chore(deps): bump cryptography from 48.0.0 to 48.0.1 in /detmir-mcp

Bumps [cryptography](https://github.com/pyca/cryptography) from 48.0.0 to 48.0.1.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/48.0.0...48.0.1)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 48.0.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

adk-rust/crates/check-aw-full/src/main.rs

@@ -7,9 +7,9 @@ use clap::Parser;
 use reqwest::blocking::Client;
 use serde_json::Value;
 
-const DEFAULT_SERVER: &str = "http://192.0.2.13:5600";
-const DEFAULT_HOST: &str = "HOST-EXAMPLE";
-const DEFAULT_RDP_HOST: &str = "198.51.100.18";
+const DEFAULT_SERVER: &str = "http://10.10.10.13:5600";
+const DEFAULT_HOST: &str = "SHARKON2025";
+const DEFAULT_RDP_HOST: &str = "192.168.100.19";
 const BUCKETS: &[(&str, &str)] = &[
     ("aw-watcher-afk", "AFK watcher"),
     ("aw-watcher-window", "Window watcher"),
@@ -38,6 +38,9 @@ struct Cli {
 
     #[arg(long)]
     no_color: bool,
+
+    #[arg(long, default_value_t = true)]
+    dlp_enabled: bool,
 }
 
 #[derive(Debug, Clone)]
@@ -119,7 +122,37 @@ fn main() {
 }
 
 fn run() -> Result<i32> {
-    let cli = Cli::parse();
+    let mut cli = Cli::parse();
+    if cli.server == DEFAULT_SERVER {
+        if let Some(value) = env_nonempty("CHECK_AW_FULL_SERVER")
+            .or_else(|| env_nonempty("AW_SMOKE_AW_SERVER"))
+            .or_else(|| env_nonempty("AW_SERVER"))
+        {
+            cli.server = value;
+        }
+    }
+    if cli.host == DEFAULT_HOST {
+        if let Some(value) = env_nonempty("CHECK_AW_FULL_HOST")
+            .or_else(|| env_nonempty("AW_SMOKE_SOURCE_HOSTNAME"))
+            .or_else(|| env_nonempty("AW_LOGICAL_HOST_ID"))
+            .or_else(|| env_nonempty("AW_MONITORED_WINDOWS_HOSTNAME"))
+        {
+            cli.host = value;
+        }
+    }
+    if cli.rdp_host == DEFAULT_RDP_HOST {
+        if let Some(value) = env_nonempty("CHECK_AW_FULL_RDP_HOST")
+            .or_else(|| env_nonempty("AW_SMOKE_WINDOWS_HOST"))
+            .or_else(|| env_nonempty("AW_WINDOWS_HOST"))
+        {
+            cli.rdp_host = value;
+        }
+    }
+    if let Some(value) =
+        env_nonempty("AW_DLP_ENABLED").or_else(|| env_nonempty("DETMIR_DLP_ENABLED"))
+    {
+        cli.dlp_enabled = parse_env_flag(&value);
+    }
     let server = cli.server.trim_end_matches('/').to_string();
     let colors = Colors::new(!cli.no_color && std::env::var_os("NO_COLOR").is_none());
     let timeout = Duration::from_secs(cli.timeout_seconds.max(1));
@@ -182,7 +215,11 @@ fn run() -> Result<i32> {
     );
 
     let mut rows = Vec::new();
-    for (bucket, label) in BUCKETS {
+    for (bucket, label) in BUCKETS
+        .iter()
+        .copied()
+        .filter(|(bucket, _)| cli.dlp_enabled || !bucket.starts_with("aw-dlp-"))
+    {
         let row = read_bucket_row(&client, &server, &cli.host, bucket, label, now, &context);
         println!(
             "  {:<42} {:<8} {:<20} {}",
@@ -193,6 +230,15 @@ fn run() -> Result<i32> {
         );
         rows.push(row);
     }
+    if !cli.dlp_enabled {
+        println!(
+            "  {:<42} {:<8} {:<20} {}",
+            "DLP buckets",
+            "-",
+            "disabled",
+            colors.paint(colors.cyan, "SKIPPED")
+        );
+    }
     println!();
 
     println!(
@@ -330,7 +376,12 @@ fn read_bucket_row(
             status: BucketStatus::Unknown,
         };
     };
-    let age_sec = (now - ts).num_seconds().max(0);
+    let effective_ts = if bucket == "aw-watcher-afk" {
+        bucket_metadata_end(client, server, &bucket_full).unwrap_or(ts)
+    } else {
+        ts
+    };
+    let age_sec = (now - effective_ts).num_seconds().max(0);
     BucketRow {
         label,
         last_id,
@@ -407,6 +458,15 @@ fn latest_event(client: &Client, server: &str, bucket: &str) -> Result<Option<Va
     Ok(value.as_array().and_then(|items| items.first()).cloned())
 }
 
+fn bucket_metadata_end(client: &Client, server: &str, bucket: &str) -> Option<DateTime<Utc>> {
+    let url = format!("{server}/api/0/buckets/{bucket}");
+    let value = get_json(client, &url).ok()?;
+    value
+        .pointer("/metadata/end")
+        .and_then(Value::as_str)
+        .and_then(parse_ts)
+}
+
 fn get_json(client: &Client, url: &str) -> Result<Value> {
     client
         .get(url)
@@ -423,7 +483,7 @@ fn check_cors(client: &Client, server: &str) -> u16 {
     let url = format!("{server}/api/0/settings/");
     client
         .get(&url)
-        .header("Origin", "http://192.0.2.13:5600")
+        .header("Origin", server)
         .send()
         .map(|response| response.status().as_u16())
         .unwrap_or(0)
@@ -466,6 +526,17 @@ fn json_value_to_string(value: &Value) -> String {
     }
 }
 
+fn env_nonempty(name: &str) -> Option<String> {
+    std::env::var(name).ok().filter(|value| !value.is_empty())
+}
+
+fn parse_env_flag(value: &str) -> bool {
+    matches!(
+        value.trim().to_ascii_lowercase().as_str(),
+        "1" | "true" | "yes" | "on"
+    )
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

check-aw-full.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 # check-aw-full.sh - Полная проверка ActivityWatch: сервер + RDP-хост
-# Сервер: 192.0.2.13:5600
-# RDP-хост: 198.51.100.18 (HOST-EXAMPLE)
+# Сервер: http://10.10.10.13:5600
+# RDP-хост: 192.168.100.19 (logical host id SHARKON2025)
 
 if [[ "${CHECK_AW_FULL_FORCE_LEGACY:-0}" != "1" ]]; then
   ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -16,12 +16,17 @@ if [[ "${CHECK_AW_FULL_FORCE_LEGACY:-0}" != "1" ]]; then
   done
 fi
 
-SERVER="http://192.0.2.13:5600"
-HOSTNAME_FILTER="HOST-EXAMPLE"
-RDP_HOST="198.51.100.18"
+SERVER="${CHECK_AW_FULL_SERVER:-${AW_SMOKE_AW_SERVER:-${AW_SERVER:-http://10.10.10.13:5600}}}"
+HOSTNAME_FILTER="${CHECK_AW_FULL_HOST:-${AW_SMOKE_SOURCE_HOSTNAME:-${AW_LOGICAL_HOST_ID:-${AW_MONITORED_WINDOWS_HOSTNAME:-SHARKON2025}}}}"
+RDP_HOST="${CHECK_AW_FULL_RDP_HOST:-${AW_SMOKE_WINDOWS_HOST:-${AW_WINDOWS_HOST:-192.168.100.19}}}"
 NOW=$(date -u +%s)
 HOST_INACTIVE=false
 GUARD_HEALTHY=false
+DLP_ENABLED="${AW_DLP_ENABLED:-${DETMIR_DLP_ENABLED:-true}}"
+case "${DLP_ENABLED,,}" in
+  0|false|no|off) DLP_ENABLED=false ;;
+  *) DLP_ENABLED=true ;;
+esac
 
 classify_bucket_age() {
     local bucket="$1"
@@ -100,7 +105,7 @@ echo ""
 # 1. Проверка сервера
 echo -e "${CYAN}--- 1. AW Server ($SERVER) ---${NC}"
 echo -n "  Connectivity... "
-RESP=$(no_proxy=192.0.2.13 curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/info" 2>&1)
+RESP=$(no_proxy='*' curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/info" 2>&1)
 if [ $? -eq 0 ] && echo "$RESP" | jq -e '.version' > /dev/null 2>&1; then
     VERSION=$(echo "$RESP" | jq -r '.version')
     echo -e "  ${GREEN}OK${NC} (aw-server $VERSION)"
@@ -110,7 +115,7 @@ else
 fi
 
 echo -n "  CORS... "
-CORS_RESP=$(no_proxy=192.0.2.13 curl -s --connect-timeout 10 --max-time 15 -o /dev/null -w '%{http_code}' -H "Origin: http://192.0.2.13:5600" "$SERVER/api/0/settings/" 2>&1)
+CORS_RESP=$(no_proxy='*' curl -s --connect-timeout 10 --max-time 15 -o /dev/null -w '%{http_code}' -H "Origin: $SERVER" "$SERVER/api/0/settings/" 2>&1)
 if [ "$CORS_RESP" = "200" ]; then
     echo -e "${GREEN}OK${NC}"
 else
@@ -119,7 +124,7 @@ fi
 echo ""
 
 # 1b. Context for inactive/event-driven classification
-WORKTIME_EVENT_DATA=$(no_proxy=192.0.2.13 curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/aw-worktime-sessions_$HOSTNAME_FILTER/events?limit=1" 2>&1)
+WORKTIME_EVENT_DATA=$(no_proxy='*' curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/aw-worktime-sessions_$HOSTNAME_FILTER/events?limit=1" 2>&1)
 WORKTIME_TS=$(echo "$WORKTIME_EVENT_DATA" | jq -r '.[0].timestamp // ""' 2>/dev/null)
 WORKTIME_ACTIVE=$(echo "$WORKTIME_EVENT_DATA" | jq -r '.[0].data.active // false' 2>/dev/null)
 if [ -n "$WORKTIME_TS" ]; then
@@ -132,7 +137,7 @@ if [ -n "$WORKTIME_TS" ]; then
   fi
 fi
 
-GUARD_EVENT_DATA=$(no_proxy=192.0.2.13 curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/aw-rus-collector-guard_$HOSTNAME_FILTER/events?limit=1" 2>&1)
+GUARD_EVENT_DATA=$(no_proxy='*' curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/aw-rus-collector-guard_$HOSTNAME_FILTER/events?limit=1" 2>&1)
 GUARD_TS=$(echo "$GUARD_EVENT_DATA" | jq -r '.[0].timestamp // ""' 2>/dev/null)
 GUARD_STATUS=$(echo "$GUARD_EVENT_DATA" | jq -r '.[0].data.status // ""' 2>/dev/null)
 GUARD_PROBLEMS=$(echo "$GUARD_EVENT_DATA" | jq -r '([.[0].data.problems[]?] | length) // 0' 2>/dev/null)
@@ -165,9 +170,12 @@ BUCKETS=(
 for entry in "${BUCKETS[@]}"; do
   bucket="${entry%%|*}"
   label="${entry##*|}"
+  if [ "$DLP_ENABLED" = "false" ] && [[ "$bucket" == aw-dlp-* ]]; then
+    continue
+  fi
   bucket_full="${bucket}_${HOSTNAME_FILTER}"
   
-  EVENT_DATA=$(no_proxy=192.0.2.13 curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/$bucket_full/events?limit=1" 2>&1)
+  EVENT_DATA=$(no_proxy='*' curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/$bucket_full/events?limit=1" 2>&1)
   LAST_ID=$(echo "$EVENT_DATA" | jq '.[0].id // 0')
   LAST_TS=$(echo "$EVENT_DATA" | jq -r '.[0].timestamp // "no events"')
   
@@ -200,6 +208,9 @@ for entry in "${BUCKETS[@]}"; do
   
   printf "  %-42s %-8s %-20s %b\n" "$label" "$LAST_ID" "$AGE" "$STATUS"
 done
+if [ "$DLP_ENABLED" = "false" ]; then
+  printf "  %-42s %-8s %-20s %b\n" "DLP buckets" "-" "disabled" "${CYAN}SKIPPED${NC}"
+fi
 echo ""
 
 # 3. Проверка RDP-хоста
@@ -230,8 +241,11 @@ DEAD_COUNT=0
 
 for entry in "${BUCKETS[@]}"; do
   bucket="${entry%%|*}"
+  if [ "$DLP_ENABLED" = "false" ] && [[ "$bucket" == aw-dlp-* ]]; then
+    continue
+  fi
   bucket_full="${bucket}_${HOSTNAME_FILTER}"
-  EVENT_DATA=$(no_proxy=192.0.2.13 curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/$bucket_full/events?limit=1" 2>&1)
+  EVENT_DATA=$(no_proxy='*' curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/$bucket_full/events?limit=1" 2>&1)
   LAST_TS=$(echo "$EVENT_DATA" | jq -r '.[0].timestamp // "no events"')
   
   if [ "$LAST_TS" != "no events" ] && [ -n "$LAST_TS" ]; then

detmir-mcp/uv.lock

@@ -135,61 +135,61 @@ wheels = [
 
 [[package]]
 name = "cryptography"
-version = "48.0.0"
+version = "48.0.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/9f/a9/db8f313fdcd85d767d4973515e1db101f9c71f95fced83233de224673757/cryptography-48.0.0.tar.gz", hash = "sha256:5c3932f4436d1cccb036cb0eaef46e6e2db91035166f1ad6505c3c9d5a635920", size = 832984, upload-time = "2026-05-04T22:59:38.133Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/12/45/870e7f4bef50e5f53b9f51d4428aee5290eedf58ba443f16b1ebb7ab8e66/cryptography-48.0.1.tar.gz", hash = "sha256:266f4ee051abb2f725b74ef8072b521ce1feacf685a3364fa6a6b45548db791a", size = 832989, upload-time = "2026-06-09T22:32:31.8Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/df/3d/01f6dd9190170a5a241e0e98c2d04be3664a9e6f5b9b872cde63aff1c3dd/cryptography-48.0.0-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:0c558d2cdffd8f4bbb30fc7134c74d2ca9a476f830bb053074498fbc86f41ed6", size = 8001587, upload-time = "2026-05-04T22:57:36.803Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/6e/e90527eef33f309beb811cf7c982c3aeffcce8e3edb178baa4ca3ae4a6fa/cryptography-48.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f5333311663ea94f75dd408665686aaf426563556bb5283554a3539177e03b8c", size = 4690433, upload-time = "2026-05-04T22:57:40.373Z" },
-    { url = "https://files.pythonhosted.org/packages/90/04/673510ed51ddff56575f306cf1617d80411ee76831ccd3097599140efdfe/cryptography-48.0.0-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7995ef305d7165c3f11ae07f2517e5a4f1d5c18da1376a0a9ed496336b69e5f3", size = 4710620, upload-time = "2026-05-04T22:57:42.935Z" },
-    { url = "https://files.pythonhosted.org/packages/14/d5/e9c4ef932c8d800490c34d8bd589d64a31d5890e27ec9e9ad532be893294/cryptography-48.0.0-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:40ba1f85eaa6959837b1d51c9767e230e14612eea4ef110ee8854ada22da1bf5", size = 4696283, upload-time = "2026-05-04T22:57:45.294Z" },
-    { url = "https://files.pythonhosted.org/packages/0c/29/174b9dfb60b12d59ecfc6cfa04bc88c21b42a54f01b8aae09bb6e51e4c7f/cryptography-48.0.0-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:369a6348999f94bbd53435c894377b20ab95f25a9065c283570e70150d8abc3c", size = 5296573, upload-time = "2026-05-04T22:57:47.933Z" },
-    { url = "https://files.pythonhosted.org/packages/95/38/0d29a6fd7d0d1373f0c0c88a04ba20e359b257753ac497564cd660fc1d55/cryptography-48.0.0-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:a0e692c683f4df67815a2d258b324e66f4738bd7a96a218c826dce4f4bd05d8f", size = 4743677, upload-time = "2026-05-04T22:57:50.067Z" },
-    { url = "https://files.pythonhosted.org/packages/30/be/eef653013d5c63b6a490529e0316f9ac14a37602965d4903efed1399f32b/cryptography-48.0.0-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:18349bbc56f4743c8b12dc32e2bccb2cf83ee8b69a3bba74ef8ae857e26b3d25", size = 4330808, upload-time = "2026-05-04T22:57:52.301Z" },
-    { url = "https://files.pythonhosted.org/packages/84/9e/500463e87abb7a0a0f9f256ec21123ecde0a7b5541a15e840ea54551fd81/cryptography-48.0.0-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:7e8eac43dfca5c4cccc6dad9a80504436fca53bb9bc3100a2386d730fbe6b602", size = 4695941, upload-time = "2026-05-04T22:57:54.603Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/dc/7303087450c2ec9e7fbb750e17c2abfbc658f23cbd0e54009509b7cc4091/cryptography-48.0.0-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:9ccdac7d40688ecb5a3b4a604b8a88c8002e3442d6c60aead1db2a89a041560c", size = 5252579, upload-time = "2026-05-04T22:57:57.207Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/c0/7101d3b7215edcdc90c45da544961fd8ed2d6448f77577460fa75a8443f7/cryptography-48.0.0-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:bd72e68b06bb1e96913f97dd4901119bc17f39d4586a5adf2d3e47bc2b9d58b5", size = 4743326, upload-time = "2026-05-04T22:57:59.535Z" },
-    { url = "https://files.pythonhosted.org/packages/ac/d8/5b833bad13016f562ab9d063d68199a4bd121d18458e439515601d3357ec/cryptography-48.0.0-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:59baa2cb386c4f0b9905bd6eb4c2a79a69a128408fd31d32ca4d7102d4156321", size = 4826672, upload-time = "2026-05-04T22:58:01.996Z" },
-    { url = "https://files.pythonhosted.org/packages/98/e1/7074eb8bf3c135558c73fc2bcf0f5633f912e6fb87e868a55c454080ef09/cryptography-48.0.0-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:9249e3cd978541d665967ac2cb2787fd6a62bddf1e75b3e347a594d7dacf4f74", size = 4972574, upload-time = "2026-05-04T22:58:03.968Z" },
-    { url = "https://files.pythonhosted.org/packages/04/70/e5a1b41d325f797f39427aa44ef8baf0be500065ab6d8e10369d850d4a4f/cryptography-48.0.0-cp311-abi3-win32.whl", hash = "sha256:9c459db21422be75e2809370b829a87eb37f74cd785fc4aa9ea1e5f43b47cda4", size = 3294868, upload-time = "2026-05-04T22:58:06.467Z" },
-    { url = "https://files.pythonhosted.org/packages/f4/ac/8ac51b4a5fc5932eb7ee5c517ba7dc8cd834f0048962b6b352f00f41ebf9/cryptography-48.0.0-cp311-abi3-win_amd64.whl", hash = "sha256:5b012212e08b8dd5edc78ef54da83dd9892fd9105323b3993eff6bea65dc21d7", size = 3817107, upload-time = "2026-05-04T22:58:08.845Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/84/70e3feea9feea87fd7cbe77efb2712ae1e3e6edf10749dc6e95f4e60e455/cryptography-48.0.0-cp314-cp314t-macosx_10_9_universal2.whl", hash = "sha256:3cb07a3ed6431663cd321ea8a000a1314c74211f823e4177fefa2255e057d1ec", size = 7986556, upload-time = "2026-05-04T22:58:11.172Z" },
-    { url = "https://files.pythonhosted.org/packages/89/6e/18e07a618bb5442ba10cf4df16e99c071365528aa570dfcb8c02e25a303b/cryptography-48.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:8c7378637d7d88016fa6791c159f698b3d3eed28ebf844ac36b9dc04a14dae18", size = 4684776, upload-time = "2026-05-04T22:58:13.712Z" },
-    { url = "https://files.pythonhosted.org/packages/be/6a/4ea3b4c6c6759794d5ee2103c304a5076dc4b19ae1f9fe47dba439e159e9/cryptography-48.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:cc90c0b39b2e3c65ef52c804b72e3c58f8a04ab2a1871272798e5f9572c17d20", size = 4698121, upload-time = "2026-05-04T22:58:16.448Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/59/6ff6ad6cae03bb887da2a5860b2c9805f8dac969ef01ce563336c49bd1d1/cryptography-48.0.0-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:76341972e1eff8b4bea859f09c0d3e64b96ce931b084f9b9b7db8ef364c30eff", size = 4690042, upload-time = "2026-05-04T22:58:18.544Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/b4/fc334ed8cfd705aca282fe4d8f5ae64a8e0f74932e9feecb344610cf6e4d/cryptography-48.0.0-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:55b7718303bf06a5753dcdccf2f3945cf18ad7bffde41b61226e4db31ab89a9c", size = 5282526, upload-time = "2026-05-04T22:58:20.75Z" },
-    { url = "https://files.pythonhosted.org/packages/11/08/9f8c5386cc4cd90d8255c7cdd0f5baf459a08502a09de30dc51f553d38dc/cryptography-48.0.0-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:a64697c641c7b1b2178e573cbc31c7c6684cd56883a478d75143dbb7118036db", size = 4733116, upload-time = "2026-05-04T22:58:23.627Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/77/99307d7574045699f8805aa500fa0fb83422d115b5400a064ddd306d7750/cryptography-48.0.0-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:561215ea3879cb1cbbf272867e2efda62476f240fb58c64de6b393ae19246741", size = 4316030, upload-time = "2026-05-04T22:58:25.581Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/36/a608b98337af3cb2aff4818e406649d30572b7031918b04c87d979495348/cryptography-48.0.0-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:ad64688338ed4bc1a6618076ba75fd7194a5f1797ac60b47afe926285adb3166", size = 4689640, upload-time = "2026-05-04T22:58:27.747Z" },
-    { url = "https://files.pythonhosted.org/packages/dd/a6/825010a291b4438aecc1f568bc428189fc1175515223632477c07dc0a6df/cryptography-48.0.0-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:906cbf0670286c6e0044156bc7d4af9cbb0ef6db9f73e52c3ec56ba6bdde5336", size = 5237657, upload-time = "2026-05-04T22:58:29.848Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/09/4e76a09b4caa29aad535ddc806f5d4c5d01885bd978bd984fbc6ca032cae/cryptography-48.0.0-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:ea8990436d914540a40ab24b6a77c0969695ed52f4a4874c5137ccf7045a7057", size = 4732362, upload-time = "2026-05-04T22:58:32.009Z" },
-    { url = "https://files.pythonhosted.org/packages/18/78/444fa04a77d0cb95f417dda20d450e13c56ba8e5220fc892a1658f44f882/cryptography-48.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:c18684a7f0cc9a3cb60328f496b8e3372def7c5d2df39ac267878b05565aaaae", size = 4819580, upload-time = "2026-05-04T22:58:34.254Z" },
-    { url = "https://files.pythonhosted.org/packages/38/85/ea67067c70a1fd4be2c63d35eeed82658023021affccc7b17705f8527dd2/cryptography-48.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:9be5aafa5736574f8f15f262adc81b2a9869e2cfe9014d52a44633905b40d52c", size = 4963283, upload-time = "2026-05-04T22:58:36.376Z" },
-    { url = "https://files.pythonhosted.org/packages/75/54/cc6d0f3deac3e81c7f847e8a189a12b6cdd65059b43dad25d4316abd849a/cryptography-48.0.0-cp314-cp314t-win32.whl", hash = "sha256:c17dfe85494deaeddc5ce251aebd1d60bbe6afc8b62071bb0b469431a000124f", size = 3270954, upload-time = "2026-05-04T22:58:38.791Z" },
-    { url = "https://files.pythonhosted.org/packages/49/67/cc947e288c0758a4e5473d1dcb743037ab7785541265a969240b8885441a/cryptography-48.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:27241b1dc9962e056062a8eef1991d02c3a24569c95975bd2322a8a52c6e5e12", size = 3797313, upload-time = "2026-05-04T22:58:40.746Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/63/61d4a4e1c6b6bab6ce1e213cd36a24c415d90e76d78c5eb8577c5541d2e8/cryptography-48.0.0-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:58d00498e8933e4a194f3076aee1b4a97dfec1a6da444535755822fe5d8b0b86", size = 7983482, upload-time = "2026-05-04T22:58:43.769Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/ac/f5b5995b87770c693e2596559ffafe195b4033a57f14a82268a2842953f3/cryptography-48.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:614d0949f4790582d2cc25553abd09dd723025f0c0e7c67376a1d77196743d6e", size = 4683266, upload-time = "2026-05-04T22:58:46.064Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/c6/8b14f67e18338fbc4adb76f66c001f5c3610b3e2d1837f268f47a347dbbb/cryptography-48.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7ce4bfae76319a532a2dc68f82cc32f5676ee792a983187dac07183690e5c66f", size = 4696228, upload-time = "2026-05-04T22:58:48.22Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/73/f808fbae9514bd91b47875b003f13e284c8c6bdfd904b7944e803937eec1/cryptography-48.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:2eb992bbd4661238c5a397594c83f5b4dc2bc5b848c365c8f991b6780efcc5c7", size = 4689097, upload-time = "2026-05-04T22:58:50.9Z" },
-    { url = "https://files.pythonhosted.org/packages/93/01/d86632d7d28db8ae83221995752eeb6639ffb374c2d22955648cf8d52797/cryptography-48.0.0-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:22a5cb272895dce158b2cacdfdc3debd299019659f42947dbdac6f32d68fe832", size = 5283582, upload-time = "2026-05-04T22:58:53.017Z" },
-    { url = "https://files.pythonhosted.org/packages/02/e1/50edc7a50334807cc4791fc4a0ce7468b4a1416d9138eab358bfc9a3d70b/cryptography-48.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:2b4d59804e8408e2fea7d1fbaf218e5ec984325221db76e6a241a9abd6cdd95c", size = 4730479, upload-time = "2026-05-04T22:58:55.611Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/af/99a582b1b1641ff5911ac559beb45097cf79efd4ead4657f578ef1af2d47/cryptography-48.0.0-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:984a20b0f62a26f48a3396c72e4bc34c66e356d356bf370053066b3b6d54634a", size = 4326481, upload-time = "2026-05-04T22:58:57.607Z" },
-    { url = "https://files.pythonhosted.org/packages/90/ee/89aa26a06ef0a7d7611788ffd571a7c50e368cc6a4d5eef8b4884e866edb/cryptography-48.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:5a5ed8fde7a1d09376ca0b40e68cd59c69fe23b1f9768bd5824f54681626032a", size = 4688713, upload-time = "2026-05-04T22:59:00.077Z" },
-    { url = "https://files.pythonhosted.org/packages/70/ba/bcb1b0bb7a33d4c7c0c4d4c7874b4a62ae4f56113a5f4baefa362dfb1f0f/cryptography-48.0.0-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:8cd666227ef7af430aa5914a9910e0ddd703e75f039cef0825cd0da71b6b711a", size = 5238165, upload-time = "2026-05-04T22:59:02.317Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/70/ca4003b1ce5ca3dc3186ada51908c8a9b9ff7d5cab83cc0d43ee14ec144f/cryptography-48.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:9071196d81abc88b3516ac8cdfad32e2b66dd4a5393a8e68a961e9161ddc6239", size = 4729947, upload-time = "2026-05-04T22:59:05.255Z" },
-    { url = "https://files.pythonhosted.org/packages/44/a0/4ec7cf774207905aef1a8d11c3750d5a1db805eb380ee4e16df317870128/cryptography-48.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:1e2d54c8be6152856a36f0882ab231e70f8ec7f14e93cf87db8a2ed056bf160c", size = 4822059, upload-time = "2026-05-04T22:59:07.802Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/75/a2e55f99c16fcac7b5d6c1eb19ad8e00799854d6be5ca845f9259eae1681/cryptography-48.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:a5da777e32ffed6f85a7b2b3f7c5cbc88c146bfcd0a1d7baf5fcc6c52ee35dd4", size = 4960575, upload-time = "2026-05-04T22:59:09.851Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/23/6e6f32143ab5d8b36ca848a502c4bcd477ae75b9e1677e3530d669062578/cryptography-48.0.0-cp39-abi3-win32.whl", hash = "sha256:77a2ccbbe917f6710e05ba9adaa25fb5075620bf3ea6fb751997875aff4ae4bd", size = 3279117, upload-time = "2026-05-04T22:59:12.019Z" },
-    { url = "https://files.pythonhosted.org/packages/9d/9a/0fea98a70cf1749d41d738836f6349d97945f7c89433a259a6c2642eefeb/cryptography-48.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:16cd65b9330583e4619939b3a3843eec1e6e789744bb01e7c7e2e62e33c239c8", size = 3792100, upload-time = "2026-05-04T22:59:14.884Z" },
-    { url = "https://files.pythonhosted.org/packages/be/d2/024b5e06be9d44cb021fb0e1a03d34d63989cf56a0fe62f3dfbab695b9b4/cryptography-48.0.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:84cf79f0dc8b36ac5da873481716e87aef31fcfa0444f9e1d8b4b2cece142855", size = 3950391, upload-time = "2026-05-04T22:59:17.415Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/17/3861e17c56fa0fd37491a14a8673fdb77c57fc5693cafe745ea8b06dba75/cryptography-48.0.0-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:fdfef35d751d510fcef5252703621574364fec16418c4a1e5e1055248401054b", size = 4637126, upload-time = "2026-05-04T22:59:20.197Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/0a/7e226dbff530f21480727eb764973a7bff2b912f8e15cd4f129e71b56d1d/cryptography-48.0.0-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:0890f502ddf7d9c6426129c3f49f5c0a39278ed7cd6322c8755ffca6ee675a13", size = 4667270, upload-time = "2026-05-04T22:59:22.647Z" },
-    { url = "https://files.pythonhosted.org/packages/3b/f2/5a72274ca9f1b2a8b44a662ee0bf1b435909deb473d6f97bcd035bcdbc71/cryptography-48.0.0-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:ecde28a596bead48b0cfd2a1b4416c3d43074c2d785e3a398d7ec1fc4d0f7fbb", size = 4636797, upload-time = "2026-05-04T22:59:24.912Z" },
-    { url = "https://files.pythonhosted.org/packages/b4/e1/48cedb2fe63626e91ded1edad159e2a4fb8b6906c4425eb7749673077ce7/cryptography-48.0.0-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:4defde8685ae324a9eb9d818717e93b4638ef67070ac9bc15b8ca85f63048355", size = 4666800, upload-time = "2026-05-04T22:59:27.474Z" },
-    { url = "https://files.pythonhosted.org/packages/a2/ca/7e8365deec19afb2b2c7be7c1c0aa8f99633b54e90c570999acda93260fc/cryptography-48.0.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:db63bf618e5dea46c07de12e900fe1cdd2541e6dc9dbae772a70b7d4d4765f6a", size = 3739536, upload-time = "2026-05-04T22:59:29.61Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/bc/ee4137cbbe105652c0ee4252792b78fc8e7afa4b8e61d9d5dc05a7f45731/cryptography-48.0.1-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:3e4a1a3232eef2e6c732827d5722db29a0cc8b27af2a4d865b094cf954be9ca1", size = 8008324, upload-time = "2026-06-09T22:31:00.702Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/85/6379d42181bfc713094f081360fc5784d6c816b599d45e7f082502d173ce/cryptography-48.0.1-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:32143b24adb918f078134e1e230f1eb8cc04886b92c28b5f0041aaf3e5699225", size = 4696243, upload-time = "2026-06-09T22:32:33.446Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/87/c85d147b53323c7eb4d850920c8901377323c2a0ff8d79c262d4fee89aa2/cryptography-48.0.1-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:f0d27a5696721ef7a672b8c810f6aded391058e0b9486e63e6d93baf765da691", size = 4713235, upload-time = "2026-06-09T22:31:40.141Z" },
+    { url = "https://files.pythonhosted.org/packages/79/58/67cbf8cf1ee7c54b439ca07bbecf8362c07afc11a3724fea70f745784add/cryptography-48.0.1-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:eb86ce1af36fe65041b6db9a8bb064ee621a7e5fded0f80d475ec243477cd242", size = 4702323, upload-time = "2026-06-09T22:31:42.191Z" },
+    { url = "https://files.pythonhosted.org/packages/89/c6/24266ac10c47f6cd2a865f4446062b466da1d1f10b27189eac00e61bf0c9/cryptography-48.0.1-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:b024e784ad6c077ee0147b35ea9cbfc1e34e1fd4c1dcca214c2794d73a12df08", size = 5300085, upload-time = "2026-06-09T22:31:58.703Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/bb/cc4b78784f97efc8c5874c2a9743708d172be6663024b34a0467885ae0c8/cryptography-48.0.1-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:3752f2dbc8f07a30aad2932c986cea495b03bb554887828225da104f732852b6", size = 4746137, upload-time = "2026-06-09T22:31:31.01Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/52/0c44de3f5267f8fbe8e835138017522a333436166e406f0db9b9e6e3033f/cryptography-48.0.1-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:bd81490cd5801d755cf97bb68ac191f14b708470b1c7cf4580f669b9c9264cd8", size = 4333867, upload-time = "2026-06-09T22:32:28.096Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/2e/772d7adbfa931537bc401640b7cac9976bff689bda187833e5d63b428e49/cryptography-48.0.1-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:66fd0771e7b9c6dcd44cf1120690d2338d16d72795cf40cae2786a39eba65429", size = 4701805, upload-time = "2026-06-09T22:31:38.284Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/a3/b06844f303873493c963caf581c04df31c7035e0c1b0f02c4814d319ec80/cryptography-48.0.1-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:3fd2ca57062b241c856670b073487d2e86c4637937ca5601e48f97bf8e11fc8f", size = 5258461, upload-time = "2026-06-09T22:31:04.187Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/13/8b765e2e12b07c74941caadb9d1c8fdc006c4dfbf2b8f2d610519758954d/cryptography-48.0.1-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:0ee6ea481db1ab889cba043ec1eda17bb9c1ea79db6722f779c3667f9f70322f", size = 4745488, upload-time = "2026-06-09T22:32:30.07Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/aa/48972bce55049b32a94f4907eda4d75fa385aad8a39506cc2fc72196ecf0/cryptography-48.0.1-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:f2ceef93cb096aa3c4cc4b5c94ca6131f9196d28c64d6111533402a9b2054d41", size = 4830256, upload-time = "2026-06-09T22:31:43.868Z" },
+    { url = "https://files.pythonhosted.org/packages/47/a2/e5079a032fb85cf6005046ca92bbd78b0c82dad2b5751ab8c311659da06f/cryptography-48.0.1-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:9bd3f92d76217892b15df84ca256c2c113d386fdda7a7d8691aeeced976507c6", size = 4979117, upload-time = "2026-06-09T22:31:05.845Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/a0/8f50cae9c74e718ed769d63ed5c74bd0ea830c9550a74629cebd1b9c7bc7/cryptography-48.0.1-cp311-abi3-win32.whl", hash = "sha256:b9a32b876490d66c8bcc9963ef220199569748434ab01a9d6aaeabf88e7f5158", size = 3304154, upload-time = "2026-06-09T22:32:16.845Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/69/0572c77dbace6fef72f33755bd52ea399c71367250d366237f8691826b9e/cryptography-48.0.1-cp311-abi3-win_amd64.whl", hash = "sha256:39489bfca54c7a1f6b297efcd8bc608ab92d16c4ca631b0cad4da46724588b24", size = 3817138, upload-time = "2026-06-09T22:32:00.388Z" },
+    { url = "https://files.pythonhosted.org/packages/42/06/3e768b4c3bc78201583fa35a0e18f640dd782ff41afba88f8545481a8874/cryptography-48.0.1-cp314-cp314t-macosx_10_9_universal2.whl", hash = "sha256:f817adc181390bd54f2f700107a7419040fb7c1bdf2fc26f36551a06a68c3345", size = 7989830, upload-time = "2026-06-09T22:31:07.8Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/13/6476736484b94041110c8340a3eb63962fea4975baea8cb4a512adb44d4d/cryptography-48.0.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d5d30989c6917b478b5817902e85fddaea2261efa8648383d965381ccb9e1ac4", size = 4689201, upload-time = "2026-06-09T22:31:09.745Z" },
+    { url = "https://files.pythonhosted.org/packages/79/62/65a87f34d2a431546e2509b85d55e8c90df86d668f6731da64d538512ac2/cryptography-48.0.1-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:df637c05205ea7c1d7fbcbe54bbfea648a52951155f997af13d895d0ecc96991", size = 4702822, upload-time = "2026-06-09T22:32:24.409Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/59/810b5204b0a9b10f4b6bc06bd551a8b609803cd931806bc3b71884b225e5/cryptography-48.0.1-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:869c3b8a53bfe27147832df48b32adadf558249d50e76cb3769d40e986b13265", size = 4694875, upload-time = "2026-06-09T22:32:08.737Z" },
+    { url = "https://files.pythonhosted.org/packages/24/dc/d8ca05ffea724eec6d232ea6f18e74c269eb6bdfdcc9bfba689790d1325f/cryptography-48.0.1-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:e361afba8918070d376df76f408a4f67fec0ee9cff81a99e48fe9a233ef59e17", size = 5290385, upload-time = "2026-06-09T22:31:15.212Z" },
+    { url = "https://files.pythonhosted.org/packages/03/8c/3be6cb4da181f5bb6c19cf560c2359d60644a6b5fc5b57854e528f47b296/cryptography-48.0.1-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:d069066deead00ac7f090be101be875a06855908f7ec004c27b8fefb4acfb411", size = 4737082, upload-time = "2026-06-09T22:32:22.66Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/f6/d5f60a5a1434dbfd949e227fd0065d194c7e6b6ac526b17f5c06152b8231/cryptography-48.0.1-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:09f73a725d582cef64b91281a322cd798d14a33b2b6f2b7ad9531dc336d84c02", size = 4325328, upload-time = "2026-06-09T22:32:10.777Z" },
+    { url = "https://files.pythonhosted.org/packages/17/b7/ba75dd947a14b6ad907b01ae8f6b5b348cdd1b48142f0063dee9e20c1d9d/cryptography-48.0.1-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:15254441469dd6bf027039453288e2072124f8b6603563f5d759e1c9b69273fa", size = 4694530, upload-time = "2026-06-09T22:31:53.105Z" },
+    { url = "https://files.pythonhosted.org/packages/62/29/50d6b9e8aff12d8b67afaeb3569335e32dc83a5723e3bbded24fdac9f809/cryptography-48.0.1-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:8ace4507d1e6533c125f4fac754f8bb8b6a74c08e92179dabd7e16571a3efbf3", size = 5245046, upload-time = "2026-06-09T22:31:25.774Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/04/618f4115cfc0add0838c82507aa18a346089428da8653ad38b3ff36f5cb3/cryptography-48.0.1-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:b4e391975f038e66432328639620a4aff2d307513b004f1ca06d6225bced815c", size = 4736660, upload-time = "2026-06-09T22:32:12.676Z" },
+    { url = "https://files.pythonhosted.org/packages/24/9c/06e062462a0de28a3b3911322eded4c16deb9f441b1b7575d3dc59488ab5/cryptography-48.0.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:42fcd8e26fe555d9b3577a135f5091fefa0aa4e99129c23fb56787a1bd4ada72", size = 4822229, upload-time = "2026-06-09T22:31:17.062Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/be/0561971eaaee4b8a0e7d5113c536921063ab91aaf23278ac374eaf881e11/cryptography-48.0.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:c1400da5e32a43253392277eac7490a60e497d810a63dd5608d71bbd7af507c9", size = 4966364, upload-time = "2026-06-09T22:31:32.842Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/27/728c77876f12b000820b69ae490f3c4083775e79e07827e9e60be07ad209/cryptography-48.0.1-cp314-cp314t-win32.whl", hash = "sha256:0df56b056bc17c1b7d6821dfa65216e62bd232d8ab05eb3db44e71d235651471", size = 3278498, upload-time = "2026-06-09T22:31:29.154Z" },
+    { url = "https://files.pythonhosted.org/packages/06/e3/79a612c6d7b1e6ee0edd43633d53035bec2cfb78c82b76f7864f39e36f34/cryptography-48.0.1-cp314-cp314t-win_amd64.whl", hash = "sha256:9de21387aa95e2a895823d0745b430bed4f33503ba9ab5e0b5311f33e37d66d2", size = 3798790, upload-time = "2026-06-09T22:31:56.697Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/6c/00fa2a95997164c8b2072ce327c23d4ab20809ccc323ea5fab91e53a4bba/cryptography-48.0.1-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:4fdc69f8e4316bcf0c8c8ec1f26f285d12e8142d88d96c876a59a03be3f6ae67", size = 7987408, upload-time = "2026-06-09T22:32:20.777Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/d9/45f309a7e4e5f3f8f121d6d3be9e94024a7726ec598d6e08ae04edb2f04d/cryptography-48.0.1-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:48fe40804d4caa2288f24e70ca8c64c42dd826da0ad7e4f1b41b2128d679e6c8", size = 4690196, upload-time = "2026-06-09T22:31:54.74Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/9f/a1bc8bcc798811b8527eb374bbccf30a3f3e806829d967118222bf1125eb/cryptography-48.0.1-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:86be3b1b0b6bf09482fb50a979c508d2950ed95f5621ec77f4e385962006b83a", size = 4696782, upload-time = "2026-06-09T22:31:45.615Z" },
+    { url = "https://files.pythonhosted.org/packages/66/c2/81a4fb4e4373c500bb526bc337ac5719dd31dd15b970b84a238168c6aa08/cryptography-48.0.1-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:4ab0a343c807bbcd90c971cd1ecf072937cd01847a9e002bef88fb47ac6be577", size = 4696618, upload-time = "2026-06-09T22:31:11.564Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/0b/aa68b221dde92d09cb29a024ede17550ee21e77a404e59fc093c82bb51e1/cryptography-48.0.1-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:9621de99d2da096006b629979efd8ae7eb2d8b822488d0c89ee4000c306c59b1", size = 5289970, upload-time = "2026-06-09T22:31:20.368Z" },
+    { url = "https://files.pythonhosted.org/packages/78/13/fba657f958d2af66ea959a4ba01212632089249d34af1ae48054136344d7/cryptography-48.0.1-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:88c852a0ae366e262e5a1744b685e6a433dc8788dd2a277e418bf4904203609d", size = 4731873, upload-time = "2026-06-09T22:31:22.253Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/4c/9a964756d24a26b3e34dfcb16f961b89838786e6700b635b0d1e3adff4b6/cryptography-48.0.1-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:43c5835e2cb98c8733d86f57d6fc879b613f5c3478607281c3e36daffc6dd8a6", size = 4330804, upload-time = "2026-06-09T22:31:36.56Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/0f/a10f3a6eb12950a10e3a874070283aa2dd5875b2bfd15fad8a3e17b3f13e/cryptography-48.0.1-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:fe0180af5bf9236518a087e35bf2d9a347d5f5f51e63c579d683ddff424e3d46", size = 4696217, upload-time = "2026-06-09T22:31:13.351Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/6f/5cd12f951165ea73ef85266775d97e4c763b2474ccfd816dd69d3a18d6f8/cryptography-48.0.1-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:b7a2d1a937a738a881737cec135a38bb61470589b17515b9f73f571d0ae10401", size = 5245252, upload-time = "2026-06-09T22:32:02.193Z" },
+    { url = "https://files.pythonhosted.org/packages/68/ab/8aaa12e4516ec4464033ab79b6f3b592bd5a92102467c4ace8a0d970203f/cryptography-48.0.1-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:b74ca3b8e5ecdd833bf6a002ca41b4793bb27fb8f1c06ffaf2643c9e9140e31b", size = 4731388, upload-time = "2026-06-09T22:32:04.019Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/24/50027ea4dca85ec1f40688f3c24fb32ccacd520583c9592c3cc95628e6fb/cryptography-48.0.1-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:2c37f2461406063b417837f5f3daab668652acd82423efcd7f0a9f04be972de1", size = 4824186, upload-time = "2026-06-09T22:32:18.707Z" },
+    { url = "https://files.pythonhosted.org/packages/52/41/04cb5eb17085ade6f50cc611fb657df6a0f5885350de8764ece89c050197/cryptography-48.0.1-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:86fe77abb1bd87afb251d4d02ada7ecf53a32cee9b67d976abb2e45a13297475", size = 4964539, upload-time = "2026-06-09T22:31:18.793Z" },
+    { url = "https://files.pythonhosted.org/packages/36/bf/ed70785c496e89d7e73b7cda2d21f2447fd6d4e821714b8d04ff217fed92/cryptography-48.0.1-cp39-abi3-win32.whl", hash = "sha256:6b2c0c3e6ccf3ade7750f836ef3ee36eea250cc467d45c256895573ac08cc6f1", size = 3282307, upload-time = "2026-06-09T22:30:53.162Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/ff/371ea7d252656ee1eb6d83eeeef3d1d0c6baf1d6497687d081ea03814670/cryptography-48.0.1-cp39-abi3-win_amd64.whl", hash = "sha256:9a49ca6c81417f6a5edb50375a60cccdd70fa0a91a5211829dbea74eba94d2ac", size = 3793408, upload-time = "2026-06-09T22:32:15.191Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/d3/eb4e394e587341fdad09a09101fa76478ead3a78b0ad63e55c22f0d75c02/cryptography-48.0.1-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:08a597acce1ff37f347400087776599e2348a3a8bc53b44120e463cd274efe4a", size = 3951747, upload-time = "2026-06-09T22:31:23.871Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/4a/3f43451b4f858bfceaaaffc649e6e787e8d4fb332a1d443af39ab02cc8f1/cryptography-48.0.1-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:735824ec41b7f74a7c45fb1591349333e4c696cb6c044e5f46356e560143e4cd", size = 4641226, upload-time = "2026-06-09T22:31:02.532Z" },
+    { url = "https://files.pythonhosted.org/packages/73/4e/855584c2c23b09e4ce2d3b9c30e983e679cd60b068c513c6bbdb91e11782/cryptography-48.0.1-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:92a46e1d638daa264ba2971c0b0489c9409787943efae4d60ffda3d091ef832c", size = 4668958, upload-time = "2026-06-09T22:32:06.213Z" },
+    { url = "https://files.pythonhosted.org/packages/42/3b/d35750e41d803d1e516fd6d6011f065424924da7af1748cef4cc9cb3ede1/cryptography-48.0.1-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:7e234ac052af99f2700826a5c29ea99d9c1b1f80341cde62d11c8154dc8e0bd9", size = 4640793, upload-time = "2026-06-09T22:32:26.331Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/aa/cdb7181fe865285e87e96825aaab239400f1de0c3bfba9bd9769b79f1a92/cryptography-48.0.1-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:33842cf0888951cef5bc7ac724ab844a42044c1727b967b7f8997289a0464f92", size = 4668505, upload-time = "2026-06-09T22:31:27.534Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/8c/ce3823c06c2804f194f9e64f0d67fa3f4094a39f2bb1a990cd03603af8fc/cryptography-48.0.1-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:6184ca7b174f28d7c703f1290d4b297217c45355f77a98f67e9b7f14549ac54a", size = 3742204, upload-time = "2026-06-09T22:31:34.773Z" },
 ]
 
 [[package]]

docs/DETMIR_CURRENT_STATE_RU.md

@@ -0,0 +1,325 @@
+# DetMir/AWatch-rus: актуальное состояние и граница DLP-модуля
+
+Дата фиксации: 2026-06-25.
+
+Обновление 2026-06-29 после восстановления RDP-сервера: фактический
+production IP Windows/RDP host теперь `192.168.100.19`; stable ActivityWatch
+logical host id остаётся `SHARKON2025`. Подробный post-restore baseline:
+`docs/DETMIR_RESTORE_BASELINE_2026-06-29_RU.md`.
+
+Документ фиксирует фактическое состояние DetMir/AWatch-rus и первую границу
+переработки горячего пути портала. Это не release evidence для реестра
+российского ПО, не заявление о сертификации и не claim замены DLP/SIEM/EDR.
+
+## Runtime baseline
+
+- Контур: DetMir / AWatch-rus.
+- Stable Windows/RDP logical host id для ActivityWatch bucket-ов и отчетов:
+  `SHARKON2025`. Это legacy logical id, а не обязательное физическое имя
+  Windows-сервера. Правило rename-safe эксплуатации описано в
+  `docs/WINDOWS_LOGICAL_HOST_ID_RU.md`.
+- Текущий физический RDP/WinRM target: `192.168.100.19`.
+- Portal host: `10.10.10.2`.
+- Portal service: `detmir-portal.service`.
+- Portal URL: `http://10.10.10.2:8720/`.
+- Задеплоенный binary hash:
+  `653b22b0fbf29a22f7de42ade7b689490b1de16fa07e785e4e0efd3078e7a3bc`.
+- Бэкап предыдущего binary на сервере:
+  `/usr/local/bin/detmir-portal.bak.20260625T045640Z`.
+- Runtime mode после phase 1 deploy:
+  `DETMIR_PORTAL_DLP_MODULE_ENABLED=false`.
+- Server-side optional DLP runtime control:
+  `AW_DLP_ENABLED=false|true` и `DETMIR_DLP_ENABLED=false|true`.
+- Runtime control/statistics script:
+  `scripts/detmir_dlp_runtime_control.sh` / live
+  `/usr/local/bin/detmir-dlp-runtime-control`.
+- Live DLP runtime state after 2026-06-25 controlled disable:
+  `AW_DLP_ENABLED=false`, `AW_DLP_INFLUX_ENABLED=false`;
+  active/enabled DLP units: `0/0`.
+- Reason: DLP runtime materially increases Proxmox VM/LXC, InfluxDB, Grafana,
+  ClickHouse and AW server load. In production DetMir it is currently kept
+  disabled, but remains a documented optional module that can be enabled later.
+- Health после деплоя: `/healthz` возвращал `status=ok`.
+- Readiness после деплоя: `/readyz` возвращал `status=ready`.
+
+## Что исправлено в текущем baseline
+
+- Первичная загрузка портала больше не зависает в бесконечном `LOADING`.
+- При холодном старте тяжелый операторский срез не блокирует UI бесконечно.
+- Frontend показывает честное состояние `STALE / Первичный срез прогревается`.
+- При prewarm больше не смешиваются статусы `STALE` и ложное
+  `Данные отсутствуют`.
+- Progress bar доходит до `100%` в fail-soft/prewarm состоянии.
+- Browser smoke после деплоя подтвердил:
+  - `loadStatus=STALE`;
+  - `progress=100%`;
+  - `LOADING=false`;
+  - `EMPTY=false`;
+  - `ERROR=false`.
+
+## Phase 1 live verification
+
+2026-06-25 после сборки `detmir-portal` и деплоя через
+`ansible/deploy_detmir_portal.yml --limit proxmox` подтверждено:
+
+- `/healthz`: `status=ok`;
+- `/readyz`: `status=ready`;
+- `/api/reports`: `ok=true`, `cache_status=warming`,
+  `modules.dlp.enabled=false`, `modules.dlp.hot_path=false`;
+- `/api/operator`: `cache_status=warming`, `summary.severity=STALE`,
+  `modules.dlp.status=disabled`, `incidents=0`;
+- server log для `/api/operator`: `status=200`, `latency_ms=49`.
+
+Это подтверждает, что первый operator/API screen больше не блокируется на
+холодной полной сборке. Полный snapshot строится в фоне и честно помечается как
+`warming`/`STALE`.
+
+## Текущая проблема производительности
+
+Наблюдаемые признаки:
+
+- после restart полный тяжелый snapshot может уходить в prewarm/stale mode;
+- report cache и stale UI защищают пользователя от зависания, но не убирают
+  саму стоимость тяжелых расчетов;
+- DLP evidence, screenshots, endpoint signals, case review и forensics
+  enrichment требуют больше CPU/IO/сетевых операций, чем Workforce core.
+
+Вывод: DLP/evidence/forensics enrichment уже вынесен из обязательного hot path
+phase 1 через `DETMIR_PORTAL_DLP_MODULE_ENABLED=false`, но полная оптимизация
+тяжелого snapshot/prewarm остается отдельной инженерной задачей.
+
+## Целевая граница после переработки
+
+Core hot path:
+
+- Workforce Operations;
+- worktime/activity;
+- загрузка, простои, перегруз;
+- дисциплина процесса;
+- качество и полнота данных;
+- легкие агрегаты для руководителя;
+- readiness/health без ожидания DLP.
+
+Optional DLP module:
+
+- DLP endpoint signals;
+- clipboard/USB/print/web/file operation incidents;
+- screenshots/evidence;
+- DLP/case review;
+- heavy security correlation;
+- forensics timelines and evidence packages;
+- Hayabusa enrichment where needed.
+
+Отключение optional DLP module не должно ломать:
+
+- `/healthz`;
+- `/readyz`;
+- первичную загрузку портала;
+- Workforce views;
+- management reports;
+- базовый operator dashboard.
+
+Отключение optional DLP module должно показывать честный статус:
+
+```text
+DLP module disabled / not configured
+```
+
+без заявления, что DLP-проверки выполнены.
+
+## Рекомендуемые feature flags
+
+Минимальная целевая модель конфигурации:
+
+```json
+{
+  "modules": {
+    "dlp": {
+      "enabled": false,
+      "evidence": false,
+      "correlation": false,
+      "screenshots": false,
+      "hot_path": false
+    }
+  }
+}
+```
+
+Первая реализованная runtime-граница:
+
+```text
+--dlp-module-enabled
+DETMIR_PORTAL_DLP_MODULE_ENABLED=true|false
+AW_DLP_ENABLED=true|false
+DETMIR_DLP_ENABLED=true|false
+```
+
+Default остается `true`, чтобы существующее поведение не менялось без явного
+решения администратора. Для ускоренного Workforce/operator режима допускается
+`DETMIR_PORTAL_DLP_MODULE_ENABLED=false`; в этом режиме портал:
+
+- не читает DLP incident/case/review/audit файлы в основном report/operator
+  path;
+- отключает security-events backend внутри snapshot, не меняя сохраненные
+  ClickHouse credentials;
+- возвращает disabled-state для DLP evidence API;
+- не считает отсутствие DLP ошибкой Workforce core.
+
+Ansible-параметр поставки:
+
+```yaml
+detmir_portal_dlp_module_enabled_override: false
+```
+
+Отдельный `detmir-portal-evidence` сервис не отключается этим флагом и остается
+самостоятельным контуром evidence/API при наличии отдельной конфигурации.
+
+Hayabusa/Velociraptor boundary:
+
+- Hayabusa/Sigma and Velociraptor are optional security findings / forensics
+  sources, not Workforce hot path dependencies.
+- Heavy DLP runtime can remain disabled while Hayabusa/Velociraptor findings
+  are imported into Security Finding Inbox / ClickHouse.
+- Velociraptor server/client mode must be enabled explicitly
+  (`disabled|offline_collector|server_clients`) and must not be auto-started by
+  routine production deploy on the small DetMir Proxmox contour.
+- Findings from Velociraptor/Hayabusa support `decide -> plan -> approve ->
+  apply -> verify`, but do not imply automatic remediation without approval.
+
+Server-side optional DLP runtime описан отдельно:
+
+- [DLP_OPTIONAL_RUNTIME_RU.md](DLP_OPTIONAL_RUNTIME_RU.md).
+
+При `AW_DLP_ENABLED=false`:
+
+- `dlp-health-check` возвращает штатный `dlp:mode=disabled`;
+- `detmir-dlp` не выполняет SSH health probe;
+- `detmir-check`, `check-aw-full` и `check-aw-data` не считают DLP buckets
+  обязательными;
+- `detmir-readiness` не требует DLP Influx write и DLP systemd units;
+- перед отключением и после отключения собираются JSON-срезы в
+  `/var/lib/activitywatch/health/dlp-runtime-history/`, latest-срез остается в
+  `/var/lib/activitywatch/health/dlp-runtime-state.json`.
+
+Live disable evidence 2026-06-25:
+
+- `dlp-health-check` returned `ok=true`, `dlp:mode=disabled`;
+- `detmir-dlp` returned `ok=true`, `dlp:mode=disabled`;
+- pre-disable active units:
+  `aw-dlp-influx-exporter.timer`,
+  `activitywatch-dlp-aggregator.timer`,
+  `aw-dlp-report-scheduler.timer`,
+  `aw-dlp-syslog-forwarder.timer`,
+  `aw-dlp-webhook-sender.timer`,
+  `aw-dlp-cef-exporter.timer`,
+  `aw-dlp-ioc-refresh.timer`,
+  `aw-dlp-policy-engine.service`,
+  `aw-dlp-case-management.service`,
+  `detmir-portal-evidence.service`;
+- post-disable active/enabled DLP units: `0/0`;
+- retained evidence files:
+  `/var/lib/activitywatch/health/dlp-runtime-history/dlp-runtime-current-20260625T083619Z.json`,
+  `/var/lib/activitywatch/health/dlp-runtime-history/dlp-runtime-pre_disable-20260625T083637Z.json`,
+  `/var/lib/activitywatch/health/dlp-runtime-history/dlp-runtime-disabled-20260625T083700Z.json`;
+- `check-aw-full` with `AW_DLP_ENABLED=false` reports `DLP buckets ...
+  SKIPPED`;
+- ActivityWatch core services remained active:
+  `activitywatch-server`, `aw-worktime-api`.
+
+Separate live observations after DLP disable, before 2026-06-29 restore:
+
+- `aw-watcher-afk`, `aw-watcher-window` and `aw-worktime-sessions` were stale
+  in the manual check and require separate RDP collector/session recovery;
+- WinRM from the server side to `192.168.100.18:5985` was unreachable during
+  this check;
+- these are not treated as DLP disable regressions.
+
+Post-restore correction on 2026-06-29:
+
+- current physical RDP/WinRM target is `192.168.100.19`;
+- laptop route to `192.168.100.19` is through DetMir OpenVPN gateway
+  `10.0.13.1`;
+- WinRM `5985` and RDP `3389` are reachable from the admin laptop;
+- stable ActivityWatch logical host id remains `SHARKON2025`.
+
+Fail-safe правила:
+
+- если DLP выключена, Security/Forensics views должны показывать disabled-state,
+  а не падать;
+- если DLP включена, тяжелые DLP операции должны выполняться асинхронно или
+  через cache, а не блокировать первый Workforce/operator screen;
+- readiness не должен заявлять DLP healthy, если модуль отключен или не
+  проверен;
+- отсутствие DLP не является ошибкой Workforce core.
+
+## Сетевое состояние
+
+Доступ к DetMir зависит от NetworkManager VPN profile
+`pfSense-gate-UDP4-1194-vpn_prog10-config`. Имя tun-интерфейса не является
+семантической идентичностью и должно проверяться по адресу `10.0.13.*`.
+
+Пример рабочего route:
+
+```text
+10.10.10.2 via 10.0.13.1 dev <current-detmir-tun>
+```
+
+Наблюдавшаяся нестабильность dataplane:
+
+- tun device может присутствовать в routing table, но gateway `10.0.13.1` не
+  отвечает;
+- при этом SSH, `/healthz` и браузерная проверка DetMir недоступны;
+- после ручного поднятия NetworkManager-подключения
+  `pfSense-gate-UDP4-1194-vpn_prog10-config` доступ восстанавливался.
+- 2026-06-25 после phase 1 deploy зафиксирован отдельный сбой:
+  `nm-openvpn` для `178.178.98.83:1194` получил `TLS handshake failed` и
+  `connect timeout exceeded`; повторная production-очистка старого systemd
+  prewarm drop-in отложена до восстановления VPN handshake.
+
+Актуальная проверка 2026-06-29:
+
+```text
+192.168.100.19 via 10.0.13.1 dev <current-detmir-tun>
+10.0.13.1 ping OK
+192.168.100.19:5985 OK
+192.168.100.19:3389 OK
+```
+
+Команда восстановления:
+
+```bash
+nmcli connection down 'pfSense-gate-UDP4-1194-vpn_prog10-config' || true
+sleep 2
+nmcli connection up 'pfSense-gate-UDP4-1194-vpn_prog10-config'
+```
+
+Проверка:
+
+```bash
+ping -c 2 -W 2 10.0.13.1
+ping -c 2 -W 2 10.10.10.2
+nc -vz -w 3 10.10.10.2 22
+curl -sS --max-time 5 http://10.10.10.2:8720/healthz
+```
+
+## Что не менять без отдельной задачи
+
+- Не удалять DLP collectors и warehouse ради ускорения портала.
+- Не включать heavy DLP или Velociraptor server runtime автоматически при
+  обычном deploy без ресурсного решения.
+- Не менять UI/API несовместимо: новые поля должны быть additive.
+- Не заявлять completed DLP decoupling до live deploy и browser/API smoke.
+- Не позиционировать AWatch-rus как сертифицированную DLP/SIEM/EDR/СЗИ.
+
+## Следующий инженерный шаг
+
+Закрыть оставшиеся production-hardening пункты:
+
+1. После восстановления DetMir VPN повторно прогнать
+   `ansible/deploy_detmir_portal.yml`, чтобы удалить legacy drop-in
+   `/etc/systemd/system/detmir-portal.service.d/30-prewarm-after-start.conf`.
+2. Подтвердить remote `sha256sum /usr/local/bin/detmir-portal` и отсутствие
+   `ExecStartPost` prewarm в `systemctl cat detmir-portal`.
+3. Подтвердить browser smoke без зависания первичной загрузки.
+4. Добавить метрики и smoke для режимов `dlp.enabled=false` и
+   `dlp.enabled=true`.

docs/DETMIR_RESTORE_BASELINE_2026-06-29_RU.md

@@ -0,0 +1,83 @@
+# DetMir restore baseline 2026-06-29
+
+Дата фиксации: 2026-06-29.
+
+Документ фиксирует фактическое состояние восстановленного контура
+AWatch-rus/DetMir после возврата RDP-сервера `SHARKON2025`.
+
+## Итог
+
+- AW server: `10.10.10.13:5600`, API отвечает, CORS OK.
+- Worktime API: `10.10.10.13:5610`, `/health` OK, report endpoints отвечают.
+- Portal/gateway: `https://dm.iri1968.dpdns.org/healthz` отвечает `200 ok`.
+- RDP host physical IP: `192.168.100.19`.
+- Stable ActivityWatch logical host id: `SHARKON2025`.
+- Старый IP `192.168.100.18` не считать текущим production target.
+
+## Выполненные исправления
+
+- На ноутбуке добавлен постоянный маршрут к `192.168.100.19/32` через DetMir
+  VPN gateway `10.0.13.1`.
+- `ansible/inventory.ini` переведен на `rdp-prod ansible_host=192.168.100.19`.
+- Диагностические скрипты больше не жёстко привязаны к `192.168.100.18`.
+- `/etc/activitywatch/aw-server.env` на AW server обновлен:
+  `AW_MONITORED_WINDOWS_HOST=192.168.100.19`.
+- На RDP host добавлены узкие Windows Firewall allow-правила для
+  `10.10.10.13 -> 5985/3389`; промежуточный firewall всё ещё блокирует этот
+  server-side TCP path.
+- Guard restart-budget quarantine очищен через backup и reset runtime state.
+- ClickHouse Security Finding Inbox schema применена:
+  `security_findings`, `security_finding_workflow_events`,
+  `security_finding_inbox`.
+- `check-aw-full` обновлен: env-aware RDP host, корректный CORS origin,
+  AFK freshness через `bucket.metadata.end`.
+- DLP runtime зафиксирован как optional disabled contour: отключён для снижения
+  нагрузки на Proxmox/InfluxDB/Grafana/ClickHouse/AW server, но оставлен
+  подключаемым через documented enable flow.
+- Hayabusa/Velociraptor зафиксированы как optional security findings /
+  forensics layer, отдельный от DLP runtime и Workforce hot path.
+
+## Проверенный статус по 7 пунктам
+
+1. AW-server/portal/API: доступны; `check-aw-data.sh` OK, public `/healthz` OK.
+2. RDP host: `192.168.100.19`, `COMPUTERNAME=SHARKON2025`,
+   WinRM/RDP/SSH доступны с админского ноутбука; guard service running.
+3. ActivityWatch buckets: worktime, session, AFK, DLP endpoint signals fresh;
+   window bucket корректно классифицируется как inactive при отсутствии
+   интерактивной активности.
+4. ClickHouse/filter/security findings: ClickHouse healthy, Security Finding
+   Inbox schema создана; portal endpoint защищен auth и без авторизации
+   возвращает `401`.
+5. InfluxDB/Grafana: InfluxDB health `pass`, Grafana DB health `ok`,
+   Influx datasource health OK. Loki log contour intentionally disabled to
+   reduce resource usage.
+6. Hayabusa/Velociraptor layer: Hayabusa doctor OK, drop.path active,
+   incoming/drop backlog empty, latest intake `2026-06-29T09:00:23Z`,
+   bad zip сохранен только в quarantine как evidence. Velociraptor integration
+   is treated as optional findings source; no always-on Velociraptor runtime is
+   required for Workforce/AW core.
+7. Baseline зафиксирован в этом документе и связан с operational docs/skills.
+
+## Остаточные риски
+
+- `aw-rus-healthd.service` на AW server всё ещё видит TCP timeout до
+  `192.168.100.19:5985/3389` через gateway `10.10.10.1`, хотя ICMP проходит и
+  доступ с админского ноутбука есть. Это network policy gap на промежуточном
+  firewall/ACL, не SQLite/datastore failure.
+- Grafana Loki datasource `10.10.10.12:3100` intentionally disabled: Proxmox
+  LXC `202 loki-logs` is stopped, active config has `onboot: 0`, and TCP
+  `10.10.10.12:3100` is closed. This is an operator decision to save resources
+  and does not break core AW/worktime/ClickHouse.
+- DLP runtime is intentionally disabled for the current production profile and
+  must not be auto-enabled by routine deploys. Re-enable only after resource
+  budget check and explicit operator decision.
+
+## Проверки
+
+- `AW_MONITORED_WINDOWS_HOSTNAME=SHARKON2025 ./check-aw-data.sh` - OK.
+- `AW_SMOKE_AW_SERVER=http://10.10.10.13:5600
+  AW_SMOKE_SOURCE_HOSTNAME=SHARKON2025
+  AW_SMOKE_WINDOWS_HOST=192.168.100.19 ./check-aw-full.sh --no-color` - OK.
+- `cargo test -p check-aw-full` - 4 passed.
+- `bash -n` для изменённых shell scripts - OK.
+- `AW_SMOKE_LOKI_ENABLED=0` is the current default for local smoke checks.

docs/DETMIR_SUPPORT_SCRIPTS_RU.md

@@ -55,7 +55,7 @@ DETMIR_SUPPORT_PVE_HOST=10.10.10.2
 DETMIR_SUPPORT_AW_HOST=10.10.10.13
 DETMIR_SUPPORT_WEB_HOST=10.10.10.2
 DETMIR_SUPPORT_WEB_TLS_HOST=10.10.10.2
-DETMIR_SUPPORT_WINDOWS_HOST=192.168.100.18
+DETMIR_SUPPORT_WINDOWS_HOST=192.168.100.19
 DETMIR_SUPPORT_SURICATA_HOST=10.10.10.2
 
 DETMIR_SUPPORT_SSH_USER=igor
@@ -79,6 +79,7 @@ DETMIR_SUPPORT_PVE_BACKUP_DIRS=/var/lib/pve/local-btrfs/dump
 
 - операторский gateway находится на `10.10.10.2`, а не на историческом
   `10.10.10.11`;
+- текущий Windows/RDP target после восстановления: `192.168.100.19`;
 - web health endpoint: `https://10.10.10.2/healthz`, ожидаемый ответ `200`;
 - защищенный корень gateway `https://10.10.10.2/` штатно отвечает `401`;
 - AW API health проверяется через

docs/DLP_OPTIONAL_RUNTIME_RU.md

@@ -0,0 +1,200 @@
+# Optional DLP runtime for DetMir
+
+Цель: DLP-контур должен отключаться управляемо, без ложных аварий в health/readiness и без автоматического подъема heavy-пайплайна, когда задача контура - снизить нагрузку на InfluxDB, Grafana и ClickHouse.
+
+## Что отключается
+
+Штатный runtime off включает:
+
+- `AW_DLP_ENABLED=false` на AW server;
+- `DETMIR_DLP_ENABLED=false` в управляющем DetMir contour check;
+- `DETMIR_PORTAL_DLP_MODULE_ENABLED=false` для portal UI/API DLP-модуля;
+- остановку DLP timers/services:
+  - `aw-dlp-influx-exporter.timer`;
+  - `activitywatch-dlp-aggregator.timer`;
+  - `aw-dlp-report-scheduler.timer`;
+  - `aw-dlp-syslog-forwarder.timer`;
+  - `aw-dlp-webhook-sender.timer`;
+  - `aw-dlp-cef-exporter.timer`;
+  - `aw-dlp-ioc-refresh.timer`;
+  - `aw-dlp-policy-engine.service`;
+  - `aw-dlp-case-management.service`;
+  - `detmir-portal-evidence.service`, если DLP evidence upload больше не нужен.
+
+Worktime, ActivityWatch server, browser/window/AFK collection, Hayabusa,
+Velociraptor findings ingest и 1C/ClickHouse core не считаются DLP runtime и
+отдельно не отключаются.
+
+Важно: отключение DLP runtime не удаляет DLP-контур из проекта. Это
+эксплуатационный режим `disabled`, выбранный для production DetMir из-за
+существенной нагрузки на виртуальную среду Proxmox, InfluxDB, Grafana,
+ClickHouse и AW server. DLP должен оставаться подключаемым обратно через
+описанный ниже enable-процесс, без переустановки продукта и без потери
+исторических артефактов до отдельной retention/cleanup процедуры.
+
+## Статистика перед отключением
+
+На AW server:
+
+```bash
+sudo bash /usr/local/bin/detmir-dlp-runtime-control stats
+sudo cat /var/lib/activitywatch/health/dlp-runtime-state.json
+```
+
+Из репозитория до деплоя:
+
+```bash
+sudo bash scripts/detmir_dlp_runtime_control.sh stats
+```
+
+JSON фиксирует:
+
+- generated timestamp;
+- effective mode;
+- DLP unit `active/enabled/load` state;
+- последние timestamps по DLP buckets для текущего host;
+- причину отключения.
+
+Каждый запуск дополнительно сохраняет неизменяемый снимок в
+`/var/lib/activitywatch/health/dlp-runtime-history/`. При `disable` остаются
+как минимум два снимка: `pre_disable` до остановки units и `disabled` после
+остановки/disable/reset-failed.
+
+## Отключение
+
+На AW server:
+
+```bash
+sudo install -o root -g root -m 0755 scripts/detmir_dlp_runtime_control.sh /usr/local/bin/detmir-dlp-runtime-control
+sudo sed -i \
+  -e 's/^AW_DLP_ENABLED=.*/AW_DLP_ENABLED=false/' \
+  -e 's/^AW_DLP_DISABLED_REASON=.*/AW_DLP_DISABLED_REASON=operator_disabled_to_reduce_influx_grafana_clickhouse_load/' \
+  /etc/activitywatch/aw-server.env
+sudo /usr/local/bin/detmir-dlp-runtime-control disable
+sudo systemctl restart aw-worktime-api.service || true
+```
+
+Для portal:
+
+```bash
+sudo sed -i 's/^DETMIR_PORTAL_DLP_MODULE_ENABLED=.*/DETMIR_PORTAL_DLP_MODULE_ENABLED=false/' /etc/detmir-portal.env
+sudo systemctl restart detmir-portal.service
+```
+
+Если переменной нет, добавьте ее в соответствующий env-файл отдельной строкой.
+
+## Проверка после отключения
+
+```bash
+AW_DLP_ENABLED=false DETMIR_DLP_ENABLED=false /usr/local/bin/dlp-health-check --json
+DETMIR_DLP_ENABLED=false detmir-dlp
+DETMIR_DLP_ENABLED=false detmir-check --json
+AW_DLP_ENABLED=false check-aw-full
+```
+
+Ожидаемое поведение:
+
+- `dlp-health-check` возвращает `ok=true` и `dlp:mode=disabled`;
+- `detmir-dlp` не открывает SSH health probe и возвращает disabled payload;
+- `detmir-check` не проверяет DLP buckets;
+- `check-aw-full` показывает DLP buckets как `SKIPPED`;
+- DLP units остаются stopped/disabled;
+- worktime/core проверки продолжают работать.
+
+## Live evidence 2026-06-25
+
+На DetMir/AW server выполнен controlled disable:
+
+- `AW_DLP_ENABLED=false`;
+- `AW_DLP_INFLUX_ENABLED=false`;
+- `AW_DLP_DISABLED_REASON=operator_disabled_to_reduce_influx_grafana_clickhouse_load`;
+- `AW_DLP_DISABLED_SINCE=2026-06-25`.
+
+Зафиксированы evidence-снимки:
+
+```text
+/var/lib/activitywatch/health/dlp-runtime-history/dlp-runtime-current-20260625T083619Z.json
+/var/lib/activitywatch/health/dlp-runtime-history/dlp-runtime-pre_disable-20260625T083637Z.json
+/var/lib/activitywatch/health/dlp-runtime-history/dlp-runtime-disabled-20260625T083700Z.json
+```
+
+Результат:
+
+- pre-disable active units included DLP Influx exporter, aggregator, report,
+  integration, policy/case and evidence units;
+- post-disable active/enabled DLP units: `0/0`;
+- `dlp-health-check` returned `ok=true`, `dlp:mode=disabled`;
+- `detmir-dlp` returned `ok=true`, `dlp:mode=disabled`;
+- `check-aw-full` returned `DLP buckets ... SKIPPED`.
+
+Отдельные non-DLP findings того же ручного прогона, до восстановления
+`192.168.100.19`:
+
+- AFK/window/worktime buckets were stale and require RDP collector/session
+  recovery;
+- WinRM from server side to `192.168.100.18:5985` was unreachable;
+- these findings are outside the DLP runtime disable boundary.
+
+## Возврат DLP
+
+```bash
+sudo sed -i 's/^AW_DLP_ENABLED=.*/AW_DLP_ENABLED=true/' /etc/activitywatch/aw-server.env
+sudo /usr/local/bin/detmir-dlp-runtime-control enable
+sudo systemctl restart aw-worktime-api.service || true
+```
+
+Для portal:
+
+```bash
+sudo sed -i 's/^DETMIR_PORTAL_DLP_MODULE_ENABLED=.*/DETMIR_PORTAL_DLP_MODULE_ENABLED=true/' /etc/detmir-portal.env
+sudo systemctl restart detmir-portal.service
+```
+
+После включения выполнить:
+
+```bash
+/usr/local/bin/dlp-health-check --json
+detmir-dlp
+detmir-check --json
+```
+
+Перед возвратом DLP в production обязательно проверить ресурсный бюджет
+Proxmox/InfluxDB/Grafana/ClickHouse. Не включайте DLP timers/services
+автоматически вместе с обычным deploy, если текущая цель - сохранить лёгкий
+Workforce/AW контур.
+
+## Hayabusa/Velociraptor при выключенном DLP
+
+Hayabusa/Sigma и Velociraptor относятся к optional security findings /
+forensics layer, а не к тяжёлому DLP runtime:
+
+- Hayabusa drop/autoprocess может продолжать работать при выключенном DLP;
+- Velociraptor findings ingest может использоваться в offline/server mode, если
+  администратор явно включил соответствующий режим;
+- результаты должны попадать в Security Finding Inbox / ClickHouse как
+  контролируемые findings, а не запускать автоматическую блокировку без
+  approve/apply workflow;
+- portal/workforce first screen не должен ждать Velociraptor или DLP;
+- disabled DLP mode не должен превращаться в FAIL только из-за отсутствия DLP
+  buckets.
+
+Velociraptor server/client runtime не должен стартовать автоматически в
+production DetMir без отдельного ресурсного решения. Для малой виртуальной
+среды предпочтителен `disabled` или `offline_collector` режим.
+
+## Ansible
+
+В inventory/group vars:
+
+```yaml
+aw_dlp_enabled: false
+aw_dlp_disabled_reason: "operator_disabled_to_reduce_influx_grafana_clickhouse_load"
+aw_dlp_disabled_since: "2026-06-25"
+detmir_portal_dlp_module_enabled_override: false
+```
+
+При `aw_dlp_enabled: false` playbook пишет `AW_DLP_ENABLED=false`, не включает DLP service/timer runtime и не должен возвращать DLP Influx exporter/aggregator в active state.
+
+## Ограничения
+
+Это не удаление DLP-функциональности и не заявление, что DLP заменен другим средством. Это штатный режим временного/постоянного отключения тяжелого DLP runtime для стабилизации производительности. Исторические DLP buckets и артефакты могут оставаться на диске и в ActivityWatch до отдельной retention/cleanup процедуры.

docs/OPERATIONS_VALIDATION_RUNBOOK_RU.md

@@ -94,11 +94,26 @@ Browser smoke не заменяет API/CLI проверки. Он подтве
 
 ```bash
 cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian
-NO_PROXY=localhost,127.0.0.1,10.10.10.13,10.10.10.2,192.168.100.18,10.10.10.0/24 \
-no_proxy=localhost,127.0.0.1,10.10.10.13,10.10.10.2,192.168.100.18,10.10.10.0/24 \
+NO_PROXY=localhost,127.0.0.1,10.10.10.13,10.10.10.2,192.168.100.19,10.10.10.0/24 \
+no_proxy=localhost,127.0.0.1,10.10.10.13,10.10.10.2,192.168.100.19,10.10.10.0/24 \
+AW_SMOKE_WINDOWS_HOST=192.168.100.19 \
+AW_SMOKE_SOURCE_HOSTNAME=SHARKON2025 \
 ./check-aw-full.sh
 ```
 
+Для DetMir production при проверке после rename RDP-сервера явно фиксируйте
+stable logical host id:
+
+```bash
+AW_MONITORED_WINDOWS_HOSTNAME=SHARKON2025 ./check-aw-data.sh
+AW_SMOKE_WINDOWS_HOST=192.168.100.19 \
+AW_SMOKE_SOURCE_HOSTNAME=SHARKON2025 \
+./scripts/aw-contour-smoke-local.sh --skip-winrm
+```
+
+`SHARKON2025` в этих командах - исторический ActivityWatch logical id, не
+физическое имя Windows-сервера.
+
 Для workforce ClickHouse дополнительно проверить quality views:
 
 ```sql

docs/PROJECT_STATUS_RU.md

@@ -60,6 +60,70 @@ backup, registry-readiness документации, плана российск
 - First protected PR workflow: PR #50 opened; required checks passed;
   review/merge still `pending_review_required`.
 - First reviewed PR evidence: pending.
+- DetMir portal live baseline on 2026-06-25:
+  `docs/DETMIR_CURRENT_STATE_RU.md`.
+- DetMir portal deployed binary:
+  `653b22b0fbf29a22f7de42ade7b689490b1de16fa07e785e4e0efd3078e7a3bc`.
+- DetMir portal cold-start UI hang: mitigated. During cold/prewarm state the UI
+  now shows `STALE / Первичный срез прогревается`, not endless loading.
+- DetMir DLP hot-path boundary: phase 1 deployed on the portal service with
+  `DETMIR_PORTAL_DLP_MODULE_ENABLED=false`.
+- DetMir optional DLP runtime controls: implemented in code/docs through
+  `AW_DLP_ENABLED`, `DETMIR_DLP_ENABLED`,
+  `scripts/detmir_dlp_runtime_control.sh` and
+  `docs/DLP_OPTIONAL_RUNTIME_RU.md`.
+- DetMir optional DLP runtime live state: disabled on 2026-06-25 to reduce
+  InfluxDB/Grafana/ClickHouse/AW server load. Evidence:
+  `dlp-health-check=dlp:mode disabled`, `detmir-dlp=dlp:mode disabled`,
+  active/enabled DLP units `0/0`, history snapshots under
+  `/var/lib/activitywatch/health/dlp-runtime-history/`.
+- DetMir DLP contour status: disabled for the current production resource
+  profile, not removed. It remains a documented optional module and must only be
+  re-enabled after explicit operator decision and Proxmox/InfluxDB/Grafana/
+  ClickHouse capacity check.
+- DetMir DLP buckets in manual full check: `SKIPPED` under
+  `AW_DLP_ENABLED=false`, not reported as dead.
+- DetMir RDP collector freshness after 2026-06-29 restore: physical RDP target
+  is `192.168.100.19`, stable AW logical host id remains `SHARKON2025`.
+  Buckets are fresh/inactive as expected, collector guard quarantine was reset,
+  and `check-aw-full` was updated to use env-driven RDP target and AFK
+  `metadata.end` freshness. Admin laptop route to `192.168.100.19` goes through
+  DetMir OpenVPN gateway `10.0.13.1`; WinRM `5985` and RDP `3389` are reachable
+  from the admin laptop.
+- Low-cost containment pack: first safe control-plane layer implemented as
+  Rust `containment-engine`, example policy/finding fixtures, Ansible/env
+  disabled-by-default configuration, and operator/policy runbooks. Current
+  engine is decision/shadow only and does not mutate firewall, pfSense, AD,
+  VLAN or routes.
+- Security Finding Inbox: ClickHouse schema, DetMir Portal view/API,
+  Hayabusa/Velociraptor ingest adapters and separate
+  `security-finding-inbox executor` are implemented. Portal records workflow
+  events only; approved `apply_requested` can be processed by the fail-closed
+  executor through `containment-engine` `decide -> plan -> apply -> verify`
+  with rollback on apply failure.
+- Velociraptor/Hayabusa status: implemented as optional findings/forensics
+  sources. They are not required for Workforce hot path, do not replace DLP or
+  SIEM, and must not start heavy always-on runtime in DetMir production unless
+  `offline_collector` or `server_clients` mode is explicitly selected.
+- Security Finding Inbox live schema: applied on ClickHouse 2026-06-29
+  (`security_findings`, `security_finding_workflow_events`,
+  `security_finding_inbox`).
+- DetMir Loki log contour: intentionally disabled by operator to reduce
+  resource usage. Proxmox LXC `202 loki-logs` is stopped, active config has
+  `onboot: 0`, and smoke checks skip Loki by default unless
+  `AW_SMOKE_LOKI_ENABLED=1` is set.
+- DetMir restore baseline 2026-06-29:
+  `docs/DETMIR_RESTORE_BASELINE_2026-06-29_RU.md`.
+- DetMir API smoke after phase 1: `/healthz` and `/readyz` OK;
+  `/api/reports` returned `cache_status=warming` with
+  `modules.dlp.enabled=false`; `/api/operator` returned bounded
+  `cache_status=warming` / `summary.severity=STALE` without waiting for the
+  full cold snapshot.
+- DetMir remaining heavy path risk: full report/snapshot prewarm can still be
+  CPU/IO expensive; deeper optimization remains pending.
+- DetMir VPN access rule: do not identify the contour by `tun0`/`tun1`; verify
+  by NetworkManager profile, `10.0.13.*` address, route via `10.0.13.1` and live
+  reachability.
 
 ## Что готово
 
@@ -133,6 +197,11 @@ backup, registry-readiness документации, плана российск
 - External peer review remains pending.
 - Community adoption remains low until external contributors, public reviews
   and sustained third-party activity appear.
+- DetMir DLP runtime disable is complete for the current live contour; deeper
+  long-term DLP product modularization and retention/cleanup policy remain
+  separate future work.
+- DetMir RDP collector/session recovery after 2026-06-29 restore is verified by
+  live smoke: `check-aw-full` reports `FRESH=8 STALE=0 DEAD=0`.
 
 ## Честные ограничения
 
@@ -170,3 +239,4 @@ backup, registry-readiness документации, плана российск
 - `docs/public-issues/public-issues-manifest.json`
 - `docs/BRANCH_PROTECTION_POLICY_RU.md`
 - `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`
+- `docs/DETMIR_CURRENT_STATE_RU.md`

docs/WINDOWS_LOGICAL_HOST_ID_RU.md

@@ -0,0 +1,133 @@
+# Stable logical host id для Windows/RDP контура
+
+Дата фиксации: 2026-06-27.
+
+Обновление 2026-06-29: восстановленный production RDP host доступен как
+`192.168.100.19`, но logical host id остаётся `SHARKON2025`.
+
+Этот документ описывает правило, которое защищает AWatch-rus/DetMir от поломки
+при переименовании Windows/RDP сервера.
+
+## Правило
+
+В AWatch-rus есть два разных идентификатора:
+
+| Поле | Назначение | Можно менять при rename Windows |
+| --- | --- | --- |
+| physical Windows name / `COMPUTERNAME` | имя ОС, локальный домен учеток, WinRM/администрирование | да |
+| `awHostname` / logical host id | суффикс ActivityWatch bucket, Grafana переменные, ClickHouse workforce keys, worktime reports | нет, только через плановую миграцию |
+
+Для DetMir production текущий stable logical host id:
+
+```text
+SHARKON2025
+```
+
+Это legacy logical id для сохранения истории bucket-ов и дашбордов. Он больше
+не должен трактоваться как обязательное физическое имя Windows-сервера.
+
+Физический IP/адрес администрирования задаётся отдельно в inventory/env:
+
+```text
+rdp-prod ansible_host=192.168.100.19
+AW_MONITORED_WINDOWS_HOST=192.168.100.19
+```
+
+## Где задается
+
+Windows deploy:
+
+```yaml
+aw_windows_logical_host_id: "SHARKON2025"
+aw_windows_hostname_override: "{{ aw_windows_logical_host_id }}"
+```
+
+Файл:
+
+```text
+ansible/host_vars/rdp-prod.yml
+```
+
+Server-side reports:
+
+```text
+AW_WORKTIME_HOST=<logical_host_id>
+AW_MONITORED_WINDOWS_HOSTNAME=<logical_host_id>
+AW_WORKTIME_INFLUX_HOSTS=<logical_host_id>
+AW_DLP_INFLUX_HOSTS=<logical_host_id>
+```
+
+Windows runtime config:
+
+```text
+C:\ProgramData\AWatch-rus\deployment-config.json
+```
+
+Ключ:
+
+```json
+{
+  "awHostname": "SHARKON2025"
+}
+```
+
+## Что делать при переименовании RDP сервера
+
+1. Не менять `awHostname`, если нет отдельного плана миграции исторических
+   bucket-ов, Grafana и ClickHouse.
+2. Windows account domain / local logon prefix можно задать явно:
+
+```yaml
+aw_windows_domain: "<new_windows_computer_or_domain_name>"
+```
+
+Если `aw_windows_domain` пустой или оставлен как `HOST-EXAMPLE`, playbook
+прочитает текущий `$env:COMPUTERNAME` через WinRM и использует его только для
+Windows-учёток. Это не меняет `awHostname`.
+
+3. Повторно применить Windows deploy после восстановления WinRM:
+
+```bash
+cd ansible
+ansible-playbook -i inventory.ini deploy_aw_windows.yml --limit rdp-prod
+```
+
+4. Проверить на Windows:
+
+```powershell
+Get-Content -Raw 'C:\ProgramData\AWatch-rus\deployment-config.json' |
+  ConvertFrom-Json |
+  Select-Object awHostname,userTasks
+```
+
+5. Проверить ActivityWatch buckets:
+
+```bash
+AW_MONITORED_WINDOWS_HOSTNAME=SHARKON2025 ./check-aw-data.sh
+```
+
+## Что ломается, если использовать `COMPUTERNAME` как bucket id
+
+- появляются новые пустые bucket-и после rename;
+- старые dashboards продолжают смотреть на старый host;
+- `aw-worktime-api` считает источники stale/missing;
+- ClickHouse workforce catalog перестает связывать пользователей с событиями;
+- guard/recovery может искать неправильные launch tasks.
+
+## Миграция на новый logical id
+
+Переход с `SHARKON2025` на нейтральный id вроде `DETMIR-RDP-01` допустим только
+как отдельная planned migration:
+
+- остановить Windows collectors;
+- создать mapping старого и нового logical id;
+- обновить Grafana dashboards;
+- обновить ClickHouse workforce catalog;
+- решить, переносить ли исторические ActivityWatch bucket-и или оставить их
+  read-only;
+- обновить `AW_WORKTIME_HOST`, `AW_MONITORED_WINDOWS_HOSTNAME`,
+  `AW_WORKTIME_INFLUX_HOSTS`, `AW_DLP_INFLUX_HOSTS`;
+- перезапустить server-side services;
+- выполнить smoke-check и ручную проверку портала.
+
+Без этих шагов менять logical id в production нельзя.

scripts/aw-contour-diag.sh

@@ -23,9 +23,14 @@ PROXMOX_HOST="10.10.10.2"
 AW_HOST="10.10.10.13"
 GRAFANA_HOST="10.10.10.11"
 INFLUXDB_HOST="10.10.10.10"
-WINDOWS_HOST="192.168.100.18"
+WINDOWS_HOST="${AW_WINDOWS_HOST:-${AW_SMOKE_WINDOWS_HOST:-192.168.100.19}}"
 CLICKHOUSE_HOST="10.10.10.2"
-SOURCE_HOSTNAME="SHARKON2025"
+SOURCE_HOSTNAME="${AW_LOGICAL_HOST_ID:-${AW_MONITORED_WINDOWS_HOSTNAME:-${AW_SMOKE_SOURCE_HOSTNAME:-SHARKON2025}}}"
+DLP_ENABLED="${AW_DLP_ENABLED:-${DETMIR_DLP_ENABLED:-true}}"
+case "${DLP_ENABLED,,}" in
+  0|false|no|off) DLP_ENABLED=false ;;
+  *) DLP_ENABLED=true ;;
+esac
 
 QUICK_MODE=0
 SKIP_WINDOWS=0
@@ -102,7 +107,7 @@ check_http_json_key() {
 check_bucket_freshness() {
   local bucket="$1" label="$2" remediation="$3"
   local bucket_id="${bucket}_${SOURCE_HOSTNAME}"
-  local tmp last_ts event_epoch now age_sec
+  local tmp last_ts event_epoch now age_sec meta_ts
   tmp="$(mktemp)"
   if ! curl -fsS --connect-timeout 5 --max-time 15 "$AW_SERVER/api/0/buckets/$bucket_id/events?limit=1" -o "$tmp" 2>"$tmp.err"; then
     fail "bucket $label ($bucket_id) — запрос не удался"
@@ -113,6 +118,12 @@ check_bucket_freshness() {
   fi
   last_ts="$(jq -r '.[0].timestamp // empty' "$tmp" 2>/dev/null)"
   rm -f "$tmp"
+  if [ "$bucket" = "aw-watcher-afk" ]; then
+    meta_ts="$(curl -fsS --connect-timeout 5 --max-time 15 "$AW_SERVER/api/0/buckets/$bucket_id" 2>/dev/null | jq -r '.metadata.end // empty' 2>/dev/null || true)"
+    if [ -n "$meta_ts" ]; then
+      last_ts="$meta_ts"
+    fi
+  fi
   if [ -z "$last_ts" ]; then
     warn "bucket $label ($bucket_id) — нет событий"
     echo "       REMEDIATION: $remediation"
@@ -268,11 +279,11 @@ if [ "$QUICK_MODE" = "1" ]; then
 
   section "4. Buckets (быстрый режим)"
   for entry in \
-    "aw-watcher-afk|AFK watcher|Запустите на RDP: schtasks /Run /TN \"ActivityWatch Recovery\" или schtasks /Run /TN \"ActivityWatch Launch [SHARKON2025_Администратор]\"" \
+    "aw-watcher-afk|AFK watcher|Запустите на RDP: schtasks /Run /TN \"ActivityWatch Recovery\" или launch task для logical host $SOURCE_HOSTNAME" \
     "aw-watcher-window|Window watcher|Запустите через ansible: ansible aw_windows -i $INVENTORY -m win_shell -a 'Start-Process -FilePath \"C:\\Program Files\\AWatch-rus\\bin\\aw-watcher-window\\aw-watcher-window.exe\" -ArgumentList @(\"--host\", \"10.10.10.13\", \"--port\", \"5600\") -WindowStyle Hidden'" \
     "aw-worktime-sessions|Worktime sessions|Проверьте работу worktime-api: systemctl status aw-worktime-api на AW сервере" \
     "aw-session-events|Session events|Проверьте collector-guard и aw-session-events-collector на RDP" \
-    "aw-dlp-endpoint-signals|DLP signals|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Launch [SHARKON2025_Администратор]\"; Start-Sleep 30'" \
+    "aw-dlp-endpoint-signals|DLP signals|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Recovery\"; Start-Sleep 30'" \
     "aw-dlp-incidents|DLP incidents|Проверьте aw-detmir-dlp-collector.ps1 на RDP (логи: C:\\ProgramData\\AWatch-rus\\logs\\)" \
   ; do
     bucket="${entry%%|*}"; rest="${entry#*|}"
@@ -302,10 +313,10 @@ section "4. Buckets (свежесть данных)"
 # ============================================================
 for entry in \
   "aw-watcher-afk|AFK watcher|Запустите на RDP: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Recovery\"'" \
-  "aw-watcher-window|Window watcher|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Launch [SHARKON2025_Администратор]\"; Start-Process -FilePath \"C:\\Program Files\\AWatch-rus\\bin\\aw-watcher-window\\aw-watcher-window.exe\" -ArgumentList @(\"--host\", \"10.10.10.13\", \"--port\", \"5600\") -WindowStyle Hidden'" \
+  "aw-watcher-window|Window watcher|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Recovery\"; Start-Sleep 60'" \
   "aw-worktime-sessions|Worktime sessions|Проверьте: ssh igor@$AW_HOST 'systemctl status aw-worktime-api && journalctl -u aw-worktime-api -n 20'" \
   "aw-session-events|Session events|Проверьте collector-guard на RDP: ansible aw_windows -i $INVENTORY -m win_shell -a 'Get-Process -Name aw-session-events-* -ErrorAction SilentlyContinue'" \
-  "aw-dlp-endpoint-signals|DLP endpoint signals|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Launch [SHARKON2025_Администратор]\"; Start-Sleep 60'" \
+  "aw-dlp-endpoint-signals|DLP endpoint signals|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Recovery\"; Start-Sleep 60'" \
   "aw-dlp-incidents|DLP incidents|Проверьте: ansible aw_windows -i $INVENTORY -m win_shell -a \"Get-Content 'C:\\ProgramData\\AWatch-rus\\logs\\dlp-*.log' -Tail 20\"" \
   "aw-dlp-review|DLP review|Проверьте: ssh igor@$AW_HOST 'journalctl -u aw-dlp-policy-engine.service -n 20 --no-pager'" \
   "aw-dlp-rules|DLP rules|Проверьте: ssh igor@$AW_HOST 'journalctl -u aw-dlp-ioc-refresh.service -n 20 --no-pager'" \
@@ -389,6 +400,9 @@ check_service_remote "Nginx service" "$PROXMOX_HOST" "nginx.service" \
 # ============================================================
 section "10. DLP Pipeline (10.10.10.13)"
 # ============================================================
+if [ "$DLP_ENABLED" = "false" ]; then
+  skip "DLP Pipeline disabled by AW_DLP_ENABLED/DETMIR_DLP_ENABLED=false"
+else
 # DLP Policy Engine — должен быть active (running)
 check_service_remote "DLP Policy Engine" "$AW_HOST" "aw-dlp-policy-engine.service" \
   "Проверьте: ssh igor@$AW_HOST 'sudo journalctl -u aw-dlp-policy-engine.service -n 30 --no-pager'"
@@ -434,6 +448,7 @@ check_service_remote "DLP Webhook Sender timer" "$AW_HOST" "aw-dlp-webhook-sende
 # DLP Report Scheduler
 check_service_remote "DLP Report Scheduler timer" "$AW_HOST" "aw-dlp-report-scheduler.timer" \
   "ssh igor@$AW_HOST 'sudo systemctl enable --now aw-dlp-report-scheduler.timer'"
+fi
 
 # Worktime Influx Exporter
 check_service_remote "Worktime Influx Exporter timer" "$AW_HOST" "aw-worktime-influx-exporter.timer" \
@@ -443,7 +458,7 @@ check_service_remote "Worktime Influx Exporter timer" "$AW_HOST" "aw-worktime-in
 if [ "$SKIP_WINDOWS" = "1" ]; then
   skip "Проверки RDP хоста пропущены (--skip-windows)"
 else
-  section "11. RDP хост (192.168.100.18)"
+  section "11. RDP хост ($WINDOWS_HOST)"
   if have ansible && [ -f "$INVENTORY" ]; then
     check_ansible_module "WinRM ping" aw_windows win_ping
 
@@ -459,7 +474,7 @@ else
       'schtasks /Query /TN "ActivityWatch Recovery" /FO LIST /V | Select-String "Status|Run|Next"'
 
     check_ansible_win_shell "Scheduled tasks (Launch Admin)" \
-      'schtasks /Query /TN "ActivityWatch Launch [SHARKON2025_Администратор]" /FO LIST /V | Select-String "Status|Run|Next"'
+      'Get-Content -Raw "C:\ProgramData\AWatch-rus\deployment-config.json" | ConvertFrom-Json | Select-Object -ExpandProperty userTasks | Select-Object LaunchTaskName,UserId | Format-Table -AutoSize'
   else
     skip "Ansible или inventory не найдены"
   fi
@@ -469,7 +484,7 @@ fi
 section "12. Systemd health (AW server)"
 # ============================================================
 check_ansible_shell "AW server core units" aw_server \
-  'systemctl is-active activitywatch-server aw-worktime-api aw-dlp-policy-engine aw-dlp-case-management aw-worktime-influx-exporter.timer aw-dlp-influx-exporter.timer activitywatch-dlp-aggregator.timer aw-clickhouse-network-health.timer | paste -sd,'
+  'if [ "${AW_DLP_ENABLED:-true}" = "false" ] || [ "${DETMIR_DLP_ENABLED:-true}" = "false" ]; then systemctl is-active activitywatch-server aw-worktime-api aw-worktime-influx-exporter.timer aw-clickhouse-network-health.timer | paste -sd,; else systemctl is-active activitywatch-server aw-worktime-api aw-dlp-policy-engine aw-dlp-case-management aw-worktime-influx-exporter.timer aw-dlp-influx-exporter.timer activitywatch-dlp-aggregator.timer aw-clickhouse-network-health.timer | paste -sd,; fi'
 
 check_ansible_shell "AW server — нет failed units" aw_server \
   'failed=$(systemctl --failed --no-legend | awk "{print \$1}" | grep -E "activitywatch|aw-|dlp" || true); test -z "$failed" && echo "no AW-related failed units" || { echo "$failed"; exit 1; }'

scripts/aw-contour-smoke-local.sh

@@ -40,12 +40,13 @@ GRAFANA_PASSWORD="${GRAFANA_PASSWORD:-}"
 PROXMOX_HOST="${AW_SMOKE_PROXMOX_HOST:-10.10.10.2}"
 AW_HOST="${AW_SMOKE_AW_HOST:-10.10.10.13}"
 GRAFANA_HOST="${AW_SMOKE_GRAFANA_HOST:-10.10.10.11}"
-WINDOWS_HOST="${AW_SMOKE_WINDOWS_HOST:-192.168.100.18}"
-AW_SOURCE_HOSTNAME="${AW_SMOKE_SOURCE_HOSTNAME:-SHARKON2025}"
+WINDOWS_HOST="${AW_SMOKE_WINDOWS_HOST:-${AW_WINDOWS_HOST:-192.168.100.19}}"
+AW_SOURCE_HOSTNAME="${AW_SMOKE_SOURCE_HOSTNAME:-${AW_LOGICAL_HOST_ID:-${AW_MONITORED_WINDOWS_HOSTNAME:-SHARKON2025}}}"
 LOG_DIR="${AW_SMOKE_LOG_DIR:-$REPO_ROOT/output/smoke}"
 RUN_REMOTE="${AW_SMOKE_RUN_REMOTE:-1}"
 RUN_WINRM="${AW_SMOKE_RUN_WINRM:-1}"
 RUN_SERVER_SYSTEMD="${AW_SMOKE_RUN_SERVER_SYSTEMD:-1}"
+LOKI_ENABLED="${AW_SMOKE_LOKI_ENABLED:-0}"
 
 NO_PROXY_REQUIRED="localhost,127.0.0.1,$PROXMOX_HOST,$AW_HOST,$GRAFANA_HOST,$WINDOWS_HOST,10.10.10.0/24,192.168.100.0/24"
 if [ -n "${no_proxy:-}" ]; then
@@ -87,6 +88,7 @@ Environment overrides:
   AW_SMOKE_WORKTIME_API=http://10.10.10.13:5610
   AW_SMOKE_GRAFANA_URL=http://10.10.10.11:3000
   AW_SMOKE_SOURCE_HOSTNAME=SHARKON2025
+  AW_SMOKE_LOKI_ENABLED=0|1
   AW_SMOKE_ENV_FILE=$HOME/.config/aw-contour-smoke.env
   AW_SMOKE_LOG_DIR=$REPO_ROOT/output/smoke
   GRAFANA_USER/GRAFANA_PASSWORD via env or a local env file
@@ -219,6 +221,10 @@ check_http_code_basic_auth() {
 check_grafana_loki_proxy() {
   local name="Grafana Loki datasource proxy"
   local tmp uid code body
+  if [ "$LOKI_ENABLED" != "1" ]; then
+    skip "$name skipped: Loki is intentionally disabled for the current DetMir resource profile"
+    return
+  fi
   tmp="$(mktemp)"
   if ! curl -k -fsS -u "$GRAFANA_USER:$GRAFANA_PASSWORD" --connect-timeout 5 --max-time 20 "$GRAFANA_URL/api/datasources" -o "$tmp" 2>"$tmp.err"; then
     fail "$name cannot list datasources"
@@ -416,7 +422,7 @@ classify_bucket_age() {
 check_bucket_freshness() {
   local bucket="$1"
   local bucket_id="${bucket}_${AW_SOURCE_HOSTNAME}"
-  local tmp last_ts last_id event_epoch now age_sec status
+  local tmp last_ts last_id event_epoch now age_sec status meta_ts
   tmp="$(mktemp)"
   if ! curl -fsS --connect-timeout 5 --max-time 20 "$AW_SERVER/api/0/buckets/$bucket_id/events?limit=1" -o "$tmp" 2>"$tmp.err"; then
     fail "bucket $bucket_id query failed"
@@ -428,6 +434,12 @@ check_bucket_freshness() {
   last_ts="$(jq -r '.[0].timestamp // empty' "$tmp" 2>/dev/null)"
   last_id="$(jq -r '.[0].id // 0' "$tmp" 2>/dev/null)"
   rm -f "$tmp" "$tmp.err"
+  if [ "$bucket" = "aw-watcher-afk" ]; then
+    meta_ts="$(curl -fsS --connect-timeout 5 --max-time 20 "$AW_SERVER/api/0/buckets/$bucket_id" 2>/dev/null | jq -r '.metadata.end // empty' 2>/dev/null || true)"
+    if [ -n "$meta_ts" ]; then
+      last_ts="$meta_ts"
+    fi
+  fi
 
   if [ -z "$last_ts" ]; then
     case "$bucket" in
@@ -611,7 +623,7 @@ if [ "$RUN_WINRM" = "1" ] && have ansible; then
   check_ansible_module "Windows win_ping" aw_windows win_ping
   check_ansible_win_shell "Windows sessions" aw_windows '$psi = [System.Diagnostics.ProcessStartInfo]::new(); $psi.FileName = "$env:SystemRoot\System32\query.exe"; $psi.Arguments = "user"; $psi.UseShellExecute = $false; $psi.RedirectStandardOutput = $true; $psi.RedirectStandardError = $true; $psi.StandardOutputEncoding = [System.Text.Encoding]::GetEncoding(866); $psi.StandardErrorEncoding = [System.Text.Encoding]::GetEncoding(866); $p = [System.Diagnostics.Process]::Start($psi); $out = $p.StandardOutput.ReadToEnd(); $err = $p.StandardError.ReadToEnd(); $p.WaitForExit(); [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false); $out; if ($err) { $err }; if ($out -match "USERNAME|ПОЛЬЗОВАТЕЛЬ|администратор|Администратор") { exit 0 } else { exit $p.ExitCode }'
   check_ansible_win_shell_warn "Windows collector processes" aw_windows '$p = Get-Process aw-watcher-afk,aw-watcher-window -ErrorAction SilentlyContinue; if ($p) { $p | Select-Object Name,Id,SessionId,StartTime | Format-Table -AutoSize } else { "no aw-watcher-afk/window process visible to this WinRM session" }'
-  check_ansible_win_shell "Windows ActivityWatch tasks" aw_windows 'schtasks /Query /TN "ActivityWatch Recovery" /FO LIST /V; schtasks /Query /TN "ActivityWatch Launch [SHARKON2025_Администратор]" /FO LIST /V'
+  check_ansible_win_shell "Windows ActivityWatch tasks" aw_windows 'schtasks /Query /TN "ActivityWatch Recovery" /FO LIST /V; Get-Content -Raw "C:\ProgramData\AWatch-rus\deployment-config.json" | ConvertFrom-Json | Select-Object -ExpandProperty userTasks | Select-Object LaunchTaskName,UserId | Format-Table -AutoSize'
 else
   skip "Windows WinRM checks skipped"
 fi
@@ -625,7 +637,7 @@ else
   skip "check-aw-data.sh missing"
 fi
 if [ -x "$REPO_ROOT/check-aw-full.sh" ]; then
-  if "$REPO_ROOT/check-aw-full.sh"; then pass "check-aw-full.sh completed"; else fail "check-aw-full.sh failed"; fi
+  if AW_SMOKE_AW_SERVER="$AW_SERVER" AW_SMOKE_SOURCE_HOSTNAME="$AW_SOURCE_HOSTNAME" AW_SMOKE_WINDOWS_HOST="$WINDOWS_HOST" "$REPO_ROOT/check-aw-full.sh"; then pass "check-aw-full.sh completed"; else fail "check-aw-full.sh failed"; fi
 else
   skip "check-aw-full.sh missing"
 fi

scripts/detmir-full-diagnostics/aw-contour-diag.sh

@@ -23,9 +23,14 @@ PROXMOX_HOST="10.10.10.2"
 AW_HOST="10.10.10.13"
 GRAFANA_HOST="10.10.10.11"
 INFLUXDB_HOST="10.10.10.10"
-WINDOWS_HOST="192.168.100.18"
+WINDOWS_HOST="${AW_WINDOWS_HOST:-${AW_SMOKE_WINDOWS_HOST:-192.168.100.19}}"
 CLICKHOUSE_HOST="10.10.10.2"
-SOURCE_HOSTNAME="SHARKON2025"
+SOURCE_HOSTNAME="${AW_LOGICAL_HOST_ID:-${AW_MONITORED_WINDOWS_HOSTNAME:-${AW_SMOKE_SOURCE_HOSTNAME:-SHARKON2025}}}"
+DLP_ENABLED="${AW_DLP_ENABLED:-${DETMIR_DLP_ENABLED:-true}}"
+case "${DLP_ENABLED,,}" in
+  0|false|no|off) DLP_ENABLED=false ;;
+  *) DLP_ENABLED=true ;;
+esac
 
 QUICK_MODE=0
 SKIP_WINDOWS=0
@@ -102,7 +107,7 @@ check_http_json_key() {
 check_bucket_freshness() {
   local bucket="$1" label="$2" remediation="$3"
   local bucket_id="${bucket}_${SOURCE_HOSTNAME}"
-  local tmp last_ts event_epoch now age_sec
+  local tmp last_ts event_epoch now age_sec meta_ts
   tmp="$(mktemp)"
   if ! curl -fsS --connect-timeout 5 --max-time 15 "$AW_SERVER/api/0/buckets/$bucket_id/events?limit=1" -o "$tmp" 2>"$tmp.err"; then
     fail "bucket $label ($bucket_id) — запрос не удался"
@@ -113,6 +118,12 @@ check_bucket_freshness() {
   fi
   last_ts="$(jq -r '.[0].timestamp // empty' "$tmp" 2>/dev/null)"
   rm -f "$tmp"
+  if [ "$bucket" = "aw-watcher-afk" ]; then
+    meta_ts="$(curl -fsS --connect-timeout 5 --max-time 15 "$AW_SERVER/api/0/buckets/$bucket_id" 2>/dev/null | jq -r '.metadata.end // empty' 2>/dev/null || true)"
+    if [ -n "$meta_ts" ]; then
+      last_ts="$meta_ts"
+    fi
+  fi
   if [ -z "$last_ts" ]; then
     warn "bucket $label ($bucket_id) — нет событий"
     echo "       REMEDIATION: $remediation"
@@ -268,11 +279,11 @@ if [ "$QUICK_MODE" = "1" ]; then
 
   section "4. Buckets (быстрый режим)"
   for entry in \
-    "aw-watcher-afk|AFK watcher|Запустите на RDP: schtasks /Run /TN \"ActivityWatch Recovery\" или schtasks /Run /TN \"ActivityWatch Launch [SHARKON2025_Администратор]\"" \
+    "aw-watcher-afk|AFK watcher|Запустите на RDP: schtasks /Run /TN \"ActivityWatch Recovery\" или launch task для logical host $SOURCE_HOSTNAME" \
     "aw-watcher-window|Window watcher|Запустите через ansible: ansible aw_windows -i $INVENTORY -m win_shell -a 'Start-Process -FilePath \"C:\\Program Files\\AWatch-rus\\bin\\aw-watcher-window\\aw-watcher-window.exe\" -ArgumentList @(\"--host\", \"10.10.10.13\", \"--port\", \"5600\") -WindowStyle Hidden'" \
     "aw-worktime-sessions|Worktime sessions|Проверьте работу worktime-api: systemctl status aw-worktime-api на AW сервере" \
     "aw-session-events|Session events|Проверьте collector-guard и aw-session-events-collector на RDP" \
-    "aw-dlp-endpoint-signals|DLP signals|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Launch [SHARKON2025_Администратор]\"; Start-Sleep 30'" \
+    "aw-dlp-endpoint-signals|DLP signals|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Recovery\"; Start-Sleep 30'" \
     "aw-dlp-incidents|DLP incidents|Проверьте aw-detmir-dlp-collector.ps1 на RDP (логи: C:\\ProgramData\\AWatch-rus\\logs\\)" \
   ; do
     bucket="${entry%%|*}"; rest="${entry#*|}"
@@ -302,10 +313,10 @@ section "4. Buckets (свежесть данных)"
 # ============================================================
 for entry in \
   "aw-watcher-afk|AFK watcher|Запустите на RDP: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Recovery\"'" \
-  "aw-watcher-window|Window watcher|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Launch [SHARKON2025_Администратор]\"; Start-Process -FilePath \"C:\\Program Files\\AWatch-rus\\bin\\aw-watcher-window\\aw-watcher-window.exe\" -ArgumentList @(\"--host\", \"10.10.10.13\", \"--port\", \"5600\") -WindowStyle Hidden'" \
+  "aw-watcher-window|Window watcher|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Recovery\"; Start-Sleep 60'" \
   "aw-worktime-sessions|Worktime sessions|Проверьте: ssh igor@$AW_HOST 'systemctl status aw-worktime-api && journalctl -u aw-worktime-api -n 20'" \
   "aw-session-events|Session events|Проверьте collector-guard на RDP: ansible aw_windows -i $INVENTORY -m win_shell -a 'Get-Process -Name aw-session-events-* -ErrorAction SilentlyContinue'" \
-  "aw-dlp-endpoint-signals|DLP endpoint signals|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Launch [SHARKON2025_Администратор]\"; Start-Sleep 60'" \
+  "aw-dlp-endpoint-signals|DLP endpoint signals|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Recovery\"; Start-Sleep 60'" \
   "aw-dlp-incidents|DLP incidents|Проверьте: ansible aw_windows -i $INVENTORY -m win_shell -a \"Get-Content 'C:\\ProgramData\\AWatch-rus\\logs\\dlp-*.log' -Tail 20\"" \
   "aw-dlp-review|DLP review|Проверьте: ssh igor@$AW_HOST 'journalctl -u aw-dlp-policy-engine.service -n 20 --no-pager'" \
   "aw-dlp-rules|DLP rules|Проверьте: ssh igor@$AW_HOST 'journalctl -u aw-dlp-ioc-refresh.service -n 20 --no-pager'" \
@@ -389,6 +400,9 @@ check_service_remote "Nginx service" "$PROXMOX_HOST" "nginx.service" \
 # ============================================================
 section "10. DLP Pipeline (10.10.10.13)"
 # ============================================================
+if [ "$DLP_ENABLED" = "false" ]; then
+  skip "DLP Pipeline disabled by AW_DLP_ENABLED/DETMIR_DLP_ENABLED=false"
+else
 # DLP Policy Engine — должен быть active (running)
 check_service_remote "DLP Policy Engine" "$AW_HOST" "aw-dlp-policy-engine.service" \
   "Проверьте: ssh igor@$AW_HOST 'sudo journalctl -u aw-dlp-policy-engine.service -n 30 --no-pager'"
@@ -434,6 +448,7 @@ check_service_remote "DLP Webhook Sender timer" "$AW_HOST" "aw-dlp-webhook-sende
 # DLP Report Scheduler
 check_service_remote "DLP Report Scheduler timer" "$AW_HOST" "aw-dlp-report-scheduler.timer" \
   "ssh igor@$AW_HOST 'sudo systemctl enable --now aw-dlp-report-scheduler.timer'"
+fi
 
 # Worktime Influx Exporter
 check_service_remote "Worktime Influx Exporter timer" "$AW_HOST" "aw-worktime-influx-exporter.timer" \
@@ -443,7 +458,7 @@ check_service_remote "Worktime Influx Exporter timer" "$AW_HOST" "aw-worktime-in
 if [ "$SKIP_WINDOWS" = "1" ]; then
   skip "Проверки RDP хоста пропущены (--skip-windows)"
 else
-  section "11. RDP хост (192.168.100.18)"
+  section "11. RDP хост ($WINDOWS_HOST)"
   if have ansible && [ -f "$INVENTORY" ]; then
     check_ansible_module "WinRM ping" aw_windows win_ping
 
@@ -459,7 +474,7 @@ else
       'schtasks /Query /TN "ActivityWatch Recovery" /FO LIST /V | Select-String "Status|Run|Next"'
 
     check_ansible_win_shell "Scheduled tasks (Launch Admin)" \
-      'schtasks /Query /TN "ActivityWatch Launch [SHARKON2025_Администратор]" /FO LIST /V | Select-String "Status|Run|Next"'
+      'Get-Content -Raw "C:\ProgramData\AWatch-rus\deployment-config.json" | ConvertFrom-Json | Select-Object -ExpandProperty userTasks | Select-Object LaunchTaskName,UserId | Format-Table -AutoSize'
   else
     skip "Ansible или inventory не найдены"
   fi
@@ -469,7 +484,7 @@ fi
 section "12. Systemd health (AW server)"
 # ============================================================
 check_ansible_shell "AW server core units" aw_server \
-  'systemctl is-active activitywatch-server aw-worktime-api aw-dlp-policy-engine aw-dlp-case-management aw-worktime-influx-exporter.timer aw-dlp-influx-exporter.timer activitywatch-dlp-aggregator.timer aw-clickhouse-network-health.timer | paste -sd,'
+  'if [ "${AW_DLP_ENABLED:-true}" = "false" ] || [ "${DETMIR_DLP_ENABLED:-true}" = "false" ]; then systemctl is-active activitywatch-server aw-worktime-api aw-worktime-influx-exporter.timer aw-clickhouse-network-health.timer | paste -sd,; else systemctl is-active activitywatch-server aw-worktime-api aw-dlp-policy-engine aw-dlp-case-management aw-worktime-influx-exporter.timer aw-dlp-influx-exporter.timer activitywatch-dlp-aggregator.timer aw-clickhouse-network-health.timer | paste -sd,; fi'
 
 check_ansible_shell "AW server — нет failed units" aw_server \
   'failed=$(systemctl --failed --no-legend | awk "{print \$1}" | grep -E "activitywatch|aw-|dlp" || true); test -z "$failed" && echo "no AW-related failed units" || { echo "$failed"; exit 1; }'

scripts/detmir-support-run.sh

@@ -79,7 +79,7 @@ fi
 DETMIR_SUPPORT_PVE_HOST="${DETMIR_SUPPORT_PVE_HOST:-10.10.10.2}"
 DETMIR_SUPPORT_AW_HOST="${DETMIR_SUPPORT_AW_HOST:-10.10.10.13}"
 DETMIR_SUPPORT_WEB_HOST="${DETMIR_SUPPORT_WEB_HOST:-$DETMIR_SUPPORT_PVE_HOST}"
-DETMIR_SUPPORT_WINDOWS_HOST="${DETMIR_SUPPORT_WINDOWS_HOST:-192.168.100.18}"
+DETMIR_SUPPORT_WINDOWS_HOST="${DETMIR_SUPPORT_WINDOWS_HOST:-192.168.100.19}"
 DETMIR_SUPPORT_PFSENSE_HOST="${DETMIR_SUPPORT_PFSENSE_HOST:-}"
 DETMIR_SUPPORT_PFSENSE_URL="${DETMIR_SUPPORT_PFSENSE_URL:-}"
 DETMIR_SUPPORT_OPENVPN_HOST="${DETMIR_SUPPORT_OPENVPN_HOST:-}"

scripts/detmir-support.env.example

@@ -2,7 +2,7 @@
 DETMIR_SUPPORT_PVE_HOST=10.10.10.2
 DETMIR_SUPPORT_AW_HOST=10.10.10.13
 DETMIR_SUPPORT_WEB_HOST=10.10.10.2
-DETMIR_SUPPORT_WINDOWS_HOST=192.168.100.18
+DETMIR_SUPPORT_WINDOWS_HOST=192.168.100.19
 
 ## Сетевые компоненты
 DETMIR_SUPPORT_PFSENSE_HOST=10.0.0.1