Phase 17 Summary: Production Validation

Result

Phase 17 is closed.

A real end-to-end forensic path was executed and closed on production infrastructure:

Windows EVTX package was exported on SHARKON2025.
The real zip package was transferred to 10.10.10.13.
aw-hayabusa accept and aw-hayabusa process-inbox --mode incident were run through the standard wrapper.
Hayabusa generated a real report set with bounded traceability metadata.
The result was linked back into AW-rus case management as bounded forensics.hayabusa metadata.

host: SHARKON2025
case id: 30
intake id: 20260521T125653Z_SHARKON2025-phase17-rerun3
package path: /opt/hayabusa/archive/packages/SHARKON2025/20260521T125653Z_SHARKON2025-phase17-rerun3.zip
sha256: e86b9abbfc1d706ac706c6c8a89509ab17023344c50880641e9175f73f1198d4
report dir: /opt/hayabusa/reports/SHARKON2025/20260521T125654Z_incident_20260521T125653Z_SHARKON2025-phase17-rerun3
report artifacts:
- summary.html
- manifest.json
- run.log
- timeline.jsonl
- logon-summary-successful.csv
- logon-summary-failed.csv

aw-hayabusa treated unzip warning return code 1 as a hard failure for Windows-created zip archives that use backslashes as path separators.
timeline modes were using the wrong Hayabusa config path; the wrapper must pass rules/config, not the rules root.

Both issues were fixed in aw-server/hayabusa/aw-hayabusa.sh and retested live against the same package.

the path is no longer theoretical or docs-only; it was proven on a real Windows export package
traceability from host to package to report directory is explicit
AW-rus case linkage now stores bounded forensic metadata exactly as designed
the remaining gaps are operational tuning items, not missing core implementation