Add portal prewarm resilience docs

- default DetMir DLP runtime to core_only/disabled with load-guard protection

- add fail-closed placeholder validation and runtime-scoped artifact checks

- document operator re-enable flow for light profile and guard rollback

- update prod docs, env examples, and Ansible DLP defaults

adk-rust/Cargo.lock

@@ -122,9 +122,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
 [[package]]
 name = "arbitrary"
@@ -561,6 +561,18 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
+[[package]]
+name = "containment-engine"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "chrono",
+ "clap",
+ "serde",
+ "serde_json",
+ "sha2",
+]
+
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -698,6 +710,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "clap",
+ "serde_json",
 ]
 
 [[package]]
@@ -739,6 +752,7 @@ dependencies = [
  "sha2",
  "tempfile",
  "tiny_http",
+ "url",
 ]
 
 [[package]]
@@ -1255,8 +1269,10 @@ dependencies = [
  "reqwest",
  "serde",
  "serde_json",
+ "sha2",
  "tempfile",
  "urlencoding",
+ "zip 2.4.2",
 ]
 
 [[package]]
@@ -2120,6 +2136,21 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "security-finding-inbox"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "chrono",
+ "clap",
+ "hayabusa-tools",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "sha2",
+ "tempfile",
+]
+
 [[package]]
 name = "semver"
 version = "1.0.28"

adk-rust/RUNBOOK.md

@@ -1796,6 +1796,76 @@ systemctl is-active tsj-guardian-bot tsj-guardian-watchdog gost-tg
 - требует laptop-only path или интерактивный shell;
 - выводит секреты в stdout/journald/report.
 
+## 12a. DetMir hardline resilience deltas
+
+2026-06-24 Hayabusa poison-package isolation:
+
+- `aw-hayabusa-autoprocess-rust` validates drop zip packages before `accept`;
+- corrupt/empty/unsafe packages and invalid sidecars are quarantined under
+  `/opt/hayabusa/quarantine/drop/...` with `reason.json`;
+- `aw-hayabusa process-inbox` isolates failed incoming packages under
+  `/opt/hayabusa/quarantine/incoming/...` and continues with the rest of the
+  queue;
+- one poison zip no longer blocks the whole Hayabusa batch or trips systemd
+  start-limit by itself;
+- verification: `bash -n aw-server/hayabusa/aw-hayabusa.sh` and
+  `cargo test -p hayabusa-tools` passed locally;
+- live rollout on AW server completed on 2026-06-24 with backups, `doctor` OK,
+  isolated empty-drop dry-run OK, production `incoming_zip=0`, `DROP_COUNT=0`,
+  `staged_dirs=0`; stale 2026-06-20 staging residue moved to quarantine with
+  `reason.json`.
+
+2026-06-24 Windows collector guard child watchdog:
+
+- `AWatchRusCollectorGuardService.cs` now watches the child process via
+  `Process.Exited`;
+- unexpected child exit triggers bounded restart inside the service wrapper;
+- restart budget exhaustion exits the service with a non-zero code so SCM
+  recovery can restart the wrapper instead of leaving `running/no child`;
+- `install-collector-guard-service.ps1` sets `sc.exe failureflag <service> 1`;
+- runtime contract is unchanged: Rust collector guard remains the preferred
+  child, PowerShell guard remains fallback, and `ActivityWatch Recovery` remains
+  enabled as bootstrap fallback;
+- local static verification passed: C# wrapper compiled through PowerShell
+  `Add-Type`; PowerShell installer parsed through the PowerShell parser;
+- live rollout on RDP completed on 2026-06-24 with backup, reinstall in
+  `enforce` mode, `failureflag` enabled, controlled child-kill fault injection,
+  and final validation `service=Running`, `child_count=1`, latest Rust guard
+  cycle `status=ok`.
+
+2026-06-24 DetMir contour resilience check:
+
+- added `scripts/detmir_resilience_check.sh`;
+- repo mode verifies hardening presence for Hayabusa poison quarantine, Windows
+  child watchdog, SCM `failureflag`, and resilience docs;
+- live mode is read-only and checks local AW service/API state, failed systemd
+  units, Hayabusa queues/quarantine, and AW SQLite DB/WAL size thresholds;
+- `scripts/run_awatch_contour_check.sh` can include it with
+  `RUN_RESILIENCE_CHECK=1` and `RESILIENCE_CHECK_MODE=repo|live|all`;
+- strict secret mode (`DETMIR_RESILIENCE_STRICT_SECRETS=1`) fails literal
+  Ansible password assignments without printing secret values;
+- local verification: shell syntax passed, repo mode passed with `ok=15`,
+  `fail=0`, and one WARN for literal private inventory password assignments;
+- live AW server verification passed with `ok=9`, `fail=0`; one expected WARN
+  remains for the deliberate quarantine `reason.json` created during stale
+  staging cleanup.
+
+2026-06-24 live healthd wrapper timeout correction:
+
+- `aw-rus-healthd-rust` had a 20 second default wrapper timeout for
+  `/usr/local/bin/aw-health-check` and `/usr/local/bin/dlp-health-check --json`;
+- under concurrent contour checks the DLP health command could exceed that
+  limit, be killed, and leave partial stdout that healthd reported as
+  `invalid JSON output`;
+- production `/etc/activitywatch/aw-server.env` now sets
+  `AW_RUS_HEALTH_WRAPPER_TIMEOUT_SECONDS=90`, still below the service
+  `TimeoutStartSec=180`;
+- `aw-server/aw-server.env.example` carries the same value so redeploys do not
+  restore the false-fail default;
+- live verification after the change: `aw-rus-healthd.service` finished with
+  `status=0/SUCCESS`, `fail=0`, while AW API, Worktime API and DLP health were
+  independently reachable.
+
 ## 13. Рабочий принцип
 
 Правильный перенос на Rust - это не переписывание строк один-в-один.

adk-rust/crates/aw-rus-healthd/src/main.rs

@@ -6,7 +6,7 @@ use std::path::{Path, PathBuf};
 use std::process::{Command, Stdio};
 use std::time::{Duration, Instant};
 
-use anyhow::{Context, Result};
+use anyhow::{Context, Result, anyhow};
 use chrono::{DateTime, Duration as ChronoDuration, SecondsFormat, Utc};
 use clap::Parser;
 use detmir_core::{exit_codes, parse_utc_rfc3339};
@@ -25,10 +25,10 @@ struct Cli {
     #[arg(long, default_value = "http://127.0.0.1:5610")]
     worktime_api: String,
 
-    #[arg(long, default_value = "198.51.100.18")]
+    #[arg(long, default_value = "")]
     rdp_host: String,
 
-    #[arg(long, default_value = "HOST-EXAMPLE")]
+    #[arg(long, default_value = "")]
     rdp_hostname: String,
 
     #[arg(long, default_value = "/var/lib/activitywatch/health")]
@@ -61,6 +61,9 @@ struct Cli {
     #[arg(long, default_value_t = 3.0)]
     tcp_timeout_seconds: f64,
 
+    #[arg(long, default_value_t = true)]
+    rdp_tcp_required: bool,
+
     #[arg(long)]
     json: bool,
 }
@@ -129,6 +132,10 @@ impl Cli {
                 self.tcp_timeout_seconds,
             );
         }
+        if !cli_arg_present("--rdp-tcp-required") {
+            self.rdp_tcp_required =
+                env_bool_default("AW_RUS_HEALTH_RDP_TCP_REQUIRED", self.rdp_tcp_required);
+        }
         self
     }
 }
@@ -221,9 +228,42 @@ fn env_f64(name: &str, fallback: f64) -> f64 {
 }
 
 fn env_bool(name: &str) -> bool {
+    env_bool_default(name, false)
+}
+
+fn env_bool_default(name: &str, fallback: bool) -> bool {
     env_string(name)
-        .map(|value| matches!(value.to_ascii_lowercase().as_str(), "1" | "true" | "yes"))
-        .unwrap_or(false)
+        .map(|value| match value.to_ascii_lowercase().as_str() {
+            "1" | "true" | "yes" | "on" => true,
+            "0" | "false" | "no" | "off" => false,
+            _ => fallback,
+        })
+        .unwrap_or(fallback)
+}
+
+fn validate_cli_config(cli: &Cli) -> Result<()> {
+    validate_prod_host("rdp_host", &cli.rdp_host)?;
+    validate_prod_host("rdp_hostname", &cli.rdp_hostname)?;
+    Ok(())
+}
+
+fn validate_prod_host(name: &str, value: &str) -> Result<()> {
+    let value = value.trim();
+    if value.is_empty() {
+        return Err(anyhow!("invalid config {name}: value is empty"));
+    }
+    let lowered = value.to_ascii_lowercase();
+    if lowered == "host-example"
+        || lowered.ends_with(".example")
+        || lowered.starts_with("192.0.2.")
+        || lowered.starts_with("198.51.100.")
+        || lowered.starts_with("203.0.113.")
+    {
+        return Err(anyhow!(
+            "invalid config {name}: placeholder/documentation host is not allowed"
+        ));
+    }
+    Ok(())
 }
 
 fn load_env_file(path: &Path) {
@@ -681,6 +721,16 @@ fn normalize_aw_api_base(aw_server: &str) -> String {
     }
 }
 
+fn tcp_check_status(ok: bool, required: bool) -> &'static str {
+    if ok {
+        "ok"
+    } else if required {
+        "fail"
+    } else {
+        "warn"
+    }
+}
+
 fn validation_check(report: &mut ReportBuilder, validation_dir: &Path, max_age_seconds: i64) {
     let Some(path) = latest_validation_report(validation_dir) else {
         report.add(
@@ -812,15 +862,18 @@ fn run(cli: &Cli) -> Result<HealthReport> {
 
     for (port, label) in [(5985_u16, "winrm"), (3389_u16, "rdp")] {
         let (ok, message) = tcp_connect(&cli.rdp_host, port, cli.tcp_timeout_seconds);
+        let status = tcp_check_status(ok, cli.rdp_tcp_required);
         report.add(
             format!("tcp:{label}"),
-            if ok { "ok" } else { "fail" },
+            status,
             if ok {
                 message
-            } else {
+            } else if cli.rdp_tcp_required {
                 format!("unreachable: {message}")
+            } else {
+                format!("optional unreachable: {message}")
             },
-            json!({"host": cli.rdp_host, "port": port}),
+            json!({"host": cli.rdp_host, "port": port, "required": cli.rdp_tcp_required}),
         );
     }
 
@@ -949,6 +1002,7 @@ fn run(cli: &Cli) -> Result<HealthReport> {
 
 fn main() -> Result<()> {
     let cli = Cli::parse().apply_env();
+    validate_cli_config(&cli)?;
     let report = run(&cli)?;
     let json_text = serde_json::to_string_pretty(&report)? + "\n";
     let text = render_text(&report) + "\n";
@@ -1029,4 +1083,20 @@ mod tests {
             "http://127.0.0.1:5600/api/0"
         );
     }
+
+    #[test]
+    fn optional_rdp_tcp_downgrades_unreachable_to_warn() {
+        assert_eq!(tcp_check_status(false, true), "fail");
+        assert_eq!(tcp_check_status(false, false), "warn");
+        assert_eq!(tcp_check_status(true, false), "ok");
+    }
+
+    #[test]
+    fn healthd_rejects_placeholder_hosts() {
+        assert!(validate_prod_host("rdp_host", "192.168.100.19").is_ok());
+        assert!(validate_prod_host("rdp_hostname", "SHARKON2025").is_ok());
+        assert!(validate_prod_host("rdp_host", "198.51.100.18").is_err());
+        assert!(validate_prod_host("rdp_hostname", "HOST-EXAMPLE").is_err());
+        assert!(validate_prod_host("rdp_host", "").is_err());
+    }
 }

adk-rust/crates/check-aw-full/src/main.rs

@@ -7,9 +7,9 @@ use clap::Parser;
 use reqwest::blocking::Client;
 use serde_json::Value;
 
-const DEFAULT_SERVER: &str = "http://192.0.2.13:5600";
-const DEFAULT_HOST: &str = "HOST-EXAMPLE";
-const DEFAULT_RDP_HOST: &str = "198.51.100.18";
+const DEFAULT_SERVER: &str = "http://10.10.10.13:5600";
+const DEFAULT_HOST: &str = "SHARKON2025";
+const DEFAULT_RDP_HOST: &str = "192.168.100.19";
 const BUCKETS: &[(&str, &str)] = &[
     ("aw-watcher-afk", "AFK watcher"),
     ("aw-watcher-window", "Window watcher"),
@@ -38,6 +38,9 @@ struct Cli {
 
     #[arg(long)]
     no_color: bool,
+
+    #[arg(long, default_value_t = true)]
+    dlp_enabled: bool,
 }
 
 #[derive(Debug, Clone)]
@@ -119,7 +122,37 @@ fn main() {
 }
 
 fn run() -> Result<i32> {
-    let cli = Cli::parse();
+    let mut cli = Cli::parse();
+    if cli.server == DEFAULT_SERVER {
+        if let Some(value) = env_nonempty("CHECK_AW_FULL_SERVER")
+            .or_else(|| env_nonempty("AW_SMOKE_AW_SERVER"))
+            .or_else(|| env_nonempty("AW_SERVER"))
+        {
+            cli.server = value;
+        }
+    }
+    if cli.host == DEFAULT_HOST {
+        if let Some(value) = env_nonempty("CHECK_AW_FULL_HOST")
+            .or_else(|| env_nonempty("AW_SMOKE_SOURCE_HOSTNAME"))
+            .or_else(|| env_nonempty("AW_LOGICAL_HOST_ID"))
+            .or_else(|| env_nonempty("AW_MONITORED_WINDOWS_HOSTNAME"))
+        {
+            cli.host = value;
+        }
+    }
+    if cli.rdp_host == DEFAULT_RDP_HOST {
+        if let Some(value) = env_nonempty("CHECK_AW_FULL_RDP_HOST")
+            .or_else(|| env_nonempty("AW_SMOKE_WINDOWS_HOST"))
+            .or_else(|| env_nonempty("AW_WINDOWS_HOST"))
+        {
+            cli.rdp_host = value;
+        }
+    }
+    if let Some(value) =
+        env_nonempty("AW_DLP_ENABLED").or_else(|| env_nonempty("DETMIR_DLP_ENABLED"))
+    {
+        cli.dlp_enabled = parse_env_flag(&value);
+    }
     let server = cli.server.trim_end_matches('/').to_string();
     let colors = Colors::new(!cli.no_color && std::env::var_os("NO_COLOR").is_none());
     let timeout = Duration::from_secs(cli.timeout_seconds.max(1));
@@ -182,7 +215,11 @@ fn run() -> Result<i32> {
     );
 
     let mut rows = Vec::new();
-    for (bucket, label) in BUCKETS {
+    for (bucket, label) in BUCKETS
+        .iter()
+        .copied()
+        .filter(|(bucket, _)| cli.dlp_enabled || !bucket.starts_with("aw-dlp-"))
+    {
         let row = read_bucket_row(&client, &server, &cli.host, bucket, label, now, &context);
         println!(
             "  {:<42} {:<8} {:<20} {}",
@@ -193,6 +230,15 @@ fn run() -> Result<i32> {
         );
         rows.push(row);
     }
+    if !cli.dlp_enabled {
+        println!(
+            "  {:<42} {:<8} {:<20} {}",
+            "DLP buckets",
+            "-",
+            "disabled",
+            colors.paint(colors.cyan, "SKIPPED")
+        );
+    }
     println!();
 
     println!(
@@ -330,7 +376,12 @@ fn read_bucket_row(
             status: BucketStatus::Unknown,
         };
     };
-    let age_sec = (now - ts).num_seconds().max(0);
+    let effective_ts = if bucket == "aw-watcher-afk" {
+        bucket_metadata_end(client, server, &bucket_full).unwrap_or(ts)
+    } else {
+        ts
+    };
+    let age_sec = (now - effective_ts).num_seconds().max(0);
     BucketRow {
         label,
         last_id,
@@ -407,6 +458,15 @@ fn latest_event(client: &Client, server: &str, bucket: &str) -> Result<Option<Va
     Ok(value.as_array().and_then(|items| items.first()).cloned())
 }
 
+fn bucket_metadata_end(client: &Client, server: &str, bucket: &str) -> Option<DateTime<Utc>> {
+    let url = format!("{server}/api/0/buckets/{bucket}");
+    let value = get_json(client, &url).ok()?;
+    value
+        .pointer("/metadata/end")
+        .and_then(Value::as_str)
+        .and_then(parse_ts)
+}
+
 fn get_json(client: &Client, url: &str) -> Result<Value> {
     client
         .get(url)
@@ -423,7 +483,7 @@ fn check_cors(client: &Client, server: &str) -> u16 {
     let url = format!("{server}/api/0/settings/");
     client
         .get(&url)
-        .header("Origin", "http://192.0.2.13:5600")
+        .header("Origin", server)
         .send()
         .map(|response| response.status().as_u16())
         .unwrap_or(0)
@@ -466,6 +526,17 @@ fn json_value_to_string(value: &Value) -> String {
     }
 }
 
+fn env_nonempty(name: &str) -> Option<String> {
+    std::env::var(name).ok().filter(|value| !value.is_empty())
+}
+
+fn parse_env_flag(value: &str) -> bool {
+    matches!(
+        value.trim().to_ascii_lowercase().as_str(),
+        "1" | "true" | "yes" | "on"
+    )
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

adk-rust/crates/detmir-portal/Cargo.toml

@@ -18,6 +18,7 @@ serde_json.workspace = true
 serde_yaml.workspace = true
 sha2.workspace = true
 tiny_http.workspace = true
+url.workspace = true
 
 [dev-dependencies]
 tempfile.workspace = true

adk-rust/crates/detmir-portal/src/production/limits.rs

@@ -11,6 +11,7 @@ use anyhow::{Result, anyhow};
 use chrono::NaiveDate;
 use serde_json::{Value, json};
 use tiny_http::StatusCode;
+use url::Url;
 
 use crate::{
     Cli, MAX_ALLOWED_PAGE_SIZE, MAX_ALLOWED_REPORT_DATE_RANGE_DAYS, MAX_ALLOWED_REQUEST_BODY_BYTES,
@@ -77,6 +78,11 @@ pub(crate) fn validate_portal_config(args: &Cli) -> Result<()> {
             "invalid config max_request_body_bytes: expected 1024..={MAX_ALLOWED_REQUEST_BODY_BYTES}"
         ));
     }
+    validate_runtime_url("worktime_url", &args.worktime_url)?;
+    validate_runtime_url("one_c_url", &args.one_c_url)?;
+    validate_probe_command("status_cmd", &args.status_cmd)?;
+    validate_probe_command("check_cmd", &args.check_cmd)?;
+    validate_probe_command("failed_units_cmd", &args.failed_units_cmd)?;
 
     // SECURITY: environment and module names can reach metrics/log labels.
     // Restrict them to short ASCII tokens to avoid label injection and runaway
@@ -112,6 +118,46 @@ pub(crate) fn validate_portal_config(args: &Cli) -> Result<()> {
     Ok(())
 }
 
+fn validate_runtime_url(name: &str, value: &str) -> Result<()> {
+    let url = Url::parse(value).map_err(|err| anyhow!("invalid config {name}: {err}"))?;
+    if !matches!(url.scheme(), "http" | "https") {
+        return Err(anyhow!("invalid config {name}: expected http or https URL"));
+    }
+    let Some(host) = url.host_str() else {
+        return Err(anyhow!("invalid config {name}: missing host"));
+    };
+    if is_placeholder_host(host) {
+        return Err(anyhow!(
+            "invalid config {name}: placeholder/documentation host is not allowed in production"
+        ));
+    }
+    Ok(())
+}
+
+fn is_placeholder_host(host: &str) -> bool {
+    let host = host.trim().to_ascii_lowercase();
+    host.is_empty()
+        || host == "host-example"
+        || host.ends_with(".example")
+        || host.starts_with("192.0.2.")
+        || host.starts_with("198.51.100.")
+        || host.starts_with("203.0.113.")
+}
+
+fn validate_probe_command(name: &str, command: &str) -> Result<()> {
+    let command = command.trim();
+    if command.is_empty() {
+        return Err(anyhow!("invalid config {name}: command is empty"));
+    }
+    let forbidden = ['\n', '\r', '\0', ';', '|', '&', '<', '>', '`'];
+    if command.contains("$(") || command.chars().any(|ch| forbidden.contains(&ch)) {
+        return Err(anyhow!(
+            "invalid config {name}: shell control operators are not allowed"
+        ));
+    }
+    Ok(())
+}
+
 fn is_safe_environment_name(value: &str) -> bool {
     let value = value.trim();
     !value.is_empty()
@@ -230,6 +276,7 @@ mod tests {
             slow_request_log_ms: DEFAULT_SLOW_REQUEST_LOG_MS,
             environment: "test".to_string(),
             enabled_modules: "executive,workforce,security,forensics,admin".to_string(),
+            dlp_module_enabled: true,
             state_dir: dir.join("state"),
             dlp_db_path: dir.join("dlp.sqlite"),
             evidence_root: dir.to_path_buf(),
@@ -293,6 +340,39 @@ mod tests {
         );
     }
 
+    #[test]
+    fn config_validation_rejects_placeholder_endpoints_and_shell_operators() {
+        let dir = tempfile::tempdir().unwrap();
+        let args = test_cli(dir.path());
+
+        let mut invalid = args.clone();
+        invalid.worktime_url = "http://192.0.2.13:5610".to_string();
+        assert!(
+            validate_portal_config(&invalid)
+                .unwrap_err()
+                .to_string()
+                .contains("placeholder")
+        );
+
+        let mut invalid = args.clone();
+        invalid.one_c_url = "http://198.51.100.2:8710".to_string();
+        assert!(
+            validate_portal_config(&invalid)
+                .unwrap_err()
+                .to_string()
+                .contains("placeholder")
+        );
+
+        let mut invalid = args.clone();
+        invalid.check_cmd = "detmir-check --json; curl http://127.0.0.1".to_string();
+        assert!(
+            validate_portal_config(&invalid)
+                .unwrap_err()
+                .to_string()
+                .contains("shell control")
+        );
+    }
+
     #[test]
     fn query_limits_reject_page_size_and_report_range() {
         let dir = tempfile::tempdir().unwrap();

adk-rust/crates/detmir-portal/src/production/metrics.rs

@@ -34,6 +34,10 @@ struct HttpMetricValue {
 #[derive(Clone, Debug, Default)]
 struct PortalMetrics {
     http: BTreeMap<HttpMetricKey, HttpMetricValue>,
+    report_requests_total: u64,
+    report_cache_hits_total: u64,
+    report_cache_misses_total: u64,
+    report_cache_stale_hits_total: u64,
     reports_generated_total: u64,
     ingestion_records_total: u64,
     ingestion_rejected_total: u64,
@@ -70,6 +74,32 @@ pub(crate) fn record_report_generated() {
     }
 }
 
+pub(crate) fn record_report_request() {
+    if let Ok(mut metrics) = portal_metrics().lock() {
+        metrics.report_requests_total = metrics.report_requests_total.saturating_add(1);
+    }
+}
+
+pub(crate) fn record_report_cache_hit() {
+    if let Ok(mut metrics) = portal_metrics().lock() {
+        metrics.report_cache_hits_total = metrics.report_cache_hits_total.saturating_add(1);
+    }
+}
+
+pub(crate) fn record_report_cache_stale_hit() {
+    if let Ok(mut metrics) = portal_metrics().lock() {
+        metrics.report_cache_hits_total = metrics.report_cache_hits_total.saturating_add(1);
+        metrics.report_cache_stale_hits_total =
+            metrics.report_cache_stale_hits_total.saturating_add(1);
+    }
+}
+
+pub(crate) fn record_report_cache_miss() {
+    if let Ok(mut metrics) = portal_metrics().lock() {
+        metrics.report_cache_misses_total = metrics.report_cache_misses_total.saturating_add(1);
+    }
+}
+
 pub(crate) fn record_ingestion_accepted() {
     if let Ok(mut metrics) = portal_metrics().lock() {
         metrics.ingestion_records_total = metrics.ingestion_records_total.saturating_add(1);
@@ -149,6 +179,26 @@ pub(crate) fn render_prometheus_metrics(args: &Cli) -> String {
         .ok();
     }
     for (name, help, value) in [
+        (
+            "awatch_report_requests_total",
+            "Report payload requests handled by the portal cache layer",
+            metrics.report_requests_total,
+        ),
+        (
+            "awatch_report_cache_hits_total",
+            "Report payload requests served from the in-process cache",
+            metrics.report_cache_hits_total,
+        ),
+        (
+            "awatch_report_cache_misses_total",
+            "Report payload requests that triggered report regeneration",
+            metrics.report_cache_misses_total,
+        ),
+        (
+            "awatch_report_cache_stale_hits_total",
+            "Report payload requests served from stale cache while refresh runs",
+            metrics.report_cache_stale_hits_total,
+        ),
         (
             "awatch_reports_generated_total",
             "Reports generated by the portal",

adk-rust/crates/detmir-portal/src/production/mod.rs

@@ -22,7 +22,8 @@ pub(crate) use limits::{is_limited_api_route, validate_api_query_limits, validat
 pub(crate) use logging::log_http_request;
 pub(crate) use metrics::{
     record_http_metric, record_ingestion_accepted, record_ingestion_rejected,
-    record_report_generated, render_prometheus_metrics,
+    record_report_cache_hit, record_report_cache_miss, record_report_cache_stale_hit,
+    record_report_generated, record_report_request, render_prometheus_metrics,
 };
 pub(crate) use readiness::build_readyz;
 pub(crate) use request_context::{http_request_metadata, mark_request_started};

adk-rust/crates/detmir-portal/src/snapshot_cache.rs

@@ -6,13 +6,20 @@
 
 use std::collections::BTreeMap;
 use std::sync::{Arc, Mutex};
+use std::thread;
 use std::time::{Duration, Instant};
 
 use crate::{Cli, HealthResponse, Snapshot, build_health, build_snapshot, now};
 
 const SNAPSHOT_CACHE_TTL: Duration = Duration::from_secs(120);
 
-pub(crate) type SnapshotCache = Arc<Mutex<Option<CachedSnapshot>>>;
+pub(crate) type SnapshotCache = Arc<Mutex<SnapshotCacheState>>;
+
+#[derive(Clone, Debug, Default)]
+pub(crate) struct SnapshotCacheState {
+    pub(crate) entry: Option<CachedSnapshot>,
+    pub(crate) refresh_in_progress: bool,
+}
 
 #[derive(Clone, Debug)]
 pub(crate) struct CachedSnapshot {
@@ -21,7 +28,7 @@ pub(crate) struct CachedSnapshot {
 }
 
 pub(crate) fn new_snapshot_cache() -> SnapshotCache {
-    Arc::new(Mutex::new(None))
+    Arc::new(Mutex::new(SnapshotCacheState::default()))
 }
 
 pub(crate) fn clone_snapshot_cache(cache: &SnapshotCache) -> SnapshotCache {
@@ -29,23 +36,76 @@ pub(crate) fn clone_snapshot_cache(cache: &SnapshotCache) -> SnapshotCache {
 }
 
 pub(crate) fn cached_snapshot(args: &Cli, cache: &SnapshotCache) -> Snapshot {
-    let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
-    if let Some(cached) = guard.as_ref() {
-        if cached.created.elapsed() <= SNAPSHOT_CACHE_TTL {
-            return cached.snapshot.clone();
+    {
+        let guard = cache.lock().expect("snapshot cache mutex poisoned");
+        if let Some(cached) = guard.entry.as_ref() {
+            if cached.created.elapsed() <= SNAPSHOT_CACHE_TTL {
+                return cached.snapshot.clone();
+            }
         }
     }
+
     let snapshot = build_snapshot(args);
-    *guard = Some(CachedSnapshot {
+    let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
+    guard.entry = Some(CachedSnapshot {
         created: Instant::now(),
         snapshot: snapshot.clone(),
     });
+    guard.refresh_in_progress = false;
     snapshot
 }
 
+pub(crate) fn cached_snapshot_or_refresh(args: &Cli, cache: &SnapshotCache) -> Option<Snapshot> {
+    let mut should_spawn = false;
+    let mut snapshot_to_return = None;
+    {
+        let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
+        if let Some(cached) = guard.entry.as_ref() {
+            let snapshot = cached.snapshot.clone();
+            if cached.created.elapsed() <= SNAPSHOT_CACHE_TTL {
+                return Some(snapshot);
+            }
+            if !guard.refresh_in_progress {
+                guard.refresh_in_progress = true;
+                should_spawn = true;
+            }
+            snapshot_to_return = Some(snapshot);
+        } else if !guard.refresh_in_progress {
+            guard.refresh_in_progress = true;
+            should_spawn = true;
+        }
+    }
+
+    if should_spawn {
+        spawn_snapshot_refresh(args.clone(), clone_snapshot_cache(cache));
+    }
+    snapshot_to_return
+}
+
+fn spawn_snapshot_refresh(args: Cli, cache: SnapshotCache) {
+    thread::spawn(move || {
+        let result =
+            std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| build_snapshot(&args)));
+        let mut guard = cache.lock().expect("snapshot cache mutex poisoned");
+        match result {
+            Ok(snapshot) => {
+                guard.entry = Some(CachedSnapshot {
+                    created: Instant::now(),
+                    snapshot,
+                });
+            }
+            Err(_) => {
+                eprintln!("detmir-portal snapshot cache refresh panicked");
+            }
+        }
+        guard.refresh_in_progress = false;
+    });
+}
+
 pub(crate) fn build_fast_health(cache: &SnapshotCache) -> HealthResponse {
     match cache.try_lock() {
         Ok(guard) => guard
+            .entry
             .as_ref()
             .map(|cached| build_health(&cached.snapshot))
             .unwrap_or_else(lightweight_health),

adk-rust/crates/detmir-portal/src/static/app.css

@@ -97,6 +97,17 @@ body.security-mode .demo-button.is-active {
   color: var(--link);
 }
 
+.compact-actions {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+  min-width: 220px;
+}
+
+.security-findings-table td {
+  vertical-align: top;
+}
+
 .shell {
   max-width: none;
   min-width: 0;

adk-rust/crates/detmir-portal/src/static/app.js

@@ -9,6 +9,7 @@ const state = {
   cases: null,
   kpiExplain: null,
   pendingScrollSelector: null,
+  refreshSeq: 0,
   load: {
     status: "LOADING",
     stage: "Инициализация портала",
@@ -81,7 +82,7 @@ function apiBase() {
 
 function apiRole() {
   if (state.tab === "employees" || state.tab === "departments") return "manager";
-  if (state.tab === "owner" || state.tab === "perimeter") return "security";
+  if (state.tab === "owner" || state.tab === "perimeter" || state.tab === "securityFindings") return "security";
   if (state.tab === "incidents") return "forensics";
   if (state.tab === "settings") return "admin";
   const mode = currentViewMode();
@@ -104,6 +105,22 @@ async function loadJson(path) {
   return response.json();
 }
 
+async function loadJsonWithTimeout(path, timeoutMs) {
+  const controller = new AbortController();
+  const timer = window.setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(`${apiBase()}${path}`, {
+      cache: "no-store",
+      headers: roleHeaders(),
+      signal: controller.signal
+    });
+    if (!response.ok) throw new Error(`${path}: HTTP ${response.status}`);
+    return response.json();
+  } finally {
+    window.clearTimeout(timer);
+  }
+}
+
 async function postJson(path, payload) {
   const response = await fetch(`${apiBase()}${path}`, {
     method: "POST",
@@ -114,6 +131,19 @@ async function postJson(path, payload) {
   return response.json();
 }
 
+function fallbackSummary(error) {
+  return {
+    operator_ok: false,
+    severity: "STALE",
+    blocks: {
+      collection: {
+        status: "STALE",
+        text: `Портал прогревает первичный срез; быстрый summary временно недоступен: ${error?.message || "timeout"}`
+      }
+    }
+  };
+}
+
 function statusClass(status) {
   const s = String(status || "UNKNOWN").toLowerCase();
   if (s === "ok" || s === "ready" || s === "true" || s === "normal" || s === "low" || s === "false_positive" || s === "resolved") return "status-ok";
@@ -480,6 +510,9 @@ function hasTabData(tab, payload) {
   if (tab === "owner" || tab === "perimeter") {
     return Boolean(payload.data && Object.keys(payload.data).length > 0);
   }
+  if (tab === "securityFindings") {
+    return Boolean(payload.data && Object.keys(payload.data).length > 0);
+  }
   if (tab === "incidents") {
     return (Array.isArray(payload.data?.incidents) && payload.data.incidents.length > 0)
       || (Array.isArray(payload.data?.reports?.risk_incident_candidates) && payload.data.reports.risk_incident_candidates.length > 0)
@@ -1370,6 +1403,7 @@ function renderSecurityView(data, report, extras = {}) {
   return `
     ${renderActionCenter(report?.recommended_actions, { title: "Рекомендуемые действия ИБ", security: true })}
     ${renderSecurityEventsSummary(report?.security_events_summary)}
+    ${renderSecurityFindingInbox(extras.securityFindings)}
     ${renderRiskIncidentCandidates(report?.risk_incident_candidates)}
     ${renderSecurityCorrelation(report?.security_correlation)}
     ${renderCases(cases)}
@@ -1382,10 +1416,84 @@ function renderSecurityView(data, report, extras = {}) {
   `;
 }
 
+function renderSecurityFindingInbox(inbox) {
+  if (!inbox) {
+    return `<section class="card security-findings-card"><h3>Подозрительные станции</h3><p class="muted">Очередь подозрительных станций загружается.</p></section>`;
+  }
+  const disabled = inbox.backend === "disabled" || inbox.status === "disabled";
+  const fallback = Boolean(inbox.fallback_used);
+  const status = disabled ? "UNKNOWN" : fallback ? "WARN" : Number(inbox.critical_count || 0) > 0 ? "FAIL" : Number(inbox.open_count || 0) > 0 ? "WARN" : "OK";
+  const items = Array.isArray(inbox.items) ? inbox.items : [];
+  const rows = items.map(item => `
+    <tr>
+      <td>
+        <strong>${ui(item.host || "-")}</strong>
+        <div class="muted small">${ui(item.ip || "-")} · ${ui(item.user || "-")} · ${ui(item.department || "-")}</div>
+      </td>
+      <td><span class="badge ${statusClass(item.severity)}">${ui(item.severity || "-")}</span></td>
+      <td>
+        <strong>${ui(item.state || "-")}</strong>
+        <div class="muted small">${ui(item.workflow_status || "new")} · ${ui(item.last_workflow_event || "created")}</div>
+      </td>
+      <td>
+        <strong>${ui(item.source || "-")}</strong>
+        <div class="muted small">${ui(item.rule_id || "-")}</div>
+      </td>
+      <td>${ui(item.summary || item.rule_title || "-")}</td>
+      <td>
+        <div class="actions compact-actions">
+          <button class="small-button" data-security-finding-action="decide" data-security-finding-id="${escapeHtml(item.finding_id)}">decide</button>
+          <button class="small-button" data-security-finding-action="plan" data-security-finding-id="${escapeHtml(item.finding_id)}">plan</button>
+          <button class="small-button" data-security-finding-action="approve" data-security-finding-id="${escapeHtml(item.finding_id)}">approve</button>
+          <button class="small-button" data-security-finding-action="apply" data-security-finding-id="${escapeHtml(item.finding_id)}">apply</button>
+          <button class="small-button" data-security-finding-action="rollback" data-security-finding-id="${escapeHtml(item.finding_id)}">rollback</button>
+        </div>
+      </td>
+    </tr>
+  `).join("");
+  return `
+    <section class="card security-findings-card">
+      <div class="section-head">
+        <div>
+          <h3 ${tooltip("Очередь подозрительных рабочих станций из Hayabusa/Sigma/Velociraptor/AWatch. Кнопки фиксируют workflow-события, но не выполняют firewall apply.")}>Подозрительные станции</h3>
+          <p class="muted">Security Finding Inbox: triage -> decide -> plan -> approve -> apply. Реальное применение выполняется отдельным executor.</p>
+        </div>
+        <span class="badge ${statusClass(status)}">${ui(status)}</span>
+      </div>
+      <div class="quality-grid">
+        <div><span class="muted">Открыто</span><strong>${ui(inbox.open_count ?? 0)}</strong></div>
+        <div><span class="muted">Critical</span><strong>${ui(inbox.critical_count ?? 0)}</strong></div>
+        <div><span class="muted">High</span><strong>${ui(inbox.high_count ?? 0)}</strong></div>
+        <div><span class="muted">Contained</span><strong>${ui(inbox.contained_count ?? 0)}</strong></div>
+      </div>
+      ${fallback ? `<div class="quality-warning">Security Finding Inbox временно недоступен: ${ui(inbox.error || "ошибка источника")}</div>` : ""}
+      ${disabled ? `<p class="muted small">Security Finding Inbox отключен: включите SECURITY_EVENTS_BACKEND=clickhouse и примените схему ClickHouse.</p>` : ""}
+      ${items.length === 0 ? `<p class="muted">Подозрительных станций в очереди нет.</p>` : `
+        <div class="table-scroll">
+          <table class="data-table security-findings-table">
+            <thead>
+              <tr>
+                <th>Станция</th>
+                <th>Риск</th>
+                <th>Статус</th>
+                <th>Источник</th>
+                <th>Описание</th>
+                <th>Workflow</th>
+              </tr>
+            </thead>
+            <tbody>${rows}</tbody>
+          </table>
+        </div>
+      `}
+    </section>
+  `;
+}
+
 function renderManagerView(report) {
   return `
     ${renderExecutiveDashboard(report)}
     ${renderKpiExplain(report?.workforce_kpi_explain)}
+    ${renderWorkforceOperations(report?.workforce_operations || report?.workforce?.operations)}
     ${renderDepartmentRanking(report)}
     ${renderDepartmentHeatMap(report)}
     ${renderOverviewAnalytics(report)}
@@ -1708,6 +1816,134 @@ function renderSimpleItems(items, emptyText) {
   `).join("")}</div>`;
 }
 
+function renderWorkforceOperations(ops) {
+  if (!ops || typeof ops !== "object") return "";
+  const summary = ops.summary || {};
+  const load = summary.load || {};
+  const idle = summary.idle || {};
+  const discipline = summary.discipline || {};
+  const confidence = summary.confidence || {};
+  const rows = Array.isArray(ops.rows) ? ops.rows.slice(0, 18) : [];
+  const model = ops.model || {};
+  const guardrail = summary.guardrail || "Low confidence строки требуют проверки источников до персонального вывода.";
+  return `
+    <section class="dashboard-band workforce-ops-band">
+      <div class="band-head">
+        <div>
+          <h3>Операционная загрузка</h3>
+          <span class="muted">загрузка, простои, перегруз, дисциплина процесса и достоверность</span>
+        </div>
+        <span class="badge ${statusClass(summary.status || ops.status)}">${ui(summary.status || ops.status || "UNKNOWN")}</span>
+      </div>
+      <div class="quality-grid">
+        <div><span class="muted">Требуют разбора</span><strong>${ui(summary.action_required_users ?? 0)}</strong></div>
+        <div><span class="muted">Недогруз / ниже цели</span><strong>${ui(load.underloaded_users ?? 0)}</strong></div>
+        <div><span class="muted">Перегруз</span><strong>${ui(load.overloaded_users ?? 0)}</strong></div>
+        <div><span class="muted">Простой</span><strong>${ui(idle.idle_users ?? 0)}</strong></div>
+        <div><span class="muted">Дисциплина процесса</span><strong>${ui(discipline.review_users ?? 0)}</strong></div>
+        <div><span class="muted">Low confidence</span><strong>${ui(confidence.low_users ?? 0)}</strong></div>
+      </div>
+      <div class="table-scroll">
+        <table class="data-table">
+          <thead>
+            <tr>
+              <th>Сотрудник</th>
+              <th>Ответственный</th>
+              <th>Активно</th>
+              <th>Простой</th>
+              <th>Coverage</th>
+              <th>Загрузка</th>
+              <th>Простой</th>
+              <th>Дисциплина</th>
+              <th>Достоверность</th>
+              <th>Действие</th>
+            </tr>
+          </thead>
+          <tbody>
+            ${rows.length ? rows.map(row => `
+              <tr>
+                <td><strong>${ui(row.user || "-")}</strong><small>${ui(row.department || "-")}</small></td>
+                <td>${ui(row.manager_owner || "-")}</td>
+                <td>${ui(row.workday_active_hhmm || "00:00")}</td>
+                <td>${ui(row.workday_idle_hhmm || "00:00")}</td>
+                <td>${ui(Math.round(Number(row.coverage_pct || 0)))}%</td>
+                <td><span class="badge ${statusClass(workforceOpsSeverity("load", row.load_status))}">${ui(workforceOpsLabel("load", row.load_status))}</span></td>
+                <td><span class="badge ${statusClass(workforceOpsSeverity("idle", row.idle_status))}">${ui(workforceOpsLabel("idle", row.idle_status))}</span></td>
+                <td><span class="badge ${statusClass(workforceOpsSeverity("discipline", row.discipline_status))}">${ui(workforceOpsLabel("discipline", row.discipline_status))}</span></td>
+                <td><span class="badge ${statusClass(workforceOpsSeverity("confidence", row.data_confidence))}">${ui(workforceOpsLabel("confidence", row.data_confidence))}</span></td>
+                <td>${ui(row.recommended_action || row.operations_recommended_action || row.operations?.recommended_action || "-")}</td>
+              </tr>
+            `).join("") : `
+              <tr><td colspan="10"><strong>Нет данных</strong><small>Управленческий срез Worktime пока не сформирован.</small></td></tr>
+            `}
+          </tbody>
+        </table>
+      </div>
+      <p class="muted small">${ui(guardrail)} · модель: <code>${escapeHtml(model.version || "workforce-operations-v1")}</code> / <code>${escapeHtml(model.type || "rule_based")}</code>.</p>
+    </section>
+  `;
+}
+
+function workforceOpsSeverity(kind, value) {
+  const status = String(value || "").toLowerCase();
+  if (kind === "load") {
+    if (status === "normal") return "OK";
+    if (status === "overloaded") return "HIGH";
+    if (["underloaded", "below_target", "no_activity"].includes(status)) return "WARN";
+    if (["no_data", "insufficient_data"].includes(status)) return "MISSING";
+  }
+  if (kind === "idle") {
+    if (status === "no_significant_idle") return "OK";
+    if (["idle_detected", "full_workday_idle_or_absent"].includes(status)) return "WARN";
+    if (status === "unknown") return "MISSING";
+  }
+  if (kind === "discipline") {
+    if (status === "ok") return "OK";
+    if (status) return "WARN";
+  }
+  if (kind === "confidence") {
+    if (status === "high") return "OK";
+    if (status === "medium") return "WARN";
+    if (status === "low") return "MISSING";
+  }
+  return "UNKNOWN";
+}
+
+function workforceOpsLabel(kind, value) {
+  const status = String(value || "").toLowerCase();
+  const labels = {
+    load: {
+      insufficient_data: "нет окна",
+      no_data: "нет данных",
+      no_activity: "нет активности",
+      underloaded: "недогруз",
+      below_target: "ниже цели",
+      normal: "норма",
+      overloaded: "перегруз",
+    },
+    idle: {
+      not_applicable: "не применимо",
+      unknown: "нет данных",
+      full_workday_idle_or_absent: "пустой день",
+      idle_detected: "простой",
+      no_significant_idle: "без простоя",
+    },
+    discipline: {
+      ok: "процесс в норме",
+      off_hours: "вне графика",
+      late_start: "поздний старт",
+      early_finish: "раннее завершение",
+      multiple_flags: "несколько отклонений",
+    },
+    confidence: {
+      high: "high",
+      medium: "medium",
+      low: "low",
+    },
+  };
+  return labels[kind]?.[status] || value || "unknown";
+}
+
 function workforceIndexText(usersCount, activeSeconds) {
   const users = Number(usersCount || 0);
   const seconds = Number(activeSeconds || 0);
@@ -3037,6 +3273,7 @@ function renderReports(data) {
     <h3 class="section-title">Ключевые показатели</h3>
     ${renderKpiCards(data.kpis)}
     ${renderKpiExplain(data.workforce_kpi_explain)}
+    ${renderWorkforceOperations(data.workforce_operations || data.workforce?.operations)}
     ${renderAgentQuality(data.agent_quality, data.agent_quality_explain)}
     ${renderAgentQualityHistory(data.agent_quality_history, data.agent_quality_history_summary)}
     ${renderAgentQualityNodes(data.agent_quality_nodes, data.agent_quality_nodes_summary)}
@@ -3107,28 +3344,41 @@ async function refresh(options = {}) {
   const content = document.getElementById("content");
   const background = Boolean(options.background);
   const stage = options.stage || "Получение данных";
+  const refreshSeq = ++state.refreshSeq;
+  const isCurrentRefresh = () => refreshSeq === state.refreshSeq;
   const progress = (status, label, value) => {
-    if (!background) setLoadStatus(status, label, value);
+    if (!background && isCurrentRefresh()) setLoadStatus(status, label, value);
   };
   try {
     progress("LOADING", stage, 8);
-    if (!background && content) content.innerHTML = renderLoadingContent(stage);
+    if (!background && content && isCurrentRefresh()) {
+      content.innerHTML = renderLoadingContent(stage);
+    }
     if (!state.links) {
       progress("LOADING", "Получение данных", 18);
       state.links = await loadJson("/links");
+      if (!isCurrentRefresh()) return;
     }
     progress("LOADING", "Расчёт показателей", 34);
-    const summary = await loadJson("/summary");
+    const summary = await loadJsonWithTimeout("/summary", 5000).catch(fallbackSummary);
+    if (!isCurrentRefresh()) return;
     progress("LOADING", "Расчёт показателей", 46);
     state.readiness = {
-      bundle: await loadJson("/readiness/bundle").catch(error => ({ ok: false, error: error.message })),
+      bundle: await loadJsonWithTimeout("/readiness/bundle", 3000).catch(error => ({ ok: false, error: error.message })),
       verify: state.readiness?.verify || null
     };
+    if (!isCurrentRefresh()) return;
     renderSummary(summary, state.readiness);
     progress("LOADING", "Формирование главного вывода", 68);
     const tabResult = await loadCurrentTab();
+    if (!isCurrentRefresh()) return;
     progress("LOADING", "Подготовка разделов", 88);
     if (!hasTabData(state.tab, tabResult)) {
+      if (tabResult.html && tabResult.html.includes("data-loading-state=\"STALE\"")) {
+        setLoadStatus("STALE", "Первичный срез прогревается", 100, { error: "cache/prewarm in progress" });
+        if (content) content.innerHTML = tabResult.html;
+        return;
+      }
       setLoadStatus("EMPTY", "Данные отсутствуют", 100);
       if (content) {
         content.innerHTML = `${renderEmptyState("Источники ответили, но полезные записи для текущего раздела пока не найдены.")}${tabResult.html || ""}`;
@@ -3139,20 +3389,29 @@ async function refresh(options = {}) {
     setLoadStatus("READY", "Данные готовы", 100);
     consumePendingScroll();
   } catch (error) {
+    if (!isCurrentRefresh()) return;
     showError(error);
   }
 }
 
 async function loadCurrentTab() {
   if (state.tab === "operator") {
-    const data = await loadJson("/operator");
+    const data = await loadJsonWithTimeout("/operator", 7000).catch(error => null);
+    if (!data) {
+      return {
+        data: {},
+        html: staleBanner("Портал прогревает первичный срез. Быстрые health/readiness доступны, тяжелый операционный срез будет подставлен после cache/prewarm.")
+      };
+    }
     state.operatorData = data;
-    state.reports = await loadJson("/reports").catch(() => state.reports);
+    state.reports = await loadJsonWithTimeout("/reports", 3000).catch(() => state.reports);
+    let securityFindings = null;
     if (currentViewMode() === "security" || currentViewMode() === "forensics") {
       state.cases = await loadJson("/cases").catch(error => ({ ok: false, error: error.message, cases: [] }));
+      securityFindings = await loadJson("/security/findings").catch(error => ({ status: "fallback", fallback_used: true, error: error.message, items: [] }));
     }
     updateFilters(state.reports);
-    return { data, report: state.reports, cases: state.cases, html: renderOperator(data, state.reports, { cases: state.cases }) };
+    return { data, report: state.reports, cases: state.cases, securityFindings, html: renderOperator(data, state.reports, { cases: state.cases, securityFindings }) };
   }
   if (state.tab === "manager") {
     const data = await loadJson("/manager");
@@ -3178,6 +3437,19 @@ async function loadCurrentTab() {
     const data = await loadJson("/owner");
     return { data, html: renderOwner(data) };
   }
+  if (state.tab === "securityFindings") {
+    const data = await loadJson("/security/findings");
+    return { data, html: `
+      <div class="page-head">
+        <div>
+          <h2 class="section-title">Подозрительные станции</h2>
+          <p class="muted">Очередь triage для Hayabusa/Sigma/Velociraptor/AWatch findings. Реальное применение containment выполняется отдельным executor.</p>
+        </div>
+        <span class="badge ${statusClass(data.status)}">${ui(data.status || "unknown")}</span>
+      </div>
+      ${renderSecurityFindingInbox(data)}
+    ` };
+  }
   if (state.tab === "incidents") {
     const data = await loadJson("/incidents");
     const evidence = await loadJson("/dlp/evidence").catch(error => ({ ok: false, error: error.message, items: [] }));
@@ -3213,6 +3485,7 @@ function tabLoadingStage(tab) {
     employees: "Получение данных сотрудников",
     departments: "Расчёт показателей подразделений",
     owner: "Формирование главного вывода по рискам",
+    securityFindings: "Загрузка очереди подозрительных станций",
     incidents: "Подготовка разделов расследований",
     perimeter: "Подготовка разделов сетевого периметра",
     reports: "Подготовка разделов отчета",
@@ -3230,7 +3503,7 @@ function setTab(tab) {
 }
 
 function applySecurityMode(tab) {
-  document.body.classList.toggle("security-mode", tab === "owner" || tab === "incidents" || tab === "perimeter");
+  document.body.classList.toggle("security-mode", tab === "owner" || tab === "incidents" || tab === "perimeter" || tab === "securityFindings");
 }
 
 function consumePendingScroll() {
@@ -3311,6 +3584,12 @@ document.addEventListener("click", event => {
   incidentAction(button).catch(showError);
 });
 
+document.addEventListener("click", event => {
+  const button = event.target.closest("[data-security-finding-action]");
+  if (!button) return;
+  securityFindingWorkflowAction(button).catch(showError);
+});
+
 document.addEventListener("click", event => {
   const button = event.target.closest("[data-review-status]");
   if (!button) return;
@@ -3425,6 +3704,23 @@ async function incidentAction(button) {
   await refresh({ stage: "Обновление статуса инцидента" });
 }
 
+async function securityFindingWorkflowAction(button) {
+  const findingId = button.dataset.securityFindingId;
+  const action = button.dataset.securityFindingAction;
+  const promptText = action === "apply"
+    ? "Комментарий к apply request. Реальное применение firewall отсюда не выполняется."
+    : `Комментарий к действию ${action}`;
+  const comment = window.prompt(promptText, "");
+  if (comment === null) return;
+  button.disabled = true;
+  await postJson("/security/findings/workflow", {
+    finding_id: findingId,
+    action,
+    comment,
+  });
+  await refresh({ stage: "Обновление очереди подозрительных станций" });
+}
+
 async function candidateReviewAction(button) {
   const candidateId = button.dataset.candidateId;
   const status = button.dataset.reviewStatus;

adk-rust/crates/detmir-portal/src/static/index.html

@@ -18,6 +18,7 @@
         <button class="tab" data-tab="employees">Сотрудники</button>
         <button class="tab" data-tab="departments">Подразделения</button>
         <button class="tab" data-tab="owner">Риски</button>
+        <button class="tab" data-tab="securityFindings">Подозрительные станции</button>
         <button class="tab" data-tab="incidents">Расследования</button>
         <button class="tab" data-tab="perimeter">Сетевой периметр</button>
         <button class="tab" data-tab="reports">Отчеты</button>

adk-rust/crates/detmir-portal/src/workforce_kpi_explain.rs

@@ -549,6 +549,7 @@ mod tests {
         };
         Snapshot {
             generated_at_utc: "2026-06-07T10:00:00Z".to_string(),
+            dlp_module_enabled: true,
             detmir_status: SourceStatus {
                 ok: true,
                 status: "OK".to_string(),

adk-rust/crates/detmir-readiness/src/main.rs

@@ -18,7 +18,9 @@ const DEFAULT_AW_ENV_FILE: &str = "/etc/activitywatch/aw-server.env";
 const DEFAULT_GRAFANA_ENV_FILE: &str = "/etc/detmir-grafana-check.env";
 const DEFAULT_GRAFANA_URL: &str = "http://127.0.0.1:3000";
 const DEFAULT_GRAFANA_DATASOURCE_UID: &str = "influxdb_aw";
-const DEFAULT_SYSTEMD_SERVICES: &str = "activitywatch-server,aw-worktime-api,aw-worktime-influx-exporter.timer,aw-dlp-influx-exporter.timer";
+const DEFAULT_SYSTEMD_SERVICES: &str =
+    "activitywatch-server,aw-worktime-api,aw-worktime-influx-exporter.timer";
+const DEFAULT_DLP_SYSTEMD_SERVICES: &str = "aw-dlp-influx-exporter.timer";
 const DEFAULT_RETENTION_DAYS: i64 = 30;
 
 #[derive(Debug, Parser)]
@@ -218,14 +220,26 @@ fn run(cli: &Cli) -> Result<Report> {
     let mut checks = Vec::new();
     let worktime = influx_config(&aw_env, "AW_WORKTIME_INFLUX");
     let dlp = influx_config(&aw_env, "AW_DLP_INFLUX");
+    let dlp_enabled = env_bool(&aw_env, "AW_DLP_ENABLED", true);
 
     checks.push(check_influx_env(&worktime, cli.allow_disabled_influx));
-    checks.push(check_influx_env(&dlp, cli.allow_disabled_influx));
+    if dlp_enabled {
+        checks.push(check_influx_env(&dlp, cli.allow_disabled_influx));
+    } else {
+        checks.push(warn(
+            "env:AW_DLP_INFLUX",
+            "DLP Influx runtime disabled by AW_DLP_ENABLED=false",
+            json!({"enabled": false, "mode": "disabled"}),
+        ));
+    }
 
     if cli.skip_systemd {
         checks.push(warn("systemd", "systemd checks skipped", json!({})));
     } else {
-        checks.extend(check_systemd_services(&cli.systemd_services));
+        checks.extend(check_systemd_services(&systemd_services_for_mode(
+            &cli.systemd_services,
+            dlp_enabled,
+        )));
     }
 
     if cli.skip_influx_write {
@@ -236,7 +250,15 @@ fn run(cli: &Cli) -> Result<Report> {
         ));
     } else {
         checks.push(check_influx_write(&client, "worktime", &worktime));
-        checks.push(check_influx_write(&client, "dlp", &dlp));
+        if dlp_enabled {
+            checks.push(check_influx_write(&client, "dlp", &dlp));
+        } else {
+            checks.push(warn(
+                "influx:write:dlp",
+                "DLP write probe skipped because DLP is disabled",
+                json!({"enabled": false, "mode": "disabled"}),
+            ));
+        }
     }
 
     if cli.skip_grafana {
@@ -270,7 +292,7 @@ fn run(cli: &Cli) -> Result<Report> {
         git_commit: cli.git_commit.clone(),
         counts,
         checks,
-        limitations: build_limitations(cli),
+        limitations: build_limitations(cli, dlp_enabled),
     })
 }
 
@@ -338,6 +360,20 @@ fn split_csv(value: &str) -> Vec<String> {
         .collect()
 }
 
+fn systemd_services_for_mode(csv: &str, dlp_enabled: bool) -> String {
+    let mut services = split_csv(csv);
+    if dlp_enabled {
+        for service in split_csv(DEFAULT_DLP_SYSTEMD_SERVICES) {
+            if !services.iter().any(|item| item == &service) {
+                services.push(service);
+            }
+        }
+    } else {
+        services.retain(|service| !service.contains("dlp"));
+    }
+    services.into_iter().collect::<Vec<_>>().join(",")
+}
+
 fn hostname() -> String {
     Command::new("hostname")
         .output()
@@ -348,7 +384,7 @@ fn hostname() -> String {
         .unwrap_or_else(|| "unknown".to_string())
 }
 
-fn build_limitations(cli: &Cli) -> Vec<String> {
+fn build_limitations(cli: &Cli, dlp_enabled: bool) -> Vec<String> {
     let mut limitations = Vec::new();
     limitations.push(
         "Проверка подтверждает состояние runtime на момент формирования акта и не заменяет аудит конфигурации, нагрузочное тестирование или приемочные испытания заказчика.".to_string(),
@@ -377,6 +413,11 @@ fn build_limitations(cli: &Cli) -> Vec<String> {
                 .to_string(),
         );
     }
+    if !dlp_enabled {
+        limitations.push(
+            "DLP runtime отключен штатно через AW_DLP_ENABLED=false; readiness не считает DLP services/timers и DLP Influx write обязательными.".to_string(),
+        );
+    }
     limitations
 }
 

ansible/README.md

@@ -38,9 +38,15 @@ ansible-playbook -i inventory.ini deploy_aw_server.yml
 Рекомендуемый способ не хранить пароли в репозитории — перед запуском экспортировать их в переменные окружения:
 
 - Linux `aw_server` (SSH пароль root): `AW_SSH_PASSWORD`
+- Linux `proxmox` (SSH пароль): `AW_PROXMOX_SSH_PASSWORD`
+- Sudo для Linux, если отличается от SSH: `AW_SUDO_PASSWORD` или
+  `AW_PROXMOX_SUDO_PASSWORD`
 - Windows `aw_windows` (WinRM пароль): `AW_WINRM_PASSWORD`
 
-В `group_vars/aw_server.yml` и `group_vars/windows.yml` они читаются через `lookup('env', ...)`.
+В `group_vars/aw_server.yml`, `group_vars/proxmox.yml` и
+`group_vars/aw_windows.yml` они читаются через `lookup('env', ...)`.
+В `ansible/inventory.ini` пароли хранить нельзя: там остаются только host,
+user, port и connection-параметры.
 
 ## Полный установочный playbook (всё за один запуск)
 
@@ -125,8 +131,8 @@ Playbook:
 - после deploy принудительно запускает `ActivityWatch Recovery` и managed `ActivityWatch Launch *` задачи;
 - включает (`Enable-ScheduledTask`) `ActivityWatch Recovery` и managed `ActivityWatch Launch *` задачи перед запуском (иначе WebUI может показывать `Active time: 0s`);
 - оставляет `ActivityWatch Recovery` включённым даже при активном `AWatchRusCollectorGuard`: guard является основным контроллером, recovery остаётся fallback/bootstrap path;
-- выполняет API smoke-check bucket `aw-watcher-afk_<COMPUTERNAME>` и ожидает свежие события;
-- выполняет API smoke-check bucket `aw-watcher-window_<COMPUTERNAME>` и ожидает свежие события (по умолчанию включено);
+- выполняет API smoke-check bucket `aw-watcher-afk_<aw_windows_logical_host_id>` и ожидает свежие события;
+- выполняет API smoke-check bucket `aw-watcher-window_<aw_windows_logical_host_id>` и ожидает свежие события (по умолчанию включено);
 - запускает `validate-deployment.ps1`;
 - забирает JSON-отчёт в локальную директорию (`/tmp/aw-rus-validation-<USER>` по умолчанию).
 - настраивает scheduled task `ActivityWatch Hayabusa Upload` с периодом и lookback по vars.
@@ -146,8 +152,10 @@ Playbook:
 - `aw_windows_legacy_install_root` / `aw_windows_legacy_state_root` — старые production paths, откуда выполняется перенос;
 - `aw_windows_migration_report_remote_path` — JSON-отчёт о миграции на Windows-хосте;
 - `aw_windows_package_version`, `aw_windows_package_url`, `aw_windows_package_zip_path` — версия и источник Windows-пакета ActivityWatch;
-- `aw_windows_api_smoke_check_bucket: ""` — автоматически использовать `aw-watcher-afk_<COMPUTERNAME>`;
-- `aw_windows_api_smoke_check_window_enabled: true` — включить дополнительный smoke-check `aw-watcher-window_<COMPUTERNAME>`;
+- `aw_windows_domain: ""` — Windows account domain/local logon prefix. Если пусто или `HOST-EXAMPLE`, playbook берёт текущий `$env:COMPUTERNAME` с Windows-хоста через WinRM;
+- `aw_windows_logical_host_id: ""` — stable ActivityWatch id для bucket-ов/дашбордов; если пусто, fallback к `COMPUTERNAME`;
+- `aw_windows_api_smoke_check_bucket: ""` — автоматически использовать `aw-watcher-afk_<aw_windows_logical_host_id>`;
+- `aw_windows_api_smoke_check_window_enabled: true` — включить дополнительный smoke-check `aw-watcher-window_<aw_windows_logical_host_id>` с fallback к физическому `COMPUTERNAME`;
 - `aw_windows_api_smoke_check_window_bucket: ""` — переопределить bucket для window smoke-check;
 - `aw_windows_api_smoke_check_min_events: 1` — минимум событий, ожидаемых в smoke-check;
 - `aw_windows_fail_on_validation_error: true` — завершать playbook ошибкой, если `validate-deployment.ps1` возвращает `overallOk=false`;
@@ -157,7 +165,7 @@ Playbook:
 - `aw_windows_hayabusa_auto_upload_hours_back: 6` — lookback для каждого запуска;
 - `aw_windows_hayabusa_auto_upload_mode: "incident"` — mode для server-side processing;
 - `aw_windows_hayabusa_auto_upload_task_name: "ActivityWatch Hayabusa Upload"` — имя scheduled task.
-- `aw_windows_hayabusa_auto_upload_run_as_user: "Администратор"` — production principal для scheduled task на RDP-хосте. На `SHARKON2025` запуск `powershell.exe` из `SYSTEM` возвращал `0xC0000142`, поэтому авто-upload должен идти как interactive/highest task от локального администратора.
+- `aw_windows_hayabusa_auto_upload_run_as_user: "Администратор"` — production principal для scheduled task на RDP-хосте. На текущем DetMir RDP-контуре запуск `powershell.exe` из `SYSTEM` возвращал `0xC0000142`, поэтому auto-upload должен идти как interactive/highest task от локального администратора.
 
 ## Server-side Hayabusa auto-case и Telegram alerting
 
@@ -290,3 +298,5 @@ bash scripts/prod_rollout.sh
 ```
 
 Скрипт попросит `AW_SSH_PASSWORD` и `AW_WINRM_PASSWORD` интерактивно (ввод скрыт) и сложит логи в `.rollout-logs/`.
+Для Proxmox можно дополнительно экспортировать `AW_PROXMOX_SSH_PASSWORD`, если
+он отличается от `AW_SSH_PASSWORD`.

ansible/deploy_aw_server.yml

@@ -19,6 +19,22 @@
     aw_db_vacuum_timer_enabled: false
 
   tasks:
+    - name: Refuse inconsistent DLP resource profile
+      ansible.builtin.assert:
+        that:
+          - aw_dlp_profile | default('core_only') in ['core_only', 'light', 'on_demand', 'full']
+          - (aw_dlp_profile | default('core_only') == 'core_only') or (aw_dlp_enabled | default(false) | bool)
+          - (aw_dlp_enabled | default(false) | bool) or not (
+              aw_dlp_influx_enabled | default(false) | bool
+              or aw_dlp_ioc_enabled | default(false) | bool
+              or aw_dlp_policy_engine_enabled | default(false) | bool
+              or aw_dlp_content_analysis_enabled | default(false) | bool
+              or aw_dlp_integrations_enabled | default(false) | bool
+              or aw_dlp_case_management_enabled | default(false) | bool
+              or aw_dlp_compliance_enabled | default(false) | bool
+            )
+        fail_msg: "Inconsistent DLP profile: keep aw_dlp_enabled=false with all DLP component flags false, or explicitly choose aw_dlp_enabled=true and aw_dlp_profile=light|on_demand|full."
+
     - name: Установить базовые пакеты
       ansible.builtin.apt:
         name:
@@ -78,6 +94,7 @@
         - "{{ aw_server_data_dir }}/backups"
         - "{{ aw_server_data_dir }}/slo"
         - "{{ aw_server_data_dir }}/browser-smoke"
+        - "{{ aw_security_finding_executor_work_dir | default(aw_server_data_dir ~ '/security-finding-executor') }}"
         - "{{ aw_rus_health_state_dir }}"
         - "{{ aw_rus_health_validation_dir }}"
         - "{{ aw_server_log_dir }}"
@@ -108,6 +125,7 @@
         - "{{ aw_server_data_dir }}/backups"
         - "{{ aw_server_data_dir }}/slo"
         - "{{ aw_server_data_dir }}/browser-smoke"
+        - "{{ aw_security_finding_executor_work_dir | default(aw_server_data_dir ~ '/security-finding-executor') }}"
         - "{{ aw_rus_health_state_dir }}"
         - "{{ aw_rus_health_validation_dir }}"
         - "{{ aw_server_log_dir }}"
@@ -713,7 +731,9 @@
               - aw_effective_dlp_influx_token | length > 0
               - (aw_effective_dlp_influx_token | string | lower | regex_search('^(change_me|changeme|replace-me|replace_me|token|secret|password|api_key|influx_token|write_token|your_.*|<.*>)$')) is none
             fail_msg: "aw_dlp_influx_enabled=true, но token пуст и в локальном env, и в текущем /etc/activitywatch/aw-server.env. Exporter будет падать и Grafana не получит DLP-ряды."
-          when: aw_dlp_influx_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_influx_enabled | default(false) | bool
 
         - name: Проверить destination для AW worktime Influx exporter
           ansible.builtin.assert:
@@ -745,7 +765,9 @@
               - (aw_dlp_influx_hosts | default('') | string | length) > 0
               - "'WINDOWS_USER_EXAMPLE' not in (aw_dlp_influx_hosts | default('') | string)"
             fail_msg: "aw_dlp_influx_enabled=true, но URL/org/bucket/hosts похожи на public example/TEST-NET значения. Задайте live значения в private inventory/env, не в public repo."
-          when: aw_dlp_influx_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_influx_enabled | default(false) | bool
 
         - name: Записать /etc/activitywatch/aw-server.env перед хотфиксами
           ansible.builtin.copy:
@@ -764,7 +786,7 @@
               AW_SERVER_GROUP={{ aw_server_group }}
               AW_WORKTIME_REPORT_BASE={{ aw_worktime_report_base }}
               AW_WORKTIME_TZ={{ aw_worktime_timezone }}
-              AW_WORKTIME_HOST={{ aw_effective_worktime_host | default(aw_effective_monitored_windows_hostname | default('SHARKON2025')) }}
+              AW_WORKTIME_HOST={{ aw_effective_worktime_host | default(aw_effective_monitored_windows_hostname | default('HOST-EXAMPLE')) }}
               AW_WORKTIME_EVENTS_LIMIT={{ aw_worktime_events_limit | default(5000) }}
               AW_WORKTIME_AW_HTTP_TIMEOUT_SECONDS={{ aw_worktime_aw_http_timeout_seconds | default(6) }}
               AW_WORKTIME_EVENTS_CACHE_TTL_SECONDS={{ aw_worktime_events_cache_ttl_seconds | default(300) }}
@@ -787,7 +809,7 @@
               AW_WORKTIME_INFLUX_URL={{ aw_worktime_influx_url | default('') }}
               AW_WORKTIME_INFLUX_ORG={{ aw_worktime_influx_org | default('proxmox') }}
               AW_WORKTIME_INFLUX_BUCKET={{ aw_worktime_influx_bucket | default('aw_metrics') }}
-              AW_WORKTIME_INFLUX_HOSTS={{ aw_worktime_influx_hosts | default('SHARKON2025') }}
+              AW_WORKTIME_INFLUX_HOSTS={{ aw_worktime_influx_hosts | default(aw_effective_monitored_windows_hostname | default('HOST-EXAMPLE')) }}
               AW_WORKTIME_INFLUX_DAYS={{ aw_worktime_influx_days | default('today,yesterday') }}
               AW_WORKTIME_INFLUX_TOKEN={{ aw_effective_worktime_influx_token | default('') }}
               AW_WORKTIME_MANAGEMENT_HISTORY_DIR={{ aw_worktime_management_history_dir | default(aw_server_data_dir ~ '/worktime-management-history') }}
@@ -798,11 +820,28 @@
               AW_WORKTIME_MANAGER_TREND_DELTA_PCT={{ aw_worktime_manager_trend_delta_pct | default(10) }}
               AW_WORKTIME_MANAGER_OFF_HOURS_THRESHOLD_SECONDS={{ aw_worktime_manager_off_hours_threshold_seconds | default(1800) }}
               AW_WORKTIME_MANAGER_INTERPRETATION_POLICY={{ aw_worktime_interpretation_policy_path | default('/etc/activitywatch/worktime-interpretation-policy.json') }}
-              AW_DLP_INFLUX_ENABLED={{ 'true' if (aw_dlp_influx_enabled | default(false) | bool) else 'false' }}
+              AW_DLP_ENABLED={{ 'true' if (aw_dlp_enabled | default(false) | bool) else 'false' }}
+              AW_DLP_PROFILE={{ aw_dlp_profile | default('core_only') }}
+              AW_DLP_DISABLED_REASON={{ aw_dlp_disabled_reason | default('') }}
+              AW_DLP_DISABLED_SINCE={{ aw_dlp_disabled_since | default('') }}
+              AW_DLP_GUARD_ENABLED={{ 'true' if (aw_dlp_light_guard_enabled | default(true) | bool) else 'false' }}
+              AW_DLP_GUARD_STATE_DIR={{ aw_dlp_light_guard_state_dir | default(aw_server_data_dir ~ '/health') }}
+              AW_DLP_GUARD_LOAD_RATIO={{ aw_dlp_light_guard_load_ratio | default('1.50') }}
+              AW_DLP_GUARD_MEM_AVAILABLE_PCT_MIN={{ aw_dlp_light_guard_mem_available_pct_min | default('15') }}
+              AW_DLP_GUARD_IOWAIT_PCT_MAX={{ aw_dlp_light_guard_iowait_pct_max | default('20') }}
+              AW_DLP_GUARD_STRIKES_REQUIRED={{ aw_dlp_light_guard_strikes_required | default(3) }}
+              AW_DLP_CONTROL_BIN=/usr/local/bin/detmir-dlp-runtime-control
+              AW_CONTAINMENT_ENABLED={{ 'true' if (aw_containment_enabled | default(false) | bool) else 'false' }}
+              AW_CONTAINMENT_MODE={{ aw_containment_mode | default('shadow') }}
+              AW_CONTAINMENT_POLICY={{ aw_containment_policy_path | default('/etc/activitywatch/containment-policy.json') }}
+              AW_CONTAINMENT_DEFAULT_TTL_MINUTES={{ aw_containment_default_ttl_minutes | default(60) }}
+              AW_CONTAINMENT_REQUIRE_ADMIN_CHANNEL_CHECK={{ 'true' if (aw_containment_require_admin_channel_check | default(true) | bool) else 'false' }}
+              AW_CONTAINMENT_ALLOW_AUTO_FOR_SERVERS={{ 'true' if (aw_containment_allow_auto_for_servers | default(false) | bool) else 'false' }}
+              AW_DLP_INFLUX_ENABLED={{ 'true' if ((aw_dlp_enabled | default(false) | bool) and (aw_dlp_influx_enabled | default(false) | bool)) else 'false' }}
               AW_DLP_INFLUX_URL={{ aw_dlp_influx_url | default('') }}
               AW_DLP_INFLUX_ORG={{ aw_dlp_influx_org | default('proxmox') }}
               AW_DLP_INFLUX_BUCKET={{ aw_dlp_influx_bucket | default('aw_metrics') }}
-              AW_DLP_INFLUX_HOSTS={{ aw_dlp_influx_hosts | default('SHARKON2025') }}
+              AW_DLP_INFLUX_HOSTS={{ aw_dlp_influx_hosts | default(aw_effective_monitored_windows_hostname | default('HOST-EXAMPLE')) }}
               AW_DLP_INFLUX_LOOKBACK_DAYS={{ aw_dlp_influx_lookback_days | default(30) }}
               AW_DLP_INFLUX_EVENT_LIMIT={{ aw_dlp_influx_event_limit | default(2000) }}
               AW_DLP_INFLUX_TOKEN={{ aw_effective_dlp_influx_token | default('') }}
@@ -820,6 +859,7 @@
               AW_RUS_HEALTH_SESSION_EVENTS_MAX_AGE_SECONDS={{ aw_rus_health_session_events_max_age_seconds | default(86400) }}
               AW_RUS_HEALTH_GUARD_MAX_AGE_SECONDS={{ aw_rus_health_guard_max_age_seconds | default(300) }}
               AW_RUS_HEALTH_GUARD_REQUIRED={{ 1 if (aw_rus_health_guard_required | default(true) | bool) else 0 }}
+              AW_RUS_HEALTH_RDP_TCP_REQUIRED={{ 'true' if (aw_rus_health_rdp_tcp_required | default(true) | bool) else 'false' }}
               AW_RUS_SLO_STATE_DIR={{ aw_server_data_dir }}/slo
               AW_RUS_SLO_AW_BASE=http://127.0.0.1:5600
               AW_RUS_SLO_WORKTIME_BASE={{ aw_rus_health_worktime_api_base | default('http://127.0.0.1:5610') }}
@@ -837,6 +877,104 @@
               AW_HAYABUSA_TELEGRAM_MIN_SEVERITY={{ aw_hayabusa_telegram_min_severity | default('high') }}
               AW_HAYABUSA_TELEGRAM_BOT_TOKEN={{ aw_hayabusa_telegram_bot_token | default('') }}
               AW_HAYABUSA_TELEGRAM_CHAT_IDS={{ aw_hayabusa_telegram_chat_ids | default('') }}
+              AW_SECURITY_FINDING_INBOX_ENABLED={{ 'true' if (aw_security_finding_inbox_enabled | default(false) | bool) else 'false' }}
+              AW_SECURITY_FINDING_INBOX_REQUIRED={{ 'true' if (aw_security_finding_inbox_required | default(false) | bool) else 'false' }}
+              AW_SECURITY_FINDING_INBOX_BIN={{ aw_security_finding_inbox_bin | default('/usr/local/bin/security-finding-inbox') }}
+              AW_SECURITY_FINDING_INBOX_MIN_SEVERITY={{ aw_security_finding_inbox_min_severity | default('medium') }}
+              AW_SECURITY_FINDING_EXECUTOR_WORK_DIR={{ aw_security_finding_executor_work_dir | default(aw_server_data_dir ~ '/security-finding-executor') }}
+              AW_SECURITY_FINDING_EXECUTOR_LOCK={{ aw_security_finding_executor_lock | default('/var/lock/aw-security-finding-executor.lock') }}
+              AW_CONTAINMENT_ENGINE_BIN={{ aw_containment_engine_bin | default('/usr/local/bin/containment-engine') }}
+              AW_CONTAINMENT_MANAGEMENT_ALLOWLIST={{ aw_containment_management_allowlist | default('') }}
+              AW_CONTAINMENT_BLOCKED_REMOTE_ADDRESSES={{ aw_containment_blocked_remote_addresses | default('') }}
+
+        - name: Установить runtime control для optional DLP контура
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/scripts/detmir_dlp_runtime_control.sh"
+            dest: /usr/local/bin/detmir-dlp-runtime-control
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: Установить load guard для lightweight DLP контура
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/scripts/detmir_dlp_load_guard.sh"
+            dest: /usr/local/bin/detmir-dlp-load-guard
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: Установить systemd unit DLP load guard
+          ansible.builtin.copy:
+            dest: /etc/systemd/system/detmir-dlp-load-guard.service
+            owner: root
+            group: root
+            mode: "0644"
+            content: |
+              [Unit]
+              Description=DetMir lightweight DLP load guard
+              After=activitywatch-server.service
+
+              [Service]
+              Type=oneshot
+              EnvironmentFile=-/etc/activitywatch/aw-server.env
+              ExecStart=/usr/local/bin/detmir-dlp-load-guard
+              Nice=10
+              IOSchedulingClass=best-effort
+              IOSchedulingPriority=7
+              TimeoutStartSec=45
+
+        - name: Установить systemd timer DLP load guard
+          ansible.builtin.copy:
+            dest: /etc/systemd/system/detmir-dlp-load-guard.timer
+            owner: root
+            group: root
+            mode: "0644"
+            content: |
+              [Unit]
+              Description=Run DetMir lightweight DLP load guard
+
+              [Timer]
+              OnBootSec=3min
+              OnUnitActiveSec=1min
+              AccuracySec=30s
+              Persistent=false
+
+              [Install]
+              WantedBy=timers.target
+
+        - name: Включить DLP load guard timer
+          ansible.builtin.systemd:
+            name: detmir-dlp-load-guard.timer
+            enabled: true
+            state: started
+            daemon_reload: true
+          when: aw_dlp_light_guard_enabled | default(true) | bool
+
+        - name: Отключить DLP load guard timer, если guard явно выключен
+          ansible.builtin.systemd:
+            name: detmir-dlp-load-guard.timer
+            enabled: false
+            state: stopped
+            daemon_reload: true
+          failed_when: false
+          when: not (aw_dlp_light_guard_enabled | default(true) | bool)
+
+        - name: Создать каталог containment policy
+          ansible.builtin.file:
+            path: "{{ (aw_containment_policy_path | default('/etc/activitywatch/containment-policy.json')) | dirname }}"
+            state: directory
+            owner: root
+            group: root
+            mode: "0755"
+
+        - name: Установить default containment policy, если live policy отсутствует
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/configs/containment-policy.example.json"
+            dest: "{{ aw_containment_policy_path | default('/etc/activitywatch/containment-policy.json') }}"
+            owner: root
+            group: root
+            mode: "0644"
+            force: false
 
         - name: Создать каталог DLP policy engine
           ansible.builtin.file:
@@ -845,7 +983,9 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when: aw_dlp_policy_engine_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_policy_engine_enabled | default(false) | bool
 
         - name: Установить systemd unit DLP policy engine
           ansible.builtin.copy:
@@ -854,7 +994,9 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_policy_engine_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_policy_engine_enabled | default(false) | bool
 
         - name: Проверить локальный Rust DLP policy engine
           ansible.builtin.stat:
@@ -889,7 +1031,7 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when: aw_dlp_content_analysis_enabled | default(true) | bool
+          when: aw_dlp_content_analysis_enabled | default(false) | bool
 
         - name: Скопировать файлы DLP content analysis
           ansible.builtin.copy:
@@ -898,7 +1040,7 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0644"
-          when: aw_dlp_content_analysis_enabled | default(true) | bool
+          when: aw_dlp_content_analysis_enabled | default(false) | bool
 
         - name: Установить wrapper запуска DLP content analysis через virtualenv
           ansible.builtin.copy:
@@ -907,7 +1049,7 @@
             owner: root
             group: root
             mode: "0755"
-          when: aw_dlp_content_analysis_enabled | default(true) | bool
+          when: aw_dlp_content_analysis_enabled | default(false) | bool
 
         - name: Проверить локальный Rust DLP content analyzer
           ansible.builtin.stat:
@@ -915,7 +1057,7 @@
           delegate_to: localhost
           register: dlp_content_analyzer_rust_binary
           become: false
-          when: aw_dlp_content_analysis_enabled | default(true) | bool
+          when: aw_dlp_content_analysis_enabled | default(false) | bool
 
         - name: Установить Rust DLP content analyzer
           ansible.builtin.copy:
@@ -925,7 +1067,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_content_analysis_enabled | default(true) | bool
+            - aw_dlp_content_analysis_enabled | default(false) | bool
             - dlp_content_analyzer_rust_binary.stat.exists | default(false)
 
         - name: Создать virtualenv DLP content analysis
@@ -933,13 +1075,13 @@
             cmd: python3 -m venv /opt/activitywatch/dlp-content-analysis/.venv
           args:
             creates: /opt/activitywatch/dlp-content-analysis/.venv/bin/python
-          when: aw_dlp_content_analysis_enabled | default(true) | bool
+          when: aw_dlp_content_analysis_enabled | default(false) | bool
 
         - name: Установить зависимости DLP content analysis
           ansible.builtin.pip:
             requirements: /opt/activitywatch/dlp-content-analysis/requirements.txt
             virtualenv: /opt/activitywatch/dlp-content-analysis/.venv
-          when: aw_dlp_content_analysis_enabled | default(true) | bool
+          when: aw_dlp_content_analysis_enabled | default(false) | bool
 
         - name: Создать каталог DLP integrations
           ansible.builtin.file:
@@ -948,7 +1090,9 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Скопировать файлы DLP integrations
           ansible.builtin.copy:
@@ -961,7 +1105,9 @@
             - cef-config.yaml
             - syslog-forwarder-config.yaml
             - webhook-config.yaml
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Создать state каталог DLP integrations
           ansible.builtin.file:
@@ -970,7 +1116,9 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить systemd unit CEF exporter
           ansible.builtin.copy:
@@ -979,7 +1127,9 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить systemd timer CEF exporter
           ansible.builtin.copy:
@@ -988,7 +1138,9 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Проверить локальный Rust CEF exporter
           ansible.builtin.stat:
@@ -996,14 +1148,16 @@
           delegate_to: localhost
           register: dlp_cef_exporter_rust_binary
           become: false
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Требовать Rust CEF exporter artifact
           ansible.builtin.assert:
             that:
               - dlp_cef_exporter_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-cef-exporter"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить Rust CEF exporter
           ansible.builtin.copy:
@@ -1013,7 +1167,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_integrations_enabled | default(true) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
             - dlp_cef_exporter_rust_binary.stat.exists | default(false)
 
         - name: Установить systemd unit syslog forwarder
@@ -1023,7 +1177,7 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить systemd timer syslog forwarder
           ansible.builtin.copy:
@@ -1032,7 +1186,7 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Проверить локальный Rust syslog forwarder
           ansible.builtin.stat:
@@ -1040,14 +1194,14 @@
           delegate_to: localhost
           register: dlp_syslog_forwarder_rust_binary
           become: false
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Требовать Rust syslog forwarder artifact
           ansible.builtin.assert:
             that:
               - dlp_syslog_forwarder_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-syslog-forwarder"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить Rust syslog forwarder
           ansible.builtin.copy:
@@ -1057,7 +1211,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_integrations_enabled | default(true) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
             - dlp_syslog_forwarder_rust_binary.stat.exists | default(false)
 
         - name: Установить systemd unit webhook sender
@@ -1067,7 +1221,7 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить systemd timer webhook sender
           ansible.builtin.copy:
@@ -1076,7 +1230,7 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Проверить локальный Rust webhook sender
           ansible.builtin.stat:
@@ -1084,14 +1238,14 @@
           delegate_to: localhost
           register: dlp_webhook_sender_rust_binary
           become: false
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Требовать Rust webhook sender artifact
           ansible.builtin.assert:
             that:
               - dlp_webhook_sender_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-webhook-sender"
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Установить Rust webhook sender
           ansible.builtin.copy:
@@ -1101,7 +1255,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_integrations_enabled | default(true) | bool
+            - aw_dlp_integrations_enabled | default(false) | bool
             - dlp_webhook_sender_rust_binary.stat.exists | default(false)
 
         - name: Создать каталог DLP case management
@@ -1111,7 +1265,9 @@
             owner: "{{ aw_server_user }}"
             group: "{{ aw_server_group }}"
             mode: "0755"
-          when: aw_dlp_case_management_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_case_management_enabled | default(false) | bool
 
         - name: Установить systemd unit DLP case management
           ansible.builtin.copy:
@@ -1120,7 +1276,9 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_case_management_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_case_management_enabled | default(false) | bool
 
         - name: Проверить локальный Rust DLP case management
           ansible.builtin.stat:
@@ -1128,14 +1286,14 @@
           delegate_to: localhost
           register: aw_dlp_case_management_rust_binary
           become: false
-          when: aw_dlp_case_management_enabled | default(true) | bool
+          when: aw_dlp_case_management_enabled | default(false) | bool
 
         - name: Требовать Rust DLP case management artifact
           ansible.builtin.assert:
             that:
               - aw_dlp_case_management_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-case-management"
-          when: aw_dlp_case_management_enabled | default(true) | bool
+          when: aw_dlp_case_management_enabled | default(false) | bool
 
         - name: Установить Rust DLP case management
           ansible.builtin.copy:
@@ -1145,7 +1303,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_case_management_enabled | default(true) | bool
+            - aw_dlp_case_management_enabled | default(false) | bool
             - aw_dlp_case_management_rust_binary.stat.exists | default(false)
 
         - name: Создать каталоги DLP compliance
@@ -1159,7 +1317,9 @@
             - /opt/activitywatch/dlp-compliance
             - /opt/activitywatch/dlp-compliance/templates
             - "{{ aw_dlp_compliance_report_dir }}"
-          when: aw_dlp_compliance_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_compliance_enabled | default(false) | bool
 
         - name: Скопировать файлы DLP compliance
           ansible.builtin.copy:
@@ -1173,7 +1333,9 @@
             - { src: "templates/pci-dss-report.html", dest: "/opt/activitywatch/dlp-compliance/templates/pci-dss-report.html", mode: "0644" }
             - { src: "report-scheduler.service", dest: "/etc/systemd/system/aw-dlp-report-scheduler.service", mode: "0644" }
             - { src: "report-scheduler.timer", dest: "/etc/systemd/system/aw-dlp-report-scheduler.timer", mode: "0644" }
-          when: aw_dlp_compliance_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_compliance_enabled | default(false) | bool
 
         - name: Проверить локальный Rust DLP compliance
           ansible.builtin.stat:
@@ -1181,14 +1343,18 @@
           delegate_to: localhost
           register: aw_dlp_compliance_rust_binary
           become: false
-          when: aw_dlp_compliance_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_compliance_enabled | default(false) | bool
 
         - name: Требовать Rust DLP compliance artifact
           ansible.builtin.assert:
             that:
               - aw_dlp_compliance_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-compliance"
-          when: aw_dlp_compliance_enabled | default(true) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_compliance_enabled | default(false) | bool
 
         - name: Установить Rust DLP compliance
           ansible.builtin.copy:
@@ -1198,7 +1364,7 @@
             group: root
             mode: "0755"
           when:
-            - aw_dlp_compliance_enabled | default(true) | bool
+            - aw_dlp_compliance_enabled | default(false) | bool
             - aw_dlp_compliance_rust_binary.stat.exists | default(false)
 
         - name: Проверить локальный Rust dlp-admin-cli
@@ -1437,6 +1603,47 @@
             mode: "0755"
           when: dlp_health_check_rust_binary.stat.exists | default(false)
 
+        - name: Проверить локальный Rust containment-engine
+          ansible.builtin.stat:
+            path: "{{ aw_rust_release_dir }}/containment-engine"
+          delegate_to: localhost
+          register: containment_engine_rust_binary
+          become: false
+
+        - name: Установить Rust containment-engine
+          ansible.builtin.copy:
+            src: "{{ aw_rust_release_dir }}/containment-engine"
+            dest: /usr/local/bin/containment-engine
+            owner: root
+            group: root
+            mode: "0755"
+          when: containment_engine_rust_binary.stat.exists | default(false)
+
+        - name: Проверить локальный Rust security-finding-inbox
+          ansible.builtin.stat:
+            path: "{{ aw_rust_release_dir }}/security-finding-inbox"
+          delegate_to: localhost
+          register: security_finding_inbox_rust_binary
+          become: false
+
+        - name: Установить Rust security-finding-inbox
+          ansible.builtin.copy:
+            src: "{{ aw_rust_release_dir }}/security-finding-inbox"
+            dest: /usr/local/bin/security-finding-inbox
+            owner: root
+            group: root
+            mode: "0755"
+          when: security_finding_inbox_rust_binary.stat.exists | default(false)
+
+        - name: Установить systemd unit Security Finding Inbox executor
+          ansible.builtin.copy:
+            src: "{{ aw_repo_root }}/ops/systemd/aw-security-finding-executor.service"
+            dest: /etc/systemd/system/aw-security-finding-executor.service
+            owner: root
+            group: root
+            mode: "0644"
+          notify: Перезагрузить systemd
+
         - name: Проверить локальный Rust AW-RUS healthd
           ansible.builtin.stat:
             path: "{{ aw_rust_release_dir }}/aw-rus-healthd"
@@ -1644,7 +1851,9 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_influx_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_influx_enabled | default(false) | bool
 
         - name: Проверить локальный Rust AW DLP Influx exporter
           ansible.builtin.stat:
@@ -1652,14 +1861,18 @@
           delegate_to: localhost
           register: aw_dlp_influx_exporter_rust_binary
           become: false
-          when: aw_dlp_influx_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_influx_enabled | default(false) | bool
 
         - name: Требовать Rust AW DLP Influx exporter artifact
           ansible.builtin.assert:
             that:
               - aw_dlp_influx_exporter_rust_binary.stat.exists | default(false)
             fail_msg: "Missing Rust artifact: {{ aw_rust_release_dir }}/dlp-influx-exporter"
-          when: aw_dlp_influx_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_influx_enabled | default(false) | bool
 
         - name: Установить Rust AW DLP Influx exporter
           ansible.builtin.copy:
@@ -1679,7 +1892,9 @@
             owner: root
             group: root
             mode: "0644"
-          when: aw_dlp_influx_enabled | default(false) | bool
+          when:
+            - aw_dlp_enabled | default(false) | bool
+            - aw_dlp_influx_enabled | default(false) | bool
 
         - name: Проверить локальный Rust DetMir readiness checker
           ansible.builtin.stat:
@@ -1831,42 +2046,42 @@
             name: aw-dlp-cef-exporter.timer
             enabled: true
             state: restarted
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Включить и перезапустить timer syslog forwarder
           ansible.builtin.systemd:
             name: aw-dlp-syslog-forwarder.timer
             enabled: true
             state: restarted
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Включить и перезапустить timer webhook sender
           ansible.builtin.systemd:
             name: aw-dlp-webhook-sender.timer
             enabled: true
             state: restarted
-          when: aw_dlp_integrations_enabled | default(true) | bool
+          when: aw_dlp_integrations_enabled | default(false) | bool
 
         - name: Включить и перезапустить DLP case management
           ansible.builtin.systemd:
             name: aw-dlp-case-management.service
             enabled: true
             state: restarted
-          when: aw_dlp_case_management_enabled | default(true) | bool
+          when: aw_dlp_case_management_enabled | default(false) | bool
 
         - name: Включить и перезапустить timer DLP compliance report
           ansible.builtin.systemd:
             name: aw-dlp-report-scheduler.timer
             enabled: true
             state: restarted
-          when: aw_dlp_compliance_enabled | default(true) | bool
+          when: aw_dlp_compliance_enabled | default(false) | bool
 
         - name: Выполнить разовый прогон DLP compliance report
           ansible.builtin.systemd:
             name: aw-dlp-report-scheduler.service
             state: started
           failed_when: false
-          when: aw_dlp_compliance_enabled | default(true) | bool
+          when: aw_dlp_compliance_enabled | default(false) | bool
 
         - name: Включить и перезапустить AW worktime API
           ansible.builtin.systemd:
@@ -2233,6 +2448,11 @@
             mode: "0755"
           when: dlp_aggregator_rust_binary.stat.exists | default(false)
 
+        - name: Удалить stale drop-in, переопределяющий lightweight DLP aggregator
+          ansible.builtin.file:
+            path: /etc/systemd/system/activitywatch-dlp-aggregator.service.d/20-rust-switch.conf
+            state: absent
+
         - name: Установить systemd unit для агрегатора
           ansible.builtin.copy:
             dest: /etc/systemd/system/activitywatch-dlp-aggregator.service
@@ -2241,7 +2461,7 @@
             mode: "0644"
             content: |
               [Unit]
-              Description=ActivityWatch DLP Event Aggregator
+              Description=ActivityWatch Lightweight DLP Event Aggregator
               After=activitywatch-server.service
 
               [Service]
@@ -2251,7 +2471,18 @@
               ExecStart=/usr/local/bin/dlp-aggregator-rust \
                 --aw-url http://127.0.0.1:{{ aw_server_port }}/api/0 \
                 --sqlite-path {{ aw_server_data_dir }}/dlp_warehouse.sqlite \
-                --state-path {{ aw_server_data_dir }}/dlp-aggregator-state.json
+                --state-path {{ aw_server_data_dir }}/dlp-aggregator-state.json \
+                --bucket-prefixes {{ aw_dlp_aggregator_bucket_prefixes | default('aw-file-operations_,aw-dlp-incidents_') }} \
+                --lookback-hours {{ aw_dlp_aggregator_lookback_hours | default(2) }} \
+                --overlap-seconds {{ aw_dlp_aggregator_overlap_seconds | default(60) }} \
+                --limit {{ aw_dlp_aggregator_limit | default(500) }} \
+                --timeout {{ aw_dlp_aggregator_timeout_seconds | default(8) }}
+              Nice=10
+              IOSchedulingClass=best-effort
+              IOSchedulingPriority=7
+              CPUQuota={{ aw_dlp_aggregator_cpu_quota | default('10%') }}
+              MemoryMax={{ aw_dlp_aggregator_memory_max | default('256M') }}
+              TimeoutStartSec={{ (aw_dlp_aggregator_timeout_seconds | default(8) | int) + 15 }}
 
               [Install]
               WantedBy=multi-user.target
@@ -2261,10 +2492,10 @@
             dest: /etc/systemd/system/activitywatch-dlp-aggregator.timer
             content: |
               [Unit]
-              Description=Run ActivityWatch DLP Aggregator every 5 minutes
+              Description=Run ActivityWatch Lightweight DLP Aggregator
 
               [Timer]
-              OnCalendar=*:3/10:10
+              OnCalendar={{ aw_dlp_aggregator_on_calendar | default('*:3/15:10') }}
               AccuracySec=30s
               RandomizedDelaySec=30s
               Persistent=false
@@ -2278,9 +2509,14 @@
             enabled: true
             state: started
             daemon_reload: true
+      when:
+        - aw_dlp_enabled | default(false) | bool
+        - aw_dlp_light_collector_enabled | default(false) | bool
 
     - name: Настроить IOC enrichment из Hayabusa Sigma
-      when: aw_dlp_ioc_enabled | default(false) | bool
+      when:
+        - aw_dlp_enabled | default(false) | bool
+        - aw_dlp_ioc_enabled | default(false) | bool
       block:
         - name: Создать каталог IOC enrichment
           ansible.builtin.file:

ansible/deploy_detmir_portal.yml

@@ -15,8 +15,16 @@
     detmir_portal_workforce_policy_path: "/etc/detmir-portal-workforce-policy.json"
     detmir_portal_ueba_policy_path: "/etc/detmir-portal-ueba-policy.yaml"
     detmir_portal_readiness_bundle_dir: "{{ detmir_portal_readiness_bundle_dir_override | default('/var/lib/activitywatch/health/readiness-bundle', true) }}"
+    detmir_portal_dlp_module_enabled: "{{ detmir_portal_dlp_module_enabled_override | default(false) }}"
 
   tasks:
+    - name: Refuse inconsistent DetMir portal DLP profile
+      ansible.builtin.assert:
+        that:
+          - detmir_portal_dlp_profile | default('core_only') in ['core_only', 'light', 'on_demand', 'full']
+          - (detmir_portal_dlp_profile | default('core_only') != 'core_only') or not (detmir_portal_dlp_module_enabled | bool)
+        fail_msg: "Inconsistent DetMir portal DLP profile: core_only must keep DETMIR_PORTAL_DLP_MODULE_ENABLED=false."
+
     - name: Check local detmir-portal binary
       ansible.builtin.stat:
         path: "{{ aw_rust_release_dir }}/detmir-portal"
@@ -54,6 +62,8 @@
           DETMIR_PORTAL_UEBA_POLICY_PATH={{ detmir_portal_ueba_policy_path }}
           DETMIR_PORTAL_TIMEOUT_SECONDS=25
           DETMIR_PORTAL_STATE_DIR=/var/lib/detmir-portal
+          DETMIR_PORTAL_DLP_MODULE_ENABLED={{ detmir_portal_dlp_module_enabled | bool | ternary('true', 'false') }}
+          DETMIR_PORTAL_DLP_PROFILE={{ detmir_portal_dlp_profile | default('core_only') }}
           DETMIR_PORTAL_DLP_DB_PATH=/var/lib/activitywatch/dlp_warehouse.sqlite
           DETMIR_PORTAL_EVIDENCE_ROOT=/var/lib/detmir-portal/evidence
           DETMIR_PORTAL_READINESS_BUNDLE_DIR={{ detmir_portal_readiness_bundle_dir }}
@@ -65,6 +75,65 @@
           CLICKHOUSE_USER={{ detmir_clickhouse_user | default('default') }}
           CLICKHOUSE_PASSWORD={{ detmir_clickhouse_password | default('') }}
 
+    - name: Install lightweight DLP warehouse sync helper
+      ansible.builtin.copy:
+        src: "{{ aw_repo_root }}/scripts/detmir_dlp_warehouse_sync.sh"
+        dest: /usr/local/bin/detmir-dlp-warehouse-sync
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Install lightweight DLP warehouse sync service
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/detmir-dlp-warehouse-sync.service
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Unit]
+          Description=Sync lightweight DetMir DLP SQLite warehouse for portal
+          After=network-online.target
+          Wants=network-online.target
+
+          [Service]
+          Type=oneshot
+          Environment=AW_DLP_WAREHOUSE_SOURCE_HOST={{ detmir_portal_dlp_warehouse_source_host | default('igor@10.10.10.13') }}
+          Environment=AW_DLP_WAREHOUSE_SOURCE_PATH={{ detmir_portal_dlp_warehouse_source_path | default('/var/lib/activitywatch/dlp_warehouse.sqlite') }}
+          Environment=AW_DLP_WAREHOUSE_DEST_PATH={{ detmir_portal_dlp_warehouse_dest_path | default('/var/lib/activitywatch/dlp_warehouse.sqlite') }}
+          Environment=AW_DLP_WAREHOUSE_SYNC_STATE_DIR={{ detmir_portal_dlp_warehouse_sync_state_dir | default('/var/lib/activitywatch/health') }}
+          ExecStart=/usr/local/bin/detmir-dlp-warehouse-sync
+          Nice=10
+          IOSchedulingClass=best-effort
+          IOSchedulingPriority=7
+          TimeoutStartSec=60
+
+    - name: Install lightweight DLP warehouse sync timer
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/detmir-dlp-warehouse-sync.timer
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Unit]
+          Description=Run lightweight DetMir DLP SQLite warehouse sync
+
+          [Timer]
+          OnBootSec=4min
+          OnUnitActiveSec={{ detmir_portal_dlp_warehouse_sync_interval | default('2min') }}
+          AccuracySec=30s
+          Persistent=false
+
+          [Install]
+          WantedBy=timers.target
+
+    - name: Enable lightweight DLP warehouse sync timer
+      ansible.builtin.systemd:
+        name: detmir-dlp-warehouse-sync.timer
+        enabled: true
+        state: started
+        daemon_reload: true
+      when: detmir_portal_dlp_module_enabled | bool
+
     - name: Preserve local ClickHouse security-events settings when available
       ansible.builtin.shell: |
         set -euo pipefail
@@ -117,7 +186,9 @@
         state: absent
       loop:
         - /etc/systemd/system/detmir-portal.service.d/20-timeouts.conf
+        - /etc/systemd/system/detmir-portal.service.d/20-prod-timeout.conf
         - /etc/systemd/system/detmir-portal.service.d/30-warm-cache.conf
+        - /etc/systemd/system/detmir-portal.service.d/30-prewarm-after-start.conf
       register: detmir_portal_stale_overrides
 
     - name: Install initial workforce policy when absent
@@ -174,6 +245,11 @@
           WantedBy=multi-user.target
       register: detmir_portal_service_unit
 
+    - name: Remove stale detmir-portal timeout override
+      ansible.builtin.file:
+        path: /etc/systemd/system/detmir-portal.service.d/10-detmir-check-env.conf
+        state: absent
+
     - name: Reload systemd
       ansible.builtin.systemd:
         daemon_reload: true

ansible/group_vars/all.example.yml

@@ -47,6 +47,7 @@ aw_worktime_host: "{{ aw_monitored_windows_hostname }}"
 aw_rus_health_worktime_api_base: "http://127.0.0.1:5610"
 aw_rus_health_state_dir: "{{ aw_server_data_dir }}/health"
 aw_rus_health_validation_dir: "{{ aw_rus_health_state_dir }}/windows-validation"
+aw_rus_health_rdp_tcp_required: true
 aw_browser_smoke_enabled: true
 aw_browser_smoke_engine: "chromium-cli"
 aw_legacy_db_merge_enabled: false
@@ -58,6 +59,15 @@ aw_hayabusa_telegram_enabled: true
 aw_hayabusa_telegram_min_severity: "high"
 aw_hayabusa_telegram_bot_token: ""
 aw_hayabusa_telegram_chat_ids: ""
+aw_security_finding_inbox_enabled: false
+aw_security_finding_inbox_required: false
+aw_security_finding_inbox_bin: "/usr/local/bin/security-finding-inbox"
+aw_security_finding_inbox_min_severity: "medium"
+aw_security_finding_executor_work_dir: "{{ aw_server_data_dir }}/security-finding-executor"
+aw_security_finding_executor_lock: "/var/lock/aw-security-finding-executor.lock"
+aw_containment_engine_bin: "/usr/local/bin/containment-engine"
+aw_containment_management_allowlist: ""
+aw_containment_blocked_remote_addresses: ""
 
 aw_repo_root: "{{ playbook_dir | dirname }}"
 
@@ -85,17 +95,44 @@ aw_server_always_active_pattern: "aw-watcher-window"
 aw_server_landingpage: "/#/activity/HOST-EXAMPLE/view/"
 aw_health_strict_fileops: 0
 
-aw_dlp_policy_engine_enabled: true
+aw_dlp_profile: "core_only"
+detmir_portal_dlp_profile: "core_only"
+detmir_portal_dlp_module_enabled_override: false
+aw_dlp_enabled: false
+aw_dlp_disabled_reason: "operator_disabled_to_reduce_proxmox_influx_grafana_clickhouse_load"
+aw_dlp_disabled_since: ""
+aw_dlp_light_collector_enabled: false
+aw_dlp_light_guard_enabled: true
+aw_dlp_light_guard_load_ratio: "1.50"
+aw_dlp_light_guard_mem_available_pct_min: "15"
+aw_dlp_light_guard_iowait_pct_max: "20"
+aw_dlp_light_guard_strikes_required: 3
+aw_dlp_light_guard_state_dir: "{{ aw_server_data_dir }}/health"
+aw_dlp_aggregator_bucket_prefixes: "aw-file-operations_,aw-dlp-incidents_"
+aw_dlp_aggregator_limit: 500
+aw_dlp_aggregator_lookback_hours: 2
+aw_dlp_aggregator_overlap_seconds: 60
+aw_dlp_aggregator_timeout_seconds: 8
+aw_dlp_aggregator_on_calendar: "*:3/15:10"
+aw_dlp_aggregator_cpu_quota: "10%"
+aw_dlp_aggregator_memory_max: "256M"
+aw_containment_enabled: false
+aw_containment_mode: "shadow"
+aw_containment_policy_path: "/etc/activitywatch/containment-policy.json"
+aw_containment_default_ttl_minutes: 60
+aw_containment_require_admin_channel_check: true
+aw_containment_allow_auto_for_servers: false
+aw_dlp_policy_engine_enabled: false
 aw_dlp_policy_engine_bind_host: "0.0.0.0"
 aw_dlp_policy_engine_port: 5601
 aw_dlp_policy_engine_db_path: "{{ aw_server_data_dir }}/dlp-policy-engine.sqlite"
-aw_dlp_content_analysis_enabled: true
-aw_dlp_integrations_enabled: true
-aw_dlp_case_management_enabled: true
+aw_dlp_content_analysis_enabled: false
+aw_dlp_integrations_enabled: false
+aw_dlp_case_management_enabled: false
 aw_dlp_case_bind_host: "0.0.0.0"
 aw_dlp_case_port: 5602
 aw_dlp_case_db_path: "/opt/activitywatch/dlp-case-management/cases.db"
-aw_dlp_compliance_enabled: true
+aw_dlp_compliance_enabled: false
 aw_dlp_compliance_report_dir: "/opt/activitywatch/dlp-compliance/reports"
 aw_dlp_compliance_template_path: "/opt/activitywatch/dlp-compliance/templates/152-fz-report.html"
 aw_server_post_deploy_health_check_enabled: true

ansible/group_vars/all.yml

@@ -33,7 +33,10 @@ aw_worktime_manager_trend_min_points: 3
 aw_worktime_manager_trend_delta_pct: 10
 aw_worktime_manager_off_hours_threshold_seconds: 1800
 aw_worktime_interpretation_policy_path: "/etc/activitywatch/worktime-interpretation-policy.json"
-aw_dlp_influx_enabled: true
+aw_dlp_profile: "core_only"
+detmir_portal_dlp_profile: "light"
+detmir_portal_dlp_module_enabled_override: true
+aw_dlp_influx_enabled: false
 aw_dlp_influx_url: "http://192.0.2.10:8086"
 aw_dlp_influx_org: "proxmox"
 aw_dlp_influx_bucket: "aw_metrics"
@@ -47,6 +50,7 @@ aw_worktime_host: "{{ aw_monitored_windows_hostname }}"
 aw_rus_health_worktime_api_base: "http://127.0.0.1:5610"
 aw_rus_health_state_dir: "{{ aw_server_data_dir }}/health"
 aw_rus_health_validation_dir: "{{ aw_rus_health_state_dir }}/windows-validation"
+aw_rus_health_rdp_tcp_required: false
 aw_hayabusa_auto_case_enabled: true
 aw_hayabusa_auto_case_min_severity: "medium"
 aw_hayabusa_telegram_enabled: true
@@ -65,22 +69,46 @@ aw_server_cors_origins:
 
 aw_apply_worktime_settings: true
 
-aw_dlp_ioc_enabled: true
+aw_dlp_ioc_enabled: false
+aw_dlp_enabled: false
+aw_dlp_disabled_reason: ""
+aw_dlp_disabled_since: ""
+aw_dlp_light_collector_enabled: false
+aw_dlp_light_guard_enabled: true
+aw_dlp_light_guard_load_ratio: "1.50"
+aw_dlp_light_guard_mem_available_pct_min: "15"
+aw_dlp_light_guard_iowait_pct_max: "20"
+aw_dlp_light_guard_strikes_required: 3
+aw_dlp_light_guard_state_dir: "{{ aw_server_data_dir }}/health"
+aw_dlp_aggregator_bucket_prefixes: "aw-file-operations_,aw-dlp-incidents_"
+aw_dlp_aggregator_limit: 500
+aw_dlp_aggregator_lookback_hours: 2
+aw_dlp_aggregator_overlap_seconds: 60
+aw_dlp_aggregator_timeout_seconds: 8
+aw_dlp_aggregator_on_calendar: "*:3/15:10"
+aw_dlp_aggregator_cpu_quota: "10%"
+aw_dlp_aggregator_memory_max: "256M"
+aw_containment_enabled: false
+aw_containment_mode: "shadow"
+aw_containment_policy_path: "/etc/activitywatch/containment-policy.json"
+aw_containment_default_ttl_minutes: 60
+aw_containment_require_admin_channel_check: true
+aw_containment_allow_auto_for_servers: false
 aw_dlp_ioc_workdir: "/opt/activitywatch/dlp-ioc"
 aw_dlp_ioc_rules_zip_url: "https://github.com/Yamato-Security/hayabusa-rules/archive/refs/heads/main.zip"
 aw_dlp_ioc_refresh_on_boot_sec: "5min"
 aw_dlp_ioc_refresh_interval: "6h"
-aw_dlp_policy_engine_enabled: true
+aw_dlp_policy_engine_enabled: false
 aw_dlp_policy_engine_bind_host: "0.0.0.0"
 aw_dlp_policy_engine_port: 5601
 aw_dlp_policy_engine_db_path: "{{ aw_server_data_dir }}/dlp-policy-engine.sqlite"
-aw_dlp_content_analysis_enabled: true
-aw_dlp_integrations_enabled: true
-aw_dlp_case_management_enabled: true
+aw_dlp_content_analysis_enabled: false
+aw_dlp_integrations_enabled: false
+aw_dlp_case_management_enabled: false
 aw_dlp_case_bind_host: "0.0.0.0"
 aw_dlp_case_port: 5602
 aw_dlp_case_db_path: "/opt/activitywatch/dlp-case-management/cases.db"
-aw_dlp_compliance_enabled: true
+aw_dlp_compliance_enabled: false
 aw_dlp_compliance_report_dir: "/opt/activitywatch/dlp-compliance/reports"
 aw_dlp_compliance_template_path: "/opt/activitywatch/dlp-compliance/templates/152-fz-report.html"
 aw_server_post_deploy_health_check_enabled: true

ansible/group_vars/proxmox.yml

@@ -0,0 +1,12 @@
+# Secret handling:
+# - put the real Proxmox SSH password into env var before running Ansible:
+#   export AW_PROXMOX_SSH_PASSWORD='...'
+# - if Proxmox and AW server share the same SSH credential, AW_SSH_PASSWORD is
+#   accepted as a fallback.
+ansible_password: "{{ lookup('env', 'AW_PROXMOX_SSH_PASSWORD') | default(lookup('env', 'AW_SSH_PASSWORD'), true) }}"
+
+ansible_become: true
+ansible_become_method: sudo
+# If sudo password differs, set AW_PROXMOX_SUDO_PASSWORD. Otherwise it reuses
+# AW_PROXMOX_SSH_PASSWORD and then AW_SSH_PASSWORD.
+ansible_become_password: "{{ lookup('env', 'AW_PROXMOX_SUDO_PASSWORD') | default(lookup('env', 'AW_PROXMOX_SSH_PASSWORD'), true) | default(lookup('env', 'AW_SUDO_PASSWORD'), true) | default(lookup('env', 'AW_SSH_PASSWORD'), true) }}"

ansible/inventory.example.ini

@@ -6,7 +6,7 @@ aw-ct ansible_host=10.20.30.13 ansible_user=root ansible_port=22
 
 [aw_windows]
 # Примечание: в русифицированных Windows часто нужен "Администратор", а не "Administrator".
-win-node1 ansible_host=<WINDOWS_HOST> ansible_user=Администратор ansible_password=CHANGE_ME ansible_connection=winrm ansible_winrm_transport=ntlm ansible_port=5985 ansible_winrm_server_cert_validation=ignore
+win-node1 ansible_host=<WINDOWS_HOST> ansible_user=Администратор ansible_connection=winrm ansible_winrm_transport=ntlm ansible_port=5985 ansible_winrm_server_cert_validation=ignore
 
 [aw_pfsense_pollers]
 # pfsense-poller1 ansible_host=198.51.100.30 ansible_user=root ansible_port=22

ansible/templates/proxmox-web-gateway.conf.j2

@@ -274,7 +274,7 @@ server {
     location ^~ /portal/api/readiness {
         proxy_set_header Authorization "";
         proxy_set_header X-Remote-User $remote_user;
-        proxy_pass http://192.0.2.13:8721/api/readiness;
+        proxy_pass http://127.0.0.1:8720/api/readiness;
         proxy_redirect off;
     }
 

aw-server/aw-host-sanitize.js

@@ -2,7 +2,7 @@
   "use strict";
 
   var BAD_HOST = ["HOST", "EXAMPLE"].join("-");
-  var DEFAULT_HOST = "SHARKON2025";
+  var DEFAULT_HOST = "HOST-EXAMPLE";
 
   function decode(value) {
     try {

aw-server/aw-server.env.example

@@ -16,7 +16,7 @@ AW_SERVER_GROUP=activitywatch
 AW_SERVER_PUBLIC_HOST=aw-server
 AW_WORKTIME_REPORT_BASE=http://aw-server:5610
 AW_WORKTIME_TZ=Europe/Moscow
-AW_WORKTIME_HOST=SHARKON2025
+AW_WORKTIME_HOST=HOST-EXAMPLE
 AW_WORKTIME_EVENTS_LIMIT=5000
 AW_WORKTIME_AW_HTTP_TIMEOUT_SECONDS=6
 AW_WORKTIME_EVENTS_CACHE_TTL_SECONDS=300
@@ -33,6 +33,16 @@ AW_WORKTIME_MANAGEMENT_WARM_URL=http://127.0.0.1:5610/reports/worktime/managemen
 AW_WORKTIME_MANAGEMENT_WARM_TIMEOUT_SECONDS=70
 
 # DLP IOC Configuration
+AW_DLP_ENABLED=false
+AW_DLP_PROFILE=core_only
+AW_DLP_DISABLED_REASON=detmir_prod_resource_guardrail
+AW_DLP_DISABLED_SINCE=
+AW_CONTAINMENT_ENABLED=false
+AW_CONTAINMENT_MODE=shadow
+AW_CONTAINMENT_POLICY=/etc/activitywatch/containment-policy.json
+AW_CONTAINMENT_DEFAULT_TTL_MINUTES=60
+AW_CONTAINMENT_REQUIRE_ADMIN_CHANNEL_CHECK=true
+AW_CONTAINMENT_ALLOW_AUTO_FOR_SERVERS=false
 AW_DLP_IOC_DIR=/opt/activitywatch/dlp-ioc/output
 
 # DLP Policy Engine Configuration
@@ -50,22 +60,24 @@ AW_HEALTH_CHECK_ENABLED=true
 AW_HEALTH_CHECK_INTERVAL=60
 AW_EXPECT_START_OF_DAY=00:00
 AW_EXPECT_ALWAYS_ACTIVE_PATTERN=aw-watcher-window
-AW_EXPECT_LANDINGPAGE=/#/activity/SHARKON2025/view/
+AW_EXPECT_LANDINGPAGE=/#/activity/HOST-EXAMPLE/view/
 AW_HEALTH_STRICT_FILEOPS=0
 AW_MONITORED_WINDOWS_HOST=<WINDOWS_HOST>
-AW_MONITORED_WINDOWS_HOSTNAME=SHARKON2025
+AW_MONITORED_WINDOWS_HOSTNAME=HOST-EXAMPLE
 AW_RUS_HEALTH_WORKTIME_API=http://127.0.0.1:5610
 AW_RUS_HEALTH_STATE_DIR=/var/lib/activitywatch/health
 AW_RUS_HEALTH_VALIDATION_DIR=/var/lib/activitywatch/health/windows-validation
 AW_RUS_HEALTH_SESSION_EVENTS_MAX_AGE_SECONDS=86400
 AW_RUS_HEALTH_GUARD_MAX_AGE_SECONDS=300
 AW_RUS_HEALTH_GUARD_REQUIRED=1
+AW_RUS_HEALTH_RDP_TCP_REQUIRED=true
+AW_RUS_HEALTH_WRAPPER_TIMEOUT_SECONDS=90
 AW_RUS_SLO_AW_BASE=http://127.0.0.1:5600
 AW_RUS_SLO_WORKTIME_BASE=http://127.0.0.1:5610
 AW_RUS_SLO_TARGET_PERCENT=99.97
 AW_BROWSER_SMOKE_AW_BASE=http://127.0.0.1:5600
 AW_BROWSER_SMOKE_WORKTIME_BASE=http://127.0.0.1:5610
-AW_BROWSER_SMOKE_HOST=SHARKON2025
+AW_BROWSER_SMOKE_HOST=HOST-EXAMPLE
 AW_BROWSER_SMOKE_OUTPUT_DIR=/var/lib/activitywatch/browser-smoke
 AW_BROWSER_SMOKE_KEEP_RUNS=24
 AW_BROWSER_SMOKE_ENGINE=chromium-cli
@@ -79,6 +91,15 @@ AW_HAYABUSA_TELEGRAM_ENABLED=true
 AW_HAYABUSA_TELEGRAM_MIN_SEVERITY=high
 AW_HAYABUSA_TELEGRAM_BOT_TOKEN=
 AW_HAYABUSA_TELEGRAM_CHAT_IDS=
+AW_SECURITY_FINDING_INBOX_ENABLED=false
+AW_SECURITY_FINDING_INBOX_REQUIRED=false
+AW_SECURITY_FINDING_INBOX_BIN=/usr/local/bin/security-finding-inbox
+AW_SECURITY_FINDING_INBOX_MIN_SEVERITY=medium
+AW_SECURITY_FINDING_EXECUTOR_WORK_DIR=/var/lib/activitywatch/security-finding-executor
+AW_SECURITY_FINDING_EXECUTOR_LOCK=/var/lock/aw-security-finding-executor.lock
+AW_CONTAINMENT_ENGINE_BIN=/usr/local/bin/containment-engine
+AW_CONTAINMENT_MANAGEMENT_ALLOWLIST=
+AW_CONTAINMENT_BLOCKED_REMOTE_ADDRESSES=
 
 # Integration Test Configuration
 AW_INTEGRATION_TEST_ENABLED=false

check-aw-full.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 # check-aw-full.sh - Полная проверка ActivityWatch: сервер + RDP-хост
-# Сервер: 192.0.2.13:5600
-# RDP-хост: 198.51.100.18 (HOST-EXAMPLE)
+# Сервер: http://10.10.10.13:5600
+# RDP-хост: 192.168.100.19 (logical host id SHARKON2025)
 
 if [[ "${CHECK_AW_FULL_FORCE_LEGACY:-0}" != "1" ]]; then
   ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -16,12 +16,17 @@ if [[ "${CHECK_AW_FULL_FORCE_LEGACY:-0}" != "1" ]]; then
   done
 fi
 
-SERVER="http://192.0.2.13:5600"
-HOSTNAME_FILTER="HOST-EXAMPLE"
-RDP_HOST="198.51.100.18"
+SERVER="${CHECK_AW_FULL_SERVER:-${AW_SMOKE_AW_SERVER:-${AW_SERVER:-http://10.10.10.13:5600}}}"
+HOSTNAME_FILTER="${CHECK_AW_FULL_HOST:-${AW_SMOKE_SOURCE_HOSTNAME:-${AW_LOGICAL_HOST_ID:-${AW_MONITORED_WINDOWS_HOSTNAME:-SHARKON2025}}}}"
+RDP_HOST="${CHECK_AW_FULL_RDP_HOST:-${AW_SMOKE_WINDOWS_HOST:-${AW_WINDOWS_HOST:-192.168.100.19}}}"
 NOW=$(date -u +%s)
 HOST_INACTIVE=false
 GUARD_HEALTHY=false
+DLP_ENABLED="${AW_DLP_ENABLED:-${DETMIR_DLP_ENABLED:-true}}"
+case "${DLP_ENABLED,,}" in
+  0|false|no|off) DLP_ENABLED=false ;;
+  *) DLP_ENABLED=true ;;
+esac
 
 classify_bucket_age() {
     local bucket="$1"
@@ -100,7 +105,7 @@ echo ""
 # 1. Проверка сервера
 echo -e "${CYAN}--- 1. AW Server ($SERVER) ---${NC}"
 echo -n "  Connectivity... "
-RESP=$(no_proxy=192.0.2.13 curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/info" 2>&1)
+RESP=$(no_proxy='*' curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/info" 2>&1)
 if [ $? -eq 0 ] && echo "$RESP" | jq -e '.version' > /dev/null 2>&1; then
     VERSION=$(echo "$RESP" | jq -r '.version')
     echo -e "  ${GREEN}OK${NC} (aw-server $VERSION)"
@@ -110,7 +115,7 @@ else
 fi
 
 echo -n "  CORS... "
-CORS_RESP=$(no_proxy=192.0.2.13 curl -s --connect-timeout 10 --max-time 15 -o /dev/null -w '%{http_code}' -H "Origin: http://192.0.2.13:5600" "$SERVER/api/0/settings/" 2>&1)
+CORS_RESP=$(no_proxy='*' curl -s --connect-timeout 10 --max-time 15 -o /dev/null -w '%{http_code}' -H "Origin: $SERVER" "$SERVER/api/0/settings/" 2>&1)
 if [ "$CORS_RESP" = "200" ]; then
     echo -e "${GREEN}OK${NC}"
 else
@@ -119,7 +124,7 @@ fi
 echo ""
 
 # 1b. Context for inactive/event-driven classification
-WORKTIME_EVENT_DATA=$(no_proxy=192.0.2.13 curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/aw-worktime-sessions_$HOSTNAME_FILTER/events?limit=1" 2>&1)
+WORKTIME_EVENT_DATA=$(no_proxy='*' curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/aw-worktime-sessions_$HOSTNAME_FILTER/events?limit=1" 2>&1)
 WORKTIME_TS=$(echo "$WORKTIME_EVENT_DATA" | jq -r '.[0].timestamp // ""' 2>/dev/null)
 WORKTIME_ACTIVE=$(echo "$WORKTIME_EVENT_DATA" | jq -r '.[0].data.active // false' 2>/dev/null)
 if [ -n "$WORKTIME_TS" ]; then
@@ -132,7 +137,7 @@ if [ -n "$WORKTIME_TS" ]; then
   fi
 fi
 
-GUARD_EVENT_DATA=$(no_proxy=192.0.2.13 curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/aw-rus-collector-guard_$HOSTNAME_FILTER/events?limit=1" 2>&1)
+GUARD_EVENT_DATA=$(no_proxy='*' curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/aw-rus-collector-guard_$HOSTNAME_FILTER/events?limit=1" 2>&1)
 GUARD_TS=$(echo "$GUARD_EVENT_DATA" | jq -r '.[0].timestamp // ""' 2>/dev/null)
 GUARD_STATUS=$(echo "$GUARD_EVENT_DATA" | jq -r '.[0].data.status // ""' 2>/dev/null)
 GUARD_PROBLEMS=$(echo "$GUARD_EVENT_DATA" | jq -r '([.[0].data.problems[]?] | length) // 0' 2>/dev/null)
@@ -165,9 +170,12 @@ BUCKETS=(
 for entry in "${BUCKETS[@]}"; do
   bucket="${entry%%|*}"
   label="${entry##*|}"
+  if [ "$DLP_ENABLED" = "false" ] && [[ "$bucket" == aw-dlp-* ]]; then
+    continue
+  fi
   bucket_full="${bucket}_${HOSTNAME_FILTER}"
   
-  EVENT_DATA=$(no_proxy=192.0.2.13 curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/$bucket_full/events?limit=1" 2>&1)
+  EVENT_DATA=$(no_proxy='*' curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/$bucket_full/events?limit=1" 2>&1)
   LAST_ID=$(echo "$EVENT_DATA" | jq '.[0].id // 0')
   LAST_TS=$(echo "$EVENT_DATA" | jq -r '.[0].timestamp // "no events"')
   
@@ -200,6 +208,9 @@ for entry in "${BUCKETS[@]}"; do
   
   printf "  %-42s %-8s %-20s %b\n" "$label" "$LAST_ID" "$AGE" "$STATUS"
 done
+if [ "$DLP_ENABLED" = "false" ]; then
+  printf "  %-42s %-8s %-20s %b\n" "DLP buckets" "-" "disabled" "${CYAN}SKIPPED${NC}"
+fi
 echo ""
 
 # 3. Проверка RDP-хоста
@@ -230,8 +241,11 @@ DEAD_COUNT=0
 
 for entry in "${BUCKETS[@]}"; do
   bucket="${entry%%|*}"
+  if [ "$DLP_ENABLED" = "false" ] && [[ "$bucket" == aw-dlp-* ]]; then
+    continue
+  fi
   bucket_full="${bucket}_${HOSTNAME_FILTER}"
-  EVENT_DATA=$(no_proxy=192.0.2.13 curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/$bucket_full/events?limit=1" 2>&1)
+  EVENT_DATA=$(no_proxy='*' curl -s --connect-timeout 10 --max-time 15 "$SERVER/api/0/buckets/$bucket_full/events?limit=1" 2>&1)
   LAST_TS=$(echo "$EVENT_DATA" | jq -r '.[0].timestamp // "no events"')
   
   if [ "$LAST_TS" != "no events" ] && [ -n "$LAST_TS" ]; then

docs/COMMERCIAL_MODULES_RU.md

@@ -19,10 +19,16 @@ Forensics усиливают продукт, но не должны перетя
 - как меняется загрузка сотрудников и подразделений;
 - где тормозят бизнес-процессы.
 
+Канонический контракт по загрузке, простоям, перегрузу, дисциплине процесса и
+достоверности данных: [WORKFORCE_OPERATIONS_MODEL_RU.md](WORKFORCE_OPERATIONS_MODEL_RU.md).
+
 Основные KPI:
 
 - UEBA риск: read-only `risk_score/risk_level/reasons` для приоритизации
   проверки;
+- операционная загрузка: rule-based статусы `load_status`, `idle_status`,
+  `discipline_status`, `data_confidence` для разбора загрузки, простоев,
+  перегруза и дисциплины процесса;
 - индекс активности: proxy `активное время / плановое рабочее время`;
 - взвешенная активность: только при настроенной role/application policy;
 - сравнение подразделений за текущий день;
@@ -195,7 +201,7 @@ Worktime API сохраняет daily history как агрегированны
 
 ```json
 {
-  "overload_threshold": 0.92,
+  "overload_threshold": 1.15,
   "underload_threshold": 0.45,
   "drop_threshold_pct": 20,
   "night_work_after": "20:00",
@@ -204,7 +210,9 @@ Worktime API сохраняет daily history как агрегированны
 ```
 
 `overload_threshold` и `underload_threshold` можно задавать дробью
-`0.92`/`0.45` или процентом `92`/`45`; внутри они нормализуются к процентам.
+`1.15`/`0.45` или процентом `115`/`45`; внутри они нормализуются к процентам.
+Порог перегруза ниже 100% не применяется как перегруз: это защищает отчет от
+ложного статуса "перегружен" при обычной высокой занятости.
 Если policy-файл отсутствует или отдельное поле не задано, используются
 env/default значения:
 
@@ -260,6 +268,27 @@ env/default значения:
 - подтвержденным инцидентом событие становится после регламентной валидации;
 - продукт не заявляется как сертифицированная DLP/SIEM/EDR/XDR/СЗИ.
 
+### Runtime boundary для DLP
+
+Актуальный DetMir baseline перед переработкой зафиксирован в
+[DETMIR_CURRENT_STATE_RU.md](DETMIR_CURRENT_STATE_RU.md).
+
+Коммерчески и технически DLP нужно подавать как подключаемый модуль, а не как
+обязательную часть первого экрана Workforce:
+
+- Workforce должен открываться и строить управленческие показатели без ожидания
+  DLP evidence, screenshots и heavy correlation;
+- DLP endpoint signals, clipboard/USB/print/web/file incidents, evidence review
+  и screenshots остаются ценным модулем Security/Forensics;
+- отключенная или не настроенная DLP должна давать честный disabled-state, а не
+  ошибку портала;
+- тяжелый DLP слой не должен блокировать `/api/operator`, prewarm и первичную
+  загрузку руководительского/операционного экрана.
+
+Это не означает отказ от DLP-сигналов. Это означает правильную модульность:
+ежедневная бизнес-ценность Workforce должна быть доступна быстро, а Security и
+Forensics подключаются как углубляющие слои.
+
 ## AWatch-rus Forensics
 
 Для разбора сложных событий и пост-инцидентной аналитики.

docs/DETMIR_CURRENT_STATE_RU.md

@@ -0,0 +1,387 @@
+# DetMir/AWatch-rus: актуальное состояние и граница DLP-модуля
+
+Дата фиксации: 2026-06-25.
+
+Обновление 2026-06-29 после восстановления RDP-сервера: фактический
+production IP Windows/RDP host теперь `192.168.100.19`; stable ActivityWatch
+logical host id остаётся `SHARKON2025`. Подробный post-restore baseline:
+`docs/DETMIR_RESTORE_BASELINE_2026-06-29_RU.md`.
+
+Документ фиксирует фактическое состояние DetMir/AWatch-rus и первую границу
+переработки горячего пути портала. Это не release evidence для реестра
+российского ПО, не заявление о сертификации и не claim замены DLP/SIEM/EDR.
+
+## Runtime baseline
+
+- Контур: DetMir / AWatch-rus.
+- Stable Windows/RDP logical host id для ActivityWatch bucket-ов и отчетов:
+  `SHARKON2025`. Это legacy logical id, а не обязательное физическое имя
+  Windows-сервера. Правило rename-safe эксплуатации описано в
+  `docs/WINDOWS_LOGICAL_HOST_ID_RU.md`.
+- Текущий физический RDP/WinRM target: `192.168.100.19`.
+- Portal host: `10.10.10.2`.
+- Portal service: `detmir-portal.service`.
+- Portal URL: `http://10.10.10.2:8720/`.
+- Задеплоенный binary hash:
+  `653b22b0fbf29a22f7de42ade7b689490b1de16fa07e785e4e0efd3078e7a3bc`.
+- Бэкап предыдущего binary на сервере:
+  `/usr/local/bin/detmir-portal.bak.20260625T045640Z`.
+- Runtime mode после 2026-06-30 prod hardening:
+  server-side DLP runtime зафиксирован в `core_only/disabled`.
+  Portal DLP UI/API module может оставаться включённым для чтения исторического
+  SQLite/evidence-среза, но это не означает запуск DLP collectors/exporters.
+- Server-side optional DLP runtime control:
+  `AW_DLP_ENABLED=false|true` и `DETMIR_DLP_ENABLED=false|true`.
+- Current resource profile: `AW_DLP_ENABLED=false`,
+  `AW_DLP_PROFILE=core_only`; возврат в `light` выполняется только вручную
+  после проверки нагрузки.
+- Runtime control/statistics script:
+  `scripts/detmir_dlp_runtime_control.sh` / live
+  `/usr/local/bin/detmir-dlp-runtime-control`.
+- DLP runtime state after 2026-06-30 prod hardening:
+  `AW_DLP_ENABLED=false`, `AW_DLP_PROFILE=core_only`,
+  `AW_DLP_INFLUX_ENABLED=false`; optional DLP units should be
+  `inactive/disabled`. `detmir-dlp-load-guard.timer` remains enabled and active
+  as protection for any later operator re-enable.
+- Reason: DLP runtime materially increases Proxmox VM/LXC, InfluxDB, Grafana,
+  ClickHouse and AW server load. In production DetMir the safe default is
+  `core_only`; `light` is a reconnectable profile, not the automatic default.
+- Auto-disable guard:
+  `scripts/detmir_dlp_load_guard.sh` / live
+  `/usr/local/bin/detmir-dlp-load-guard`. При перегрузе переводит DLP в
+  `core_only` через runtime-control и пишет evidence в
+  `/var/lib/activitywatch/health/dlp-light-guard-state.json`.
+- DLP warehouse sync для портала:
+  `scripts/detmir_dlp_warehouse_sync.sh` / live
+  `/usr/local/bin/detmir-dlp-warehouse-sync`. Доставляет локальный SQLite
+  snapshot на portal host для UEBA/DLP views без heavy DLP hot path.
+- Loki CT is intentionally excluded from the current DetMir production resource
+  profile. It must not be returned by routine deploy/recovery while the goal is
+  to keep Proxmox VM/LXC load low.
+- Health после деплоя: `/healthz` возвращал `status=ok`.
+- Readiness после деплоя: `/readyz` возвращал `status=ready`.
+
+## Что исправлено в текущем baseline
+
+- Первичная загрузка портала больше не зависает в бесконечном `LOADING`.
+- При холодном старте тяжелый операторский срез не блокирует UI бесконечно.
+- Frontend показывает честное состояние `STALE / Первичный срез прогревается`.
+- При prewarm больше не смешиваются статусы `STALE` и ложное
+  `Данные отсутствуют`.
+- Progress bar доходит до `100%` в fail-soft/prewarm состоянии.
+- Browser smoke после деплоя подтвердил:
+  - `loadStatus=STALE`;
+  - `progress=100%`;
+  - `LOADING=false`;
+  - `EMPTY=false`;
+  - `ERROR=false`.
+
+## Phase 1 live verification
+
+2026-06-25 после сборки `detmir-portal` и деплоя через
+`ansible/deploy_detmir_portal.yml --limit proxmox` подтверждено:
+
+- `/healthz`: `status=ok`;
+- `/readyz`: `status=ready`;
+- `/api/reports`: `ok=true`, `cache_status=warming`,
+  `modules.dlp.enabled=false`, `modules.dlp.hot_path=false`;
+- `/api/operator`: `cache_status=warming`, `summary.severity=STALE`,
+  `modules.dlp.status=disabled`, `incidents=0`;
+- server log для `/api/operator`: `status=200`, `latency_ms=49`.
+
+Это подтверждает, что первый operator/API screen больше не блокируется на
+холодной полной сборке. Полный snapshot строится в фоне и честно помечается как
+`warming`/`STALE`.
+
+## Текущая проблема производительности
+
+Наблюдаемые признаки:
+
+- после restart полный тяжелый snapshot может уходить в prewarm/stale mode;
+- report cache и stale UI защищают пользователя от зависания, но не убирают
+  саму стоимость тяжелых расчетов;
+- DLP evidence, screenshots, endpoint signals, case review и forensics
+  enrichment требуют больше CPU/IO/сетевых операций, чем Workforce core.
+
+Вывод: DLP/evidence/forensics enrichment вынесен из обязательного hot path.
+Phase 1 делал это через `DETMIR_PORTAL_DLP_MODULE_ENABLED=false`; текущий
+lightweight-профиль оставляет DLP-status/UEBA-сигналы включенными без тяжелого
+evidence/case/exporter path. Полная оптимизация тяжелого snapshot/prewarm
+остается отдельной инженерной задачей.
+
+## Целевая граница после переработки
+
+Core hot path:
+
+- Workforce Operations;
+- worktime/activity;
+- загрузка, простои, перегруз;
+- дисциплина процесса;
+- качество и полнота данных;
+- легкие агрегаты для руководителя;
+- readiness/health без ожидания DLP.
+
+Optional DLP module:
+
+- DLP endpoint signals;
+- clipboard/USB/print/web/file operation incidents;
+- screenshots/evidence;
+- DLP/case review;
+- heavy security correlation;
+- forensics timelines and evidence packages;
+- Hayabusa enrichment where needed.
+
+Отключение optional DLP module не должно ломать:
+
+- `/healthz`;
+- `/readyz`;
+- первичную загрузку портала;
+- Workforce views;
+- management reports;
+- базовый operator dashboard.
+
+Отключение optional DLP module должно показывать честный статус:
+
+```text
+DLP module disabled / not configured
+```
+
+без заявления, что DLP-проверки выполнены.
+
+## Рекомендуемые feature flags
+
+Минимальная целевая модель конфигурации:
+
+```json
+{
+  "modules": {
+    "dlp": {
+      "enabled": false,
+      "evidence": false,
+      "correlation": false,
+      "screenshots": false,
+      "hot_path": false
+    }
+  }
+}
+```
+
+Первая реализованная runtime-граница:
+
+```text
+--dlp-module-enabled
+DETMIR_PORTAL_DLP_MODULE_ENABLED=true|false
+AW_DLP_ENABLED=true|false
+DETMIR_DLP_ENABLED=true|false
+```
+
+DetMir production default после 2026-06-30 hardening:
+`AW_DLP_ENABLED=false` / `AW_DLP_PROFILE=core_only`. Portal DLP module may stay
+enabled for historical/security views, but server-side DLP collectors/exporters
+remain off. В этом режиме портал:
+
+- не читает DLP incident/case/review/audit файлы в основном report/operator
+  path;
+- использует только уже имеющийся лёгкий DLP-срез для UEBA и статуса;
+- не включает evidence/case/exporters/Loki/Influx-heavy path;
+- не считает отсутствие heavy DLP ошибкой Workforce core.
+
+Ansible-параметр поставки для старого disabled-профиля:
+
+```yaml
+detmir_portal_dlp_module_enabled_override: false
+```
+
+Для текущего safe production профиля:
+
+```yaml
+detmir_portal_dlp_module_enabled_override: true
+aw_dlp_profile: "core_only"
+aw_dlp_enabled: false
+aw_dlp_influx_enabled: false
+aw_dlp_light_collector_enabled: false
+aw_dlp_light_guard_enabled: true
+```
+
+Возврат в `light` выполняется только после resource check:
+
+```bash
+sudo AW_DLP_DISABLED_REASON=operator_reenable_after_resource_check \
+  /usr/local/bin/detmir-dlp-runtime-control set-profile light
+sudo sed -i \
+  -e 's/^AW_DLP_ENABLED=.*/AW_DLP_ENABLED=true/' \
+  -e 's/^AW_DLP_PROFILE=.*/AW_DLP_PROFILE=light/' \
+  /etc/activitywatch/aw-server.env
+```
+
+Отдельный `detmir-portal-evidence` сервис не отключается этим флагом и остается
+самостоятельным контуром evidence/API при наличии отдельной конфигурации.
+
+Hayabusa/Velociraptor boundary:
+
+- Hayabusa/Sigma and Velociraptor are optional security findings / forensics
+  sources, not Workforce hot path dependencies.
+- Heavy DLP runtime can remain disabled while Hayabusa/Velociraptor findings
+  are imported into Security Finding Inbox / ClickHouse.
+- Velociraptor server/client mode must be enabled explicitly
+  (`disabled|offline_collector|server_clients`) and must not be auto-started by
+  routine production deploy on the small DetMir Proxmox contour.
+- Findings from Velociraptor/Hayabusa support `decide -> plan -> approve ->
+  apply -> verify`, but do not imply automatic remediation without approval.
+
+Server-side optional DLP runtime описан отдельно:
+
+- [DLP_OPTIONAL_RUNTIME_RU.md](DLP_OPTIONAL_RUNTIME_RU.md).
+- [DLP_RESOURCE_PROFILES_RU.md](DLP_RESOURCE_PROFILES_RU.md).
+
+При `AW_DLP_ENABLED=false`:
+
+- `dlp-health-check` возвращает штатный `dlp:mode=disabled`;
+- `detmir-dlp` не выполняет SSH health probe;
+- `detmir-check`, `check-aw-full` и `check-aw-data` не считают DLP buckets
+  обязательными;
+- `detmir-readiness` не требует DLP Influx write и DLP systemd units;
+- DLP profile changes use
+  `/usr/local/bin/detmir-dlp-runtime-control set-profile <profile>` and keep a
+  rollback snapshot for `/usr/local/bin/detmir-dlp-runtime-control rollback`;
+- перед отключением и после отключения собираются JSON-срезы в
+  `/var/lib/activitywatch/health/dlp-runtime-history/`, latest-срез остается в
+  `/var/lib/activitywatch/health/dlp-runtime-state.json`.
+
+При `AW_DLP_PROFILE=light`:
+
+- `activitywatch-dlp-aggregator.timer` собирает только ограниченный набор DLP
+  events в локальный SQLite warehouse;
+- `detmir-dlp-warehouse-sync.timer` доставляет этот warehouse на portal host
+  атомарным snapshot;
+- UEBA может учитывать `dlp_warn`/`dlp_fail` без запуска Loki/Influx-heavy path;
+- `detmir-dlp-load-guard.timer` автоматически переводит профиль в `core_only`
+  при превышении порогов load/RAM/iowait;
+- тяжёлые DLP units (`aw-dlp-influx-exporter`, report/syslog/webhook/CEF,
+  policy engine, case management, evidence API) должны оставаться выключенными.
+- если `detmir-dlp-load-guard.timer` видит повторный перегруз, он автоматически
+  возвращает DLP runtime в `core_only`.
+
+Live disable evidence 2026-06-25:
+
+- `dlp-health-check` returned `ok=true`, `dlp:mode=disabled`;
+- `detmir-dlp` returned `ok=true`, `dlp:mode=disabled`;
+- pre-disable active units:
+  `aw-dlp-influx-exporter.timer`,
+  `activitywatch-dlp-aggregator.timer`,
+  `aw-dlp-report-scheduler.timer`,
+  `aw-dlp-syslog-forwarder.timer`,
+  `aw-dlp-webhook-sender.timer`,
+  `aw-dlp-cef-exporter.timer`,
+  `aw-dlp-ioc-refresh.timer`,
+  `aw-dlp-policy-engine.service`,
+  `aw-dlp-case-management.service`,
+  `detmir-portal-evidence.service`;
+- post-disable active/enabled DLP units: `0/0`;
+- retained evidence files:
+  `/var/lib/activitywatch/health/dlp-runtime-history/dlp-runtime-current-20260625T083619Z.json`,
+  `/var/lib/activitywatch/health/dlp-runtime-history/dlp-runtime-pre_disable-20260625T083637Z.json`,
+  `/var/lib/activitywatch/health/dlp-runtime-history/dlp-runtime-disabled-20260625T083700Z.json`;
+- `check-aw-full` with `AW_DLP_ENABLED=false` reports `DLP buckets ...
+  SKIPPED`;
+- ActivityWatch core services remained active:
+  `activitywatch-server`, `aw-worktime-api`.
+
+Separate live observations after DLP disable, before 2026-06-29 restore:
+
+- `aw-watcher-afk`, `aw-watcher-window` and `aw-worktime-sessions` were stale
+  in the manual check and require separate RDP collector/session recovery;
+- WinRM from the server side to `192.168.100.18:5985` was unreachable during
+  this check;
+- these are not treated as DLP disable regressions.
+
+Post-restore correction on 2026-06-29:
+
+- current physical RDP/WinRM target is `192.168.100.19`;
+- laptop route to `192.168.100.19` is through DetMir OpenVPN gateway
+  `10.0.13.1`;
+- WinRM `5985` and RDP `3389` are reachable from the admin laptop;
+- stable ActivityWatch logical host id remains `SHARKON2025`.
+
+Fail-safe правила:
+
+- если DLP выключена, Security/Forensics views должны показывать disabled-state,
+  а не падать;
+- если DLP включена, тяжелые DLP операции должны выполняться асинхронно или
+  через cache, а не блокировать первый Workforce/operator screen;
+- readiness не должен заявлять DLP healthy, если модуль отключен или не
+  проверен;
+- отсутствие DLP не является ошибкой Workforce core.
+
+## Сетевое состояние
+
+Доступ к DetMir зависит от NetworkManager VPN profile
+`pfSense-gate-UDP4-1194-vpn_prog10-config`. Имя tun-интерфейса не является
+семантической идентичностью и должно проверяться по адресу `10.0.13.*`.
+
+Пример рабочего route:
+
+```text
+10.10.10.2 via 10.0.13.1 dev <current-detmir-tun>
+```
+
+Наблюдавшаяся нестабильность dataplane:
+
+- tun device может присутствовать в routing table, но gateway `10.0.13.1` не
+  отвечает;
+- при этом SSH, `/healthz` и браузерная проверка DetMir недоступны;
+- после ручного поднятия NetworkManager-подключения
+  `pfSense-gate-UDP4-1194-vpn_prog10-config` доступ восстанавливался.
+- 2026-06-25 после phase 1 deploy зафиксирован отдельный сбой:
+  `nm-openvpn` для `178.178.98.83:1194` получил `TLS handshake failed` и
+  `connect timeout exceeded`; повторная production-очистка старого systemd
+  prewarm drop-in отложена до восстановления VPN handshake.
+
+Актуальная проверка 2026-06-29:
+
+```text
+192.168.100.19 via 10.0.13.1 dev <current-detmir-tun>
+10.0.13.1 ping OK
+192.168.100.19:5985 OK
+192.168.100.19:3389 OK
+```
+
+Команда восстановления:
+
+```bash
+nmcli connection down 'pfSense-gate-UDP4-1194-vpn_prog10-config' || true
+sleep 2
+nmcli connection up 'pfSense-gate-UDP4-1194-vpn_prog10-config'
+```
+
+Проверка:
+
+```bash
+ping -c 2 -W 2 10.0.13.1
+ping -c 2 -W 2 10.10.10.2
+nc -vz -w 3 10.10.10.2 22
+curl -sS --max-time 5 http://10.10.10.2:8720/healthz
+```
+
+## Что не менять без отдельной задачи
+
+- Не удалять DLP collectors и warehouse ради ускорения портала.
+- Не включать heavy DLP или Velociraptor server runtime автоматически при
+  обычном deploy без ресурсного решения.
+- Не включать Loki CT автоматически при обычном deploy/recovery DetMir.
+- Не менять UI/API несовместимо: новые поля должны быть additive.
+- Не заявлять completed DLP decoupling до live deploy и browser/API smoke.
+- Не позиционировать AWatch-rus как сертифицированную DLP/SIEM/EDR/СЗИ.
+
+## Следующий инженерный шаг
+
+Закрыть оставшиеся production-hardening пункты:
+
+1. После восстановления DetMir VPN повторно прогнать
+   `ansible/deploy_detmir_portal.yml`, чтобы удалить legacy drop-in
+   `/etc/systemd/system/detmir-portal.service.d/30-prewarm-after-start.conf`.
+2. Подтвердить remote `sha256sum /usr/local/bin/detmir-portal` и отсутствие
+   `ExecStartPost` prewarm в `systemctl cat detmir-portal`.
+3. Подтвердить browser smoke без зависания первичной загрузки.
+4. Добавить метрики и smoke для режимов `dlp.enabled=false` и
+   `dlp.enabled=true`.

docs/DETMIR_RESILIENCE_HARDENING_RU.md

@@ -0,0 +1,695 @@
+# DetMir/AWatch-rus: hardline resilience hardening
+
+Документ фиксирует реализованные и проверенные шаги по доведению живого
+контура до fail-closed уровня. Он не заменяет production runbook; здесь только
+изменения, влияющие на отказоустойчивость.
+
+## 2026-06-30: crash-test readiness gate and healthd route boundary
+
+Статус: implemented in repo, deployed on live AW server, verified by manual
+crash test.
+
+Что прогонялось:
+
+- baseline `check-aw-full.sh`, SQLite hot-path plan, disk/headroom, RDP guard;
+- bounded parallel load на `/api/0/info`,
+  `/aw-worktime-sessions_SHARKON2025/events?limit=100`,
+  `aw-detmir-web-category_SHARKON2025` и Worktime API;
+- controlled restart: `aw-worktime-api`, `activitywatch-server`,
+  `AWatchRusCollectorGuard`;
+- gateway/ClickHouse/Grafana reachability checks;
+- live `scripts/detmir_resilience_check.sh --live` on AW server.
+
+Что найдено:
+
+- `systemctl is-active activitywatch-server` не равен полной готовности API:
+  сразу после `systemctl restart activitywatch-server` первый `/api/0/info`
+  мог уйти в 15 секунд timeout, затем API стабилизировался и hot-path
+  `/events?limit=100` отвечал быстро;
+- `aw-dlp-case-management.service` оставался active при disabled DLP profile;
+- `aw-rus-healthd.service` падал из-за TCP timeout с AW server до
+  `192.168.100.19:5985/3389`, хотя фактическая RDP/WinRM проверка с
+  admin/VPN side и bucket freshness были зелёными;
+- SQLite hot-path index
+  `events_bucketrow_starttime_desc_index` присутствовал и использовался,
+  `TEMP B-TREE` для worktime event query не строился.
+
+Что изменено:
+
+- `scripts/detmir_resilience_check.sh --live` теперь использует readiness-loop
+  для `/api/0/info`, проверяет worktime hot path, Worktime API rows/degraded
+  state, SQLite hot-path index/plan и disabled-state optional DLP/Loki units;
+- `aw-rus-healthd-rust` получил fail-closed параметр
+  `AW_RUS_HEALTH_RDP_TCP_REQUIRED` / `--rdp-tcp-required`;
+- default/example остаётся `true`; в DetMir production выставлено
+  `false`, потому что server-side TCP до RDP сейчас является route/ACL
+  boundary, а не authoritative proof of collector health;
+- active drift `aw-dlp-case-management.service` остановлен, unit оставлен
+  disabled для штатного будущего включения DLP contour.
+
+Live verification:
+
+- `check-aw-full.sh`: `FRESH=8`, `STALE=0`, `DEAD=0`;
+- targeted load after stabilization:
+  `info_p2/p4/p8/p12` по `24/24` HTTP 200,
+  worktime events `40/40` HTTP 200,
+  web category bucket `40/40` HTTP 200,
+  Worktime today `30/30` HTTP 200;
+- `AWatchRusCollectorGuard` restart: service `Running`, `GUARD_CHILDREN=1`,
+  collector process layout unchanged;
+- `aw-rus-healthd.service`: `status=0/SUCCESS`, `ok=11`, `warn=3`, `fail=0`;
+- `scripts/detmir_resilience_check.sh --live` after fixes:
+  readiness, hot path, Worktime API, SQLite index, optional DLP and Loki checks
+  pass; Hayabusa quarantine warning remains informational evidence to review.
+
+Safety guardrails:
+
+- no AW bucket schema, API, UI or Workforce business logic changed;
+- GitHub/Grafana/ClickHouse are still validation/visibility surfaces, not
+  Russian registry release evidence;
+- DLP remains optional/reconnectable, not removed.
+
+## 2026-06-25: optional DLP runtime off switch and statistics
+
+Статус: implemented in repo, deployed, live disable verified on 2026-06-25.
+
+Проблема:
+
+- DLP runtime может создавать избыточную нагрузку на InfluxDB, Grafana,
+  ClickHouse и AW server при включенных aggregator/exporter/case/report
+  pipeline;
+- простая остановка DLP units раньше приводила бы к ложным красным health,
+  readiness и contour checks.
+
+Что добавлено:
+
+- `AW_DLP_ENABLED=false` для AW server runtime;
+- `DETMIR_DLP_ENABLED=false` для управляющего DetMir contour check;
+- `dlp-health-check` возвращает штатный `dlp:mode=disabled`;
+- `detmir-dlp` не выполняет SSH health probe при disabled mode;
+- `detmir-check`, `check-aw-full`, `check-aw-data` пропускают DLP buckets при
+  disabled mode;
+- `detmir-readiness` не требует DLP Influx write и DLP systemd units при
+  disabled mode;
+- `scripts/detmir_dlp_runtime_control.sh` собирает JSON-срез DLP units/buckets
+  и выполняет controlled `disable|enable`.
+- live `disable` сохраняет отдельные evidence-снимки `current`,
+  `pre_disable` и `disabled` в
+  `/var/lib/activitywatch/health/dlp-runtime-history/`.
+
+Safety guardrails:
+
+- ActivityWatch server, worktime, Hayabusa, 1C/ClickHouse core не отключаются;
+- historical DLP buckets/evidence не удаляются;
+- disabled-state не заявляет, что DLP проверки выполнены;
+- это не claim замены DLP/SIEM/EDR и не удаление DLP-функциональности.
+
+Runbook:
+
+- [DLP_OPTIONAL_RUNTIME_RU.md](DLP_OPTIONAL_RUNTIME_RU.md).
+
+Live verification 2026-06-25:
+
+- before disable, active DLP runtime units were present:
+  `aw-dlp-influx-exporter.timer`, `activitywatch-dlp-aggregator.timer`,
+  DLP report/integration timers, policy/case services and
+  `detmir-portal-evidence.service`;
+- after disable, active/enabled DLP units: `0/0`;
+- `AW_DLP_ENABLED=false`, `AW_DLP_INFLUX_ENABLED=false`,
+  `AW_DLP_DISABLED_REASON=operator_disabled_to_reduce_influx_grafana_clickhouse_load`;
+- `dlp-health-check` and `detmir-dlp` both returned `dlp:mode=disabled`;
+- `check-aw-full` reported DLP buckets as `SKIPPED`;
+- ActivityWatch core remained active:
+  `activitywatch-server`, `aw-worktime-api`.
+
+Residual non-DLP findings from the same check:
+
+- RDP-side collectors require separate recovery: AFK/window/worktime buckets
+  were stale;
+- server-side WinRM reachability to `192.168.100.18:5985` was unavailable;
+- `aw-rus-healthd.service` was already failed and is tracked separately from
+  this DLP runtime disable.
+
+## 2026-06-24: Hayabusa poison-package isolation
+
+Статус: implemented locally, unit-tested, deployed on AW server.
+
+Проблема:
+
+- один битый zip в `/opt/hayabusa/inbox/incoming` мог остановить весь
+  Hayabusa pipeline;
+- `aw-hayabusa-drop.path` после повторных падений мог упереться в systemd
+  start-limit;
+- восстановление требовало ручного переноса bad zip в quarantine.
+
+Что изменено:
+
+- `aw-hayabusa-autoprocess-rust` проверяет drop zip до `accept`;
+- corrupt/empty/unsafe zip и битые sidecar-файлы не попадают в рабочий inbox;
+- bad drop package переносится в `/opt/hayabusa/quarantine/drop/...` вместе с
+  `.meta.json`, `.caseid`, optional `.sha256` и `reason.json`;
+- `aw-hayabusa process-inbox` больше не abort'ит весь batch из-за одного
+  incoming package;
+- failed incoming package переносится в
+  `/opt/hayabusa/quarantine/incoming/...` с partial staging payload и
+  `reason.json`, если пакет остался в incoming;
+- пакеты, уже архивированные wrapper'ом как `failed-no-evtx` или
+  `failed-analysis`, остаются в штатном archive/intake manifest для
+  расследования.
+
+Safety guardrails:
+
+- quarantine не удаляет evidence;
+- replay выполняется только после re-export или явного восстановления пакета;
+- один poison archive не должен мешать обработке остальных zip;
+- operational failures инфраструктуры (`aw-hayabusa` отсутствует, права,
+  broken runtime) остаются красными и не маскируются как успешная обработка.
+
+Проверки:
+
+```bash
+cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian
+bash -n aw-server/hayabusa/aw-hayabusa.sh
+
+cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian/adk-rust
+export CARGO_TARGET_DIR=/home/igor/.cache/detmir-adk-rust-target
+cargo test -p hayabusa-tools
+```
+
+Результат проверки:
+
+- `bash -n aw-server/hayabusa/aw-hayabusa.sh` passed;
+- `cargo test -p hayabusa-tools` passed: 5 tests passed.
+
+Production deployment note:
+
+- после сборки и доставки нового `aw-hayabusa-autoprocess-rust` нужно
+  выполнить live dry-run на empty drop и контролируемый bad-zip test в
+  непроизводственном каталоге или с временным isolated `--drop-dir`;
+- live production queue руками не мутировать без предварительного backup/listing.
+
+Live rollout evidence:
+
+- deployed on AW server on `2026-06-24`;
+- previous `/usr/local/bin/aw-hayabusa` and
+  `/usr/local/bin/aw-hayabusa-autoprocess-rust` were backed up with timestamp
+  suffix;
+- `/usr/local/bin/aw-hayabusa doctor` returned OK;
+- isolated empty-drop dry-run returned `no zip packages in drop dir`;
+- production queue after rollout: `incoming_zip=0`, `DROP_COUNT=0`,
+  `aw-hayabusa-drop.path=active`, `aw-hayabusa-drop.service=inactive`;
+- stale staging residue from `2026-06-20` was moved, not deleted, to
+  `/opt/hayabusa/quarantine/staging-stale-20260624T190739Z/` with
+  `reason.json`;
+- after cleanup: `staged_dirs=0`, `archived_packages=74`,
+  `archived_payloads=74`.
+
+## 2026-06-24: Windows collector guard service child watchdog
+
+Статус: implemented locally, static checks passed, deployed on RDP host.
+
+Проблема:
+
+- Windows service `AWatchRusCollectorGuard` мог оставаться в состоянии
+  `running`, когда дочерний `aw-windows-telemetry.exe collector-guard` уже
+  отсутствовал;
+- SCM recovery не срабатывал, потому что сам service wrapper не падал.
+
+Что изменено:
+
+- `AWatchRusCollectorGuardService.cs` теперь подписывается на `Process.Exited`;
+- при неожиданном выходе child-процесса wrapper делает bounded restart;
+- restart budget: 5 child restarts за 600 секунд, задержка 5 секунд;
+- при исчерпании бюджета wrapper завершает service с ошибкой, чтобы Windows
+  Service Control Manager применил recovery actions;
+- installer включает `sc.exe failureflag <service> 1`, чтобы recovery actions
+  применялись к service failures, а не только к crash-путям;
+- `ActivityWatch Recovery` остаётся fallback/bootstrap задачей и не отключается.
+
+Safety guardrails:
+
+- штатный `Stop-Service`/shutdown выставляет `stopping=true`, поэтому child exit
+  во время остановки не считается аварией;
+- wrapper не меняет collector mode, bucket names, event schema и AW API;
+- service-level recovery ограничен существующим `sc.exe failure` budget.
+
+Проверки:
+
+```powershell
+pwsh -NoProfile -Command '<compile AWatchRusCollectorGuardService.cs through Add-Type>'
+pwsh -NoProfile -Command '<parse install-collector-guard-service.ps1>'
+
+powershell -NoProfile -ExecutionPolicy Bypass -File windows/install-collector-guard-service.ps1
+Get-Service AWatchRusCollectorGuard
+Get-Content C:\ProgramData\AWatch-rus\logs\collector-guard-service.log -Tail 20
+```
+
+Результат локальной проверки:
+
+- `AWatchRusCollectorGuardService.cs` compiled through PowerShell `Add-Type`;
+- `windows/install-collector-guard-service.ps1` parsed with PowerShell parser;
+- live install/restart validation still requires Windows/RDP deployment window.
+
+Live rollout evidence:
+
+- deployed on RDP host on `2026-06-24`;
+- previous service source, installer and exe were backed up under
+  `C:\ProgramData\AWatch-rus\backup\collector-guard-service-20260624T190827Z`;
+- installer completed with `Runtime: rust`, `Mode: enforce`;
+- SCM `failureflag` is enabled:
+  `FAILURE_ACTIONS_ON_NONCRASH_FAILURES: TRUE`;
+- controlled fault-injection killed only the child
+  `aw-windows-telemetry.exe collector-guard`;
+- wrapper observed child exit, attempted bounded restarts, SCM recovery restarted
+  wrapper after budget exhaustion, and child stabilized;
+- final validation after one guard loop: service `Running`, `CHILD_COUNT=1`,
+  child `aw-windows-telemetry.exe`, latest rust guard cycle `status=ok`.
+
+Live validation после деплоя:
+
+- убить только child `aw-windows-telemetry.exe collector-guard`;
+- убедиться, что service остаётся running и child перезапущен;
+- повторить child crash больше 5 раз за 600 секунд в тестовом окне;
+- убедиться, что service перешёл через SCM recovery, а не остался
+  `running/no child`.
+
+## 2026-06-24: contour resilience check
+
+Статус: implemented locally, shell syntax/repo-mode passed, live AW server
+check passed.
+
+Проблема:
+
+- отдельные исправления легко потерять при deploy/drift;
+- CI не проверял, что poison-package isolation и child watchdog реально
+  присутствуют в коде и документации;
+- live-проверки должны оставаться read-only и не маскировать production сбой.
+
+Что добавлено:
+
+- `scripts/detmir_resilience_check.sh`;
+- `--repo` режим для CI-safe проверки hardening-файлов, паттернов и docs;
+- `--live` режим для read-only проверки локального AW/Hayabusa host:
+  `activitywatch-server`, `aw-worktime-api`, AW `/api/0/info`, failed systemd
+  units, Hayabusa `incoming/drop/quarantine`, SQLite DB/WAL size;
+- `RUN_RESILIENCE_CHECK=1` hook в `scripts/run_awatch_contour_check.sh`;
+- `DETMIR_RESILIENCE_STRICT_SECRETS=1` режим, который fail'ит literal
+  `ansible_password`/`ansible_become_password` в private inventory без вывода
+  значений.
+
+Safety guardrails:
+
+- check не рестартует сервисы, не двигает очереди, не пишет в production dirs;
+- secret check печатает только факт наличия literal assignments, не значения;
+- live mode запускается явно через `--live` или `--all`;
+- GitHub/public CI может использовать только `--repo`.
+
+Secret handling update 2026-06-30:
+
+- literal `ansible_password` и `ansible_become_password` удалены из локального
+  `ansible/inventory.ini`;
+- `aw_server` читает SSH/sudo secrets из `AW_SSH_PASSWORD` и
+  `AW_SUDO_PASSWORD`;
+- `proxmox` читает SSH/sudo secrets из `AW_PROXMOX_SSH_PASSWORD` и
+  `AW_PROXMOX_SUDO_PASSWORD`, с fallback на `AW_SSH_PASSWORD` /
+  `AW_SUDO_PASSWORD`;
+- `aw_windows` читает WinRM secret из `AW_WINRM_PASSWORD`;
+- `inventory.example.ini` больше не содержит placeholder password-поля.
+
+Проверки:
+
+```bash
+bash -n scripts/detmir_resilience_check.sh
+bash scripts/detmir_resilience_check.sh --repo
+```
+
+Результат локальной проверки:
+
+- shell syntax passed for `scripts/detmir_resilience_check.sh`;
+- shell syntax passed for `scripts/run_awatch_contour_check.sh`;
+- repo-mode passed with `ok=15`, `fail=0`;
+- repo-mode reported one WARN: literal Ansible password assignments appear to
+  exist in `ansible/inventory.ini`; values are not printed, and
+  `DETMIR_RESILIENCE_STRICT_SECRETS=1` converts this to fail for private
+  contour gates.
+
+Live AW server result:
+
+- `bash /tmp/detmir_resilience_check.sh --live` passed on AW server;
+- result: `ok=9`, `warn=1`, `fail=0`;
+- WARN is expected after this rollout: one quarantine `reason.json` exists for
+  the moved stale Hayabusa staging residue.
+
+## 2026-06-24: live drift fixes after full contour re-check
+
+Статус: deployed and verified live.
+
+Что было найдено:
+
+- ClickHouse container was healthy by direct SQL checks, but Docker Compose did
+  not define a container `HEALTHCHECK`; because of that
+  `aw-1c-clickhouse-health.service` failed with
+  `docker healthcheck is not configured`.
+- `detmir-auto` used the default public gateway URL for portal checks when
+  `/etc/detmir/detmir-check.env` did not set `DETMIR_PORTAL_URL`; protected
+  public `/readyz`, `/version` and `/metrics` returned legitimate `401`.
+- `detmir-portal-prewarm.service` had `curl --max-time 60`, but a cold
+  `/api/reports` build on the live contour can take more than 60 seconds.
+- `aw-rus-healthd-rust` used the default 20 second wrapper timeout; under
+  concurrent checks `dlp-health-check --json` could be killed mid-output and be
+  reported as `invalid JSON output`.
+
+Что изменено:
+
+- `clickhouse-1c/docker-compose.yml` now defines a ClickHouse client
+  `HEALTHCHECK`, deployed to `/opt/activitywatch/clickhouse-1c/docker-compose.yml`;
+- production `/etc/detmir/detmir-check.env` now contains
+  `DETMIR_PORTAL_URL=http://127.0.0.1:8720` and
+  `DETMIR_GATEWAY_HOST=127.0.0.1`;
+- `ops/systemd/detmir-portal-prewarm.service` is now tracked in the repo and
+  deployed with `curl --max-time 180` and `TimeoutStartSec=210`;
+- production `/etc/activitywatch/aw-server.env` and
+  `aw-server/aw-server.env.example` now set
+  `AW_RUS_HEALTH_WRAPPER_TIMEOUT_SECONDS=90`.
+
+Verification:
+
+- `check-aw-full.sh`: `FRESH=8`, `STALE=0`, `DEAD=0`;
+- `detmir-check` through the production env file: `ok=true`,
+  `service_failures=0`;
+- `detmir-auto.service`, `awatch-contour-daily-check.service`,
+  `awatch-contour-weekly-check.service`: `status=0/SUCCESS`;
+- `detmir-portal-prewarm.service`: `status=0/SUCCESS`;
+- `aw-1c-clickhouse-health.service`: `status=0/SUCCESS`, Docker state
+  `(healthy)`;
+- `aw-rus-healthd.service`: `status=0/SUCCESS`, failed systemd units on
+  AW server and Proxmox are zero.
+
+## 2026-06-25: portal cold-start prewarm after service restart
+
+Статус: deployed and verified live at the time, then superseded by the
+fail-soft hot-path boundary below.
+
+Что было найдено:
+
+- после ручного `systemctl restart detmir-portal` первый
+  `/api/reports?role=manager` может выполнять холодный расчет дольше 120 секунд;
+- `detmir-portal-prewarm.timer` держит cache теплым каждые 30 минут, но не
+  запускается немедленно при ручном рестарте портала.
+- одного prewarm недостаточно, если каждый пользовательский `/api/reports`
+  заново запускает тяжелую генерацию отчета.
+
+Что изменено:
+
+- добавлен tracked drop-in
+  `ops/systemd/detmir-portal.service.d/30-prewarm-after-start.conf`;
+- production drop-in `/etc/systemd/system/detmir-portal.service.d/30-prewarm-after-start.conf`
+  запускает `detmir-portal-prewarm.service` через `systemctl --no-block` после
+  каждого старта портала;
+- prewarm остается best-effort: портал стартует независимо, а тяжелый
+  `/api/reports` прогревается в фоне.
+- в `detmir-portal` добавлен short-lived in-process report cache с TTL 120
+  секунд и защитой от stampede: первый report-запрос строит payload, следующие
+  report endpoints в окне TTL отдают тот же payload без повторной генерации.
+- в `/metrics` добавлены отдельные счетчики report-cache:
+  `awatch_report_requests_total`, `awatch_report_cache_hits_total`,
+  `awatch_report_cache_misses_total`. Старый
+  `awatch_reports_generated_total` остается счетчиком успешно завершенных
+  тяжелых генераций отчета, а не счетчиком HTTP-запросов.
+
+Verification:
+
+- `/healthz`: `200`;
+- `/readyz`: `200`, `status=ready`;
+- prewarm after restart: `status=0/SUCCESS`;
+- cold `/api/reports?role=manager` after expired cache: `200`, около `63s`;
+- warm `/api/reports?role=manager`: `200`, около `0.34..0.35s` в трех
+  последовательных запросах;
+- `awatch_reports_generated_total` не вырос после трех warm report-запросов;
+- `awatch_report_requests_total` растет на report endpoints, а
+  `awatch_report_cache_hits_total` растет на warm cache-запросах;
+- во время cold/prewarm сборки `awatch_report_requests_total` показывает
+  входящие report-запросы до ожидания cache lock, а
+  `awatch_reports_generated_total` растет только после готового payload;
+- `workforce_operations.summary` и `workforce_operations.rows` доступны в JSON;
+- browser smoke: блок `Операционная загрузка` отрисован, строки сотрудников
+  видны, console errors/warnings отсутствуют.
+
+Superseded note:
+
+- restart-triggered external prewarm reduced warm-cache latency, but it also
+  kept a heavy full-report job coupled to service restart;
+- after the DLP/hot-path phase 1 change, the preferred production behavior is
+  immediate `warming`/`STALE` API response from the portal itself, not a
+  mandatory heavy `ExecStartPost` prewarm after every restart;
+- legacy drop-ins
+  `/etc/systemd/system/detmir-portal.service.d/20-prod-timeout.conf` and
+  `/etc/systemd/system/detmir-portal.service.d/30-prewarm-after-start.conf`
+  are now treated as stale deployment residue and are removed by
+  `ansible/deploy_detmir_portal.yml`.
+
+## 2026-06-25: current state and first DLP hot-path boundary
+
+Статус: phase 1 implemented, targeted Rust tests passed, deployed once on the
+DetMir portal host and API-smoke verified. Follow-up production cleanup of stale
+restart-prewarm drop-ins is pending until DetMir VPN handshake is stable again.
+
+Фактический runtime:
+
+- production `detmir-portal` binary:
+  `653b22b0fbf29a22f7de42ade7b689490b1de16fa07e785e4e0efd3078e7a3bc`;
+- deploy command used:
+  `ansible-playbook -i inventory.ini deploy_detmir_portal.yml --limit proxmox -e detmir_portal_bind_override=0.0.0.0:8720 -e detmir_portal_dlp_module_enabled_override=false`;
+- `/healthz`: `status=ok` after deploy;
+- `/readyz`: `status=ready` after deploy;
+- `/api/reports`: `ok=true`, `cache_status=warming`,
+  `modules.dlp.enabled=false`, `modules.dlp.hot_path=false`;
+- `/api/operator`: `cache_status=warming`, `summary.severity=STALE`,
+  `modules.dlp.status=disabled`, `incidents=0`;
+- server log: `/api/operator` returned `200` with `latency_ms=49`;
+- browser smoke after restart: `loadStatus=STALE`, progress `100%`,
+  `LOADING=false`, `EMPTY=false`, `ERROR=false`.
+
+Что это означает:
+
+- первичное зависание портала устранено на уровне UX/cache/stale fallback;
+- `/api/operator` no longer waits for the cold full snapshot and can return a
+  bounded `warming` payload;
+- тяжелая генерация полного отчета/snapshot все еще может быть дорогой во время
+  cold/prewarm;
+- DLP/security enrichment has a first runtime boundary out of the Workforce hot
+  path: phase 1 used `DETMIR_PORTAL_DLP_MODULE_ENABLED=false`; the current
+  DetMir production default keeps DLP runtime disabled/`core_only`, while
+  `light` remains an explicit operator re-enable profile after resource check;
+- текущее состояние зафиксировано отдельно:
+  `docs/DETMIR_CURRENT_STATE_RU.md`.
+
+Архитектурное решение для следующего шага:
+
+- Workforce core должен оставаться быстрым и доступным без DLP;
+- DLP evidence, endpoint signals, screenshots, case review, heavy correlation
+  and forensics enrichment должны стать optional module;
+- prewarm не должен обязательно выполнять heavy DLP path;
+- Security/Forensics views при отключенной DLP должны показывать disabled-state,
+  а не ломать portal readiness.
+
+Реализованная первая граница:
+
+- CLI/env flag: `--dlp-module-enabled` /
+  `DETMIR_PORTAL_DLP_MODULE_ENABLED`;
+- DetMir production default после resource hardening: `false` / `core_only`,
+  чтобы обычный deploy/recovery не возвращал DLP нагрузку на Proxmox, AW,
+  ClickHouse, InfluxDB и Grafana;
+- `light` допускается только как явное operator re-enable действие после
+  resource check; при `light` основной portal snapshot не читает тяжелые
+  incident/case/review/audit DLP state, а evidence/case/exporter path остается
+  выключенным;
+- Ansible deploy parameter:
+  `detmir_portal_dlp_module_enabled_override`.
+
+Проверено локально:
+
+- `cargo test -p detmir-portal --locked`;
+- `cargo clippy -p detmir-portal --all-targets --locked -- -D warnings`.
+
+Deployment cleanup status:
+
+- `ansible/deploy_detmir_portal.yml` now removes stale restart-prewarm drop-ins:
+  `20-prod-timeout.conf` and `30-prewarm-after-start.conf`;
+- repeat production deploy of that cleanup is pending because the DetMir
+  `pfSense-gate-UDP4-1194-vpn_prog10-config` tunnel later failed TLS handshake
+  to `178.178.98.83:1194`;
+- do not claim final production prewarm cleanup until
+  `systemctl cat detmir-portal` no longer shows `ExecStartPost` prewarm.
+
+Ограничения:
+
+- это не удаление DLP collectors;
+- это не claim, что production DLP decoupling уже завершен без live smoke;
+- это не registry release evidence;
+- GitHub/GitHub Actions не являются primary registry build contour.
+
+## 2026-06-30: DLP disabled/core_only default, load guard and rollback
+
+Статус: implemented in repository defaults/scripts/docs, deployed on live
+DetMir contour and verified manually.
+
+Что изменено:
+
+- DetMir production defaults переведены в `AW_DLP_ENABLED=false` и
+  `AW_DLP_PROFILE=core_only`;
+- `aw_dlp_enabled=false`, `aw_dlp_influx_enabled=false`;
+- lightweight collector остается подключаемым, но не стартует по умолчанию;
+- heavy DLP component flags в production defaults остаются выключены;
+- `detmir_portal_dlp_module_enabled_override=false` показывает честный
+  disabled-state в портале без heavy evidence/case path;
+- добавлен `scripts/detmir_dlp_load_guard.sh`;
+- `detmir-dlp-load-guard.timer` контролирует load/RAM/iowait и при перегрузе
+  переводит DLP в `core_only`;
+- Ansible DLP tasks больше не имеют DLP-heavy default `true`;
+- `scripts/detmir_dlp_runtime_control.sh` получил профили
+  `core_only`, `light`, `on_demand`, `full`;
+- перед каждым `set-profile` сохраняется rollback-снимок systemd
+  active/enabled состояния DLP units;
+- `rollback` восстанавливает предыдущее состояние DLP units без изменения
+  retention и без запуска Loki CT.
+
+Эксплуатационная позиция:
+
+- Loki CT отключён намеренно для снижения нагрузки на Proxmox VM/LXC;
+- Loki не является обязательной зависимостью Workforce/Worktime/AW core;
+- DLP не удалён: lightweight-сбор нужен для UEBA, а тяжелый runtime не должен
+  возвращаться обычным deploy/recovery;
+- Hayabusa/Velociraptor findings остаются отдельным optional security layer
+  через Security Finding Inbox / ClickHouse и не требуют Loki.
+
+Runbook:
+
+- `docs/DLP_RESOURCE_PROFILES_RU.md`;
+- `docs/DLP_OPTIONAL_RUNTIME_RU.md`.
+
+## 2026-06-24: fail-closed timeout hardening after manual live run
+
+Статус: implemented locally, targeted Rust tests passed, deployed and verified
+live.
+
+Что было найдено ручным прогоном:
+
+- при деградации `activitywatch-server` запросы `/api/0/buckets` и отдельные
+  bucket event endpoints могли занимать 15-30 секунд;
+- `detmir-check` мог зависнуть без общего дедлайна, а штатные
+  daily/weekly checks оставались в `activating`;
+- timeout в `detmir-check` убивал shell, но мог оставить `detmir-dlp`/`ssh`
+  хвост, который удерживал stdout pipe;
+- `detmir-dlp` не имел собственного SSH timeout;
+- прямой `dlp-health-check --json` на AW server мог зависать дольше ожиданий;
+- `aw-worktime-autoheal-rust` считал ошибкой timeout чтения response body после
+  POST backfill, хотя ActivityWatch уже мог применить запись.
+
+Что изменено:
+
+- `detmir-check` получил общий watchdog
+  `DETMIR_CHECK_OVERALL_TIMEOUT_SECONDS` и env-настройки
+  `DETMIR_SERVICE_TIMEOUT_SECONDS`, `DETMIR_BUCKET_TIMEOUT_SECONDS`,
+  `DETMIR_DLP_TIMEOUT_SECONDS`;
+- production `/etc/detmir/detmir-check.env` настроен на:
+  `DETMIR_SERVICE_TIMEOUT_SECONDS=35`,
+  `DETMIR_BUCKET_TIMEOUT_SECONDS=35`,
+  `DETMIR_DLP_TIMEOUT_SECONDS=120`,
+  `DETMIR_CHECK_OVERALL_TIMEOUT_SECONDS=300`;
+- `detmir-check` и `detmir-auto` убивают timed-out child process group, чтобы
+  не оставлять shell/SSH/DLP хвосты;
+- `detmir-dlp` получил bounded SSH timeout и больше не выносит SSH child в
+  отдельную process group, чтобы parent timeout мог убить всю ветку;
+- `dlp-health-check` получил общий self-timeout
+  `AW_DLP_HEALTH_OVERALL_TIMEOUT_SECONDS` с default 120 секунд;
+- `aw-worktime-autoheal-rust` для POST events проверяет HTTP status и не читает
+  response body, потому что body не нужен для backfill evidence.
+
+Safety guardrails:
+
+- изменения не меняют AW API schema, bucket names, UI или product workflow;
+- timeout failure остается красным, но больше не оставляет активные процессы и
+  lock poisoning;
+- production timeouts расширены только до фактической live latency, общий
+  deadline остается bounded;
+- remote DLP и worktime autoheal не публикуют secrets/PII в logs сверх уже
+  существующих operational identifiers.
+
+Проверки:
+
+```bash
+cargo test --manifest-path adk-rust/Cargo.toml \
+  -p detmir-check -p detmir-auto -p detmir-dlp -p dlp-health-check \
+  -p worktime-autoheal
+
+cargo build --manifest-path adk-rust/Cargo.toml --release \
+  -p detmir-check -p detmir-auto -p detmir-dlp -p dlp-health-check \
+  -p worktime-autoheal
+```
+
+Live verification:
+
+- `dlp-health-check --json`: `ok=22`, `warn=0`, `fail=0`, elapsed 17s;
+- `aw-worktime-autoheal.service`: success, posted `afk=28`, `win=28`;
+- `aw-rus-healthd.service`: success, `ok=13`, `warn=1`, `fail=0`;
+- `detmir-check` through production env: `rc=0`, elapsed 19s;
+- `detmir-auto.service`: `rc=0`, elapsed 56s, bucket `dead=0`, `stale=0`,
+  `ok=8`;
+- `awatch-contour-daily-check.service`: `rc=0`, elapsed 14s;
+- `awatch-contour-weekly-check.service`: `rc=0`, elapsed 136s;
+- `check-aw-full.sh`: `FRESH=8`, `STALE=0`, `DEAD=0`;
+- final AW/PVE failed systemd units: `0`;
+- final RDP guard: service `Running`, 13 telemetry processes, last guard cycles
+  `status=ok problems=0`.
+
+## 2026-06-30: manual collection and analysis smoke after DLP light enablement
+
+Статус: partially green, live fixes applied, one external reachability blocker
+remains.
+
+Ручной прогон подтвердил:
+
+- `activitywatch-server` and `aw-worktime-api` are active;
+- Worktime API `/reports/worktime/today` returns current data for 4 users;
+- DetMir portal `/portal` renders through browser and no frontend console error
+  was observed for the tested portal pages;
+- `/api/manager` returns OK after restoring the portal timeout to 25 seconds;
+- `/api/operator` returns current collection/DLP/Grafana/1C/worktime blocks;
+- Security Finding Inbox is reachable for `security`/`admin` role headers and
+  returns ClickHouse backend `status=ok`, `open_count=0`;
+- DLP light warehouse is present on the portal host and DLP checks show OK in
+  the operator card;
+- Grafana backend is reachable directly at `10.10.10.11:3000/api/health`.
+
+Live fixes applied:
+
+- removed stale systemd drop-in
+  `/etc/systemd/system/detmir-portal.service.d/10-detmir-check-env.conf`;
+- restored `/etc/detmir-portal.env` timeout to
+  `DETMIR_PORTAL_TIMEOUT_SECONDS=25`;
+- updated `/etc/detmir/detmir-check.env` for the current light profile:
+  `DETMIR_DLP_ENABLED=true` and `DETMIR_DISABLE_DLP_HEALTH_CHECK=true`;
+- updated `/var/lib/detmir-ai/latest-run` to the fresh 2026-06-30
+  `detmir-check` JSON so the portal no longer displays the stale 2026-06-25
+  collection snapshot;
+- updated Ansible to remove the stale portal timeout override during deploy.
+
+Remaining live blocker:
+
+- `detmir-check` still fails by design because RDP host `192.168.100.19`
+  responds to ICMP, but TCP `22` and `5985` time out from the DetMir contour;
+- `awatch-contour-daily-check.service` therefore remains failed with
+  `service_failures=2`;
+- this is not an AW-server, Worktime API, DLP warehouse, ClickHouse, or portal
+  rendering failure. It is the current RDP control/reachability failure.
+
+Grafana note:
+
+- Browser access to Grafana through the gateway is protected by Basic Auth and
+  the current certificate chain is not trusted by the Playwright browser when
+  opened by IP/DNS in this run;
+- direct backend health check is green:
+  `http://10.10.10.11:3000/api/health -> 200`;
+- gateway returns `401` without credentials, which is expected for the
+  protected dashboard entrypoint.

docs/DETMIR_RESTORE_BASELINE_2026-06-29_RU.md

@@ -0,0 +1,83 @@
+# DetMir restore baseline 2026-06-29
+
+Дата фиксации: 2026-06-29.
+
+Документ фиксирует фактическое состояние восстановленного контура
+AWatch-rus/DetMir после возврата RDP-сервера `SHARKON2025`.
+
+## Итог
+
+- AW server: `10.10.10.13:5600`, API отвечает, CORS OK.
+- Worktime API: `10.10.10.13:5610`, `/health` OK, report endpoints отвечают.
+- Portal/gateway: `https://dm.iri1968.dpdns.org/healthz` отвечает `200 ok`.
+- RDP host physical IP: `192.168.100.19`.
+- Stable ActivityWatch logical host id: `SHARKON2025`.
+- Старый IP `192.168.100.18` не считать текущим production target.
+
+## Выполненные исправления
+
+- На ноутбуке добавлен постоянный маршрут к `192.168.100.19/32` через DetMir
+  VPN gateway `10.0.13.1`.
+- `ansible/inventory.ini` переведен на `rdp-prod ansible_host=192.168.100.19`.
+- Диагностические скрипты больше не жёстко привязаны к `192.168.100.18`.
+- `/etc/activitywatch/aw-server.env` на AW server обновлен:
+  `AW_MONITORED_WINDOWS_HOST=192.168.100.19`.
+- На RDP host добавлены узкие Windows Firewall allow-правила для
+  `10.10.10.13 -> 5985/3389`; промежуточный firewall всё ещё блокирует этот
+  server-side TCP path.
+- Guard restart-budget quarantine очищен через backup и reset runtime state.
+- ClickHouse Security Finding Inbox schema применена:
+  `security_findings`, `security_finding_workflow_events`,
+  `security_finding_inbox`.
+- `check-aw-full` обновлен: env-aware RDP host, корректный CORS origin,
+  AFK freshness через `bucket.metadata.end`.
+- DLP runtime зафиксирован как optional disabled contour: отключён для снижения
+  нагрузки на Proxmox/InfluxDB/Grafana/ClickHouse/AW server, но оставлен
+  подключаемым через documented enable flow.
+- Hayabusa/Velociraptor зафиксированы как optional security findings /
+  forensics layer, отдельный от DLP runtime и Workforce hot path.
+
+## Проверенный статус по 7 пунктам
+
+1. AW-server/portal/API: доступны; `check-aw-data.sh` OK, public `/healthz` OK.
+2. RDP host: `192.168.100.19`, `COMPUTERNAME=SHARKON2025`,
+   WinRM/RDP/SSH доступны с админского ноутбука; guard service running.
+3. ActivityWatch buckets: worktime, session, AFK, DLP endpoint signals fresh;
+   window bucket корректно классифицируется как inactive при отсутствии
+   интерактивной активности.
+4. ClickHouse/filter/security findings: ClickHouse healthy, Security Finding
+   Inbox schema создана; portal endpoint защищен auth и без авторизации
+   возвращает `401`.
+5. InfluxDB/Grafana: InfluxDB health `pass`, Grafana DB health `ok`,
+   Influx datasource health OK. Loki log contour intentionally disabled to
+   reduce resource usage.
+6. Hayabusa/Velociraptor layer: Hayabusa doctor OK, drop.path active,
+   incoming/drop backlog empty, latest intake `2026-06-29T09:00:23Z`,
+   bad zip сохранен только в quarantine как evidence. Velociraptor integration
+   is treated as optional findings source; no always-on Velociraptor runtime is
+   required for Workforce/AW core.
+7. Baseline зафиксирован в этом документе и связан с operational docs/skills.
+
+## Остаточные риски
+
+- `aw-rus-healthd.service` на AW server всё ещё видит TCP timeout до
+  `192.168.100.19:5985/3389` через gateway `10.10.10.1`, хотя ICMP проходит и
+  доступ с админского ноутбука есть. Это network policy gap на промежуточном
+  firewall/ACL, не SQLite/datastore failure.
+- Grafana Loki datasource `10.10.10.12:3100` intentionally disabled: Proxmox
+  LXC `202 loki-logs` is stopped, active config has `onboot: 0`, and TCP
+  `10.10.10.12:3100` is closed. This is an operator decision to save resources
+  and does not break core AW/worktime/ClickHouse.
+- DLP runtime is intentionally disabled for the current production profile and
+  must not be auto-enabled by routine deploys. Re-enable only after resource
+  budget check and explicit operator decision.
+
+## Проверки
+
+- `AW_MONITORED_WINDOWS_HOSTNAME=SHARKON2025 ./check-aw-data.sh` - OK.
+- `AW_SMOKE_AW_SERVER=http://10.10.10.13:5600
+  AW_SMOKE_SOURCE_HOSTNAME=SHARKON2025
+  AW_SMOKE_WINDOWS_HOST=192.168.100.19 ./check-aw-full.sh --no-color` - OK.
+- `cargo test -p check-aw-full` - 4 passed.
+- `bash -n` для изменённых shell scripts - OK.
+- `AW_SMOKE_LOKI_ENABLED=0` is the current default for local smoke checks.

docs/DETMIR_SUPPORT_SCRIPTS_RU.md

@@ -55,7 +55,7 @@ DETMIR_SUPPORT_PVE_HOST=10.10.10.2
 DETMIR_SUPPORT_AW_HOST=10.10.10.13
 DETMIR_SUPPORT_WEB_HOST=10.10.10.2
 DETMIR_SUPPORT_WEB_TLS_HOST=10.10.10.2
-DETMIR_SUPPORT_WINDOWS_HOST=192.168.100.18
+DETMIR_SUPPORT_WINDOWS_HOST=192.168.100.19
 DETMIR_SUPPORT_SURICATA_HOST=10.10.10.2
 
 DETMIR_SUPPORT_SSH_USER=igor
@@ -79,6 +79,7 @@ DETMIR_SUPPORT_PVE_BACKUP_DIRS=/var/lib/pve/local-btrfs/dump
 
 - операторский gateway находится на `10.10.10.2`, а не на историческом
   `10.10.10.11`;
+- текущий Windows/RDP target после восстановления: `192.168.100.19`;
 - web health endpoint: `https://10.10.10.2/healthz`, ожидаемый ответ `200`;
 - защищенный корень gateway `https://10.10.10.2/` штатно отвечает `401`;
 - AW API health проверяется через

docs/DLP_OPTIONAL_RUNTIME_RU.md

@@ -0,0 +1,258 @@
+# Optional DLP runtime for DetMir
+
+Цель: DLP-контур должен оставаться подключаемым, но production default для
+DetMir сейчас `core_only/disabled`. Возврат в лёгкий режим выполняется вручную
+после resource check; при перегрузе guard снова переводит DLP в `core_only`.
+
+Ресурсные профили и rollback-процедура описаны отдельно:
+[DLP_RESOURCE_PROFILES_RU.md](DLP_RESOURCE_PROFILES_RU.md).
+
+## Что отключается
+
+Текущий production-профиль DetMir после 2026-06-30 prod hardening -
+`core_only/disabled`:
+
+- `AW_DLP_ENABLED=false`;
+- `AW_DLP_PROFILE=core_only`;
+- `AW_DLP_INFLUX_ENABLED=false`;
+- optional DLP timers/services inactive/disabled;
+- `detmir-dlp-load-guard.timer` остаётся enabled/active как защита на случай
+  последующего operator re-enable;
+- heavy DLP units, Influx exporter, evidence/case/report/integration units и
+  Loki остаются выключенными.
+
+Автоотключение выполняет `detmir-dlp-load-guard`: при превышении порогов
+load/RAM/iowait он переводит DLP в `core_only` через
+`detmir-dlp-runtime-control set-profile core_only`. После стабилизации контур
+возвращается вручную командой `set-profile light`.
+
+Штатный runtime off включает:
+
+- `AW_DLP_ENABLED=false` на AW server;
+- `DETMIR_DLP_ENABLED=false` в управляющем DetMir contour check;
+- portal UI/API DLP-модуль может оставаться включённым для исторического
+  SQLite/evidence-среза; это не запускает server-side DLP runtime;
+- остановку DLP timers/services:
+  - `aw-dlp-influx-exporter.timer`;
+  - `activitywatch-dlp-aggregator.timer`;
+  - `aw-dlp-report-scheduler.timer`;
+  - `aw-dlp-syslog-forwarder.timer`;
+  - `aw-dlp-webhook-sender.timer`;
+  - `aw-dlp-cef-exporter.timer`;
+  - `aw-dlp-ioc-refresh.timer`;
+  - `aw-dlp-policy-engine.service`;
+  - `aw-dlp-case-management.service`;
+  - `detmir-portal-evidence.service`, если DLP evidence upload больше не нужен.
+
+Worktime, ActivityWatch server, browser/window/AFK collection, Hayabusa,
+Velociraptor findings ingest и 1C/ClickHouse core не считаются DLP runtime и
+отдельно не отключаются.
+
+Важно: отключение DLP runtime не удаляет DLP-контур из проекта. Это
+эксплуатационный режим `disabled`, выбранный для production DetMir из-за
+существенной нагрузки на виртуальную среду Proxmox, InfluxDB, Grafana,
+ClickHouse и AW server. DLP должен оставаться подключаемым обратно через
+описанный ниже enable-процесс, без переустановки продукта и без потери
+исторических артефактов до отдельной retention/cleanup процедуры.
+
+## Статистика перед отключением
+
+На AW server:
+
+```bash
+sudo bash /usr/local/bin/detmir-dlp-runtime-control stats
+sudo cat /var/lib/activitywatch/health/dlp-runtime-state.json
+```
+
+Из репозитория до деплоя:
+
+```bash
+sudo bash scripts/detmir_dlp_runtime_control.sh stats
+```
+
+JSON фиксирует:
+
+- generated timestamp;
+- effective mode;
+- DLP unit `active/enabled/load` state;
+- последние timestamps по DLP buckets для текущего host;
+- причину отключения.
+
+Каждый запуск дополнительно сохраняет неизменяемый снимок в
+`/var/lib/activitywatch/health/dlp-runtime-history/`. При `disable` остаются
+как минимум два снимка: `pre_disable` до остановки units и `disabled` после
+остановки/disable/reset-failed.
+
+## Отключение
+
+На AW server:
+
+```bash
+sudo install -o root -g root -m 0755 scripts/detmir_dlp_runtime_control.sh /usr/local/bin/detmir-dlp-runtime-control
+sudo sed -i \
+  -e 's/^AW_DLP_ENABLED=.*/AW_DLP_ENABLED=false/' \
+  -e 's/^AW_DLP_DISABLED_REASON=.*/AW_DLP_DISABLED_REASON=operator_disabled_to_reduce_influx_grafana_clickhouse_load/' \
+  /etc/activitywatch/aw-server.env
+sudo /usr/local/bin/detmir-dlp-runtime-control disable
+sudo systemctl restart aw-worktime-api.service || true
+```
+
+Для portal:
+
+```bash
+sudo sed -i 's/^DETMIR_PORTAL_DLP_MODULE_ENABLED=.*/DETMIR_PORTAL_DLP_MODULE_ENABLED=false/' /etc/detmir-portal.env
+sudo systemctl restart detmir-portal.service
+```
+
+Если переменной нет, добавьте ее в соответствующий env-файл отдельной строкой.
+
+## Проверка после отключения
+
+```bash
+AW_DLP_ENABLED=false DETMIR_DLP_ENABLED=false /usr/local/bin/dlp-health-check --json
+DETMIR_DLP_ENABLED=false detmir-dlp
+DETMIR_DLP_ENABLED=false detmir-check --json
+AW_DLP_ENABLED=false check-aw-full
+```
+
+Ожидаемое поведение:
+
+- `dlp-health-check` возвращает `ok=true` и `dlp:mode=disabled`;
+- `detmir-dlp` не открывает SSH health probe и возвращает disabled payload;
+- `detmir-check` не проверяет DLP buckets;
+- `check-aw-full` показывает DLP buckets как `SKIPPED`;
+- DLP units остаются stopped/disabled;
+- worktime/core проверки продолжают работать.
+
+## Live evidence 2026-06-25
+
+На DetMir/AW server выполнен controlled disable:
+
+- `AW_DLP_ENABLED=false`;
+- `AW_DLP_INFLUX_ENABLED=false`;
+- `AW_DLP_DISABLED_REASON=operator_disabled_to_reduce_influx_grafana_clickhouse_load`;
+- `AW_DLP_DISABLED_SINCE=2026-06-25`.
+
+Зафиксированы evidence-снимки:
+
+```text
+/var/lib/activitywatch/health/dlp-runtime-history/dlp-runtime-current-20260625T083619Z.json
+/var/lib/activitywatch/health/dlp-runtime-history/dlp-runtime-pre_disable-20260625T083637Z.json
+/var/lib/activitywatch/health/dlp-runtime-history/dlp-runtime-disabled-20260625T083700Z.json
+```
+
+Результат:
+
+- pre-disable active units included DLP Influx exporter, aggregator, report,
+  integration, policy/case and evidence units;
+- post-disable active/enabled DLP units: `0/0`;
+- `dlp-health-check` returned `ok=true`, `dlp:mode=disabled`;
+- `detmir-dlp` returned `ok=true`, `dlp:mode=disabled`;
+- `check-aw-full` returned `DLP buckets ... SKIPPED`.
+
+Отдельные non-DLP findings того же ручного прогона, до восстановления
+`192.168.100.19`:
+
+- AFK/window/worktime buckets were stale and require RDP collector/session
+  recovery;
+- WinRM from server side to `192.168.100.18:5985` was unreachable;
+- these findings are outside the DLP runtime disable boundary.
+
+## Возврат DLP
+
+Для DetMir предпочтительно возвращать не весь DLP сразу, а лёгкий профиль.
+Перед этим проверить load/RAM/iowait на Proxmox/AW/Influx/Grafana/ClickHouse.
+
+```bash
+sudo AW_DLP_DISABLED_REASON=operator_reenable_after_resource_check \
+  /usr/local/bin/detmir-dlp-runtime-control set-profile light
+sudo sed -i \
+  -e 's/^AW_DLP_ENABLED=.*/AW_DLP_ENABLED=true/' \
+  -e 's/^AW_DLP_PROFILE=.*/AW_DLP_PROFILE=light/' \
+  -e 's/^AW_DLP_INFLUX_ENABLED=.*/AW_DLP_INFLUX_ENABLED=false/' \
+  /etc/activitywatch/aw-server.env
+```
+
+Если профиль ухудшил состояние контура:
+
+```bash
+sudo /usr/local/bin/detmir-dlp-runtime-control rollback
+```
+
+`on_demand` и `full` включаются только вручную после отдельного resource
+preflight:
+
+```bash
+sudo /usr/local/bin/detmir-dlp-runtime-control set-profile on_demand
+sudo /usr/local/bin/detmir-dlp-runtime-control set-profile full
+```
+
+Для portal:
+
+```bash
+sudo sed -i 's/^DETMIR_PORTAL_DLP_MODULE_ENABLED=.*/DETMIR_PORTAL_DLP_MODULE_ENABLED=true/' /etc/detmir-portal.env
+sudo systemctl restart detmir-portal.service
+```
+
+После включения выполнить:
+
+```bash
+/usr/local/bin/dlp-health-check --json
+detmir-dlp
+detmir-check --json
+```
+
+Перед возвратом DLP в production обязательно проверить ресурсный бюджет
+Proxmox/InfluxDB/Grafana/ClickHouse. Не включайте DLP timers/services
+автоматически вместе с обычным deploy, если текущая цель - сохранить лёгкий
+Workforce/AW контур.
+
+## Hayabusa/Velociraptor при выключенном DLP
+
+Hayabusa/Sigma и Velociraptor относятся к optional security findings /
+forensics layer, а не к тяжёлому DLP runtime:
+
+- Hayabusa drop/autoprocess может продолжать работать при выключенном DLP;
+- Velociraptor findings ingest может использоваться в offline/server mode, если
+  администратор явно включил соответствующий режим;
+- результаты должны попадать в Security Finding Inbox / ClickHouse как
+  контролируемые findings, а не запускать автоматическую блокировку без
+  approve/apply workflow;
+- portal/workforce first screen не должен ждать Velociraptor или DLP;
+- disabled DLP mode не должен превращаться в FAIL только из-за отсутствия DLP
+  buckets.
+
+Velociraptor server/client runtime не должен стартовать автоматически в
+production DetMir без отдельного ресурсного решения. Для малой виртуальной
+среды предпочтителен `disabled` или `offline_collector` режим.
+
+## Ansible
+
+В inventory/group vars:
+
+```yaml
+aw_dlp_profile: "core_only"
+aw_dlp_enabled: false
+aw_dlp_influx_enabled: false
+aw_dlp_light_collector_enabled: false
+aw_dlp_light_guard_enabled: true
+detmir_portal_dlp_module_enabled_override: true
+```
+
+Для временного operator re-enable в `light`:
+
+```yaml
+aw_dlp_profile: "light"
+aw_dlp_enabled: true
+aw_dlp_influx_enabled: false
+aw_dlp_light_collector_enabled: true
+aw_dlp_light_guard_enabled: true
+```
+
+При `aw_dlp_profile: light` playbook включает только лёгкий агрегатор, IOC
+refresh и load guard. DLP Influx exporter, report/syslog/webhook/CEF,
+policy/case/evidence и Loki не должны возвращаться в active state.
+
+## Ограничения
+
+Это не удаление DLP-функциональности и не заявление, что DLP заменен другим средством. Это штатный режим временного/постоянного отключения тяжелого DLP runtime для стабилизации производительности. Исторические DLP buckets и артефакты могут оставаться на диске и в ActivityWatch до отдельной retention/cleanup процедуры.

docs/DLP_RESOURCE_PROFILES_RU.md

@@ -0,0 +1,196 @@
+# DLP resource profiles for DetMir
+
+Дата фиксации: 2026-06-30.
+
+Цель: сохранить стабильный Workforce/AW hot path на малом DetMir Proxmox
+контуре и оставить DLP подключаемым модулем. Loki CT в текущем production
+resource profile отключен намеренно и не является обязательной зависимостью
+AWatch-rus.
+
+## Профили
+
+### `core_only`
+
+Production default и аварийный/экономный профиль для DetMir.
+
+- DLP runtime: выключен.
+- DLP Influx exporter: выключен.
+- DLP aggregators/report/syslog/webhook/CEF/case/evidence units: выключены.
+- Loki/Promtail: выключены.
+- Workforce, Worktime, ActivityWatch, ClickHouse 1C, Grafana core,
+  Hayabusa/Security Finding Inbox: работают независимо от DLP.
+
+Назначение: безопасное состояние при перегрузе CPU/RAM/IOPS или при ручном
+отключении DLP.
+
+### `light`
+
+Операторский re-enable профиль для DetMir после проверки ресурсов: лёгкий DLP
+режим без Loki и без Influx-heavy path.
+
+- Разрешены `activitywatch-dlp-aggregator.timer` и
+  `aw-dlp-ioc-refresh.timer`.
+- `dlp-aggregator-rust` собирает ограниченный срез из bucket-ов
+  `aw-file-operations_` и `aw-dlp-incidents_` в локальный
+  `dlp_warehouse.sqlite` для последующей UEBA-корреляции.
+- `detmir-dlp-warehouse-sync.timer` доставляет SQLite warehouse на portal host
+  через атомарный snapshot, чтобы DetMir Portal/UEBA читали локальный файл, а
+  не блокировали AW server hot path.
+- Для агрегатора заданы короткий lookback, малый event limit, timeout,
+  `CPUQuota` и `MemoryMax`.
+- Evidence, screenshots, case management и exporters остаются выключенными.
+- InfluxDB/Grafana/Loki не участвуют в hot path лёгкого DLP.
+- Используется для ежедневной эксплуатации, когда нужны DLP-сигналы для UEBA,
+  но нельзя нагружать Proxmox/Influx/Grafana/ClickHouse.
+
+### `on_demand`
+
+Временный режим для конкретного инцидента или окна проверки.
+
+- Разрешены IOC refresh, policy engine, case management и evidence API.
+- Influx exporter, CEF/syslog/webhook/report scheduler и aggregator остаются
+  выключенными, если администратор отдельно не выбрал `full`.
+- После окна проверки профиль должен быть возвращён в `core_only`.
+
+### `full`
+
+Только вручную, только после resource preflight.
+
+- Может включать DLP Influx exporter, aggregator, reports, integrations,
+  policy/case и evidence.
+- На DetMir не является штатным production режимом.
+- Запрещено включать автоматически при обычном deploy/recovery.
+
+## Управление
+
+На AW server:
+
+```bash
+sudo /usr/local/bin/detmir-dlp-runtime-control status
+sudo /usr/local/bin/detmir-dlp-runtime-control set-profile core_only
+sudo /usr/local/bin/detmir-dlp-runtime-control set-profile light
+sudo /usr/local/bin/detmir-dlp-runtime-control set-profile on_demand
+sudo /usr/local/bin/detmir-dlp-runtime-control set-profile full
+sudo /usr/local/bin/detmir-dlp-load-guard
+```
+
+Перед каждым `set-profile` скрипт сохраняет rollback-снимок active/enabled
+состояния DLP units:
+
+```text
+/var/lib/activitywatch/health/dlp-runtime-rollback.state
+```
+
+Откат к предыдущему состоянию:
+
+```bash
+sudo /usr/local/bin/detmir-dlp-runtime-control rollback
+```
+
+Важно: rollback восстанавливает только systemd active/enabled состояния DLP
+units. Он не меняет retention, не удаляет данные и не включает Loki CT.
+
+## Автоотключение при перегрузе
+
+`detmir-dlp-load-guard.timer` запускает
+`/usr/local/bin/detmir-dlp-load-guard`. Guard читает `/proc/loadavg`,
+`/proc/meminfo` и `/proc/stat`; если load, свободная память или iowait выходят
+за пороги несколько запусков подряд (`AW_DLP_GUARD_STRIKES_REQUIRED`, default
+`3`), а DLP units активны, он переводит DLP в `core_only` через:
+
+```bash
+AW_DLP_DISABLED_REASON=auto_disabled_by_dlp_load_guard:<reason> \
+  /usr/local/bin/detmir-dlp-runtime-control set-profile core_only
+```
+
+State и история пишутся в:
+
+```text
+/var/lib/activitywatch/health/dlp-light-guard-state.json
+/var/lib/activitywatch/health/dlp-light-guard-history/
+```
+
+Единичный IO/load spike фиксируется как `observe_overload`, но DLP не
+отключается до достижения порога подряд. Guard не перезапускает
+ActivityWatch/портал, не меняет маршруты, не трогает ClickHouse/Grafana и не
+включает Loki. Возврат из `core_only` в `light` делает администратор после
+стабилизации контура и проверки Proxmox/AW/Influx/Grafana/ClickHouse load. Если
+перегруз повторится, guard снова переведёт профиль в `core_only`.
+
+## Доставка DLP warehouse на портал
+
+Portal читает DLP-срез из локального
+`/var/lib/activitywatch/dlp_warehouse.sqlite`. На разнесённом контуре DetMir
+этот файл создаётся на AW server, поэтому используется лёгкий sync:
+
+```bash
+sudo systemctl start detmir-dlp-warehouse-sync.service
+sudo systemctl status detmir-dlp-warehouse-sync.timer
+sudo jq . /var/lib/activitywatch/health/dlp-warehouse-sync-state.json
+```
+
+Sync делает SQLite backup на AW server и атомарно заменяет локальный файл на
+portal host. Он не запускает DLP evidence/case/exporters и не включает Loki.
+
+## Ansible defaults
+
+Для DetMir production defaults должны оставаться экономными и
+самозащищающимися:
+
+```yaml
+aw_dlp_profile: "core_only"
+aw_dlp_enabled: false
+aw_dlp_influx_enabled: false
+aw_dlp_light_collector_enabled: false
+aw_dlp_light_guard_enabled: true
+detmir_portal_dlp_profile: "core_only"
+detmir_portal_dlp_module_enabled_override: true
+```
+
+Для временного возврата в лёгкий профиль:
+
+```yaml
+aw_dlp_profile: "light"
+aw_dlp_enabled: true
+aw_dlp_influx_enabled: false
+aw_dlp_light_collector_enabled: true
+aw_dlp_light_guard_enabled: true
+detmir_portal_dlp_profile: "light"
+detmir_portal_dlp_module_enabled_override: true
+```
+
+Все тяжёлые DLP component flags должны быть `false`, пока администратор явно не
+выбрал `on_demand` или `full`.
+
+## Resource preflight перед `full`
+
+Перед временным включением `full` проверить:
+
+- Proxmox host load и steal/wait;
+- свободную RAM и swap pressure;
+- IOPS/latency storage;
+- ClickHouse health и backlog ingest;
+- InfluxDB/Grafana health, если они участвуют в выбранном профиле;
+- ActivityWatch `/healthz`, Worktime API и portal latency;
+- отсутствие старого Loki CT в autostart.
+
+Если любой core-сервис деградирует, DLP возвращается в `core_only`.
+
+## Проверка
+
+```bash
+DETMIR_RESILIENCE_EXPECT_DLP_PROFILE=light \
+DETMIR_RESILIENCE_EXPECT_LOKI_OFF=1 \
+scripts/detmir_resilience_check.sh --repo
+```
+
+Live check на сервере в `light` должен показывать inactive для heavy DLP units
+и Loki units. В `core_only` inactive должны быть все optional DLP units.
+
+## Запрещённые утверждения
+
+- Не заявлять, что AWatch-rus заменяет DLP/SIEM/EDR.
+- Не заявлять, что Loki обязателен для DetMir production.
+- Не заявлять DLP health OK, если DLP выключен.
+- Не запускать автоматическое блокирование рабочих станций без approve/apply
+  workflow.

docs/EXPLAINABLE_KPI_RU.md

@@ -4,6 +4,12 @@ Explainable Workforce KPI отвечает на вопрос: почему по
 активности. Слой предназначен для руководителя, ИБ и администратора, но не
 является HR-оценкой сотрудника и не использует ML/LLM.
 
+Смежный, но отдельный contract по операционной загрузке описан в
+[WORKFORCE_OPERATIONS_MODEL_RU.md](WORKFORCE_OPERATIONS_MODEL_RU.md). KPI
+объясняет процент активности, а Workforce Operations показывает загрузку,
+простои, перегруз, дисциплину процесса, достоверность данных и рекомендуемое
+ручное действие.
+
 ## API
 
 Endpoint:
@@ -102,6 +108,10 @@ Security и Forensics не получают Workforce Dashboard через `/api
 Раздел содержит KPI score, confidence, coverage, факторы, warnings и
 рекомендации.
 
+Блок `Операционная загрузка` в портале использует другой payload:
+`workforce_operations`. Он не заменяет explainable KPI и не должен
+интерпретироваться как автоматическая HR-оценка.
+
 ## Ограничения Pilot v1
 
 - Это не ML и не LLM.

docs/GRAFANA_DASHBOARDS_RU.md

@@ -83,6 +83,11 @@ gateway:
 /d/detmir-rdp-user-activity/detmir3a-rabota-pol-zovatelej-v-rdp?orgId=1&from=now-7d&to=now&timezone=browser&var-host=SHARKON2025&refresh=5m
 ```
 
+`var-host=SHARKON2025` здесь является stable logical host id, а не требованием
+к физическому Windows `COMPUTERNAME`. При переименовании RDP-сервера dashboard
+должен продолжать смотреть на тот же logical id до отдельной planned migration.
+См. `docs/WINDOWS_LOGICAL_HOST_ID_RU.md`.
+
 В портале он доступен как кнопка `Графики сотрудников`.
 
 Не включайте `[auth.anonymous]` для решения этой задачи: это откроет Grafana на

docs/OPERATIONS_VALIDATION_RUNBOOK_RU.md

@@ -94,11 +94,26 @@ Browser smoke не заменяет API/CLI проверки. Он подтве
 
 ```bash
 cd /mnt/usb_hdd2/Projects/ActivityWatch-Russian
-NO_PROXY=localhost,127.0.0.1,10.10.10.13,10.10.10.2,192.168.100.18,10.10.10.0/24 \
-no_proxy=localhost,127.0.0.1,10.10.10.13,10.10.10.2,192.168.100.18,10.10.10.0/24 \
+NO_PROXY=localhost,127.0.0.1,10.10.10.13,10.10.10.2,192.168.100.19,10.10.10.0/24 \
+no_proxy=localhost,127.0.0.1,10.10.10.13,10.10.10.2,192.168.100.19,10.10.10.0/24 \
+AW_SMOKE_WINDOWS_HOST=192.168.100.19 \
+AW_SMOKE_SOURCE_HOSTNAME=SHARKON2025 \
 ./check-aw-full.sh
 ```
 
+Для DetMir production при проверке после rename RDP-сервера явно фиксируйте
+stable logical host id:
+
+```bash
+AW_MONITORED_WINDOWS_HOSTNAME=SHARKON2025 ./check-aw-data.sh
+AW_SMOKE_WINDOWS_HOST=192.168.100.19 \
+AW_SMOKE_SOURCE_HOSTNAME=SHARKON2025 \
+./scripts/aw-contour-smoke-local.sh --skip-winrm
+```
+
+`SHARKON2025` в этих командах - исторический ActivityWatch logical id, не
+физическое имя Windows-сервера.
+
 Для workforce ClickHouse дополнительно проверить quality views:
 
 ```sql

docs/PILOT_VALIDATION_CHECKLIST_RU.md

@@ -19,6 +19,8 @@
 ## Workforce сценарий
 
 - Отображается индекс активности и объяснение факторов.
+- Отображается блок `Операционная загрузка`: загрузка, простой, перегруз,
+  дисциплина процесса и достоверность данных.
 - Доступно сравнение подразделений и ответственных.
 - Видны тренды daily, weekly и monthly, если данные есть.
 - Отдельно показываются признаки перегрузки и недозагрузки.

docs/PORTAL_API_CONTRACTS_RU.md

@@ -46,6 +46,51 @@ React/Tauri-интерфейса без переписывания backend-ло
 - `GET /api/readiness/latest` - готовность системы;
 - `GET /api/workforce/policy/explain` - объяснение расчёта показателей.
 
+`GET /api/reports` должен сохранять additive payload `workforce_operations`.
+Это основной contract для экрана руководителя по загрузке, простоям, перегрузу,
+дисциплине процесса и достоверности данных. Клиент должен читать:
+
+- `workforce_operations.summary`;
+- `workforce_operations.rows`;
+- `workforce_operations.model`;
+- `workforce_operations.rows[].load_status`;
+- `workforce_operations.rows[].idle_status`;
+- `workforce_operations.rows[].discipline_status`;
+- `workforce_operations.rows[].data_confidence`;
+- `workforce_operations.rows[].recommended_action`.
+
+Подробная семантика статусов:
+[WORKFORCE_OPERATIONS_MODEL_RU.md](WORKFORCE_OPERATIONS_MODEL_RU.md).
+
+`GET /api/reports` также публикует additive payload `modules.dlp`.
+Клиент должен трактовать его как runtime capability, а не как claim
+сертифицированной DLP:
+
+- `modules.dlp.enabled`;
+- `modules.dlp.status`;
+- `modules.dlp.hot_path`;
+- `modules.dlp.note`.
+
+Если `modules.dlp.enabled=false`, Workforce UI должен продолжать работу и
+показывать DLP/Security/Forensics как disabled или not configured, не превращая
+это в ошибку основного рабочего экрана.
+
+`GET /api/operator` также публикует additive runtime-state поля для первичного
+экрана:
+
+- `cache_status`;
+- `modules.dlp.enabled`;
+- `modules.dlp.status`;
+- `modules.dlp.hot_path`;
+- `modules.dlp.note`;
+- `summary.severity`;
+- `summary.blocks`.
+
+Если `cache_status=warming`, клиент должен показать bounded stale/warming
+state и не держать бесконечный loading indicator. Если
+`modules.dlp.enabled=false`, operator screen должен считать DLP disabled-state
+допустимым состоянием, а не ошибкой Workforce core.
+
 ## Что не меняется
 
 - HTML-портал не удаляется.

docs/PRODUCTION_READINESS_RU.md

@@ -47,6 +47,8 @@ bounded payload/query limits и role-gate smoke.
 | `--slow-request-log-ms` | `AWATCH_PORTAL_SLOW_REQUEST_LOG_MS` | Порог медленного запроса для логов |
 | `--environment` | `AWATCH_PORTAL_ENVIRONMENT` | Безопасное имя окружения |
 | `--enabled-modules` | `AWATCH_PORTAL_ENABLED_MODULES` | Разрешенные модули портала |
+| `--dlp-module-enabled` | `DETMIR_PORTAL_DLP_MODULE_ENABLED` | Включает DLP/security status для портала; может оставаться `true` для исторического SQLite/evidence-среза без запуска server-side DLP runtime |
+| DLP resource profile | `AW_DLP_PROFILE`, `DETMIR_PORTAL_DLP_PROFILE` | Для DetMir production default `core_only`; `light` включается оператором после resource check |
 
 Ограничения применяются к тяжелым API:
 
@@ -66,6 +68,21 @@ bounded payload/query limits и role-gate smoke.
   возвращает `400`;
 - слишком большое тело запроса возвращает `413`;
 - role gate возвращает `403`.
+- при `DETMIR_PORTAL_DLP_MODULE_ENABLED=true` и `AW_DLP_PROFILE=core_only`
+  портал может показывать исторический DLP/security status без запуска
+  collectors/exporters.
+- при `DETMIR_PORTAL_DLP_MODULE_ENABLED=true` и `AW_DLP_PROFILE=light`
+  Workforce core, `/healthz`, `/readyz`, `/api/reports` и `/api/operator`
+  должны оставаться доступными без тяжелого DLP/case/evidence чтения.
+- при `AW_DLP_ENABLED=false` и `DETMIR_DLP_ENABLED=false` server-side
+  DLP health/readiness/checks должны возвращать контролируемый disabled-state,
+  а не пытаться поднять DLP Influx/exporter/aggregator/case runtime.
+  Runbook: [DLP_OPTIONAL_RUNTIME_RU.md](DLP_OPTIONAL_RUNTIME_RU.md).
+- при `AW_DLP_PROFILE=light` активны только lightweight collector/IOC/guard;
+  Loki/DLP heavy runtime должен оставаться inactive. При перегрузе
+  `detmir-dlp-load-guard` переводит DLP в `core_only`; возврат выполняется
+  только через profile switch и rollback, см.
+  [DLP_RESOURCE_PROFILES_RU.md](DLP_RESOURCE_PROFILES_RU.md).
 
 ### Request ID, logs и metrics
 

docs/PROJECT_STATUS_RU.md

@@ -60,6 +60,75 @@ backup, registry-readiness документации, плана российск
 - First protected PR workflow: PR #50 opened; required checks passed;
   review/merge still `pending_review_required`.
 - First reviewed PR evidence: pending.
+- DetMir portal live baseline on 2026-06-25:
+  `docs/DETMIR_CURRENT_STATE_RU.md`.
+- DetMir portal deployed binary:
+  `653b22b0fbf29a22f7de42ade7b689490b1de16fa07e785e4e0efd3078e7a3bc`.
+- DetMir portal cold-start UI hang: mitigated. During cold/prewarm state the UI
+  now shows `STALE / Первичный срез прогревается`, not endless loading.
+- DetMir DLP hot-path boundary: phase 1 deployed; current production runtime
+  uses `AW_DLP_ENABLED=false`, `AW_DLP_PROFILE=core_only`. The portal DLP module
+  may stay enabled for historical/security views, but server-side DLP
+  collectors/exporters are off.
+- DetMir optional DLP runtime controls: implemented in code/docs through
+  `AW_DLP_ENABLED`, `DETMIR_DLP_ENABLED`,
+  `scripts/detmir_dlp_runtime_control.sh` and
+  `docs/DLP_OPTIONAL_RUNTIME_RU.md`. Resource profiles
+  `core_only|light|on_demand|full` and rollback are documented in
+  `docs/DLP_RESOURCE_PROFILES_RU.md`.
+- DetMir optional DLP runtime state: 2026-06-25 controlled disable evidence is
+  retained; 2026-06-30 prod hardening keeps production in `core_only` by
+  default. `light` can be re-enabled by operator command after
+  Proxmox/InfluxDB/Grafana/ClickHouse capacity check.
+- DetMir DLP contour status: server-side DLP collection is currently disabled;
+  heavy DLP remains optional and must only be enabled after explicit operator
+  decision and resource check.
+- DetMir DLP auto-disable guard: `detmir-dlp-load-guard` records load/RAM/iowait
+  state and switches DLP to `core_only` if thresholds are exceeded.
+- DetMir RDP collector freshness after 2026-06-29 restore: physical RDP target
+  is `192.168.100.19`, stable AW logical host id remains `SHARKON2025`.
+  Buckets are fresh/inactive as expected, collector guard quarantine was reset,
+  and `check-aw-full` was updated to use env-driven RDP target and AFK
+  `metadata.end` freshness. Admin laptop route to `192.168.100.19` goes through
+  DetMir OpenVPN gateway `10.0.13.1`; WinRM `5985` and RDP `3389` are reachable
+  from the admin laptop.
+- Low-cost containment pack: first safe control-plane layer implemented as
+  Rust `containment-engine`, example policy/finding fixtures, Ansible/env
+  disabled-by-default configuration, and operator/policy runbooks. Current
+  engine is decision/shadow only and does not mutate firewall, pfSense, AD,
+  VLAN or routes.
+- Security Finding Inbox: ClickHouse schema, DetMir Portal view/API,
+  Hayabusa/Velociraptor ingest adapters and separate
+  `security-finding-inbox executor` are implemented. Portal records workflow
+  events only; approved `apply_requested` can be processed by the fail-closed
+  executor through `containment-engine` `decide -> plan -> apply -> verify`
+  with rollback on apply failure.
+- Velociraptor/Hayabusa status: implemented as optional findings/forensics
+  sources. They are not required for Workforce hot path, do not replace DLP or
+  SIEM, and must not start heavy always-on runtime in DetMir production unless
+  `offline_collector` or `server_clients` mode is explicitly selected.
+- Security Finding Inbox live schema: applied on ClickHouse 2026-06-29
+  (`security_findings`, `security_finding_workflow_events`,
+  `security_finding_inbox`).
+- DetMir Loki log contour: intentionally disabled by operator to reduce
+  resource usage. Proxmox LXC `202 loki-logs` is stopped, active config has
+  `onboot: 0`, and smoke checks skip Loki by default unless
+  `AW_SMOKE_LOKI_ENABLED=1` is set.
+- DetMir DLP rollback guard: `detmir-dlp-runtime-control set-profile` stores
+  the previous DLP systemd active/enabled state and `rollback` restores it.
+  Rollback does not start Loki CT.
+- DetMir restore baseline 2026-06-29:
+  `docs/DETMIR_RESTORE_BASELINE_2026-06-29_RU.md`.
+- DetMir API smoke after phase 1: `/healthz` and `/readyz` OK;
+  `/api/reports` returned `cache_status=warming` with
+  `modules.dlp.enabled=false`; `/api/operator` returned bounded
+  `cache_status=warming` / `summary.severity=STALE` without waiting for the
+  full cold snapshot.
+- DetMir remaining heavy path risk: full report/snapshot prewarm can still be
+  CPU/IO expensive; deeper optimization remains pending.
+- DetMir VPN access rule: do not identify the contour by `tun0`/`tun1`; verify
+  by NetworkManager profile, `10.0.13.*` address, route via `10.0.13.1` and live
+  reachability.
 
 ## Что готово
 
@@ -133,6 +202,11 @@ backup, registry-readiness документации, плана российск
 - External peer review remains pending.
 - Community adoption remains low until external contributors, public reviews
   and sustained third-party activity appear.
+- DetMir lightweight DLP profile is implemented in repo defaults/scripts/docs;
+  heavy DLP modularization and retention/cleanup policy remain separate future
+  work.
+- DetMir RDP collector/session recovery after 2026-06-29 restore is verified by
+  live smoke: `check-aw-full` reports `FRESH=8 STALE=0 DEAD=0`.
 
 ## Честные ограничения
 
@@ -170,3 +244,4 @@ backup, registry-readiness документации, плана российск
 - `docs/public-issues/public-issues-manifest.json`
 - `docs/BRANCH_PROTECTION_POLICY_RU.md`
 - `docs/BRANCH_PROTECTION_EVIDENCE_RU.md`
+- `docs/DETMIR_CURRENT_STATE_RU.md`

docs/REGISTRY_FUNCTIONAL_SCOPE_RU.md

@@ -50,6 +50,13 @@ Security layer:
 
 Это не полноценная SIEM и не сертифицированная DLP.
 
+Heavy DLP processing is not part of the required Workforce hot path. DLP
+endpoint signals, screenshots, evidence review, heavy correlation and forensics
+enrichment are treated as optional/deployment-specific modules. If the DLP
+module is disabled or not configured, core Workforce reports and portal
+readiness must remain available and the Security/Forensics views must show an
+honest disabled/not configured state.
+
 ## Forensics Core
 
 Forensics layer:
@@ -68,6 +75,7 @@ Optional addons and deployment-specific directions:
 
 - pfSense;
 - 1C;
+- DLP endpoint signals and evidence workflow;
 - AD/LDAP;
 - SIEM/syslog;
 - external storage;

docs/WINDOWS_LOGICAL_HOST_ID_RU.md

@@ -0,0 +1,133 @@
+# Stable logical host id для Windows/RDP контура
+
+Дата фиксации: 2026-06-27.
+
+Обновление 2026-06-29: восстановленный production RDP host доступен как
+`192.168.100.19`, но logical host id остаётся `SHARKON2025`.
+
+Этот документ описывает правило, которое защищает AWatch-rus/DetMir от поломки
+при переименовании Windows/RDP сервера.
+
+## Правило
+
+В AWatch-rus есть два разных идентификатора:
+
+| Поле | Назначение | Можно менять при rename Windows |
+| --- | --- | --- |
+| physical Windows name / `COMPUTERNAME` | имя ОС, локальный домен учеток, WinRM/администрирование | да |
+| `awHostname` / logical host id | суффикс ActivityWatch bucket, Grafana переменные, ClickHouse workforce keys, worktime reports | нет, только через плановую миграцию |
+
+Для DetMir production текущий stable logical host id:
+
+```text
+SHARKON2025
+```
+
+Это legacy logical id для сохранения истории bucket-ов и дашбордов. Он больше
+не должен трактоваться как обязательное физическое имя Windows-сервера.
+
+Физический IP/адрес администрирования задаётся отдельно в inventory/env:
+
+```text
+rdp-prod ansible_host=192.168.100.19
+AW_MONITORED_WINDOWS_HOST=192.168.100.19
+```
+
+## Где задается
+
+Windows deploy:
+
+```yaml
+aw_windows_logical_host_id: "SHARKON2025"
+aw_windows_hostname_override: "{{ aw_windows_logical_host_id }}"
+```
+
+Файл:
+
+```text
+ansible/host_vars/rdp-prod.yml
+```
+
+Server-side reports:
+
+```text
+AW_WORKTIME_HOST=<logical_host_id>
+AW_MONITORED_WINDOWS_HOSTNAME=<logical_host_id>
+AW_WORKTIME_INFLUX_HOSTS=<logical_host_id>
+AW_DLP_INFLUX_HOSTS=<logical_host_id>
+```
+
+Windows runtime config:
+
+```text
+C:\ProgramData\AWatch-rus\deployment-config.json
+```
+
+Ключ:
+
+```json
+{
+  "awHostname": "SHARKON2025"
+}
+```
+
+## Что делать при переименовании RDP сервера
+
+1. Не менять `awHostname`, если нет отдельного плана миграции исторических
+   bucket-ов, Grafana и ClickHouse.
+2. Windows account domain / local logon prefix можно задать явно:
+
+```yaml
+aw_windows_domain: "<new_windows_computer_or_domain_name>"
+```
+
+Если `aw_windows_domain` пустой или оставлен как `HOST-EXAMPLE`, playbook
+прочитает текущий `$env:COMPUTERNAME` через WinRM и использует его только для
+Windows-учёток. Это не меняет `awHostname`.
+
+3. Повторно применить Windows deploy после восстановления WinRM:
+
+```bash
+cd ansible
+ansible-playbook -i inventory.ini deploy_aw_windows.yml --limit rdp-prod
+```
+
+4. Проверить на Windows:
+
+```powershell
+Get-Content -Raw 'C:\ProgramData\AWatch-rus\deployment-config.json' |
+  ConvertFrom-Json |
+  Select-Object awHostname,userTasks
+```
+
+5. Проверить ActivityWatch buckets:
+
+```bash
+AW_MONITORED_WINDOWS_HOSTNAME=SHARKON2025 ./check-aw-data.sh
+```
+
+## Что ломается, если использовать `COMPUTERNAME` как bucket id
+
+- появляются новые пустые bucket-и после rename;
+- старые dashboards продолжают смотреть на старый host;
+- `aw-worktime-api` считает источники stale/missing;
+- ClickHouse workforce catalog перестает связывать пользователей с событиями;
+- guard/recovery может искать неправильные launch tasks.
+
+## Миграция на новый logical id
+
+Переход с `SHARKON2025` на нейтральный id вроде `DETMIR-RDP-01` допустим только
+как отдельная planned migration:
+
+- остановить Windows collectors;
+- создать mapping старого и нового logical id;
+- обновить Grafana dashboards;
+- обновить ClickHouse workforce catalog;
+- решить, переносить ли исторические ActivityWatch bucket-и или оставить их
+  read-only;
+- обновить `AW_WORKTIME_HOST`, `AW_MONITORED_WINDOWS_HOSTNAME`,
+  `AW_WORKTIME_INFLUX_HOSTS`, `AW_DLP_INFLUX_HOSTS`;
+- перезапустить server-side services;
+- выполнить smoke-check и ручную проверку портала.
+
+Без этих шагов менять logical id в production нельзя.

grafana/detmir-aw-main-dashboard.json

@@ -342,7 +342,7 @@
       "id": 7,
       "targets": [
         {
-          "query": "import \"date\"\nimport \"strings\"\nimport \"timezone\"\noption location = timezone.location(name: \"Europe/Moscow\")\ntoday = strings.substring(v: string(v: date.add(d: 3h, to: date.truncate(t: now(), unit: 1d))), start: 0, end: 10)\nbase = from(bucket: \"aw_metrics\")\n  |> range(start: -3d)\n  |> filter(fn: (r) => r._measurement == \"aw_true_active_app_daily\" and r.host == \"${host}\" and r.report_date == today)\n\nnums = base\n  |> filter(fn: (r) => r._field == \"proved_work_seconds\" or r._field == \"evidence_events\")\n  |> group(columns:[\"application\",\"_field\"])\n  |> last()\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n\ntexts = base\n  |> filter(fn: (r) => r._field == \"last_action\" or r._field == \"last_action_local\")\n  |> group(columns:[\"application\",\"_field\"])\n  |> last()\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n\njoin(tables: {n: nums, t: texts}, on: [\"application\", \"report_date\"])\n  |> map(fn:(r)=>({ r with hours: float(v:r.proved_work_seconds) / 3600.0 }))\n  |> sort(columns:[\"proved_work_seconds\"], desc:true)\n  |> group()\n  |> keep(columns:[\"report_date\",\"application\",\"hours\",\"last_action_local\",\"last_action\",\"evidence_events\"])\n  |> rename(columns:{report_date:\"Дата\", application:\"Приложение\", hours:\"Доказано, ч\", last_action_local:\"Последнее действие\", last_action:\"Окно / действие\", evidence_events:\"Подтверждений\"})\n",
+          "query": "import \"date\"\nimport \"strings\"\nimport \"timezone\"\noption location = timezone.location(name: \"Europe/Moscow\")\ntoday = strings.substring(v: string(v: date.add(d: 3h, to: date.truncate(t: now(), unit: 1d))), start: 0, end: 10)\nfrom(bucket: \"aw_metrics\")\n  |> range(start: -3d)\n  |> filter(fn: (r) => r._measurement == \"aw_true_active_app_daily\" and r.host == \"${host}\" and r.report_date == today)\n  |> filter(fn: (r) => r._field == \"proved_work_seconds\" or r._field == \"evidence_events\" or r._field == \"last_action\" or r._field == \"last_action_local\")\n  |> group(columns:[\"application\",\"report_date\",\"_field\"])\n  |> last()\n  |> keep(columns:[\"application\",\"report_date\",\"_field\",\"_value\"])\n  |> map(fn:(r)=>({ r with _value: string(v:r._value) }))\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n  |> map(fn:(r)=>({ r with hours: float(v:r.proved_work_seconds) / 3600.0 }))\n  |> sort(columns:[\"hours\"], desc:true)\n  |> group()\n  |> keep(columns:[\"report_date\",\"application\",\"hours\",\"last_action_local\",\"last_action\",\"evidence_events\"])\n  |> rename(columns:{report_date:\"Дата\", application:\"Приложение\", hours:\"Доказано, ч\", last_action_local:\"Последнее действие\", last_action:\"Окно / действие\", evidence_events:\"Подтверждений\"})\n",
           "refId": "A"
         }
       ],

grafana/detmir-rdp-user-activity-dashboard.json

@@ -630,7 +630,7 @@
       },
       "targets": [
         {
-          "query": "import \"date\"\nimport \"strings\"\nimport \"timezone\"\noption location = timezone.location(name: \"Europe/Moscow\")\ntoday = strings.substring(v: string(v: date.add(d: 3h, to: date.truncate(t: now(), unit: 1d))), start: 0, end: 10)\nbase = from(bucket: \"aw_metrics\")\n  |> range(start: -3d)\n  |> filter(fn: (r) => r._measurement == \"aw_true_active_app_daily\" and r.host == \"${host}\" and r.report_date == today)\n\nnums = base\n  |> filter(fn: (r) => r._field == \"proved_work_seconds\" or r._field == \"evidence_events\")\n  |> group(columns:[\"application\",\"_field\"])\n  |> last()\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n\ntexts = base\n  |> filter(fn: (r) => r._field == \"last_action\" or r._field == \"last_action_local\")\n  |> group(columns:[\"application\",\"_field\"])\n  |> last()\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n\njoin(tables: {n: nums, t: texts}, on: [\"application\", \"report_date\"])\n  |> map(fn:(r)=>({ r with hours: float(v:r.proved_work_seconds) / 3600.0 }))\n  |> sort(columns:[\"proved_work_seconds\"], desc:true)\n  |> group()\n  |> keep(columns:[\"report_date\",\"application\",\"hours\",\"last_action_local\",\"last_action\",\"evidence_events\"])\n  |> rename(columns:{report_date:\"Дата\", application:\"Приложение\", hours:\"Доказано, ч\", last_action_local:\"Последнее действие\", last_action:\"Окно / действие\", evidence_events:\"Подтверждений\"})",
+          "query": "import \"date\"\nimport \"strings\"\nimport \"timezone\"\noption location = timezone.location(name: \"Europe/Moscow\")\ntoday = strings.substring(v: string(v: date.add(d: 3h, to: date.truncate(t: now(), unit: 1d))), start: 0, end: 10)\nfrom(bucket: \"aw_metrics\")\n  |> range(start: -3d)\n  |> filter(fn: (r) => r._measurement == \"aw_true_active_app_daily\" and r.host == \"${host}\" and r.report_date == today)\n  |> filter(fn: (r) => r._field == \"proved_work_seconds\" or r._field == \"evidence_events\" or r._field == \"last_action\" or r._field == \"last_action_local\")\n  |> group(columns:[\"application\",\"report_date\",\"_field\"])\n  |> last()\n  |> keep(columns:[\"application\",\"report_date\",\"_field\",\"_value\"])\n  |> map(fn:(r)=>({ r with _value: string(v:r._value) }))\n  |> group()\n  |> pivot(rowKey:[\"application\",\"report_date\"], columnKey:[\"_field\"], valueColumn:\"_value\")\n  |> map(fn:(r)=>({ r with hours: float(v:r.proved_work_seconds) / 3600.0 }))\n  |> sort(columns:[\"hours\"], desc:true)\n  |> group()\n  |> keep(columns:[\"report_date\",\"application\",\"hours\",\"last_action_local\",\"last_action\",\"evidence_events\"])\n  |> rename(columns:{report_date:\"Дата\", application:\"Приложение\", hours:\"Доказано, ч\", last_action_local:\"Последнее действие\", last_action:\"Окно / действие\", evidence_events:\"Подтверждений\"})",
           "refId": "A"
         }
       ],

ops/systemd/detmir-portal-prewarm.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=DetMir portal report cache prewarm
+After=network-online.target detmir-portal.service
+Wants=network-online.target detmir-portal.service
+
+[Service]
+Type=oneshot
+User=igor
+Group=igor
+Environment=no_proxy=localhost,127.0.0.1,10.10.10.2
+Environment=NO_PROXY=localhost,127.0.0.1,10.10.10.2
+ExecStart=/usr/bin/curl -fsS --max-time 180 http://127.0.0.1:8720/api/reports -o /dev/null
+TimeoutStartSec=210
+Nice=19
+IOSchedulingClass=idle

ops/systemd/detmir-portal-prewarm.timer

@@ -0,0 +1,12 @@
+[Unit]
+Description=Pre-warm DetMir portal report cache every 30 minutes
+
+[Timer]
+OnBootSec=5min
+OnUnitActiveSec=30min
+AccuracySec=1min
+Persistent=true
+Unit=detmir-portal-prewarm.service
+
+[Install]
+WantedBy=timers.target

ops/systemd/detmir-portal.service.d/30-prewarm-after-start.conf

@@ -0,0 +1,2 @@
+[Service]
+ExecStartPost=/bin/systemctl --no-block start detmir-portal-prewarm.service

scripts/aw-contour-diag.sh

@@ -23,9 +23,14 @@ PROXMOX_HOST="10.10.10.2"
 AW_HOST="10.10.10.13"
 GRAFANA_HOST="10.10.10.11"
 INFLUXDB_HOST="10.10.10.10"
-WINDOWS_HOST="192.168.100.18"
+WINDOWS_HOST="${AW_WINDOWS_HOST:-${AW_SMOKE_WINDOWS_HOST:-192.168.100.19}}"
 CLICKHOUSE_HOST="10.10.10.2"
-SOURCE_HOSTNAME="SHARKON2025"
+SOURCE_HOSTNAME="${AW_LOGICAL_HOST_ID:-${AW_MONITORED_WINDOWS_HOSTNAME:-${AW_SMOKE_SOURCE_HOSTNAME:-SHARKON2025}}}"
+DLP_ENABLED="${AW_DLP_ENABLED:-${DETMIR_DLP_ENABLED:-true}}"
+case "${DLP_ENABLED,,}" in
+  0|false|no|off) DLP_ENABLED=false ;;
+  *) DLP_ENABLED=true ;;
+esac
 
 QUICK_MODE=0
 SKIP_WINDOWS=0
@@ -102,7 +107,7 @@ check_http_json_key() {
 check_bucket_freshness() {
   local bucket="$1" label="$2" remediation="$3"
   local bucket_id="${bucket}_${SOURCE_HOSTNAME}"
-  local tmp last_ts event_epoch now age_sec
+  local tmp last_ts event_epoch now age_sec meta_ts
   tmp="$(mktemp)"
   if ! curl -fsS --connect-timeout 5 --max-time 15 "$AW_SERVER/api/0/buckets/$bucket_id/events?limit=1" -o "$tmp" 2>"$tmp.err"; then
     fail "bucket $label ($bucket_id) — запрос не удался"
@@ -113,6 +118,12 @@ check_bucket_freshness() {
   fi
   last_ts="$(jq -r '.[0].timestamp // empty' "$tmp" 2>/dev/null)"
   rm -f "$tmp"
+  if [ "$bucket" = "aw-watcher-afk" ]; then
+    meta_ts="$(curl -fsS --connect-timeout 5 --max-time 15 "$AW_SERVER/api/0/buckets/$bucket_id" 2>/dev/null | jq -r '.metadata.end // empty' 2>/dev/null || true)"
+    if [ -n "$meta_ts" ]; then
+      last_ts="$meta_ts"
+    fi
+  fi
   if [ -z "$last_ts" ]; then
     warn "bucket $label ($bucket_id) — нет событий"
     echo "       REMEDIATION: $remediation"
@@ -268,11 +279,11 @@ if [ "$QUICK_MODE" = "1" ]; then
 
   section "4. Buckets (быстрый режим)"
   for entry in \
-    "aw-watcher-afk|AFK watcher|Запустите на RDP: schtasks /Run /TN \"ActivityWatch Recovery\" или schtasks /Run /TN \"ActivityWatch Launch [SHARKON2025_Администратор]\"" \
+    "aw-watcher-afk|AFK watcher|Запустите на RDP: schtasks /Run /TN \"ActivityWatch Recovery\" или launch task для logical host $SOURCE_HOSTNAME" \
     "aw-watcher-window|Window watcher|Запустите через ansible: ansible aw_windows -i $INVENTORY -m win_shell -a 'Start-Process -FilePath \"C:\\Program Files\\AWatch-rus\\bin\\aw-watcher-window\\aw-watcher-window.exe\" -ArgumentList @(\"--host\", \"10.10.10.13\", \"--port\", \"5600\") -WindowStyle Hidden'" \
     "aw-worktime-sessions|Worktime sessions|Проверьте работу worktime-api: systemctl status aw-worktime-api на AW сервере" \
     "aw-session-events|Session events|Проверьте collector-guard и aw-session-events-collector на RDP" \
-    "aw-dlp-endpoint-signals|DLP signals|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Launch [SHARKON2025_Администратор]\"; Start-Sleep 30'" \
+    "aw-dlp-endpoint-signals|DLP signals|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Recovery\"; Start-Sleep 30'" \
     "aw-dlp-incidents|DLP incidents|Проверьте aw-detmir-dlp-collector.ps1 на RDP (логи: C:\\ProgramData\\AWatch-rus\\logs\\)" \
   ; do
     bucket="${entry%%|*}"; rest="${entry#*|}"
@@ -302,10 +313,10 @@ section "4. Buckets (свежесть данных)"
 # ============================================================
 for entry in \
   "aw-watcher-afk|AFK watcher|Запустите на RDP: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Recovery\"'" \
-  "aw-watcher-window|Window watcher|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Launch [SHARKON2025_Администратор]\"; Start-Process -FilePath \"C:\\Program Files\\AWatch-rus\\bin\\aw-watcher-window\\aw-watcher-window.exe\" -ArgumentList @(\"--host\", \"10.10.10.13\", \"--port\", \"5600\") -WindowStyle Hidden'" \
+  "aw-watcher-window|Window watcher|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Recovery\"; Start-Sleep 60'" \
   "aw-worktime-sessions|Worktime sessions|Проверьте: ssh igor@$AW_HOST 'systemctl status aw-worktime-api && journalctl -u aw-worktime-api -n 20'" \
   "aw-session-events|Session events|Проверьте collector-guard на RDP: ansible aw_windows -i $INVENTORY -m win_shell -a 'Get-Process -Name aw-session-events-* -ErrorAction SilentlyContinue'" \
-  "aw-dlp-endpoint-signals|DLP endpoint signals|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Launch [SHARKON2025_Администратор]\"; Start-Sleep 60'" \
+  "aw-dlp-endpoint-signals|DLP endpoint signals|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Recovery\"; Start-Sleep 60'" \
   "aw-dlp-incidents|DLP incidents|Проверьте: ansible aw_windows -i $INVENTORY -m win_shell -a \"Get-Content 'C:\\ProgramData\\AWatch-rus\\logs\\dlp-*.log' -Tail 20\"" \
   "aw-dlp-review|DLP review|Проверьте: ssh igor@$AW_HOST 'journalctl -u aw-dlp-policy-engine.service -n 20 --no-pager'" \
   "aw-dlp-rules|DLP rules|Проверьте: ssh igor@$AW_HOST 'journalctl -u aw-dlp-ioc-refresh.service -n 20 --no-pager'" \
@@ -389,6 +400,9 @@ check_service_remote "Nginx service" "$PROXMOX_HOST" "nginx.service" \
 # ============================================================
 section "10. DLP Pipeline (10.10.10.13)"
 # ============================================================
+if [ "$DLP_ENABLED" = "false" ]; then
+  skip "DLP Pipeline disabled by AW_DLP_ENABLED/DETMIR_DLP_ENABLED=false"
+else
 # DLP Policy Engine — должен быть active (running)
 check_service_remote "DLP Policy Engine" "$AW_HOST" "aw-dlp-policy-engine.service" \
   "Проверьте: ssh igor@$AW_HOST 'sudo journalctl -u aw-dlp-policy-engine.service -n 30 --no-pager'"
@@ -434,6 +448,7 @@ check_service_remote "DLP Webhook Sender timer" "$AW_HOST" "aw-dlp-webhook-sende
 # DLP Report Scheduler
 check_service_remote "DLP Report Scheduler timer" "$AW_HOST" "aw-dlp-report-scheduler.timer" \
   "ssh igor@$AW_HOST 'sudo systemctl enable --now aw-dlp-report-scheduler.timer'"
+fi
 
 # Worktime Influx Exporter
 check_service_remote "Worktime Influx Exporter timer" "$AW_HOST" "aw-worktime-influx-exporter.timer" \
@@ -443,7 +458,7 @@ check_service_remote "Worktime Influx Exporter timer" "$AW_HOST" "aw-worktime-in
 if [ "$SKIP_WINDOWS" = "1" ]; then
   skip "Проверки RDP хоста пропущены (--skip-windows)"
 else
-  section "11. RDP хост (192.168.100.18)"
+  section "11. RDP хост ($WINDOWS_HOST)"
   if have ansible && [ -f "$INVENTORY" ]; then
     check_ansible_module "WinRM ping" aw_windows win_ping
 
@@ -459,7 +474,7 @@ else
       'schtasks /Query /TN "ActivityWatch Recovery" /FO LIST /V | Select-String "Status|Run|Next"'
 
     check_ansible_win_shell "Scheduled tasks (Launch Admin)" \
-      'schtasks /Query /TN "ActivityWatch Launch [SHARKON2025_Администратор]" /FO LIST /V | Select-String "Status|Run|Next"'
+      'Get-Content -Raw "C:\ProgramData\AWatch-rus\deployment-config.json" | ConvertFrom-Json | Select-Object -ExpandProperty userTasks | Select-Object LaunchTaskName,UserId | Format-Table -AutoSize'
   else
     skip "Ansible или inventory не найдены"
   fi
@@ -469,7 +484,7 @@ fi
 section "12. Systemd health (AW server)"
 # ============================================================
 check_ansible_shell "AW server core units" aw_server \
-  'systemctl is-active activitywatch-server aw-worktime-api aw-dlp-policy-engine aw-dlp-case-management aw-worktime-influx-exporter.timer aw-dlp-influx-exporter.timer activitywatch-dlp-aggregator.timer aw-clickhouse-network-health.timer | paste -sd,'
+  'if [ "${AW_DLP_ENABLED:-true}" = "false" ] || [ "${DETMIR_DLP_ENABLED:-true}" = "false" ]; then systemctl is-active activitywatch-server aw-worktime-api aw-worktime-influx-exporter.timer aw-clickhouse-network-health.timer | paste -sd,; else systemctl is-active activitywatch-server aw-worktime-api aw-dlp-policy-engine aw-dlp-case-management aw-worktime-influx-exporter.timer aw-dlp-influx-exporter.timer activitywatch-dlp-aggregator.timer aw-clickhouse-network-health.timer | paste -sd,; fi'
 
 check_ansible_shell "AW server — нет failed units" aw_server \
   'failed=$(systemctl --failed --no-legend | awk "{print \$1}" | grep -E "activitywatch|aw-|dlp" || true); test -z "$failed" && echo "no AW-related failed units" || { echo "$failed"; exit 1; }'

scripts/aw-contour-smoke-local.sh

@@ -40,12 +40,13 @@ GRAFANA_PASSWORD="${GRAFANA_PASSWORD:-}"
 PROXMOX_HOST="${AW_SMOKE_PROXMOX_HOST:-10.10.10.2}"
 AW_HOST="${AW_SMOKE_AW_HOST:-10.10.10.13}"
 GRAFANA_HOST="${AW_SMOKE_GRAFANA_HOST:-10.10.10.11}"
-WINDOWS_HOST="${AW_SMOKE_WINDOWS_HOST:-192.168.100.18}"
-AW_SOURCE_HOSTNAME="${AW_SMOKE_SOURCE_HOSTNAME:-SHARKON2025}"
+WINDOWS_HOST="${AW_SMOKE_WINDOWS_HOST:-${AW_WINDOWS_HOST:-192.168.100.19}}"
+AW_SOURCE_HOSTNAME="${AW_SMOKE_SOURCE_HOSTNAME:-${AW_LOGICAL_HOST_ID:-${AW_MONITORED_WINDOWS_HOSTNAME:-SHARKON2025}}}"
 LOG_DIR="${AW_SMOKE_LOG_DIR:-$REPO_ROOT/output/smoke}"
 RUN_REMOTE="${AW_SMOKE_RUN_REMOTE:-1}"
 RUN_WINRM="${AW_SMOKE_RUN_WINRM:-1}"
 RUN_SERVER_SYSTEMD="${AW_SMOKE_RUN_SERVER_SYSTEMD:-1}"
+LOKI_ENABLED="${AW_SMOKE_LOKI_ENABLED:-0}"
 
 NO_PROXY_REQUIRED="localhost,127.0.0.1,$PROXMOX_HOST,$AW_HOST,$GRAFANA_HOST,$WINDOWS_HOST,10.10.10.0/24,192.168.100.0/24"
 if [ -n "${no_proxy:-}" ]; then
@@ -87,6 +88,7 @@ Environment overrides:
   AW_SMOKE_WORKTIME_API=http://10.10.10.13:5610
   AW_SMOKE_GRAFANA_URL=http://10.10.10.11:3000
   AW_SMOKE_SOURCE_HOSTNAME=SHARKON2025
+  AW_SMOKE_LOKI_ENABLED=0|1
   AW_SMOKE_ENV_FILE=$HOME/.config/aw-contour-smoke.env
   AW_SMOKE_LOG_DIR=$REPO_ROOT/output/smoke
   GRAFANA_USER/GRAFANA_PASSWORD via env or a local env file
@@ -219,6 +221,10 @@ check_http_code_basic_auth() {
 check_grafana_loki_proxy() {
   local name="Grafana Loki datasource proxy"
   local tmp uid code body
+  if [ "$LOKI_ENABLED" != "1" ]; then
+    skip "$name skipped: Loki is intentionally disabled for the current DetMir resource profile"
+    return
+  fi
   tmp="$(mktemp)"
   if ! curl -k -fsS -u "$GRAFANA_USER:$GRAFANA_PASSWORD" --connect-timeout 5 --max-time 20 "$GRAFANA_URL/api/datasources" -o "$tmp" 2>"$tmp.err"; then
     fail "$name cannot list datasources"
@@ -416,7 +422,7 @@ classify_bucket_age() {
 check_bucket_freshness() {
   local bucket="$1"
   local bucket_id="${bucket}_${AW_SOURCE_HOSTNAME}"
-  local tmp last_ts last_id event_epoch now age_sec status
+  local tmp last_ts last_id event_epoch now age_sec status meta_ts
   tmp="$(mktemp)"
   if ! curl -fsS --connect-timeout 5 --max-time 20 "$AW_SERVER/api/0/buckets/$bucket_id/events?limit=1" -o "$tmp" 2>"$tmp.err"; then
     fail "bucket $bucket_id query failed"
@@ -428,6 +434,12 @@ check_bucket_freshness() {
   last_ts="$(jq -r '.[0].timestamp // empty' "$tmp" 2>/dev/null)"
   last_id="$(jq -r '.[0].id // 0' "$tmp" 2>/dev/null)"
   rm -f "$tmp" "$tmp.err"
+  if [ "$bucket" = "aw-watcher-afk" ]; then
+    meta_ts="$(curl -fsS --connect-timeout 5 --max-time 20 "$AW_SERVER/api/0/buckets/$bucket_id" 2>/dev/null | jq -r '.metadata.end // empty' 2>/dev/null || true)"
+    if [ -n "$meta_ts" ]; then
+      last_ts="$meta_ts"
+    fi
+  fi
 
   if [ -z "$last_ts" ]; then
     case "$bucket" in
@@ -611,7 +623,7 @@ if [ "$RUN_WINRM" = "1" ] && have ansible; then
   check_ansible_module "Windows win_ping" aw_windows win_ping
   check_ansible_win_shell "Windows sessions" aw_windows '$psi = [System.Diagnostics.ProcessStartInfo]::new(); $psi.FileName = "$env:SystemRoot\System32\query.exe"; $psi.Arguments = "user"; $psi.UseShellExecute = $false; $psi.RedirectStandardOutput = $true; $psi.RedirectStandardError = $true; $psi.StandardOutputEncoding = [System.Text.Encoding]::GetEncoding(866); $psi.StandardErrorEncoding = [System.Text.Encoding]::GetEncoding(866); $p = [System.Diagnostics.Process]::Start($psi); $out = $p.StandardOutput.ReadToEnd(); $err = $p.StandardError.ReadToEnd(); $p.WaitForExit(); [Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false); $out; if ($err) { $err }; if ($out -match "USERNAME|ПОЛЬЗОВАТЕЛЬ|администратор|Администратор") { exit 0 } else { exit $p.ExitCode }'
   check_ansible_win_shell_warn "Windows collector processes" aw_windows '$p = Get-Process aw-watcher-afk,aw-watcher-window -ErrorAction SilentlyContinue; if ($p) { $p | Select-Object Name,Id,SessionId,StartTime | Format-Table -AutoSize } else { "no aw-watcher-afk/window process visible to this WinRM session" }'
-  check_ansible_win_shell "Windows ActivityWatch tasks" aw_windows 'schtasks /Query /TN "ActivityWatch Recovery" /FO LIST /V; schtasks /Query /TN "ActivityWatch Launch [SHARKON2025_Администратор]" /FO LIST /V'
+  check_ansible_win_shell "Windows ActivityWatch tasks" aw_windows 'schtasks /Query /TN "ActivityWatch Recovery" /FO LIST /V; Get-Content -Raw "C:\ProgramData\AWatch-rus\deployment-config.json" | ConvertFrom-Json | Select-Object -ExpandProperty userTasks | Select-Object LaunchTaskName,UserId | Format-Table -AutoSize'
 else
   skip "Windows WinRM checks skipped"
 fi
@@ -625,7 +637,7 @@ else
   skip "check-aw-data.sh missing"
 fi
 if [ -x "$REPO_ROOT/check-aw-full.sh" ]; then
-  if "$REPO_ROOT/check-aw-full.sh"; then pass "check-aw-full.sh completed"; else fail "check-aw-full.sh failed"; fi
+  if AW_SMOKE_AW_SERVER="$AW_SERVER" AW_SMOKE_SOURCE_HOSTNAME="$AW_SOURCE_HOSTNAME" AW_SMOKE_WINDOWS_HOST="$WINDOWS_HOST" "$REPO_ROOT/check-aw-full.sh"; then pass "check-aw-full.sh completed"; else fail "check-aw-full.sh failed"; fi
 else
   skip "check-aw-full.sh missing"
 fi

scripts/check_detmir_rust_release_artifacts.sh

@@ -4,8 +4,33 @@ set -euo pipefail
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 TARGET_ROOT="${CARGO_TARGET_DIR:-$ROOT_DIR/adk-rust/target}"
 RELEASE_DIR="$TARGET_ROOT/release"
+SCOPE="${CHECK_DETMIR_RUST_RELEASE_SCOPE:-prod-runtime}"
 
-required_bins=(
+prod_runtime_bins=(
+  aw-1c-ingest
+  aw-hayabusa-autoprocess-rust
+  aw-rus-healthd
+  aw-slo-monitor
+  aw-workforce-ingest
+  detmir-auto
+  detmir-portal
+  detmir-readiness
+  dlp-aggregator
+  dlp-case-management
+  dlp-cef-exporter
+  dlp-compliance
+  dlp-influx-exporter
+  dlp-policy-engine
+  dlp-syslog-forwarder
+  dlp-webhook-sender
+  worktime-api
+  worktime-autoheal
+  worktime-influx-exporter
+  worktime-prewarm
+  worktime-ui-bridge
+)
+
+workspace_bins=(
   detmir-status
   detmir-adk-status
   detmir-check
@@ -61,8 +86,23 @@ required_bins=(
   aw-hayabusa-from-windows-rust
   aw-hayabusa-autoprocess-rust
   aw-1c-ingest
+  containment-engine
+  security-finding-inbox
 )
 
+case "$SCOPE" in
+  prod-runtime)
+    required_bins=("${prod_runtime_bins[@]}")
+    ;;
+  workspace)
+    required_bins=("${workspace_bins[@]}")
+    ;;
+  *)
+    echo "Unsupported CHECK_DETMIR_RUST_RELEASE_SCOPE=$SCOPE; expected prod-runtime or workspace" >&2
+    exit 2
+    ;;
+esac
+
 missing=0
 for bin in "${required_bins[@]}"; do
   if [[ -x "$RELEASE_DIR/$bin" ]]; then
@@ -76,7 +116,7 @@ done
 if (( missing != 0 )); then
   cat >&2 <<EOF
 
-Missing DetMir Rust release artifacts.
+Missing DetMir Rust release artifacts for scope: $SCOPE.
 Build them with:
   cd "$ROOT_DIR/adk-rust"
   CARGO_TARGET_DIR="$TARGET_ROOT" cargo build --release --workspace
@@ -84,4 +124,4 @@ EOF
   exit 1
 fi
 
-echo "detmir rust release artifacts: OK ($RELEASE_DIR)"
+echo "detmir rust release artifacts: OK scope=$SCOPE ($RELEASE_DIR)"

scripts/detmir-full-diagnostics/aw-contour-diag.sh

@@ -23,9 +23,14 @@ PROXMOX_HOST="10.10.10.2"
 AW_HOST="10.10.10.13"
 GRAFANA_HOST="10.10.10.11"
 INFLUXDB_HOST="10.10.10.10"
-WINDOWS_HOST="192.168.100.18"
+WINDOWS_HOST="${AW_WINDOWS_HOST:-${AW_SMOKE_WINDOWS_HOST:-192.168.100.19}}"
 CLICKHOUSE_HOST="10.10.10.2"
-SOURCE_HOSTNAME="SHARKON2025"
+SOURCE_HOSTNAME="${AW_LOGICAL_HOST_ID:-${AW_MONITORED_WINDOWS_HOSTNAME:-${AW_SMOKE_SOURCE_HOSTNAME:-SHARKON2025}}}"
+DLP_ENABLED="${AW_DLP_ENABLED:-${DETMIR_DLP_ENABLED:-true}}"
+case "${DLP_ENABLED,,}" in
+  0|false|no|off) DLP_ENABLED=false ;;
+  *) DLP_ENABLED=true ;;
+esac
 
 QUICK_MODE=0
 SKIP_WINDOWS=0
@@ -102,7 +107,7 @@ check_http_json_key() {
 check_bucket_freshness() {
   local bucket="$1" label="$2" remediation="$3"
   local bucket_id="${bucket}_${SOURCE_HOSTNAME}"
-  local tmp last_ts event_epoch now age_sec
+  local tmp last_ts event_epoch now age_sec meta_ts
   tmp="$(mktemp)"
   if ! curl -fsS --connect-timeout 5 --max-time 15 "$AW_SERVER/api/0/buckets/$bucket_id/events?limit=1" -o "$tmp" 2>"$tmp.err"; then
     fail "bucket $label ($bucket_id) — запрос не удался"
@@ -113,6 +118,12 @@ check_bucket_freshness() {
   fi
   last_ts="$(jq -r '.[0].timestamp // empty' "$tmp" 2>/dev/null)"
   rm -f "$tmp"
+  if [ "$bucket" = "aw-watcher-afk" ]; then
+    meta_ts="$(curl -fsS --connect-timeout 5 --max-time 15 "$AW_SERVER/api/0/buckets/$bucket_id" 2>/dev/null | jq -r '.metadata.end // empty' 2>/dev/null || true)"
+    if [ -n "$meta_ts" ]; then
+      last_ts="$meta_ts"
+    fi
+  fi
   if [ -z "$last_ts" ]; then
     warn "bucket $label ($bucket_id) — нет событий"
     echo "       REMEDIATION: $remediation"
@@ -268,11 +279,11 @@ if [ "$QUICK_MODE" = "1" ]; then
 
   section "4. Buckets (быстрый режим)"
   for entry in \
-    "aw-watcher-afk|AFK watcher|Запустите на RDP: schtasks /Run /TN \"ActivityWatch Recovery\" или schtasks /Run /TN \"ActivityWatch Launch [SHARKON2025_Администратор]\"" \
+    "aw-watcher-afk|AFK watcher|Запустите на RDP: schtasks /Run /TN \"ActivityWatch Recovery\" или launch task для logical host $SOURCE_HOSTNAME" \
     "aw-watcher-window|Window watcher|Запустите через ansible: ansible aw_windows -i $INVENTORY -m win_shell -a 'Start-Process -FilePath \"C:\\Program Files\\AWatch-rus\\bin\\aw-watcher-window\\aw-watcher-window.exe\" -ArgumentList @(\"--host\", \"10.10.10.13\", \"--port\", \"5600\") -WindowStyle Hidden'" \
     "aw-worktime-sessions|Worktime sessions|Проверьте работу worktime-api: systemctl status aw-worktime-api на AW сервере" \
     "aw-session-events|Session events|Проверьте collector-guard и aw-session-events-collector на RDP" \
-    "aw-dlp-endpoint-signals|DLP signals|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Launch [SHARKON2025_Администратор]\"; Start-Sleep 30'" \
+    "aw-dlp-endpoint-signals|DLP signals|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Recovery\"; Start-Sleep 30'" \
     "aw-dlp-incidents|DLP incidents|Проверьте aw-detmir-dlp-collector.ps1 на RDP (логи: C:\\ProgramData\\AWatch-rus\\logs\\)" \
   ; do
     bucket="${entry%%|*}"; rest="${entry#*|}"
@@ -302,10 +313,10 @@ section "4. Buckets (свежесть данных)"
 # ============================================================
 for entry in \
   "aw-watcher-afk|AFK watcher|Запустите на RDP: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Recovery\"'" \
-  "aw-watcher-window|Window watcher|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Launch [SHARKON2025_Администратор]\"; Start-Process -FilePath \"C:\\Program Files\\AWatch-rus\\bin\\aw-watcher-window\\aw-watcher-window.exe\" -ArgumentList @(\"--host\", \"10.10.10.13\", \"--port\", \"5600\") -WindowStyle Hidden'" \
+  "aw-watcher-window|Window watcher|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Recovery\"; Start-Sleep 60'" \
   "aw-worktime-sessions|Worktime sessions|Проверьте: ssh igor@$AW_HOST 'systemctl status aw-worktime-api && journalctl -u aw-worktime-api -n 20'" \
   "aw-session-events|Session events|Проверьте collector-guard на RDP: ansible aw_windows -i $INVENTORY -m win_shell -a 'Get-Process -Name aw-session-events-* -ErrorAction SilentlyContinue'" \
-  "aw-dlp-endpoint-signals|DLP endpoint signals|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Launch [SHARKON2025_Администратор]\"; Start-Sleep 60'" \
+  "aw-dlp-endpoint-signals|DLP endpoint signals|Запустите: ansible aw_windows -i $INVENTORY -m win_shell -a 'schtasks /Run /TN \"ActivityWatch Recovery\"; Start-Sleep 60'" \
   "aw-dlp-incidents|DLP incidents|Проверьте: ansible aw_windows -i $INVENTORY -m win_shell -a \"Get-Content 'C:\\ProgramData\\AWatch-rus\\logs\\dlp-*.log' -Tail 20\"" \
   "aw-dlp-review|DLP review|Проверьте: ssh igor@$AW_HOST 'journalctl -u aw-dlp-policy-engine.service -n 20 --no-pager'" \
   "aw-dlp-rules|DLP rules|Проверьте: ssh igor@$AW_HOST 'journalctl -u aw-dlp-ioc-refresh.service -n 20 --no-pager'" \
@@ -389,6 +400,9 @@ check_service_remote "Nginx service" "$PROXMOX_HOST" "nginx.service" \
 # ============================================================
 section "10. DLP Pipeline (10.10.10.13)"
 # ============================================================
+if [ "$DLP_ENABLED" = "false" ]; then
+  skip "DLP Pipeline disabled by AW_DLP_ENABLED/DETMIR_DLP_ENABLED=false"
+else
 # DLP Policy Engine — должен быть active (running)
 check_service_remote "DLP Policy Engine" "$AW_HOST" "aw-dlp-policy-engine.service" \
   "Проверьте: ssh igor@$AW_HOST 'sudo journalctl -u aw-dlp-policy-engine.service -n 30 --no-pager'"
@@ -434,6 +448,7 @@ check_service_remote "DLP Webhook Sender timer" "$AW_HOST" "aw-dlp-webhook-sende
 # DLP Report Scheduler
 check_service_remote "DLP Report Scheduler timer" "$AW_HOST" "aw-dlp-report-scheduler.timer" \
   "ssh igor@$AW_HOST 'sudo systemctl enable --now aw-dlp-report-scheduler.timer'"
+fi
 
 # Worktime Influx Exporter
 check_service_remote "Worktime Influx Exporter timer" "$AW_HOST" "aw-worktime-influx-exporter.timer" \
@@ -443,7 +458,7 @@ check_service_remote "Worktime Influx Exporter timer" "$AW_HOST" "aw-worktime-in
 if [ "$SKIP_WINDOWS" = "1" ]; then
   skip "Проверки RDP хоста пропущены (--skip-windows)"
 else
-  section "11. RDP хост (192.168.100.18)"
+  section "11. RDP хост ($WINDOWS_HOST)"
   if have ansible && [ -f "$INVENTORY" ]; then
     check_ansible_module "WinRM ping" aw_windows win_ping
 
@@ -459,7 +474,7 @@ else
       'schtasks /Query /TN "ActivityWatch Recovery" /FO LIST /V | Select-String "Status|Run|Next"'
 
     check_ansible_win_shell "Scheduled tasks (Launch Admin)" \
-      'schtasks /Query /TN "ActivityWatch Launch [SHARKON2025_Администратор]" /FO LIST /V | Select-String "Status|Run|Next"'
+      'Get-Content -Raw "C:\ProgramData\AWatch-rus\deployment-config.json" | ConvertFrom-Json | Select-Object -ExpandProperty userTasks | Select-Object LaunchTaskName,UserId | Format-Table -AutoSize'
   else
     skip "Ansible или inventory не найдены"
   fi
@@ -469,7 +484,7 @@ fi
 section "12. Systemd health (AW server)"
 # ============================================================
 check_ansible_shell "AW server core units" aw_server \
-  'systemctl is-active activitywatch-server aw-worktime-api aw-dlp-policy-engine aw-dlp-case-management aw-worktime-influx-exporter.timer aw-dlp-influx-exporter.timer activitywatch-dlp-aggregator.timer aw-clickhouse-network-health.timer | paste -sd,'
+  'if [ "${AW_DLP_ENABLED:-true}" = "false" ] || [ "${DETMIR_DLP_ENABLED:-true}" = "false" ]; then systemctl is-active activitywatch-server aw-worktime-api aw-worktime-influx-exporter.timer aw-clickhouse-network-health.timer | paste -sd,; else systemctl is-active activitywatch-server aw-worktime-api aw-dlp-policy-engine aw-dlp-case-management aw-worktime-influx-exporter.timer aw-dlp-influx-exporter.timer activitywatch-dlp-aggregator.timer aw-clickhouse-network-health.timer | paste -sd,; fi'
 
 check_ansible_shell "AW server — нет failed units" aw_server \
   'failed=$(systemctl --failed --no-legend | awk "{print \$1}" | grep -E "activitywatch|aw-|dlp" || true); test -z "$failed" && echo "no AW-related failed units" || { echo "$failed"; exit 1; }'

scripts/detmir-support-run.sh

@@ -79,7 +79,7 @@ fi
 DETMIR_SUPPORT_PVE_HOST="${DETMIR_SUPPORT_PVE_HOST:-10.10.10.2}"
 DETMIR_SUPPORT_AW_HOST="${DETMIR_SUPPORT_AW_HOST:-10.10.10.13}"
 DETMIR_SUPPORT_WEB_HOST="${DETMIR_SUPPORT_WEB_HOST:-$DETMIR_SUPPORT_PVE_HOST}"
-DETMIR_SUPPORT_WINDOWS_HOST="${DETMIR_SUPPORT_WINDOWS_HOST:-192.168.100.18}"
+DETMIR_SUPPORT_WINDOWS_HOST="${DETMIR_SUPPORT_WINDOWS_HOST:-192.168.100.19}"
 DETMIR_SUPPORT_PFSENSE_HOST="${DETMIR_SUPPORT_PFSENSE_HOST:-}"
 DETMIR_SUPPORT_PFSENSE_URL="${DETMIR_SUPPORT_PFSENSE_URL:-}"
 DETMIR_SUPPORT_OPENVPN_HOST="${DETMIR_SUPPORT_OPENVPN_HOST:-}"

scripts/detmir-support.env.example

@@ -2,7 +2,7 @@
 DETMIR_SUPPORT_PVE_HOST=10.10.10.2
 DETMIR_SUPPORT_AW_HOST=10.10.10.13
 DETMIR_SUPPORT_WEB_HOST=10.10.10.2
-DETMIR_SUPPORT_WINDOWS_HOST=192.168.100.18
+DETMIR_SUPPORT_WINDOWS_HOST=192.168.100.19
 
 ## Сетевые компоненты
 DETMIR_SUPPORT_PFSENSE_HOST=10.0.0.1

scripts/detmir_dlp_load_guard.sh

@@ -0,0 +1,260 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ENABLED="${AW_DLP_GUARD_ENABLED:-true}"
+PROFILE="${AW_DLP_PROFILE:-light}"
+STATE_DIR="${AW_DLP_GUARD_STATE_DIR:-/var/lib/activitywatch/health}"
+STATE_FILE="${AW_DLP_GUARD_STATE_FILE:-${STATE_DIR}/dlp-light-guard-state.json}"
+STATE_HISTORY_DIR="${AW_DLP_GUARD_HISTORY_DIR:-${STATE_DIR}/dlp-light-guard-history}"
+CONTROL_BIN="${AW_DLP_CONTROL_BIN:-/usr/local/bin/detmir-dlp-runtime-control}"
+LOAD_RATIO="${AW_DLP_GUARD_LOAD_RATIO:-1.50}"
+MEM_AVAILABLE_PCT_MIN="${AW_DLP_GUARD_MEM_AVAILABLE_PCT_MIN:-15}"
+IOWAIT_PCT_MAX="${AW_DLP_GUARD_IOWAIT_PCT_MAX:-20}"
+STRIKES_REQUIRED="${AW_DLP_GUARD_STRIKES_REQUIRED:-3}"
+
+DLP_GUARDED_UNITS=(
+  aw-dlp-influx-exporter.timer
+  aw-dlp-influx-exporter.service
+  activitywatch-dlp-aggregator.timer
+  activitywatch-dlp-aggregator.service
+  aw-dlp-report-scheduler.timer
+  aw-dlp-report-scheduler.service
+  aw-dlp-syslog-forwarder.timer
+  aw-dlp-syslog-forwarder.service
+  aw-dlp-webhook-sender.timer
+  aw-dlp-webhook-sender.service
+  aw-dlp-cef-exporter.timer
+  aw-dlp-cef-exporter.service
+  aw-dlp-ioc-refresh.timer
+  aw-dlp-ioc-refresh.service
+  aw-dlp-policy-engine.service
+  aw-dlp-case-management.service
+  detmir-portal-evidence.service
+)
+
+json_string() {
+  python3 -c 'import json,sys; print(json.dumps(sys.argv[1], ensure_ascii=False))' "$1"
+}
+
+number_or_null() {
+  local value="${1:-}"
+  if [[ "$value" =~ ^-?[0-9]+([.][0-9]+)?$ ]]; then
+    printf '%s' "$value"
+  else
+    printf 'null'
+  fi
+}
+
+active_dlp_units_json() {
+  local first=1 unit
+  printf '['
+  if command -v systemctl >/dev/null 2>&1; then
+    for unit in "${DLP_GUARDED_UNITS[@]}"; do
+      if systemctl is-active --quiet "$unit" 2>/dev/null; then
+        [[ "$first" -eq 1 ]] || printf ','
+        first=0
+        json_string "$unit"
+      fi
+    done
+  fi
+  printf ']'
+}
+
+active_dlp_unit_count() {
+  local count=0 unit
+  if command -v systemctl >/dev/null 2>&1; then
+    for unit in "${DLP_GUARDED_UNITS[@]}"; do
+      if systemctl is-active --quiet "$unit" 2>/dev/null; then
+        count=$((count + 1))
+      fi
+    done
+  fi
+  printf '%s\n' "$count"
+}
+
+read_load1() {
+  awk '{print $1}' /proc/loadavg 2>/dev/null || printf '0'
+}
+
+read_cpu_count() {
+  local cores
+  cores="$(getconf _NPROCESSORS_ONLN 2>/dev/null || printf '1')"
+  if [[ ! "$cores" =~ ^[0-9]+$ || "$cores" -lt 1 ]]; then
+    cores=1
+  fi
+  printf '%s\n' "$cores"
+}
+
+read_mem_available_pct() {
+  awk '
+    /^MemTotal:/ { total=$2 }
+    /^MemAvailable:/ { available=$2 }
+    END {
+      if (total > 0) {
+        printf "%.2f", (available * 100.0 / total)
+      } else {
+        printf "0"
+      }
+    }
+  ' /proc/meminfo 2>/dev/null || printf '0'
+}
+
+read_cpu_sample() {
+  awk '/^cpu / {
+    idle=$5
+    iowait=$6
+    total=0
+    for (i=2; i<=NF; i++) total += $i
+    printf "%s %s\n", total, iowait
+    exit
+  }' /proc/stat 2>/dev/null || printf '0 0'
+}
+
+read_iowait_pct() {
+  local total1 wait1 total2 wait2 dtotal dwait
+  read -r total1 wait1 < <(read_cpu_sample)
+  sleep 1
+  read -r total2 wait2 < <(read_cpu_sample)
+  dtotal=$((total2 - total1))
+  dwait=$((wait2 - wait1))
+  if [[ "$dtotal" -le 0 || "$dwait" -lt 0 ]]; then
+    printf '0'
+    return
+  fi
+  awk -v wait="$dwait" -v total="$dtotal" 'BEGIN { printf "%.2f", wait * 100.0 / total }'
+}
+
+is_over_threshold() {
+  local value="$1"
+  local threshold="$2"
+  awk -v value="$value" -v threshold="$threshold" 'BEGIN { exit !(value > threshold) }'
+}
+
+is_under_threshold() {
+  local value="$1"
+  local threshold="$2"
+  awk -v value="$value" -v threshold="$threshold" 'BEGIN { exit !(value < threshold) }'
+}
+
+write_state() {
+  local action="$1"
+  local reason="$2"
+  local load1="$3"
+  local cores="$4"
+  local load_threshold="$5"
+  local mem_pct="$6"
+  local iowait_pct="$7"
+  local active_count="$8"
+  local active_units_json="$9"
+  local control_exit="${10}"
+  local strikes="${11:-0}"
+  local now stamp tmp history
+
+  now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  stamp="$(date -u +%Y%m%dT%H%M%SZ)"
+  mkdir -p "$STATE_DIR" "$STATE_HISTORY_DIR"
+  tmp="$(mktemp "${STATE_FILE}.tmp.XXXXXX")"
+  {
+    printf '{'
+    printf '"generated_at_utc":%s,' "$(json_string "$now")"
+    printf '"profile":%s,' "$(json_string "$PROFILE")"
+    printf '"guard_enabled":%s,' "$(json_string "$ENABLED")"
+    printf '"action":%s,' "$(json_string "$action")"
+    printf '"reason":%s,' "$(json_string "$reason")"
+    printf '"consecutive_overload_count":%s,' "$(number_or_null "$strikes")"
+    printf '"consecutive_overload_required":%s,' "$(number_or_null "$STRIKES_REQUIRED")"
+    printf '"control_bin":%s,' "$(json_string "$CONTROL_BIN")"
+    printf '"control_exit":%s,' "$(number_or_null "$control_exit")"
+    printf '"metrics":{'
+    printf '"load1":%s,' "$(number_or_null "$load1")"
+    printf '"cpu_count":%s,' "$(number_or_null "$cores")"
+    printf '"load_threshold":%s,' "$(number_or_null "$load_threshold")"
+    printf '"mem_available_pct":%s,' "$(number_or_null "$mem_pct")"
+    printf '"mem_available_pct_min":%s,' "$(number_or_null "$MEM_AVAILABLE_PCT_MIN")"
+    printf '"iowait_pct":%s,' "$(number_or_null "$iowait_pct")"
+    printf '"iowait_pct_max":%s' "$(number_or_null "$IOWAIT_PCT_MAX")"
+    printf '},'
+    printf '"active_dlp_unit_count":%s,' "$(number_or_null "$active_count")"
+    printf '"active_dlp_units":%s' "$active_units_json"
+    printf '}\n'
+  } >"$tmp"
+  mv "$tmp" "$STATE_FILE"
+  history="${STATE_HISTORY_DIR}/dlp-light-guard-${stamp}.json"
+  cp -a "$STATE_FILE" "$history"
+  printf 'dlp guard action=%s reason=%s state=%s history=%s\n' "$action" "$reason" "$STATE_FILE" "$history"
+}
+
+main() {
+  local load1 cores load_threshold mem_pct iowait_pct active_count active_units_json overloaded reason control_exit strikes prev_strikes
+
+  load1="$(read_load1)"
+  cores="$(read_cpu_count)"
+  load_threshold="$(awk -v cores="$cores" -v ratio="$LOAD_RATIO" 'BEGIN { printf "%.2f", cores * ratio }')"
+  mem_pct="$(read_mem_available_pct)"
+  iowait_pct="$(read_iowait_pct)"
+  active_units_json="$(active_dlp_units_json)"
+  active_count="$(active_dlp_unit_count)"
+  overloaded=0
+  reason="within_thresholds"
+  prev_strikes="$(
+    python3 - "$STATE_FILE" <<'PY' 2>/dev/null || true
+import json, sys
+try:
+    print(int(json.load(open(sys.argv[1])).get("consecutive_overload_count", 0)))
+except Exception:
+    print(0)
+PY
+  )"
+  [[ "$prev_strikes" =~ ^[0-9]+$ ]] || prev_strikes=0
+  strikes=0
+
+  if is_over_threshold "$load1" "$load_threshold"; then
+    overloaded=1
+    reason="load1_above_threshold"
+  elif is_under_threshold "$mem_pct" "$MEM_AVAILABLE_PCT_MIN"; then
+    overloaded=1
+    reason="mem_available_below_threshold"
+  elif is_over_threshold "$iowait_pct" "$IOWAIT_PCT_MAX"; then
+    overloaded=1
+    reason="iowait_above_threshold"
+  fi
+
+  if [[ "$ENABLED" != "true" && "$ENABLED" != "1" && "$ENABLED" != "yes" ]]; then
+    write_state "skipped" "guard_disabled" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "0" "0"
+    return 0
+  fi
+
+  if [[ "$overloaded" -eq 0 ]]; then
+    write_state "none" "$reason" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "0" "0"
+    return 0
+  fi
+
+  strikes=$((prev_strikes + 1))
+
+  if [[ "$strikes" -lt "$STRIKES_REQUIRED" ]]; then
+    write_state "observe_overload" "$reason" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "0" "$strikes"
+    return 0
+  fi
+
+  if [[ "$active_count" -eq 0 ]]; then
+    write_state "none" "${reason}_but_no_active_dlp_units" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "0" "$strikes"
+    return 0
+  fi
+
+  if [[ ! -x "$CONTROL_BIN" ]]; then
+    write_state "failed" "${reason}_control_bin_missing" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "127" "$strikes"
+    printf 'DLP guard cannot disable overloaded DLP: executable not found: %s\n' "$CONTROL_BIN" >&2
+    return 127
+  fi
+
+  control_exit=0
+  AW_DLP_DISABLED_REASON="auto_disabled_by_dlp_load_guard:${reason}" "$CONTROL_BIN" set-profile core_only || control_exit=$?
+  if [[ "$control_exit" -eq 0 ]]; then
+    write_state "auto_disabled" "$reason" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "$control_exit" "$strikes"
+  else
+    write_state "failed" "${reason}_control_exit_${control_exit}" "$load1" "$cores" "$load_threshold" "$mem_pct" "$iowait_pct" "$active_count" "$active_units_json" "$control_exit" "$strikes"
+  fi
+  return "$control_exit"
+}
+
+main "$@"

scripts/detmir_dlp_runtime_control.sh

@@ -0,0 +1,269 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ACTION="${1:-status}"
+PROFILE="${2:-${AW_DLP_PROFILE:-core_only}}"
+AW_BASE="${AW_DLP_CONTROL_AW_BASE:-http://127.0.0.1:5600}"
+HOSTNAME_FILTER="${AW_DLP_CONTROL_HOSTNAME:-${AW_LOGICAL_HOST_ID:-${AW_MONITORED_WINDOWS_HOSTNAME:-HOST-EXAMPLE}}}"
+STATE_DIR="${AW_DLP_CONTROL_STATE_DIR:-/var/lib/activitywatch/health}"
+STATE_FILE="${AW_DLP_CONTROL_STATE_FILE:-${STATE_DIR}/dlp-runtime-state.json}"
+STATE_HISTORY_DIR="${AW_DLP_CONTROL_HISTORY_DIR:-${STATE_DIR}/dlp-runtime-history}"
+ROLLBACK_FILE="${AW_DLP_CONTROL_ROLLBACK_FILE:-${STATE_DIR}/dlp-runtime-rollback.state}"
+REASON="${AW_DLP_DISABLED_REASON:-dlp_runtime_profile_control}"
+
+DLP_UNITS=(
+  aw-dlp-influx-exporter.timer
+  aw-dlp-influx-exporter.service
+  activitywatch-dlp-aggregator.timer
+  activitywatch-dlp-aggregator.service
+  aw-dlp-report-scheduler.timer
+  aw-dlp-report-scheduler.service
+  aw-dlp-syslog-forwarder.timer
+  aw-dlp-syslog-forwarder.service
+  aw-dlp-webhook-sender.timer
+  aw-dlp-webhook-sender.service
+  aw-dlp-cef-exporter.timer
+  aw-dlp-cef-exporter.service
+  aw-dlp-ioc-refresh.timer
+  aw-dlp-ioc-refresh.service
+  aw-dlp-policy-engine.service
+  aw-dlp-case-management.service
+  detmir-portal-evidence.service
+)
+
+DLP_BUCKET_PREFIXES=(
+  aw-dlp-endpoint-signals
+  aw-dlp-incidents
+  aw-dlp-review
+  aw-dlp-rules
+)
+
+DLP_LIGHT_UNITS=(
+  activitywatch-dlp-aggregator.timer
+  aw-dlp-ioc-refresh.timer
+)
+
+DLP_ON_DEMAND_UNITS=(
+  aw-dlp-ioc-refresh.timer
+  aw-dlp-policy-engine.service
+  aw-dlp-case-management.service
+  detmir-portal-evidence.service
+)
+
+json_escape() {
+  local value="$1"
+  python3 -c 'import json,sys; print(json.dumps(sys.argv[1], ensure_ascii=False))' "$value"
+}
+
+unit_json() {
+  local first=1 unit active enabled load
+  printf '['
+  for unit in "${DLP_UNITS[@]}"; do
+    load="$(systemctl show -p LoadState --value "$unit" 2>/dev/null || true)"
+    if [[ "$load" == "not-found" || -z "$load" ]]; then
+      active="not-found"
+      enabled="not-found"
+    else
+      active="$(systemctl is-active "$unit" 2>/dev/null || true)"
+      enabled="$(systemctl is-enabled "$unit" 2>/dev/null || true)"
+    fi
+    [[ "$first" -eq 1 ]] || printf ','
+    first=0
+    printf '{"unit":%s,"load":%s,"active":%s,"enabled":%s}' \
+      "$(json_escape "$unit")" \
+      "$(json_escape "${load:-not-found}")" \
+      "$(json_escape "${active:-unknown}")" \
+      "$(json_escape "${enabled:-unknown}")"
+  done
+  printf ']'
+}
+
+bucket_json() {
+  local first=1 prefix bucket url payload ts count
+  printf '['
+  for prefix in "${DLP_BUCKET_PREFIXES[@]}"; do
+    bucket="${prefix}_${HOSTNAME_FILTER}"
+    url="${AW_BASE%/}/api/0/buckets/${bucket}/events?limit=1"
+    payload="$(curl -sS --connect-timeout 3 --max-time 8 "$url" 2>/dev/null || true)"
+    ts="$(printf '%s' "$payload" | jq -r '.[0].timestamp // ""' 2>/dev/null || true)"
+    count="$(printf '%s' "$payload" | jq -r 'if type == "array" then length else 0 end' 2>/dev/null || printf '0')"
+    [[ "$first" -eq 1 ]] || printf ','
+    first=0
+    printf '{"bucket":%s,"sample_count":%s,"latest_timestamp":%s}' \
+      "$(json_escape "$bucket")" \
+      "${count:-0}" \
+      "$(json_escape "$ts")"
+  done
+  printf ']'
+}
+
+unit_exists() {
+  local unit="$1"
+  systemctl list-unit-files "$unit" --no-legend 2>/dev/null | grep -q . || systemctl status "$unit" >/dev/null 2>&1
+}
+
+stop_disable_all_dlp() {
+  local unit
+  for unit in "${DLP_UNITS[@]}"; do
+    if unit_exists "$unit"; then
+      systemctl stop "$unit" >/dev/null 2>&1 || true
+      systemctl disable "$unit" >/dev/null 2>&1 || true
+      systemctl reset-failed "$unit" >/dev/null 2>&1 || true
+    fi
+  done
+}
+
+enable_start_units() {
+  local unit
+  for unit in "$@"; do
+    if unit_exists "$unit"; then
+      systemctl enable --now "$unit" >/dev/null 2>&1 || true
+    fi
+  done
+}
+
+capture_rollback_state() {
+  local tmp unit load active enabled
+  mkdir -p "$STATE_DIR"
+  tmp="$(mktemp "${ROLLBACK_FILE}.tmp.XXXXXX")"
+  {
+    printf '# generated_at_utc=%s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    printf '# reason=pre_profile_change\n'
+    for unit in "${DLP_UNITS[@]}"; do
+      load="$(systemctl show -p LoadState --value "$unit" 2>/dev/null || true)"
+      if [[ "$load" == "not-found" || -z "$load" ]]; then
+        active="not-found"
+        enabled="not-found"
+      else
+        active="$(systemctl is-active "$unit" 2>/dev/null || true)"
+        enabled="$(systemctl is-enabled "$unit" 2>/dev/null || true)"
+      fi
+      printf '%s|%s|%s|%s\n' "$unit" "${load:-not-found}" "$active" "$enabled"
+    done
+  } >"$tmp"
+  mv "$tmp" "$ROLLBACK_FILE"
+}
+
+write_stats() {
+  local mode="${1:-current}" now stamp tmp history_file
+  now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  stamp="$(date -u +%Y%m%dT%H%M%SZ)"
+  mkdir -p "$STATE_DIR" "$STATE_HISTORY_DIR"
+  tmp="$(mktemp "${STATE_FILE}.tmp.XXXXXX")"
+  {
+    printf '{'
+    printf '"generated_at_utc":%s,' "$(json_escape "$now")"
+    printf '"mode":%s,' "$(json_escape "$mode")"
+    printf '"profile":%s,' "$(json_escape "${AW_DLP_PROFILE:-$PROFILE}")"
+    printf '"reason":%s,' "$(json_escape "$REASON")"
+    printf '"aw_base":%s,' "$(json_escape "$AW_BASE")"
+    printf '"hostname":%s,' "$(json_escape "$HOSTNAME_FILTER")"
+    printf '"units":'
+    unit_json
+    printf ',"buckets":'
+    bucket_json
+    printf '}\n'
+  } >"$tmp"
+  mv "$tmp" "$STATE_FILE"
+  history_file="${STATE_HISTORY_DIR}/dlp-runtime-${mode}-${stamp}.json"
+  cp -a "$STATE_FILE" "$history_file"
+  printf 'latest=%s\nhistory=%s\n' "$STATE_FILE" "$history_file"
+}
+
+apply_profile() {
+  local target_profile="$1"
+  capture_rollback_state
+  case "$target_profile" in
+    core_only|disabled|off)
+      PROFILE="core_only"
+      stop_disable_all_dlp
+      AW_DLP_PROFILE="core_only" write_stats "disabled"
+      ;;
+    light)
+      PROFILE="light"
+      stop_disable_all_dlp
+      enable_start_units "${DLP_LIGHT_UNITS[@]}"
+      AW_DLP_PROFILE="light" write_stats "enabled_light"
+      ;;
+    on_demand)
+      PROFILE="on_demand"
+      stop_disable_all_dlp
+      enable_start_units "${DLP_ON_DEMAND_UNITS[@]}"
+      AW_DLP_PROFILE="on_demand" write_stats "enabled_on_demand"
+      ;;
+    full|enabled|on)
+      PROFILE="full"
+      stop_disable_all_dlp
+      enable_start_units "${DLP_LIGHT_UNITS[@]}"
+      enable_start_units \
+        aw-dlp-influx-exporter.timer \
+        activitywatch-dlp-aggregator.timer \
+        aw-dlp-report-scheduler.timer \
+        aw-dlp-syslog-forwarder.timer \
+        aw-dlp-webhook-sender.timer \
+        aw-dlp-cef-exporter.timer \
+        aw-dlp-policy-engine.service \
+        aw-dlp-case-management.service \
+        detmir-portal-evidence.service
+      AW_DLP_PROFILE="full" write_stats "enabled_full"
+      ;;
+    *)
+      printf 'unsupported DLP profile: %s\n' "$target_profile" >&2
+      printf 'supported profiles: core_only, light, on_demand, full\n' >&2
+      exit 2
+      ;;
+  esac
+}
+
+disable_dlp() {
+  apply_profile "core_only"
+}
+
+enable_dlp() {
+  apply_profile "full"
+}
+
+rollback_dlp() {
+  local unit load active enabled
+  if [[ ! -s "$ROLLBACK_FILE" ]]; then
+    printf 'rollback state not found: %s\n' "$ROLLBACK_FILE" >&2
+    exit 1
+  fi
+  stop_disable_all_dlp
+  while IFS='|' read -r unit load active enabled; do
+    [[ -n "${unit:-}" && "${unit:0:1}" != "#" ]] || continue
+    [[ "$load" != "not-found" ]] || continue
+    if [[ "$enabled" == "enabled" ]]; then
+      systemctl enable "$unit" >/dev/null 2>&1 || true
+    fi
+    if [[ "$active" == "active" ]]; then
+      systemctl start "$unit" >/dev/null 2>&1 || true
+    fi
+  done <"$ROLLBACK_FILE"
+  write_stats "rollback"
+}
+
+case "$ACTION" in
+  status|stats)
+    write_stats "current"
+    ;;
+  profile)
+    printf '%s\n' "${AW_DLP_PROFILE:-$PROFILE}"
+    ;;
+  set-profile)
+    apply_profile "$PROFILE"
+    ;;
+  disable)
+    disable_dlp
+    ;;
+  enable)
+    enable_dlp
+    ;;
+  rollback)
+    rollback_dlp
+    ;;
+  *)
+    printf 'Usage: %s [status|stats|profile|set-profile <core_only|light|on_demand|full>|disable|enable|rollback]\n' "$0" >&2
+    exit 2
+    ;;
+esac

scripts/detmir_dlp_warehouse_sync.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SOURCE_HOST="${AW_DLP_WAREHOUSE_SOURCE_HOST:-igor@10.10.10.13}"
+SOURCE_PATH="${AW_DLP_WAREHOUSE_SOURCE_PATH:-/var/lib/activitywatch/dlp_warehouse.sqlite}"
+DEST_PATH="${AW_DLP_WAREHOUSE_DEST_PATH:-/var/lib/activitywatch/dlp_warehouse.sqlite}"
+STATE_DIR="${AW_DLP_WAREHOUSE_SYNC_STATE_DIR:-/var/lib/activitywatch/health}"
+STATE_FILE="${AW_DLP_WAREHOUSE_SYNC_STATE_FILE:-${STATE_DIR}/dlp-warehouse-sync-state.json}"
+SSH_OPTS="${AW_DLP_WAREHOUSE_SSH_OPTS:--o BatchMode=yes -o ConnectTimeout=5}"
+REMOTE_TMP="/tmp/dlp_warehouse_sync_$$.sqlite"
+LOCAL_TMP=""
+
+json_string() {
+  python3 -c 'import json,sys; print(json.dumps(sys.argv[1], ensure_ascii=False))' "$1"
+}
+
+write_state() {
+  local status="$1"
+  local message="$2"
+  local rows="${3:-}"
+  local bytes="${4:-}"
+  local now tmp
+  now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  mkdir -p "$STATE_DIR"
+  tmp="$(mktemp "${STATE_FILE}.tmp.XXXXXX")"
+  {
+    printf '{'
+    printf '"generated_at_utc":%s,' "$(json_string "$now")"
+    printf '"status":%s,' "$(json_string "$status")"
+    printf '"message":%s,' "$(json_string "$message")"
+    printf '"source_host":%s,' "$(json_string "$SOURCE_HOST")"
+    printf '"source_path":%s,' "$(json_string "$SOURCE_PATH")"
+    printf '"dest_path":%s,' "$(json_string "$DEST_PATH")"
+    if [[ "$rows" =~ ^[0-9]+$ ]]; then
+      printf '"dlp_events":%s,' "$rows"
+    else
+      printf '"dlp_events":null,'
+    fi
+    if [[ "$bytes" =~ ^[0-9]+$ ]]; then
+      printf '"bytes":%s' "$bytes"
+    else
+      printf '"bytes":null'
+    fi
+    printf '}\n'
+  } >"$tmp"
+  mv "$tmp" "$STATE_FILE"
+}
+
+cleanup_remote() {
+  ssh $SSH_OPTS "$SOURCE_HOST" "rm -f '$REMOTE_TMP'" >/dev/null 2>&1 || true
+}
+
+main() {
+  local dest_dir rows bytes
+  dest_dir="$(dirname "$DEST_PATH")"
+  mkdir -p "$dest_dir" "$STATE_DIR"
+  LOCAL_TMP="$(mktemp "${DEST_PATH}.tmp.XXXXXX")"
+  trap 'rm -f "${LOCAL_TMP:-}"; cleanup_remote' EXIT
+
+  ssh $SSH_OPTS "$SOURCE_HOST" \
+    "set -euo pipefail; if command -v sqlite3 >/dev/null 2>&1; then sqlite3 '$SOURCE_PATH' \".backup '$REMOTE_TMP'\" || cp -f '$SOURCE_PATH' '$REMOTE_TMP'; else cp -f '$SOURCE_PATH' '$REMOTE_TMP'; fi; test -s '$REMOTE_TMP'"
+  scp $SSH_OPTS "$SOURCE_HOST:$REMOTE_TMP" "$LOCAL_TMP"
+  chmod 0644 "$LOCAL_TMP"
+  mv "$LOCAL_TMP" "$DEST_PATH"
+
+  bytes="$(stat -c %s "$DEST_PATH" 2>/dev/null || printf '')"
+  rows="$(sqlite3 "$DEST_PATH" 'select count(*) from dlp_events;' 2>/dev/null || printf '')"
+  write_state "ok" "synced" "$rows" "$bytes"
+  printf 'dlp warehouse synced: source=%s:%s dest=%s rows=%s bytes=%s\n' \
+    "$SOURCE_HOST" "$SOURCE_PATH" "$DEST_PATH" "${rows:-unknown}" "${bytes:-unknown}"
+}
+
+main "$@"

scripts/diag_and_manual_restart.sh

@@ -53,6 +53,26 @@ done
 log() { printf "%s %s\n" "$(date +"%F %T")" "$*" >&2; }
 die() { log "ERROR: $*"; exit 1; }
 
+is_truthy() {
+  case "${1:-}" in
+    1|true|TRUE|yes|YES|on|ON) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+require_real_value() {
+  local name="$1"
+  local value="${!name:-}"
+  if [[ -z "$value" ]]; then
+    die "missing required variable: $name"
+  fi
+  case "$value" in
+    *192.0.2.*|*198.51.100.*|*203.0.113.*|*HOST-EXAMPLE*|*.example*)
+      die "refusing placeholder value for $name: $value"
+      ;;
+  esac
+}
+
 command -v ansible >/dev/null 2>&1 || die "ansible not found"
 command -v ansible-playbook >/dev/null 2>&1 || die "ansible-playbook not found"
 [[ -f "$INVENTORY" ]] || die "inventory not found: $INVENTORY"
@@ -68,10 +88,14 @@ restart_server_components() {
     "activitywatch-server"
     "aw-worktime-api"
     "aw-worktime-ui-bridge.timer"
-    "aw-dlp-policy-engine.service"
-    "aw-dlp-aggregator.timer"
-    "activitywatch-dlp-aggregator.timer"
   )
+  if is_truthy "${DETMIR_DLP_ENABLED:-${AW_DLP_ENABLED:-false}}"; then
+    units+=(
+      "aw-dlp-policy-engine.service"
+      "aw-dlp-aggregator.timer"
+      "activitywatch-dlp-aggregator.timer"
+    )
+  fi
   for unit in "${units[@]}"; do
     if ansible -i "$INVENTORY" aw_server -b -m ansible.builtin.command -a "systemctl status ${unit}" >/dev/null 2>&1; then
       ansible -i "$INVENTORY" aw_server -b -m ansible.builtin.systemd -a "name=${unit} state=restarted enabled=true" || true
@@ -80,24 +104,32 @@ restart_server_components() {
 }
 
 seed_server_dlp_events() {
+  if ! is_truthy "${ALLOW_DLP_SEED_EVENTS:-0}"; then
+    log "Skipping DLP freshness seeding; set ALLOW_DLP_SEED_EVENTS=1 with real DETMIR_HOSTNAME/DETMIR_AW_SERVER_HOST to allow it."
+    return 0
+  fi
+  require_real_value DETMIR_HOSTNAME
+  require_real_value DETMIR_AW_SERVER_HOST
   log "Seeding DLP freshness events on aw_server..."
-  local ts
+  local ts host server_host
   ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+  host="${DETMIR_HOSTNAME}"
+  server_host="${DETMIR_AW_SERVER_HOST}"
   ansible -i "$INVENTORY" aw_server -b -m ansible.builtin.shell -a "cat >/tmp/aw-endpoint-seed.json <<'JSON'
-{\"timestamp\":\"${ts}\",\"duration\":0.0,\"data\":{\"hostname\":\"HOST-EXAMPLE\",\"signalType\":\"self_test\",\"source\":\"diag_and_manual_restart\",\"username\":\"system\",\"queueDepth\":0,\"eventsEnqueued\":0,\"eventsFlushed\":0,\"sendFailures\":0}}
+{\"timestamp\":\"${ts}\",\"duration\":0.0,\"data\":{\"hostname\":\"${host}\",\"signalType\":\"self_test\",\"source\":\"diag_and_manual_restart\",\"username\":\"system\",\"queueDepth\":0,\"eventsEnqueued\":0,\"eventsFlushed\":0,\"sendFailures\":0}}
 JSON
 cat >/tmp/aw-fileops-seed-host.json <<'JSON'
-{\"timestamp\":\"${ts}\",\"duration\":0.0,\"data\":{\"hostname\":\"HOST-EXAMPLE\",\"operation\":\"self_test\",\"source\":\"diag_and_manual_restart\"}}
+{\"timestamp\":\"${ts}\",\"duration\":0.0,\"data\":{\"hostname\":\"${host}\",\"operation\":\"self_test\",\"source\":\"diag_and_manual_restart\"}}
 JSON
 cat >/tmp/aw-fileops-seed-server.json <<'JSON'
-{\"timestamp\":\"${ts}\",\"duration\":0.0,\"data\":{\"hostname\":\"192.0.2.13\",\"operation\":\"self_test\",\"source\":\"diag_and_manual_restart\"}}
+{\"timestamp\":\"${ts}\",\"duration\":0.0,\"data\":{\"hostname\":\"${server_host}\",\"operation\":\"self_test\",\"source\":\"diag_and_manual_restart\"}}
 JSON
-curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-dlp-endpoint-signals_HOST-EXAMPLE' -H 'Content-Type: application/json' -d '{\"client\":\"aw-dlp-endpoint-signals\",\"type\":\"aw.dlp.endpoint.signal\",\"hostname\":\"HOST-EXAMPLE\"}' >/dev/null 2>&1 || true
-curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_HOST-EXAMPLE' -H 'Content-Type: application/json' -d '{\"client\":\"aw-file-operations\",\"type\":\"aw.file.operation\",\"hostname\":\"HOST-EXAMPLE\"}' >/dev/null 2>&1 || true
-curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_192.0.2.13' -H 'Content-Type: application/json' -d '{\"client\":\"aw-file-operations\",\"type\":\"aw.file.operation\",\"hostname\":\"192.0.2.13\"}' >/dev/null 2>&1 || true
-curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-dlp-endpoint-signals_HOST-EXAMPLE/heartbeat?pulsetime=30' -H 'Content-Type: application/json' --data-binary @/tmp/aw-endpoint-seed.json >/dev/null
-curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_HOST-EXAMPLE/heartbeat?pulsetime=30' -H 'Content-Type: application/json' --data-binary @/tmp/aw-fileops-seed-host.json >/dev/null
-curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_192.0.2.13/heartbeat?pulsetime=30' -H 'Content-Type: application/json' --data-binary @/tmp/aw-fileops-seed-server.json >/dev/null
+curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-dlp-endpoint-signals_${host}' -H 'Content-Type: application/json' -d '{\"client\":\"aw-dlp-endpoint-signals\",\"type\":\"aw.dlp.endpoint.signal\",\"hostname\":\"${host}\"}' >/dev/null 2>&1 || true
+curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_${host}' -H 'Content-Type: application/json' -d '{\"client\":\"aw-file-operations\",\"type\":\"aw.file.operation\",\"hostname\":\"${host}\"}' >/dev/null 2>&1 || true
+curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_${server_host}' -H 'Content-Type: application/json' -d '{\"client\":\"aw-file-operations\",\"type\":\"aw.file.operation\",\"hostname\":\"${server_host}\"}' >/dev/null 2>&1 || true
+curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-dlp-endpoint-signals_${host}/heartbeat?pulsetime=30' -H 'Content-Type: application/json' --data-binary @/tmp/aw-endpoint-seed.json >/dev/null
+curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_${host}/heartbeat?pulsetime=30' -H 'Content-Type: application/json' --data-binary @/tmp/aw-fileops-seed-host.json >/dev/null
+curl -sS -X POST 'http://127.0.0.1:5600/api/0/buckets/aw-file-operations_${server_host}/heartbeat?pulsetime=30' -H 'Content-Type: application/json' --data-binary @/tmp/aw-fileops-seed-server.json >/dev/null
 " >/dev/null
 }
 
@@ -107,8 +139,14 @@ restart_windows_collectors() {
 }
 
 seed_windows_dlp_events() {
+  if ! is_truthy "${ALLOW_DLP_SEED_EVENTS:-0}"; then
+    log "Skipping Windows DLP freshness seeding; set ALLOW_DLP_SEED_EVENTS=1 with real DETMIR_HOSTNAME/DETMIR_AW_API to allow it."
+    return 0
+  fi
+  require_real_value DETMIR_HOSTNAME
+  require_real_value DETMIR_AW_API
   log "Seeding endpoint/file-ops events from aw_windows..."
-  ansible -i "$INVENTORY" aw_windows -m ansible.windows.win_shell -a "powershell -NoProfile -ExecutionPolicy Bypass -Command \"\$ErrorActionPreference = 'Stop'; \$ts = (Get-Date).ToUniversalTime().ToString('o'); \$api='http://192.0.2.13:5600/api/0'; \$endpoint=@{timestamp=\$ts;duration=0.0;data=@{hostname='HOST-EXAMPLE';signalType='self_test';source='diag_and_manual_restart';username=\$env:USERNAME;queueDepth=0;eventsEnqueued=0;eventsFlushed=0;sendFailures=0}} | ConvertTo-Json -Depth 8 -Compress; \$fileops=@{timestamp=\$ts;duration=0.0;data=@{hostname='HOST-EXAMPLE';operation='self_test';source='diag_and_manual_restart';username=\$env:USERNAME}} | ConvertTo-Json -Depth 8 -Compress; Invoke-RestMethod -Method Post -Uri \$api'/buckets/aw-dlp-endpoint-signals_HOST-EXAMPLE' -ContentType 'application/json' -Body '{\\\"client\\\":\\\"aw-dlp-endpoint-signals\\\",\\\"type\\\":\\\"aw.dlp.endpoint.signal\\\",\\\"hostname\\\":\\\"HOST-EXAMPLE\\\"}' -TimeoutSec 15 -DisableKeepAlive -ErrorAction SilentlyContinue | Out-Null; Invoke-RestMethod -Method Post -Uri \$api'/buckets/aw-file-operations_HOST-EXAMPLE' -ContentType 'application/json' -Body '{\\\"client\\\":\\\"aw-file-operations\\\",\\\"type\\\":\\\"aw.file.operation\\\",\\\"hostname\\\":\\\"HOST-EXAMPLE\\\"}' -TimeoutSec 15 -DisableKeepAlive -ErrorAction SilentlyContinue | Out-Null; Invoke-RestMethod -Method Post -Uri \$api'/buckets/aw-dlp-endpoint-signals_HOST-EXAMPLE/heartbeat?pulsetime=30' -ContentType 'application/json' -Body \$endpoint -TimeoutSec 15 -DisableKeepAlive | Out-Null; Invoke-RestMethod -Method Post -Uri \$api'/buckets/aw-file-operations_HOST-EXAMPLE/heartbeat?pulsetime=30' -ContentType 'application/json' -Body \$fileops -TimeoutSec 15 -DisableKeepAlive | Out-Null; Write-Output 'windows-dlp-seeded'\""
+  ansible -i "$INVENTORY" aw_windows -m ansible.windows.win_shell -a "powershell -NoProfile -ExecutionPolicy Bypass -Command \"\$ErrorActionPreference = 'Stop'; \$ts = (Get-Date).ToUniversalTime().ToString('o'); \$api='${DETMIR_AW_API}'; \$hostName='${DETMIR_HOSTNAME}'; \$endpointBucket=\$api + '/buckets/aw-dlp-endpoint-signals_' + \$hostName; \$fileopsBucket=\$api + '/buckets/aw-file-operations_' + \$hostName; \$endpoint=@{timestamp=\$ts;duration=0.0;data=@{hostname=\$hostName;signalType='self_test';source='diag_and_manual_restart';username=\$env:USERNAME;queueDepth=0;eventsEnqueued=0;eventsFlushed=0;sendFailures=0}} | ConvertTo-Json -Depth 8 -Compress; \$fileops=@{timestamp=\$ts;duration=0.0;data=@{hostname=\$hostName;operation='self_test';source='diag_and_manual_restart';username=\$env:USERNAME}} | ConvertTo-Json -Depth 8 -Compress; Invoke-RestMethod -Method Post -Uri \$endpointBucket -ContentType 'application/json' -Body (@{client='aw-dlp-endpoint-signals';type='aw.dlp.endpoint.signal';hostname=\$hostName} | ConvertTo-Json -Compress) -TimeoutSec 15 -DisableKeepAlive -ErrorAction SilentlyContinue | Out-Null; Invoke-RestMethod -Method Post -Uri \$fileopsBucket -ContentType 'application/json' -Body (@{client='aw-file-operations';type='aw.file.operation';hostname=\$hostName} | ConvertTo-Json -Compress) -TimeoutSec 15 -DisableKeepAlive -ErrorAction SilentlyContinue | Out-Null; Invoke-RestMethod -Method Post -Uri (\$endpointBucket + '/heartbeat?pulsetime=30') -ContentType 'application/json' -Body \$endpoint -TimeoutSec 15 -DisableKeepAlive | Out-Null; Invoke-RestMethod -Method Post -Uri (\$fileopsBucket + '/heartbeat?pulsetime=30') -ContentType 'application/json' -Body \$fileops -TimeoutSec 15 -DisableKeepAlive | Out-Null; Write-Output 'windows-dlp-seeded'\""
 }
 
 confirm_restart() {

scripts/rdp-worktime-report.sh

@@ -4,14 +4,29 @@ set -euo pipefail
 DAY=""
 FROM=""
 TO=""
-AW_BASE_URL="${AW_BASE_URL:-http://192.0.2.13:5600/api/0}"
-AW_WORKTIME_HOST="${AW_WORKTIME_HOST:-HOST-EXAMPLE}"
+AW_BASE_URL="${AW_BASE_URL:-}"
+AW_WORKTIME_HOST="${AW_WORKTIME_HOST:-}"
 AW_WORKTIME_DEFAULT_SAMPLE_SECONDS="${AW_WORKTIME_DEFAULT_SAMPLE_SECONDS:-30}"
 AW_WORKTIME_MAX_SAMPLE_SECONDS="${AW_WORKTIME_MAX_SAMPLE_SECONDS:-300}"
 OUT_DIR="${OUT_DIR:-reports}"
 TARGET_ROOT="${CARGO_TARGET_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/adk-rust/target}"
 RUST_BIN="${RDP_WORKTIME_REPORT_RUST:-}"
 
+require_live_value() {
+  local name="$1"
+  local value="${!name:-}"
+  if [[ -z "$value" ]]; then
+    echo "Missing required variable: $name" >&2
+    exit 2
+  fi
+  case "$value" in
+    *192.0.2.*|*198.51.100.*|*203.0.113.*|*HOST-EXAMPLE*|*.example*)
+      echo "Refusing placeholder value for $name: $value" >&2
+      exit 2
+      ;;
+  esac
+}
+
 usage() {
   cat <<EOF
 Usage:
@@ -52,6 +67,9 @@ if [[ -z "$FROM" || -z "$TO" ]]; then
   exit 2
 fi
 
+require_live_value AW_BASE_URL
+require_live_value AW_WORKTIME_HOST
+
 mkdir -p "$OUT_DIR"
 CSV_OUT="${OUT_DIR}/rdp-worktime-${FROM}_${TO}.csv"
 JSON_OUT="${OUT_DIR}/rdp-worktime-${FROM}_${TO}.json"
@@ -80,7 +98,9 @@ import urllib.request
 from datetime import datetime, timedelta, timezone
 
 base, host, default_sample, max_sample, from_d, to_d, csv_out, json_out = sys.argv[1:9]
-base = (base or "http://192.0.2.13:5600").rstrip("/")
+if not base:
+    raise SystemExit("AW_BASE_URL is required")
+base = base.rstrip("/")
 if not base.endswith("/api/0"):
     base = base + "/api/0"
 default_sample = max(1.0, float(default_sample))

scripts/run_awatch_contour_check.sh

@@ -43,11 +43,27 @@ configure_detmir_env() {
     fi
   fi
 
-  export DETMIR_AW_API="${DETMIR_AW_API:-http://192.0.2.13:5600/api/0}"
-  export DETMIR_WORKTIME_URL="${DETMIR_WORKTIME_URL:-http://192.0.2.13:5610}"
-  export DETMIR_ONE_C_URL="${DETMIR_ONE_C_URL:-http://192.0.2.2:8710}"
-  export DETMIR_RDP_HOST="${DETMIR_RDP_HOST:-198.51.100.18}"
-  export DETMIR_HOSTNAME="${DETMIR_HOSTNAME:-HOST-EXAMPLE}"
+  export DETMIR_DLP_ENABLED="${DETMIR_DLP_ENABLED:-${AW_DLP_ENABLED:-false}}"
+  require_live_value DETMIR_AW_API
+  require_live_value DETMIR_WORKTIME_URL
+  require_live_value DETMIR_ONE_C_URL
+  require_live_value DETMIR_RDP_HOST
+  require_live_value DETMIR_HOSTNAME
+}
+
+require_live_value() {
+  local name="$1"
+  local value="${!name:-}"
+  if [[ -z "${value}" ]]; then
+    printf 'Missing required live contour variable: %s. Set it in %s or the environment.\n' "${name}" "${ENV_FILE}" >&2
+    exit 2
+  fi
+  case "${value}" in
+    *192.0.2.*|*198.51.100.*|*203.0.113.*|*HOST-EXAMPLE*|*.example*)
+      printf 'Refusing placeholder value for %s: %s\n' "${name}" "${value}" >&2
+      exit 2
+      ;;
+  esac
 }
 
 write_summary() {
@@ -64,6 +80,7 @@ write_summary() {
     printf 'DETMIR_HOSTNAME=%s\n' "${DETMIR_HOSTNAME}"
     printf 'DETMIR_GATEWAY_HOST=%s\n' "${DETMIR_GATEWAY_HOST}"
     printf 'DETMIR_PORTAL_URL=%s\n' "${DETMIR_PORTAL_URL}"
+    printf 'DETMIR_DLP_ENABLED=%s\n' "${DETMIR_DLP_ENABLED}"
     printf 'DETMIR_DLP_COMMAND=%s\n' "${DETMIR_DLP_COMMAND}"
     printf 'DETMIR_DISABLE_PORTAL_CHECK=%s\n' "${DETMIR_DISABLE_PORTAL_CHECK:-0}"
     printf 'DETMIR_DISABLE_DLP_HEALTH_CHECK=%s\n' "${DETMIR_DISABLE_DLP_HEALTH_CHECK:-0}"
@@ -181,5 +198,12 @@ if [[ "${RUN_REGISTRY_CHECK:-0}" == "1" ]] && [[ -x "${REPO_ROOT}/scripts/regist
   fi
 fi
 
+if [[ "${RUN_RESILIENCE_CHECK:-0}" == "1" ]] && [[ -f "${REPO_ROOT}/scripts/detmir_resilience_check.sh" ]]; then
+  resilience_mode="${RESILIENCE_CHECK_MODE:-repo}"
+  if ! run_and_log "detmir-resilience-check" bash "${REPO_ROOT}/scripts/detmir_resilience_check.sh" "--${resilience_mode}"; then
+    status=1
+  fi
+fi
+
 printf 'final_status: %s\n' "$([[ "${status}" -eq 0 ]] && printf ok || printf fail)" | tee -a "${OUTPUT_DIR}/SUMMARY.md"
 exit "${status}"