        ''
-      ) IN ('', 'unknown')
-  )
-GROUP BY domain_name
-ORDER BY duration_sec DESC;
-
-CREATE OR REPLACE VIEW aw_workforce.v_workforce_unknown_quality_daily AS
-SELECT
-    event_date,
-    sum(event_count) AS events,
-    sum(unknown_subject_events) AS unknown_subject_events,
-    round(unknown_subject_events / nullIf(events, 0), 4) AS unknown_subject_ratio,
-    sum(unknown_category_events) AS unknown_category_events,
-    round(unknown_category_events / nullIf(events, 0), 4) AS unknown_category_ratio
-FROM aw_workforce.agg_workforce_productivity_hourly
-GROUP BY event_date
-ORDER BY event_date DESC;

clickhouse-workforce/clickhouse/users.d/99-aw-workforce-local.xml

@@ -1,18 +0,0 @@
-<clickhouse>
-  <users>
-    <default>
-      <networks replace="replace">
-        <ip>::/0</ip>
-      </networks>
-    </default>
-    <aw_workforce_dict>
-      <no_password/>
-      <networks>
-        <ip>127.0.0.1</ip>
-        <ip>::1</ip>
-      </networks>
-      <profile>readonly</profile>
-      <quota>default</quota>
-    </aw_workforce_dict>
-  </users>
-</clickhouse>

clickhouse-workforce/docker-compose.yml

@@ -1,17 +0,0 @@
-services:
-  clickhouse:
-    image: clickhouse/clickhouse-server:24.8
-    container_name: aw-rus-workforce-clickhouse
-    restart: unless-stopped
-    environment:
-      CLICKHOUSE_DB: ${CLICKHOUSE_DB:-aw_workforce}
-    ports:
-      - "${CLICKHOUSE_HTTP_BIND:-127.0.0.1}:${CLICKHOUSE_PORT:-8124}:8123"
-      - "${CLICKHOUSE_NATIVE_BIND:-127.0.0.1}:${CLICKHOUSE_NATIVE_PORT:-9001}:9000"
-    volumes:
-      - clickhouse_workforce_data:/var/lib/clickhouse
-      - ./clickhouse/init:/docker-entrypoint-initdb.d:ro
-      - ./clickhouse/users.d/99-aw-workforce-local.xml:/etc/clickhouse-server/users.d/99-aw-workforce-local.xml:ro
-
-volumes:
-  clickhouse_workforce_data:

clickhouse-workforce/ops/apply_catalogs.sh

@@ -1,169 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ROOT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
-CATALOG_DIR="${CATALOG_DIR:-$ROOT_DIR/catalog}"
-
-CLICKHOUSE_CONTAINER="${CLICKHOUSE_CONTAINER:-aw-rus-workforce-clickhouse}"
-CLICKHOUSE_DATABASE="${CLICKHOUSE_DATABASE:-aw_workforce}"
-CLICKHOUSE_USER="${CLICKHOUSE_USER:-}"
-CLICKHOUSE_PASSWORD="${CLICKHOUSE_PASSWORD:-}"
-CLICKHOUSE_CLIENT_BIN="${CLICKHOUSE_CLIENT_BIN:-clickhouse-client}"
-CLICKHOUSE_READY_TIMEOUT_SEC="${CLICKHOUSE_READY_TIMEOUT_SEC:-60}"
-REBUILD_AGGREGATES="${REBUILD_AGGREGATES:-0}"
-
-client_auth_args=()
-if [[ -n "$CLICKHOUSE_USER" ]]; then
-  client_auth_args+=(--user "$CLICKHOUSE_USER")
-fi
-if [[ -n "$CLICKHOUSE_PASSWORD" ]]; then
-  client_auth_args+=(--password "$CLICKHOUSE_PASSWORD")
-fi
-
-run_query() {
-  local query="$1"
-
-  if docker ps --format '{{.Names}}' | grep -Fxq "$CLICKHOUSE_CONTAINER"; then
-    docker exec -i "$CLICKHOUSE_CONTAINER" clickhouse-client "${client_auth_args[@]}" \
-      --database "$CLICKHOUSE_DATABASE" --query "$query"
-    return
-  fi
-
-  if command -v "$CLICKHOUSE_CLIENT_BIN" >/dev/null 2>&1; then
-    "$CLICKHOUSE_CLIENT_BIN" "${client_auth_args[@]}" \
-      --database "$CLICKHOUSE_DATABASE" --query "$query"
-    return
-  fi
-
-  printf 'No running ClickHouse container "%s" and no %s in PATH\n' \
-    "$CLICKHOUSE_CONTAINER" "$CLICKHOUSE_CLIENT_BIN" >&2
-  return 127
-}
-
-run_query_file() {
-  local query_file="$1"
-
-  if docker ps --format '{{.Names}}' | grep -Fxq "$CLICKHOUSE_CONTAINER"; then
-    docker exec -i "$CLICKHOUSE_CONTAINER" clickhouse-client "${client_auth_args[@]}" \
-      --multiquery <"$query_file"
-    return
-  fi
-
-  if command -v "$CLICKHOUSE_CLIENT_BIN" >/dev/null 2>&1; then
-    "$CLICKHOUSE_CLIENT_BIN" "${client_auth_args[@]}" --multiquery <"$query_file"
-    return
-  fi
-
-  printf 'No running ClickHouse container "%s" and no %s in PATH\n' \
-    "$CLICKHOUSE_CONTAINER" "$CLICKHOUSE_CLIENT_BIN" >&2
-  return 127
-}
-
-run_insert_file() {
-  local query="$1"
-  local data_file="$2"
-
-  if docker ps --format '{{.Names}}' | grep -Fxq "$CLICKHOUSE_CONTAINER"; then
-    docker exec -i "$CLICKHOUSE_CONTAINER" clickhouse-client "${client_auth_args[@]}" \
-      --database "$CLICKHOUSE_DATABASE" --query "$query" <"$data_file"
-    return
-  fi
-
-  if command -v "$CLICKHOUSE_CLIENT_BIN" >/dev/null 2>&1; then
-    "$CLICKHOUSE_CLIENT_BIN" "${client_auth_args[@]}" \
-      --database "$CLICKHOUSE_DATABASE" --query "$query" <"$data_file"
-    return
-  fi
-
-  printf 'No running ClickHouse container "%s" and no %s in PATH\n' \
-    "$CLICKHOUSE_CONTAINER" "$CLICKHOUSE_CLIENT_BIN" >&2
-  return 127
-}
-
-wait_for_clickhouse() {
-  local deadline
-  deadline=$((SECONDS + CLICKHOUSE_READY_TIMEOUT_SEC))
-  while (( SECONDS < deadline )); do
-    if run_query "SELECT 1" >/dev/null 2>&1; then
-      return 0
-    fi
-    sleep 1
-  done
-
-  printf 'ClickHouse is not ready after %s seconds\n' "$CLICKHOUSE_READY_TIMEOUT_SEC" >&2
-  return 1
-}
-
-require_file() {
-  local path="$1"
-  if [[ ! -f "$path" ]]; then
-    printf 'Required catalog file is missing: %s\n' "$path" >&2
-    return 1
-  fi
-}
-
-wait_for_clickhouse
-
-require_file "$CATALOG_DIR/workstation_users.tsv"
-require_file "$CATALOG_DIR/application_categories.tsv"
-require_file "$CATALOG_DIR/domain_categories.tsv"
-
-printf '[catalog] truncate dimension tables\n'
-run_query "TRUNCATE TABLE $CLICKHOUSE_DATABASE.dim_workstation_user"
-run_query "TRUNCATE TABLE $CLICKHOUSE_DATABASE.dim_application_category"
-run_query "TRUNCATE TABLE $CLICKHOUSE_DATABASE.dim_domain_category"
-
-printf '[catalog] load workstation users\n'
-run_insert_file "
-INSERT INTO $CLICKHOUSE_DATABASE.dim_workstation_user
-    (host_name, user_login, user_domain, employee_id, employee_name, department, branch, position, source, is_active)
-FORMAT TabSeparatedWithNames
-" "$CATALOG_DIR/workstation_users.tsv"
-
-printf '[catalog] load application categories\n'
-run_insert_file "
-INSERT INTO $CLICKHOUSE_DATABASE.dim_application_category
-    (process_name, application_name, vendor, category, productivity_class, risk_level, is_system, source, comment, is_active)
-FORMAT TabSeparatedWithNames
-" "$CATALOG_DIR/application_categories.tsv"
-
-printf '[catalog] load domain categories\n'
-run_insert_file "
-INSERT INTO $CLICKHOUSE_DATABASE.dim_domain_category
-    (domain, site_name, category, productivity_class, risk_level, business_allowed, source, comment, is_active)
-FORMAT TabSeparatedWithNames
-" "$CATALOG_DIR/domain_categories.tsv"
-
-printf '[catalog] reload dictionaries\n'
-run_query "SYSTEM RELOAD DICTIONARY $CLICKHOUSE_DATABASE.dict_workstation_user"
-run_query "SYSTEM RELOAD DICTIONARY $CLICKHOUSE_DATABASE.dict_application_category"
-run_query "SYSTEM RELOAD DICTIONARY $CLICKHOUSE_DATABASE.dict_domain_category"
-
-if [[ "$REBUILD_AGGREGATES" == "1" ]]; then
-  printf '[catalog] rebuild aggregates\n'
-  run_query_file "$ROOT_DIR/admin/rebuild_aggregates.sql"
-fi
-
-printf '[catalog] dictionary status\n'
-run_query "
-SELECT name, status, last_exception
-FROM system.dictionaries
-WHERE database = '$CLICKHOUSE_DATABASE'
-  AND name IN ('dict_workstation_user', 'dict_application_category', 'dict_domain_category')
-ORDER BY name
-FORMAT PrettyCompact
-"
-
-printf '[catalog] raw unknown summary\n'
-run_query "
-SELECT 'subjects' AS area, count() AS rows
-FROM $CLICKHOUSE_DATABASE.v_workforce_unknown_subjects
-UNION ALL
-SELECT 'processes' AS area, count() AS rows
-FROM $CLICKHOUSE_DATABASE.v_workforce_unknown_processes
-UNION ALL
-SELECT 'domains' AS area, count() AS rows
-FROM $CLICKHOUSE_DATABASE.v_workforce_unknown_domains
-FORMAT PrettyCompact
-"

clickhouse-workforce/ops/aw-workforce-ingest.env.example

@@ -1,14 +0,0 @@
-AW_WORKFORCE_AW_URL=http://10.10.10.13:5600/api/0
-AW_WORKFORCE_CLICKHOUSE_URL=http://10.10.10.2:8123
-AW_WORKFORCE_CLICKHOUSE_DATABASE=aw_workforce
-AW_WORKFORCE_CLICKHOUSE_USER=
-AW_WORKFORCE_CLICKHOUSE_PASSWORD=
-AW_WORKFORCE_HOST=SHARKON2025
-AW_WORKFORCE_STATE_PATH=/var/lib/aw-workforce-ingest/state.json
-AW_WORKFORCE_OVERLAP_SECONDS=300
-AW_WORKFORCE_RETRY_ATTEMPTS=3
-AW_WORKFORCE_RETRY_BACKOFF_MS=1000
-AW_WORKFORCE_FAIL_ON_EMPTY=false
-AW_WORKFORCE_JSON=true
-no_proxy=localhost,127.0.0.1,10.10.10.13,10.10.10.2,10.10.10.0/24
-NO_PROXY=localhost,127.0.0.1,10.10.10.13,10.10.10.2,10.10.10.0/24

clickhouse-workforce/ops/aw-workforce-ingest.service

@@ -1,17 +0,0 @@
-[Unit]
-Description=AW-rus workforce ClickHouse ingest
-After=network-online.target docker.service
-Wants=network-online.target
-
-[Service]
-Type=oneshot
-WorkingDirectory=/opt/activitywatch/clickhouse-workforce
-EnvironmentFile=-/etc/activitywatch/aw-workforce-ingest.env
-ExecStart=/usr/local/bin/aw-workforce-ingest
-TimeoutStartSec=20min
-User=root
-Group=root
-Nice=5
-StandardOutput=journal
-StandardError=journal
-SyslogIdentifier=aw-workforce-ingest

clickhouse-workforce/ops/aw-workforce-ingest.timer

@@ -1,13 +0,0 @@
-[Unit]
-Description=Run AW-rus workforce ClickHouse ingest every 5 minutes
-
-[Timer]
-OnBootSec=2min
-OnUnitActiveSec=5min
-AccuracySec=30s
-RandomizedDelaySec=30s
-Persistent=true
-Unit=aw-workforce-ingest.service
-
-[Install]
-WantedBy=timers.target

clickhouse-workforce/ops/bootstrap_runtime.sh

@@ -1,34 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ROOT="${AW_WORKFORCE_ROOT:-/opt/activitywatch/clickhouse-workforce}"
-ENV_DIR="${AW_WORKFORCE_ENV_DIR:-/etc/activitywatch}"
-STATE_DIR="${AW_WORKFORCE_STATE_DIR:-/var/lib/aw-workforce-ingest}"
-SYSTEMD_DIR="${AW_WORKFORCE_SYSTEMD_DIR:-/etc/systemd/system}"
-
-install -d -m 0755 "$ROOT" "$ENV_DIR" "$STATE_DIR" "$SYSTEMD_DIR"
-
-if [[ ! -f "$ENV_DIR/aw-workforce-ingest.env" ]]; then
-  install -m 0640 "$SCRIPT_DIR/aw-workforce-ingest.env.example" \
-    "$ENV_DIR/aw-workforce-ingest.env"
-fi
-
-install -m 0644 "$SCRIPT_DIR/aw-workforce-ingest.service" \
-  "$SYSTEMD_DIR/aw-workforce-ingest.service"
-install -m 0644 "$SCRIPT_DIR/aw-workforce-ingest.timer" \
-  "$SYSTEMD_DIR/aw-workforce-ingest.timer"
-
-if command -v systemctl >/dev/null 2>&1; then
-  systemctl daemon-reload
-fi
-
-cat <<EOF
-Installed aw-workforce-ingest runtime files.
-
-Next manual deployment steps:
-  install -m 0755 <built aw-workforce-ingest binary> /usr/local/bin/aw-workforce-ingest
-  edit $ENV_DIR/aw-workforce-ingest.env
-  systemctl enable --now aw-workforce-ingest.timer
-  systemctl start aw-workforce-ingest.service
-EOF

clickhouse-workforce/ops/report_unknowns.sh

@@ -1,48 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ROOT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
-
-CLICKHOUSE_CONTAINER="${CLICKHOUSE_CONTAINER:-aw-rus-workforce-clickhouse}"
-CLICKHOUSE_DATABASE="${CLICKHOUSE_DATABASE:-aw_workforce}"
-CLICKHOUSE_CLIENT_BIN="${CLICKHOUSE_CLIENT_BIN:-clickhouse-client}"
-LIMIT="${LIMIT:-50}"
-
-run_query() {
-  local query="$1"
-
-  if docker ps --format '{{.Names}}' | grep -Fxq "$CLICKHOUSE_CONTAINER"; then
-    docker exec -i "$CLICKHOUSE_CONTAINER" clickhouse-client \
-      --database "$CLICKHOUSE_DATABASE" --query "$query"
-    return
-  fi
-
-  "$CLICKHOUSE_CLIENT_BIN" --database "$CLICKHOUSE_DATABASE" --query "$query"
-}
-
-cd "$ROOT_DIR"
-
-printf '\n[unknown subjects]\n'
-run_query "
-SELECT *
-FROM $CLICKHOUSE_DATABASE.v_workforce_unknown_subjects
-LIMIT $LIMIT
-FORMAT PrettyCompact
-"
-
-printf '\n[unknown processes]\n'
-run_query "
-SELECT *
-FROM $CLICKHOUSE_DATABASE.v_workforce_unknown_processes
-LIMIT $LIMIT
-FORMAT PrettyCompact
-"
-
-printf '\n[unknown domains]\n'
-run_query "
-SELECT *
-FROM $CLICKHOUSE_DATABASE.v_workforce_unknown_domains
-LIMIT $LIMIT
-FORMAT PrettyCompact
-"

clickhouse-workforce/ops/run_smoke.sh

@@ -1,136 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ROOT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
-
-CLICKHOUSE_CONTAINER="${CLICKHOUSE_CONTAINER:-aw-rus-workforce-clickhouse}"
-CLICKHOUSE_DATABASE="${CLICKHOUSE_DATABASE:-aw_workforce}"
-CLICKHOUSE_USER="${CLICKHOUSE_USER:-}"
-CLICKHOUSE_PASSWORD="${CLICKHOUSE_PASSWORD:-}"
-CLICKHOUSE_CLIENT_BIN="${CLICKHOUSE_CLIENT_BIN:-clickhouse-client}"
-LOAD_DEMO_SEED="${LOAD_DEMO_SEED:-1}"
-CLICKHOUSE_READY_TIMEOUT_SEC="${CLICKHOUSE_READY_TIMEOUT_SEC:-60}"
-
-client_auth_args=()
-if [[ -n "$CLICKHOUSE_USER" ]]; then
-  client_auth_args+=(--user "$CLICKHOUSE_USER")
-fi
-if [[ -n "$CLICKHOUSE_PASSWORD" ]]; then
-  client_auth_args+=(--password "$CLICKHOUSE_PASSWORD")
-fi
-
-run_client() {
-  local query_file="${1:-}"
-  local query="${2:-}"
-
-  if docker ps --format '{{.Names}}' | grep -Fxq "$CLICKHOUSE_CONTAINER"; then
-    if [[ -n "$query_file" ]]; then
-      docker exec -i "$CLICKHOUSE_CONTAINER" clickhouse-client "${client_auth_args[@]}" --multiquery <"$query_file"
-    else
-      docker exec -i "$CLICKHOUSE_CONTAINER" clickhouse-client "${client_auth_args[@]}" --database "$CLICKHOUSE_DATABASE" --query "$query"
-    fi
-    return
-  fi
-
-  if command -v "$CLICKHOUSE_CLIENT_BIN" >/dev/null 2>&1; then
-    if [[ -n "$query_file" ]]; then
-      "$CLICKHOUSE_CLIENT_BIN" "${client_auth_args[@]}" --multiquery <"$query_file"
-    else
-      "$CLICKHOUSE_CLIENT_BIN" "${client_auth_args[@]}" --database "$CLICKHOUSE_DATABASE" --query "$query"
-    fi
-    return
-  fi
-
-  printf 'No running ClickHouse container "%s" and no %s in PATH\n' \
-    "$CLICKHOUSE_CONTAINER" "$CLICKHOUSE_CLIENT_BIN" >&2
-  return 127
-}
-
-wait_for_clickhouse() {
-  local deadline
-  deadline=$((SECONDS + CLICKHOUSE_READY_TIMEOUT_SEC))
-  while (( SECONDS < deadline )); do
-    if run_client "" "SELECT 1" >/dev/null 2>&1; then
-      return 0
-    fi
-    sleep 1
-  done
-
-  printf 'ClickHouse is not ready after %s seconds\n' "$CLICKHOUSE_READY_TIMEOUT_SEC" >&2
-  return 1
-}
-
-apply_sql_dir() {
-  local sql_file
-  for sql_file in "$ROOT_DIR"/clickhouse/init/*.sql; do
-    printf '[sql] %s\n' "${sql_file#$ROOT_DIR/}"
-    run_client "$sql_file" ""
-  done
-}
-
-assert_scalar_nonzero() {
-  local name="$1"
-  local query="$2"
-  local value
-  value="$(run_client "" "$query" | tr -d '[:space:]')"
-  if [[ ! "$value" =~ ^[0-9]+$ ]] || (( value < 1 )); then
-    printf '[FAIL] %s: expected positive integer, got "%s"\n' "$name" "$value" >&2
-    return 1
-  fi
-  printf '[OK]   %s: %s\n' "$name" "$value"
-}
-
-assert_no_dictionary_errors() {
-  local errors
-  errors="$(run_client "" "
-SELECT count()
-FROM system.dictionaries
-WHERE database = '$CLICKHOUSE_DATABASE'
-  AND name IN ('dict_workstation_user', 'dict_application_category', 'dict_domain_category')
-  AND (status != 'LOADED' OR last_exception != '')
-")"
-  errors="$(printf '%s' "$errors" | tr -d '[:space:]')"
-  if [[ "$errors" != "0" ]]; then
-    printf '[FAIL] dictionaries have load errors\n' >&2
-    run_client "" "
-SELECT database, name, status, last_exception
-FROM system.dictionaries
-WHERE database = '$CLICKHOUSE_DATABASE'
-  AND name IN ('dict_workstation_user', 'dict_application_category', 'dict_domain_category')
-FORMAT Vertical
-"
-    return 1
-  fi
-  printf '[OK]   dictionaries loaded\n'
-}
-
-wait_for_clickhouse
-apply_sql_dir
-
-if [[ "$LOAD_DEMO_SEED" == "1" ]]; then
-  printf '[sql] sample/seed_demo.sql\n'
-  run_client "$ROOT_DIR/sample/seed_demo.sql" ""
-fi
-
-assert_no_dictionary_errors
-assert_scalar_nonzero "dictionary count" "
-SELECT count()
-FROM system.dictionaries
-WHERE database = '$CLICKHOUSE_DATABASE'
-  AND name IN ('dict_workstation_user', 'dict_application_category', 'dict_domain_category')
-"
-assert_scalar_nonzero "hourly aggregate rows" "
-SELECT count()
-FROM $CLICKHOUSE_DATABASE.agg_workforce_productivity_hourly
-"
-assert_scalar_nonzero "daily productivity rows" "
-SELECT count()
-FROM $CLICKHOUSE_DATABASE.v_workforce_productivity_daily
-"
-assert_scalar_nonzero "unknown quality rows" "
-SELECT count()
-FROM $CLICKHOUSE_DATABASE.v_workforce_unknown_quality_daily
-"
-
-printf '[OK] ClickHouse workforce smoke completed\n'

clickhouse-workforce/sample/seed_demo.sql

@@ -1,37 +0,0 @@
-INSERT INTO aw_workforce.dim_workstation_user
-    (host_name, user_login, user_domain, employee_id, employee_name, department, branch, position, source)
-VALUES
-    ('ws-001', 'ivanov', 'corp', 'E001', 'Иванов И.И.', 'Бухгалтерия', 'Филиал 1', 'Бухгалтер', 'demo'),
-    ('ws-002', 'petrova', 'corp', 'E002', 'Петрова П.П.', 'Операционный отдел', 'Филиал 1', 'Оператор', 'demo');
-
-INSERT INTO aw_workforce.dim_application_category
-    (process_name, application_name, vendor, category, productivity_class, risk_level, is_system, source, comment)
-VALUES
-    ('1cv8.exe', '1C:Enterprise', '1C', '1c', 'productive', 'low', 0, 'demo', 'core business app'),
-    ('chrome.exe', 'Google Chrome', 'Google', 'browser', 'neutral', 'low', 0, 'demo', 'domain classified separately'),
-    ('soffice.bin', 'LibreOffice', 'The Document Foundation', 'office', 'productive', 'low', 0, 'demo', 'office suite');
-
-INSERT INTO aw_workforce.dim_domain_category
-    (domain, site_name, category, productivity_class, risk_level, business_allowed, source, comment)
-VALUES
-    ('intranet.local', 'Internal portal', 'internal_service', 'productive', 'low', 1, 'demo', 'internal work portal'),
-    ('github.com', 'GitHub', 'developer', 'productive', 'low', 1, 'demo', 'developer workflow'),
-    ('youtube.com', 'YouTube', 'media', 'neutral', 'medium', 0, 'demo', 'context-dependent media');
-
-SYSTEM RELOAD DICTIONARY aw_workforce.dict_workstation_user;
-SYSTEM RELOAD DICTIONARY aw_workforce.dict_application_category;
-SYSTEM RELOAD DICTIONARY aw_workforce.dict_domain_category;
-
-INSERT INTO aw_workforce.aw_window_events
-    (event_time, host_name, user_login, process_name, window_title, duration_sec, source_bucket, source_event_id)
-VALUES
-    (now() - INTERVAL 20 MINUTE, 'ws-001', 'ivanov', '1cv8.exe', '1C - документы', 900, 'demo-window', 'w-001'),
-    (now() - INTERVAL 15 MINUTE, 'ws-002', 'petrova', 'soffice.bin', 'Отчет', 600, 'demo-window', 'w-002'),
-    (now() - INTERVAL 10 MINUTE, 'ws-unknown', 'unknown', 'unknown.exe', 'Unknown tool', 120, 'demo-window', 'w-003');
-
-INSERT INTO aw_workforce.aw_browser_events
-    (event_time, host_name, user_login, browser_name, url, title, duration_sec, source_bucket, source_event_id)
-VALUES
-    (now() - INTERVAL 9 MINUTE, 'ws-001', 'ivanov', 'chrome.exe', 'https://intranet.local/tasks', 'Tasks', 300, 'demo-browser', 'b-001'),
-    (now() - INTERVAL 8 MINUTE, 'ws-002', 'petrova', 'chrome.exe', 'https://github.com/igor04091968/AWatch-rus', 'AWatch-rus', 240, 'demo-browser', 'b-002'),
-    (now() - INTERVAL 7 MINUTE, 'ws-002', 'petrova', 'chrome.exe', 'https://unknown.example/path', 'Unknown', 90, 'demo-browser', 'b-003');

clickhouse-workforce/sample/seed_sharkon2025_p3.sql

@@ -1,6 +0,0 @@
-INSERT INTO aw_workforce.dim_workstation_user
-    (host_name, user_login, user_domain, employee_id, employee_name, department, branch, position, source)
-VALUES
-    ('SHARKON2025', 'user1', 'sharkon2025', 'sharkon2025\\user1', 'user1', 'tsj', 'tsj', 'RDP user', 'manual-p3');
-
-SYSTEM RELOAD DICTIONARY aw_workforce.dict_workstation_user;

deny.toml

@@ -1,40 +0,0 @@
-# Public mirror dependency policy for cargo-deny.
-# This is advisory validation for public engineering transparency.
-# Final license and registry-submission review still requires legal review.
-
-[advisories]
-version = 2
-yanked = "warn"
-ignore = []
-
-[licenses]
-version = 2
-confidence-threshold = 0.8
-allow = [
-  "Apache-2.0",
-  "Apache-2.0 WITH LLVM-exception",
-  "BSD-2-Clause",
-  "BSD-3-Clause",
-  "CDLA-Permissive-2.0",
-  "CC0-1.0",
-  "ISC",
-  "MIT",
-  "MPL-2.0",
-  "OpenSSL",
-  "Unicode-3.0",
-  "Unicode-DFS-2016",
-  "Zlib",
-]
-
-[bans]
-multiple-versions = "warn"
-wildcards = "warn"
-deny = []
-skip = []
-skip-tree = []
-
-[sources]
-unknown-registry = "warn"
-unknown-git = "warn"
-allow-registry = ["https://github.com/rust-lang/crates.io-index"]
-allow-git = []

docs/BRANCH_PROTECTION_EVIDENCE_RU.md

@@ -1,119 +0,0 @@
-# AWatch-rus: branch protection evidence
-
-Дата: 2026-06-24
-
-branch_protection_status: "verified_active_ruleset"
-
-GitHub issue: https://github.com/igor04091968/AWatch-rus/issues/49
-
-Этот документ фиксирует maintainer-verified GitHub ruleset / branch protection
-evidence для публичного зеркала. Подтверждение относится только к GitHub public
-mirror governance.
-
-## Target
-
-- Repository: `igor04091968/AWatch-rus`.
-- Platform role: GitHub public mirror validation only.
-- Protected branch: `main`.
-- Ruleset name: `main`.
-- Enforcement: `active`.
-- Policy source: `docs/BRANCH_PROTECTION_POLICY_RU.md`.
-- Evidence owner: maintainer.
-
-## Verified Settings
-
-Maintainer manually verified the following GitHub UI state:
-
-- verification date: `2026-06-24`;
-- maintainer: `maintainer`;
-- repository: `github.com/igor04091968/AWatch-rus`;
-- ruleset name: `main`;
-- enforcement: `active`;
-- target branch: `main`;
-- applies_to_targets: `1`;
-- bypass_list: `empty`;
-- required pull request: `enabled`;
-- required approvals: `1`;
-- dismiss stale pull request approvals when new commits are pushed: `enabled`;
-- require review from Code Owners: `enabled`;
-- block force pushes: `enabled`.
-
-## Verified Required Status Checks
-
-GitHub ruleset required status checks verified in the UI:
-
-- `Coverage baseline`
-- `security`
-- `rust-checks`
-- `docs-registry-checks`
-- `smoke-checks`
-
-These names are the ruleset-visible required check names from GitHub UI. They
-may differ from the human-readable workflow job names shown inside workflow
-files.
-
-## Evidence Record
-
-- Screenshot filename placeholder:
-  `docs/evidence/github-ruleset-main-2026-06-24.png`
-- Date: `2026-06-24`
-- Maintainer: `maintainer`
-- Repository: `github.com/igor04091968/AWatch-rus`
-- Ruleset: `main`
-- Protected branch: `main`
-- Enforcement: `active`
-- Applies to targets: `1`
-- Bypass list: `empty`
-- Required checks verified: `Coverage baseline`, `security`, `rust-checks`,
-  `docs-registry-checks`, `smoke-checks`
-- Force-push restriction verified: `enabled`
-- Notes: GitHub UI confirms active ruleset for target branch `main`.
-
-## First Protected PR Validation
-
-- PR URL: `https://github.com/igor04091968/AWatch-rus/pull/50`
-- Linked governance issue: `https://github.com/igor04091968/AWatch-rus/issues/49`
-- PR source branch: `docs/verified-github-ruleset-evidence`
-- PR target branch: `main`
-- Runtime/API/UI/product code changes: `none`
-- Required checks status: `passed`
-- Required checks: `Coverage baseline`, `security`, `rust-checks`,
-  `docs-registry-checks`, `smoke-checks`
-- Review requirement status: `pending_review_required`
-- Merge status: `open`
-- Admin bypass used: `false`
-- Outcome note: PR #50 confirms required checks execute under the active ruleset;
-  review/merge evidence is not yet complete.
-
-## Future Reverification Procedure
-
-1. Open repository settings for `igor04091968/AWatch-rus`.
-2. Open repository rules/rulesets for `main`.
-3. Confirm enforcement remains `active`.
-4. Confirm target branch remains `main`.
-5. Confirm bypass list remains empty.
-6. Confirm required PR, approvals, stale dismissal, Code Owners review, status
-   checks and force-push block.
-7. Capture screenshot evidence without private account data or tokens.
-
-## Not Registry Release Evidence
-
-GitHub ruleset / branch protection evidence is public governance evidence only.
-It is not Russian registry release evidence and does not replace Russian
-Gitea/build-runner release contour, release artifacts, checksums, build logs or
-release evidence from the Russian build-runner.
-
-## Russian Contour Note
-
-Primary registry-readiness contour remains Russian Gitea plus the planned
-Russian build-runner. GitHub remains public mirror validation only.
-
-## Guardrails
-
-- Do not record secrets, tokens, private URLs or account recovery details.
-- Do not include private employee/customer data in screenshots.
-- Do not claim completed registry submission.
-- Do not claim certification.
-- Do not claim SIEM/DLP replacement.
-- Do not claim ML/LLM-based detection.
-- Do not claim automatic remediation.

docs/BRANCH_PROTECTION_POLICY_RU.md

@@ -1,104 +0,0 @@
-# AWatch-rus: advisory branch protection policy
-
-Дата: 2026-06-23
-
-Статус: recommended policy plus verified GitHub ruleset evidence. GitHub UI
-verification is recorded in `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`.
-
-GitHub остается public mirror validation surface. Primary registry-readiness
-contour остается Russian Gitea plus Russian build-runner release evidence.
-
-## Scope
-
-- Branch: `main`.
-- Ruleset: `main`.
-- Platform: GitHub public mirror.
-- Purpose: visible review discipline, status-check discipline and public
-  engineering maturity signal.
-- Registry release evidence: out of scope for GitHub Actions.
-
-## Recommended rules
-
-- Require pull request before merge.
-- Require at least one approving review for non-emergency changes.
-- Require status checks before merge.
-- Require `CI` workflow.
-- Require `Security` workflow.
-- Require `Coverage` workflow as baseline visibility; no coverage threshold is
-  enforced yet.
-- Require conversation resolution before merge.
-- Restrict force push.
-- Restrict branch deletion.
-- Require linear history if compatible with the maintainer workflow.
-- Administrator bypass should be emergency-only and documented after the fact.
-
-## Recommended GitHub Branch Protection Settings
-
-Recommended settings for `main` on the GitHub public mirror:
-
-- Ruleset name: `main`.
-- Enforcement: `active`.
-- Target branches: `main`.
-- Applies to: `1` target, `main`.
-- Bypass list: empty.
-- Require pull request before merging.
-- Required approvals: `1`.
-- Dismiss stale approvals when new commits are pushed.
-- Require review from Code Owners.
-- Require status checks to pass before merging.
-- Require branches to be up to date before merging if this does not block the
-  current maintainer workflow.
-- Restrict force pushes.
-- Restrict deletions.
-- Allow administrators bypass: documented decision only; stricter mode should
-  keep bypass disabled unless repository recovery requires it.
-
-Verified ruleset required status checks from GitHub UI:
-
-- `Coverage baseline`
-- `security`
-- `rust-checks`
-- `docs-registry-checks`
-- `smoke-checks`
-
-Workflow/job-name mapping for operator review:
-
-- `Coverage baseline`: Coverage workflow baseline job.
-- `rust-checks`: CI Rust checks job.
-- `docs-registry-checks`: CI docs and registry checks job.
-- `smoke-checks`: CI smoke checks job.
-- `security`: security validation context shown by GitHub rulesets UI.
-
-Current evidence status is `verified_active_ruleset` in
-`docs/BRANCH_PROTECTION_EVIDENCE_RU.md`.
-
-## Review expectations
-
-- CODEOWNERS routes changes to the current maintainer.
-- External visible peer review is still pending and should be introduced through
-  public pull requests.
-- Review approval is not a warranty of security, fitness for production or
-  legal readiness.
-- Contributors remain responsible for the safety and accuracy of their changes.
-
-## Registry and security guardrails
-
-- Do not claim FSTEC/FSB certification.
-- Do not claim completed Russian software registry submission.
-- Do not claim SIEM/DLP replacement.
-- Do not publish secrets, personal data, employee data or customer
-  infrastructure identifiers.
-- Do not claim Gitea restore test completed until evidence exists.
-- Do not claim Russian build-runner ready until provisioning evidence exists.
-
-## Emergency bypass
-
-Emergency administrator bypass may be used only for urgent repository recovery,
-blocked release hygiene or security containment. The follow-up record should
-state:
-
-- reason for bypass;
-- commits affected;
-- checks run after bypass;
-- rollback or follow-up action;
-- whether registry-readiness claims changed.

docs/CONTOUR_CHECK_MATRIX_RU.md

@@ -1,127 +0,0 @@
-# Матрица проверки контура AWatch-rus
-
-Дата фиксации: 2026-06-21.
-
-Документ описывает ежедневную и еженедельную проверку эксплуатационного контура
-AWatch-rus. Он не является заявлением о сертификации, не подменяет юридическую
-экспертизу и не описывает GitHub Actions как основной контур выпуска.
-
-## Цель
-
-Ежедневная проверка должна отвечать на один вопрос: можно ли оператору считать
-контур AWatch-rus пригодным для работы сегодня без ручного обхода всех
-компонентов.
-
-Еженедельная проверка расширяет ежедневную: добавляет portal smoke, registry
-docs check и доказательные артефакты для последующего release/readiness пакета.
-
-## Канонический запуск
-
-Основной запускной скрипт:
-
-```bash
-scripts/run_awatch_contour_check.sh
-```
-
-## Локальный запуск с ноутбука
-
-Для ручной проверки на ноутбуке удобно явно указать env-файл и корень артефактов:
-
-```bash
-export CONTOUR_CHECK_ENV_FILE=~/path/to/your/contour-check.env
-export CONTOUR_CHECK_OUTPUT_ROOT=~/tmp/contour-check-runs
-export CONTOUR_CHECK_STREAM=1
-scripts/run_awatch_contour_check.sh
-```
-
-Во время выполнения можно наблюдать прогресс отдельным окном:
-
-```bash
-ls -dt ~/tmp/contour-check-runs/* | head -n 1 | xargs -r -I{} tail -f {}/logs/detmir-check-json.log
-```
-
-`CONTOUR_CHECK_STREAM=1` полезен для локального запуска, если кажется, что скрипт «завис» на `== detmir-check-json ==`; фактически это длительный шаг в `detmir-check` с таймаутами по каждому endpoint.
-
-Рекомендуемые systemd units для российского/internal контура:
-
-```text
-ops/systemd/awatch-contour-daily-check.service
-ops/systemd/awatch-contour-daily-check.timer
-ops/systemd/awatch-contour-weekly-check.service
-ops/systemd/awatch-contour-weekly-check.timer
-```
-
-Live endpoints, hostnames, tokens and passwords must be supplied through
-`/etc/detmir/detmir-check.env` (systemd units) or another private environment
-file outside the public repository.
-
-## Текущий планировщик Proxmox, проверено 2026-06-21
-
-На Proxmox уже присутствуют следующие регулярные проверки:
-
-| Timer | Частота | Роль |
-|---|---:|---|
-| `detmir-auto.timer` | каждые 30 минут | общий read-only check, AI report и safe recovery |
-| `detmir-readiness-sync.timer` | каждые 10 минут | синхронизация readiness bundle |
-| `detmir-portal-prewarm.timer` | каждые 30 минут | прогрев portal report cache |
-| `aw-1c-clickhouse-health.timer` | каждые 5 минут | здоровье ClickHouse/1C layer |
-| `aw-1c-ingest.timer` | каждые 15 минут | ingest cycle 1C/file layer |
-| `aw-1c-proofcheck.timer` | каждые 6 часов | freshness proof check |
-| `aw-1c-manager-brief.timer` | каждые 6 часов | manager brief |
-| `aw-1c-recovery-brief.timer` | каждые 6 часов | recovery brief |
-| `aw-1c-weekly-digest.timer` | понедельник 08:20 | weekly executive digest |
-| `proxmox-lxc-critical-updates-check.timer` | ежедневно 03:00 | critical/important updates check |
-
-Наблюдение: отдельный ежедневный полный gate по всей матрице AWatch-rus
-отсутствует. Его роль должен закрыть `awatch-contour-daily-check.timer`.
-
-Наблюдение: последняя проверка `detmir-portal-prewarm.service` на момент осмотра
-имела `Result=exit-code` и `ExecMainStatus=28`. Это не надо маскировать:
-канонический check должен показывать такой сбой как fail/warn в зависимости от
-политики эксплуатации.
-
-## Матрица требований и проверок
-
-| Область | Что проверяется | Исполнитель | Ежедневно | Еженедельно |
-|---|---|---|---:|---:|
-| ActivityWatch API | `/api/0/info`, доступность API | `detmir-check` | да | да |
-| Worktime API | `/reports/worktime/today` | `detmir-check` | да | да |
-| 1C API | `/api/health` | `detmir-check` | да | да |
-| Gateway | `/healthz` | `detmir-check` | да | да |
-| Portal hardening | `/healthz`, `/readyz`, `/version`, `/metrics` | `detmir-check` | да | да |
-| Windows/RDP | TCP 5985 и 22 | `detmir-check` | да | да |
-| ActivityWatch buckets | AFK/window/worktime/session events | `detmir-check` | да | да |
-| AWatch DLP buckets | endpoint signals/incidents/review/rules | `detmir-check` | да | да |
-| AWatch DLP health | remote `dlp-health-check --json` через `detmir-dlp` | `detmir-check` | да | да |
-| Grafana evidence | свежий JSON артефакт Grafana check | `detmir-check` | да | да |
-| Security events backend | ClickHouse events, если включено | `detmir-check` | да | да |
-| Portal contract | role/API smoke | `scripts/awatch-production-hardening-smoke.mjs` | нет | да |
-| Pilot contract | demo/API smoke | `scripts/detmir-pilot-demo-smoke.mjs` | нет | да |
-| Registry/readiness docs | registry readiness check | `scripts/registry_readiness_check.sh` | опционально | да |
-
-## Fail-closed политика
-
-Ежедневный check должен завершаться non-zero, если падает обязательная область:
-
-- ActivityWatch API;
-- Worktime API;
-- Gateway/Portal health;
-- RDP/Windows reachability;
-- свежесть обязательных bucket streams;
-- AWatch DLP health;
-- Grafana evidence freshness.
-
-Event-driven buckets не должны считаться stale только из-за отсутствия новых
-инцидентов. Для них фиксируется статус `EVENT-DRIVEN`.
-
-## Что ещё требуется довести
-
-- Развернуть `awatch-contour-daily-check.timer` на Proxmox после установки
-  обновленного `detmir-check`.
-- Развернуть `awatch-contour-weekly-check.timer` для расширенного smoke/docs
-  контроля.
-- Заполнить `/etc/awatch-rus/contour-check.env` live значениями без записи
-  секретов в репозиторий.
-- Настроить retention для `.ops/contour-check-runs` или серверного output path.
-- После первого успешного недельного запуска приложить summary к
-  registry/readiness evidence пакету.

docs/DETMIR_CURRENT_STATE_RU.md

@@ -1,387 +0,0 @@
-# DetMir/AWatch-rus: актуальное состояние и граница DLP-модуля
-
-Дата фиксации: 2026-06-25.
-
-Обновление 2026-06-29 после восстановления RDP-сервера: фактический
-production IP Windows/RDP host теперь `192.168.100.19`; stable ActivityWatch
-logical host id остаётся `SHARKON2025`. Подробный post-restore baseline:
-`docs/DETMIR_RESTORE_BASELINE_2026-06-29_RU.md`.
-
-Документ фиксирует фактическое состояние DetMir/AWatch-rus и первую границу
-переработки горячего пути портала. Это не release evidence для реестра
-российского ПО, не заявление о сертификации и не claim замены DLP/SIEM/EDR.
-
-## Runtime baseline
-
-- Контур: DetMir / AWatch-rus.
-- Stable Windows/RDP logical host id для ActivityWatch bucket-ов и отчетов:
-  `SHARKON2025`. Это legacy logical id, а не обязательное физическое имя
-  Windows-сервера. Правило rename-safe эксплуатации описано в
-  `docs/WINDOWS_LOGICAL_HOST_ID_RU.md`.
-- Текущий физический RDP/WinRM target: `192.168.100.19`.
-- Portal host: `10.10.10.2`.
-- Portal service: `detmir-portal.service`.
-- Portal URL: `http://10.10.10.2:8720/`.
-- Задеплоенный binary hash:
-  `653b22b0fbf29a22f7de42ade7b689490b1de16fa07e785e4e0efd3078e7a3bc`.
-- Бэкап предыдущего binary на сервере:
-  `/usr/local/bin/detmir-portal.bak.20260625T045640Z`.
-- Runtime mode после 2026-06-30 prod hardening:
-  server-side DLP runtime зафиксирован в `core_only/disabled`.
-  Portal DLP UI/API module может оставаться включённым для чтения исторического
-  SQLite/evidence-среза, но это не означает запуск DLP collectors/exporters.
-- Server-side optional DLP runtime control:
-  `AW_DLP_ENABLED=false|true` и `DETMIR_DLP_ENABLED=false|true`.
-- Current resource profile: `AW_DLP_ENABLED=false`,
-  `AW_DLP_PROFILE=core_only`; возврат в `light` выполняется только вручную
-  после проверки нагрузки.
-- Runtime control/statistics script:
-  `scripts/detmir_dlp_runtime_control.sh` / live
-  `/usr/local/bin/detmir-dlp-runtime-control`.
-- DLP runtime state after 2026-06-30 prod hardening:
-  `AW_DLP_ENABLED=false`, `AW_DLP_PROFILE=core_only`,
-  `AW_DLP_INFLUX_ENABLED=false`; optional DLP units should be
-  `inactive/disabled`. `detmir-dlp-load-guard.timer` remains enabled and active
-  as protection for any later operator re-enable.
-- Reason: DLP runtime materially increases Proxmox VM/LXC, InfluxDB, Grafana,
-  ClickHouse and AW server load. In production DetMir the safe default is
-  `core_only`; `light` is a reconnectable profile, not the automatic default.
-- Auto-disable guard:
-  `scripts/detmir_dlp_load_guard.sh` / live
-  `/usr/local/bin/detmir-dlp-load-guard`. При перегрузе переводит DLP в
-  `core_only` через runtime-control и пишет evidence в
-  `/var/lib/activitywatch/health/dlp-light-guard-state.json`.
-- DLP warehouse sync для портала:
-  `scripts/detmir_dlp_warehouse_sync.sh` / live
-  `/usr/local/bin/detmir-dlp-warehouse-sync`. Доставляет локальный SQLite
-  snapshot на portal host для UEBA/DLP views без heavy DLP hot path.
-- Loki CT is intentionally excluded from the current DetMir production resource
-  profile. It must not be returned by routine deploy/recovery while the goal is
-  to keep Proxmox VM/LXC load low.
-- Health после деплоя: `/healthz` возвращал `status=ok`.
-- Readiness после деплоя: `/readyz` возвращал `status=ready`.
-
-## Что исправлено в текущем baseline
-
-- Первичная загрузка портала больше не зависает в бесконечном `LOADING`.
-- При холодном старте тяжелый операторский срез не блокирует UI бесконечно.
-- Frontend показывает честное состояние `STALE / Первичный срез прогревается`.
-- При prewarm больше не смешиваются статусы `STALE` и ложное
-  `Данные отсутствуют`.
-- Progress bar доходит до `100%` в fail-soft/prewarm состоянии.
-- Browser smoke после деплоя подтвердил:
-  - `loadStatus=STALE`;
-  - `progress=100%`;
-  - `LOADING=false`;
-  - `EMPTY=false`;
-  - `ERROR=false`.
-
-## Phase 1 live verification
-
-2026-06-25 после сборки `detmir-portal` и деплоя через
-`ansible/deploy_detmir_portal.yml --limit proxmox` подтверждено:
-
-- `/healthz`: `status=ok`;
-- `/readyz`: `status=ready`;
-- `/api/reports`: `ok=true`, `cache_status=warming`,
-  `modules.dlp.enabled=false`, `modules.dlp.hot_path=false`;
-- `/api/operator`: `cache_status=warming`, `summary.severity=STALE`,
-  `modules.dlp.status=disabled`, `incidents=0`;
-- server log для `/api/operator`: `status=200`, `latency_ms=49`.
-
-Это подтверждает, что первый operator/API screen больше не блокируется на
-холодной полной сборке. Полный snapshot строится в фоне и честно помечается как
-`warming`/`STALE`.
-
-## Текущая проблема производительности
-
-Наблюдаемые признаки:
-
-- после restart полный тяжелый snapshot может уходить в prewarm/stale mode;
-- report cache и stale UI защищают пользователя от зависания, но не убирают
-  саму стоимость тяжелых расчетов;
-- DLP evidence, screenshots, endpoint signals, case review и forensics
-  enrichment требуют больше CPU/IO/сетевых операций, чем Workforce core.
-
-Вывод: DLP/evidence/forensics enrichment вынесен из обязательного hot path.
-Phase 1 делал это через `DETMIR_PORTAL_DLP_MODULE_ENABLED=false`; текущий
-lightweight-профиль оставляет DLP-status/UEBA-сигналы включенными без тяжелого
-evidence/case/exporter path. Полная оптимизация тяжелого snapshot/prewarm
-остается отдельной инженерной задачей.
-
-## Целевая граница после переработки
-
-Core hot path:
-
-- Workforce Operations;
-- worktime/activity;
-- загрузка, простои, перегруз;
-- дисциплина процесса;
-- качество и полнота данных;
-- легкие агрегаты для руководителя;
-- readiness/health без ожидания DLP.
-
-Optional DLP module:
-
-- DLP endpoint signals;
-- clipboard/USB/print/web/file operation incidents;
-- screenshots/evidence;
-- DLP/case review;
-- heavy security correlation;
-- forensics timelines and evidence packages;
-- Hayabusa enrichment where needed.
-
-Отключение optional DLP module не должно ломать:
-
-- `/healthz`;
-- `/readyz`;
-- первичную загрузку портала;
-- Workforce views;
-- management reports;
-- базовый operator dashboard.
-
-Отключение optional DLP module должно показывать честный статус:
-
-```text
-DLP module disabled / not configured
-```
-
-без заявления, что DLP-проверки выполнены.
-
-## Рекомендуемые feature flags
-
-Минимальная целевая модель конфигурации:
-
-```json
-{
-  "modules": {
-    "dlp": {
-      "enabled": false,
-      "evidence": false,
-      "correlation": false,
-      "screenshots": false,
-      "hot_path": false
-    }
-  }
-}
-```
-
-Первая реализованная runtime-граница:
-
-```text
---dlp-module-enabled
-DETMIR_PORTAL_DLP_MODULE_ENABLED=true|false
-AW_DLP_ENABLED=true|false
-DETMIR_DLP_ENABLED=true|false
-```
-
-DetMir production default после 2026-06-30 hardening:
-`AW_DLP_ENABLED=false` / `AW_DLP_PROFILE=core_only`. Portal DLP module may stay
-enabled for historical/security views, but server-side DLP collectors/exporters
-remain off. В этом режиме портал:
-
-- не читает DLP incident/case/review/audit файлы в основном report/operator
-  path;
-- использует только уже имеющийся лёгкий DLP-срез для UEBA и статуса;
-- не включает evidence/case/exporters/Loki/Influx-heavy path;
-- не считает отсутствие heavy DLP ошибкой Workforce core.
-
-Ansible-параметр поставки для старого disabled-профиля:
-
-```yaml
-detmir_portal_dlp_module_enabled_override: false
-```
-
-Для текущего safe production профиля:
-
-```yaml
-detmir_portal_dlp_module_enabled_override: true
-aw_dlp_profile: "core_only"
-aw_dlp_enabled: false
-aw_dlp_influx_enabled: false
-aw_dlp_light_collector_enabled: false
-aw_dlp_light_guard_enabled: true
-```
-
-Возврат в `light` выполняется только после resource check:
-
-```bash
-sudo AW_DLP_DISABLED_REASON=operator_reenable_after_resource_check \
-  /usr/local/bin/detmir-dlp-runtime-control set-profile light
-sudo sed -i \
-  -e 's/^AW_DLP_ENABLED=.*/AW_DLP_ENABLED=true/' \
-  -e 's/^AW_DLP_PROFILE=.*/AW_DLP_PROFILE=light/' \
-  /etc/activitywatch/aw-server.env
-```
-
-Отдельный `detmir-portal-evidence` сервис не отключается этим флагом и остается
-самостоятельным контуром evidence/API при наличии отдельной конфигурации.
-
-Hayabusa/Velociraptor boundary:
-
-- Hayabusa/Sigma and Velociraptor are optional security findings / forensics
-  sources, not Workforce hot path dependencies.
-- Heavy DLP runtime can remain disabled while Hayabusa/Velociraptor findings
-  are imported into Security Finding Inbox / ClickHouse.
-- Velociraptor server/client mode must be enabled explicitly
-  (`disabled|offline_collector|server_clients`) and must not be auto-started by
-  routine production deploy on the small DetMir Proxmox contour.
-- Findings from Velociraptor/Hayabusa support `decide -> plan -> approve ->
-  apply -> verify`, but do not imply automatic remediation without approval.
-
-Server-side optional DLP runtime описан отдельно:
-
-- [DLP_OPTIONAL_RUNTIME_RU.md](DLP_OPTIONAL_RUNTIME_RU.md).
-- [DLP_RESOURCE_PROFILES_RU.md](DLP_RESOURCE_PROFILES_RU.md).
-
-При `AW_DLP_ENABLED=false`:
-
-- `dlp-health-check` возвращает штатный `dlp:mode=disabled`;
-- `detmir-dlp` не выполняет SSH health probe;
-- `detmir-check`, `check-aw-full` и `check-aw-data` не считают DLP buckets
-  обязательными;
-- `detmir-readiness` не требует DLP Influx write и DLP systemd units;
-- DLP profile changes use
-  `/usr/local/bin/detmir-dlp-runtime-control set-profile <profile>` and keep a
-  rollback snapshot for `/usr/local/bin/detmir-dlp-runtime-control rollback`;
-- перед отключением и после отключения собираются JSON-срезы в
-  `/var/lib/activitywatch/health/dlp-runtime-history/`, latest-срез остается в
-  `/var/lib/activitywatch/health/dlp-runtime-state.json`.
-
-При `AW_DLP_PROFILE=light`:
-
-- `activitywatch-dlp-aggregator.timer` собирает только ограниченный набор DLP
-  events в локальный SQLite warehouse;
-- `detmir-dlp-warehouse-sync.timer` доставляет этот warehouse на portal host
-  атомарным snapshot;
-- UEBA может учитывать `dlp_warn`/`dlp_fail` без запуска Loki/Influx-heavy path;
-- `detmir-dlp-load-guard.timer` автоматически переводит профиль в `core_only`
-  при превышении порогов load/RAM/iowait;
-- тяжёлые DLP units (`aw-dlp-influx-exporter`, report/syslog/webhook/CEF,
-  policy engine, case management, evidence API) должны оставаться выключенными.
-- если `detmir-dlp-load-guard.timer` видит повторный перегруз, он автоматически
-  возвращает DLP runtime в `core_only`.
-
-Live disable evidence 2026-06-25:
-
-- `dlp-health-check` returned `ok=true`, `dlp:mode=disabled`;
-- `detmir-dlp` returned `ok=true`, `dlp:mode=disabled`;
-- pre-disable active units:
-  `aw-dlp-influx-exporter.timer`,
-  `activitywatch-dlp-aggregator.timer`,
-  `aw-dlp-report-scheduler.timer`,
-  `aw-dlp-syslog-forwarder.timer`,
-  `aw-dlp-webhook-sender.timer`,
-  `aw-dlp-cef-exporter.timer`,
-  `aw-dlp-ioc-refresh.timer`,
-  `aw-dlp-policy-engine.service`,
-  `aw-dlp-case-management.service`,
-  `detmir-portal-evidence.service`;
-- post-disable active/enabled DLP units: `0/0`;
-- retained evidence files:
-  `/var/lib/activitywatch/health/dlp-runtime-history/dlp-runtime-current-20260625T083619Z.json`,
-  `/var/lib/activitywatch/health/dlp-runtime-history/dlp-runtime-pre_disable-20260625T083637Z.json`,
-  `/var/lib/activitywatch/health/dlp-runtime-history/dlp-runtime-disabled-20260625T083700Z.json`;
-- `check-aw-full` with `AW_DLP_ENABLED=false` reports `DLP buckets ...
-  SKIPPED`;
-- ActivityWatch core services remained active:
-  `activitywatch-server`, `aw-worktime-api`.
-
-Separate live observations after DLP disable, before 2026-06-29 restore:
-
-- `aw-watcher-afk`, `aw-watcher-window` and `aw-worktime-sessions` were stale
-  in the manual check and require separate RDP collector/session recovery;
-- WinRM from the server side to `192.168.100.18:5985` was unreachable during
-  this check;
-- these are not treated as DLP disable regressions.
-
-Post-restore correction on 2026-06-29:
-
-- current physical RDP/WinRM target is `192.168.100.19`;
-- laptop route to `192.168.100.19` is through DetMir OpenVPN gateway
-  `10.0.13.1`;
-- WinRM `5985` and RDP `3389` are reachable from the admin laptop;
-- stable ActivityWatch logical host id remains `SHARKON2025`.
-
-Fail-safe правила:
-
-- если DLP выключена, Security/Forensics views должны показывать disabled-state,
-  а не падать;
-- если DLP включена, тяжелые DLP операции должны выполняться асинхронно или
-  через cache, а не блокировать первый Workforce/operator screen;
-- readiness не должен заявлять DLP healthy, если модуль отключен или не
-  проверен;
-- отсутствие DLP не является ошибкой Workforce core.
-
-## Сетевое состояние
-
-Доступ к DetMir зависит от NetworkManager VPN profile
-`pfSense-gate-UDP4-1194-vpn_prog10-config`. Имя tun-интерфейса не является
-семантической идентичностью и должно проверяться по адресу `10.0.13.*`.
-
-Пример рабочего route:
-
-```text
-10.10.10.2 via 10.0.13.1 dev <current-detmir-tun>
-```
-
-Наблюдавшаяся нестабильность dataplane:
-
-- tun device может присутствовать в routing table, но gateway `10.0.13.1` не
-  отвечает;
-- при этом SSH, `/healthz` и браузерная проверка DetMir недоступны;
-- после ручного поднятия NetworkManager-подключения
-  `pfSense-gate-UDP4-1194-vpn_prog10-config` доступ восстанавливался.
-- 2026-06-25 после phase 1 deploy зафиксирован отдельный сбой:
-  `nm-openvpn` для `178.178.98.83:1194` получил `TLS handshake failed` и
-  `connect timeout exceeded`; повторная production-очистка старого systemd
-  prewarm drop-in отложена до восстановления VPN handshake.
-
-Актуальная проверка 2026-06-29:
-
-```text
-192.168.100.19 via 10.0.13.1 dev <current-detmir-tun>
-10.0.13.1 ping OK
-192.168.100.19:5985 OK
-192.168.100.19:3389 OK
-```
-
-Команда восстановления:
-
-```bash
-nmcli connection down 'pfSense-gate-UDP4-1194-vpn_prog10-config' || true
-sleep 2
-nmcli connection up 'pfSense-gate-UDP4-1194-vpn_prog10-config'
-```
-
-Проверка:
-
-```bash
-ping -c 2 -W 2 10.0.13.1
-ping -c 2 -W 2 10.10.10.2
-nc -vz -w 3 10.10.10.2 22
-curl -sS --max-time 5 http://10.10.10.2:8720/healthz
-```
-
-## Что не менять без отдельной задачи
-
-- Не удалять DLP collectors и warehouse ради ускорения портала.
-- Не включать heavy DLP или Velociraptor server runtime автоматически при
-  обычном deploy без ресурсного решения.
-- Не включать Loki CT автоматически при обычном deploy/recovery DetMir.
-- Не менять UI/API несовместимо: новые поля должны быть additive.
-- Не заявлять completed DLP decoupling до live deploy и browser/API smoke.
-- Не позиционировать AWatch-rus как сертифицированную DLP/SIEM/EDR/СЗИ.
-
-## Следующий инженерный шаг
-
-Закрыть оставшиеся production-hardening пункты:
-
-1. После восстановления DetMir VPN повторно прогнать
-   `ansible/deploy_detmir_portal.yml`, чтобы удалить legacy drop-in
-   `/etc/systemd/system/detmir-portal.service.d/30-prewarm-after-start.conf`.
-2. Подтвердить remote `sha256sum /usr/local/bin/detmir-portal` и отсутствие
-   `ExecStartPost` prewarm в `systemctl cat detmir-portal`.
-3. Подтвердить browser smoke без зависания первичной загрузки.
-4. Добавить метрики и smoke для режимов `dlp.enabled=false` и
-   `dlp.enabled=true`.

docs/DETMIR_RESTORE_BASELINE_2026-06-29_RU.md

@@ -1,83 +0,0 @@
-# DetMir restore baseline 2026-06-29
-
-Дата фиксации: 2026-06-29.
-
-Документ фиксирует фактическое состояние восстановленного контура
-AWatch-rus/DetMir после возврата RDP-сервера `SHARKON2025`.
-
-## Итог
-
-- AW server: `10.10.10.13:5600`, API отвечает, CORS OK.
-- Worktime API: `10.10.10.13:5610`, `/health` OK, report endpoints отвечают.
-- Portal/gateway: `https://dm.iri1968.dpdns.org/healthz` отвечает `200 ok`.
-- RDP host physical IP: `192.168.100.19`.
-- Stable ActivityWatch logical host id: `SHARKON2025`.
-- Старый IP `192.168.100.18` не считать текущим production target.
-
-## Выполненные исправления
-
-- На ноутбуке добавлен постоянный маршрут к `192.168.100.19/32` через DetMir
-  VPN gateway `10.0.13.1`.
-- `ansible/inventory.ini` переведен на `rdp-prod ansible_host=192.168.100.19`.
-- Диагностические скрипты больше не жёстко привязаны к `192.168.100.18`.
-- `/etc/activitywatch/aw-server.env` на AW server обновлен:
-  `AW_MONITORED_WINDOWS_HOST=192.168.100.19`.
-- На RDP host добавлены узкие Windows Firewall allow-правила для
-  `10.10.10.13 -> 5985/3389`; промежуточный firewall всё ещё блокирует этот
-  server-side TCP path.
-- Guard restart-budget quarantine очищен через backup и reset runtime state.
-- ClickHouse Security Finding Inbox schema применена:
-  `security_findings`, `security_finding_workflow_events`,
-  `security_finding_inbox`.
-- `check-aw-full` обновлен: env-aware RDP host, корректный CORS origin,
-  AFK freshness через `bucket.metadata.end`.
-- DLP runtime зафиксирован как optional disabled contour: отключён для снижения
-  нагрузки на Proxmox/InfluxDB/Grafana/ClickHouse/AW server, но оставлен
-  подключаемым через documented enable flow.
-- Hayabusa/Velociraptor зафиксированы как optional security findings /
-  forensics layer, отдельный от DLP runtime и Workforce hot path.
-
-## Проверенный статус по 7 пунктам
-
-1. AW-server/portal/API: доступны; `check-aw-data.sh` OK, public `/healthz` OK.
-2. RDP host: `192.168.100.19`, `COMPUTERNAME=SHARKON2025`,
-   WinRM/RDP/SSH доступны с админского ноутбука; guard service running.
-3. ActivityWatch buckets: worktime, session, AFK, DLP endpoint signals fresh;
-   window bucket корректно классифицируется как inactive при отсутствии
-   интерактивной активности.
-4. ClickHouse/filter/security findings: ClickHouse healthy, Security Finding
-   Inbox schema создана; portal endpoint защищен auth и без авторизации
-   возвращает `401`.
-5. InfluxDB/Grafana: InfluxDB health `pass`, Grafana DB health `ok`,
-   Influx datasource health OK. Loki log contour intentionally disabled to
-   reduce resource usage.
-6. Hayabusa/Velociraptor layer: Hayabusa doctor OK, drop.path active,
-   incoming/drop backlog empty, latest intake `2026-06-29T09:00:23Z`,
-   bad zip сохранен только в quarantine как evidence. Velociraptor integration
-   is treated as optional findings source; no always-on Velociraptor runtime is
-   required for Workforce/AW core.
-7. Baseline зафиксирован в этом документе и связан с operational docs/skills.
-
-## Остаточные риски
-
-- `aw-rus-healthd.service` на AW server всё ещё видит TCP timeout до
-  `192.168.100.19:5985/3389` через gateway `10.10.10.1`, хотя ICMP проходит и
-  доступ с админского ноутбука есть. Это network policy gap на промежуточном
-  firewall/ACL, не SQLite/datastore failure.
-- Grafana Loki datasource `10.10.10.12:3100` intentionally disabled: Proxmox
-  LXC `202 loki-logs` is stopped, active config has `onboot: 0`, and TCP
-  `10.10.10.12:3100` is closed. This is an operator decision to save resources
-  and does not break core AW/worktime/ClickHouse.
-- DLP runtime is intentionally disabled for the current production profile and
-  must not be auto-enabled by routine deploys. Re-enable only after resource
-  budget check and explicit operator decision.
-
-## Проверки
-
-- `AW_MONITORED_WINDOWS_HOSTNAME=SHARKON2025 ./check-aw-data.sh` - OK.
-- `AW_SMOKE_AW_SERVER=http://10.10.10.13:5600
-  AW_SMOKE_SOURCE_HOSTNAME=SHARKON2025
-  AW_SMOKE_WINDOWS_HOST=192.168.100.19 ./check-aw-full.sh --no-color` - OK.
-- `cargo test -p check-aw-full` - 4 passed.
-- `bash -n` для изменённых shell scripts - OK.
-- `AW_SMOKE_LOKI_ENABLED=0` is the current default for local smoke checks.