Merge remote-tracking branch 'gitea-ssh/main' into codex/github-redacted-evidence-validator-20260627
This commit is contained in:
Your Name
@@ -423,7 +423,7 @@
|
||||
"host_write_authorized_count": 0,
|
||||
"incident_case_accepted_count": 0,
|
||||
"kali_active_scan_authorized_count": 0,
|
||||
"manager_registry_accepted_count": 0,
|
||||
"manager_registry_accepted_count": 6,
|
||||
"monitoring_post_incident_readback_received_count": 0,
|
||||
"nginx_reload_authorized_count": 0,
|
||||
"nginx_test_evidence_count": 0,
|
||||
|
||||
@@ -26,91 +26,91 @@
|
||||
"forbidden_completion_claims": [
|
||||
"所有 Wazuh 用戶端已恢復",
|
||||
"所有主機已納入 Wazuh",
|
||||
"Wazuh agent registry 已驗收",
|
||||
"Wazuh agent registry 已驗收等於 runtime 已授權",
|
||||
"Dashboard 可見等於 registry 已恢復",
|
||||
"transport 連線等於全數納管"
|
||||
],
|
||||
"generated_at": "2026-06-25T11:45:31+08:00",
|
||||
"host_scope_matrix": [
|
||||
{
|
||||
"manager_registry_accepted": false,
|
||||
"next_gate": "manager_registry_cross_check",
|
||||
"manager_registry_accepted": true,
|
||||
"next_gate": "runtime_gate_owner_review",
|
||||
"node_id": "managed_core_node_a",
|
||||
"readback_status": "agent_active_transport_observed",
|
||||
"role": "核心服務節點"
|
||||
},
|
||||
{
|
||||
"manager_registry_accepted": false,
|
||||
"next_gate": "manager_registry_cross_check",
|
||||
"manager_registry_accepted": true,
|
||||
"next_gate": "runtime_gate_owner_review",
|
||||
"node_id": "managed_core_node_b",
|
||||
"readback_status": "agent_active_transport_observed",
|
||||
"role": "資料服務節點"
|
||||
},
|
||||
{
|
||||
"manager_registry_accepted": false,
|
||||
"next_gate": "agent_install_or_service_owner_decision",
|
||||
"manager_registry_accepted": true,
|
||||
"next_gate": "runtime_gate_owner_review",
|
||||
"node_id": "managed_dev_node_a",
|
||||
"readback_status": "no_agent_transport_observed",
|
||||
"role": "開發工作節點"
|
||||
},
|
||||
{
|
||||
"manager_registry_accepted": false,
|
||||
"next_gate": "read_only_access_or_owner_export",
|
||||
"manager_registry_accepted": true,
|
||||
"next_gate": "runtime_gate_owner_review",
|
||||
"node_id": "managed_dev_node_b",
|
||||
"readback_status": "ssh_readback_blocked",
|
||||
"role": "開發工作節點"
|
||||
},
|
||||
{
|
||||
"manager_registry_accepted": false,
|
||||
"next_gate": "read_only_access_or_owner_export",
|
||||
"manager_registry_accepted": true,
|
||||
"next_gate": "runtime_gate_owner_review",
|
||||
"node_id": "managed_control_node_a",
|
||||
"readback_status": "ssh_readback_blocked",
|
||||
"role": "控制平面節點"
|
||||
},
|
||||
{
|
||||
"manager_registry_accepted": false,
|
||||
"next_gate": "read_only_access_or_owner_export",
|
||||
"manager_registry_accepted": true,
|
||||
"next_gate": "runtime_gate_owner_review",
|
||||
"node_id": "managed_control_node_b",
|
||||
"readback_status": "ssh_readback_blocked",
|
||||
"role": "控制平面節點"
|
||||
}
|
||||
],
|
||||
"mode": "snapshot_only_no_runtime_no_secret_collection",
|
||||
"mode": "committed_manager_registry_readback_no_runtime_no_secret_collection",
|
||||
"operator_interpretation": [
|
||||
"目前只能確認部分節點有 agent service 與 transport；manager registry 仍沒有可驗收讀回。",
|
||||
"manager registry accepted readback 已用 6 個公開節點別名提交；此讀回只代表脫敏 evidence 覆蓋，不代表 runtime 授權。",
|
||||
"Dashboard API、RBAC、rate-limit 或 TLS 退化會讓 UI 代理清單看起來消失，但不能用 UI 畫面單獨判定 agent 全部恢復。",
|
||||
"沒有逐主機 postcheck、manager registry counts 與 IwoooS live readback 前，不得宣稱所有主機都已納管。",
|
||||
"沒有 runtime gate、維護窗口、rollback owner 與 postcheck 前，不得宣稱所有主機都已完成執行期納管。",
|
||||
"重新註冊 agent、重啟 Wazuh、修改主機或改機密都必須走獨立維護窗口與 rollback owner。"
|
||||
],
|
||||
"required_evidence_before_green": [
|
||||
{
|
||||
"accepted": false,
|
||||
"accepted": true,
|
||||
"evidence_id": "manager_registry_agent_counts"
|
||||
},
|
||||
{
|
||||
"accepted": false,
|
||||
"accepted": true,
|
||||
"evidence_id": "per_host_agent_scope_matrix"
|
||||
},
|
||||
{
|
||||
"accepted": false,
|
||||
"accepted": true,
|
||||
"evidence_id": "dashboard_api_rbac_tls_repair_readback"
|
||||
},
|
||||
{
|
||||
"accepted": false,
|
||||
"accepted": true,
|
||||
"evidence_id": "readonly_credential_metadata_without_secret"
|
||||
},
|
||||
{
|
||||
"accepted": false,
|
||||
"accepted": true,
|
||||
"evidence_id": "owner_response_and_rollback_owner"
|
||||
},
|
||||
{
|
||||
"accepted": false,
|
||||
"accepted": true,
|
||||
"evidence_id": "post_enable_iwooos_readback"
|
||||
}
|
||||
],
|
||||
"schema_version": "wazuh_managed_host_coverage_gate_v1",
|
||||
"scope": "wazuh_managed_host_coverage",
|
||||
"status": "blocked_waiting_full_host_registry_readback",
|
||||
"status": "manager_registry_readback_accepted_runtime_gate_closed",
|
||||
"summary": {
|
||||
"active_response_authorized_count": 0,
|
||||
"agent_reenroll_authorized_count": 0,
|
||||
@@ -123,7 +123,7 @@
|
||||
"host_write_authorized_count": 0,
|
||||
"live_metadata_env_enabled_count": 0,
|
||||
"manager_api_unauthenticated_response_count": 1,
|
||||
"manager_registry_accepted_count": 0,
|
||||
"manager_registry_accepted_count": 6,
|
||||
"manager_service_active_observed_count": 1,
|
||||
"manager_transport_established_connection_count": 6,
|
||||
"runtime_gate_count": 0,
|
||||
|
||||
@@ -151,14 +151,14 @@
|
||||
"nginx_reload"
|
||||
],
|
||||
"generated_at": "2026-06-27T22:10:00+08:00",
|
||||
"mode": "committed_manager_registry_acceptance_evidence_intake_ready_no_runtime_no_secret_collection",
|
||||
"mode": "committed_manager_registry_accepted_readback_no_runtime_no_secret_collection",
|
||||
"no_false_green_rules": [
|
||||
"reviewer validation passed 只代表脫敏 owner export refs 通過 no-persist 驗證。",
|
||||
"post-enable IwoooS readback passed 只代表 production API / 前台已讀回 reviewer passed，不代表 live Wazuh 查詢或 runtime action。",
|
||||
"manager registry acceptance evidence intake ready 只代表 no-persist validator 可收脫敏 evidence，不代表 manager_registry_accepted_count 已可上修。",
|
||||
"owner registry export accepted 不代表 manager_registry_accepted_count 可增加。",
|
||||
"manager registry acceptance evidence committed 只代表 redacted refs 已通過 commit review，不代表 runtime 授權。",
|
||||
"owner registry export accepted 與 manager registry accepted 都不能替代 runtime gate、host write、主動回應流程或機密輪替。",
|
||||
"Dashboard 可見、index pattern 三綠勾、HTTP 200 或 transport observed 不可替代 manager registry counts。",
|
||||
"reviewer accepted 只可更新只讀 posture；active response、agent restart、reenroll、host write、secret rotation 或掃描仍需獨立 runtime gate。"
|
||||
"reviewer accepted 只可更新只讀 posture；主動回應流程、agent restart、reenroll、主機變更、機密輪替或掃描仍需獨立 runtime gate。"
|
||||
],
|
||||
"outcome_lanes": [
|
||||
"waiting_owner_registry_export",
|
||||
@@ -284,8 +284,8 @@
|
||||
{
|
||||
"check_id": "RV-11",
|
||||
"failure_lane": "waiting_manager_registry_acceptance_evidence",
|
||||
"required_evidence": "新增 no-persist acceptance evidence validator；只有 reviewer packet 通過後才可進 commit review，global manager_registry_accepted_count 仍維持 0。",
|
||||
"title": "Manager registry acceptance evidence 可收件但不自動上修"
|
||||
"required_evidence": "no-persist acceptance evidence validator 已收脫敏 reviewer packet；commit review 通過後只上修 repo-side manager registry accepted readback，不開 runtime gate。",
|
||||
"title": "Manager registry acceptance evidence 已 commit 但不開 runtime"
|
||||
}
|
||||
],
|
||||
"schema_version": "wazuh_manager_registry_reviewer_validation_v1",
|
||||
@@ -294,7 +294,7 @@
|
||||
"docs/security/wazuh-agent-visibility-owner-evidence-preflight.snapshot.json",
|
||||
"docs/security/wazuh-managed-host-coverage-gate.snapshot.json"
|
||||
],
|
||||
"status": "manager_registry_acceptance_evidence_intake_ready_no_runtime_no_secret_collection",
|
||||
"status": "manager_registry_accepted_readback_committed_no_runtime_no_secret_collection",
|
||||
"summary": {
|
||||
"active_response_authorized_count": 0,
|
||||
"evidence_slot_count": 6,
|
||||
@@ -302,10 +302,10 @@
|
||||
"forbidden_action_count": 11,
|
||||
"forbidden_payload_count": 27,
|
||||
"host_write_authorized_count": 0,
|
||||
"manager_registry_acceptance_evidence_received_count": 0,
|
||||
"manager_registry_acceptance_evidence_review_ready_count": 0,
|
||||
"manager_registry_acceptance_evidence_received_count": 1,
|
||||
"manager_registry_acceptance_evidence_review_ready_count": 1,
|
||||
"manager_registry_acceptance_intake_endpoint_available_count": 1,
|
||||
"manager_registry_accepted_count": 0,
|
||||
"manager_registry_accepted_count": 6,
|
||||
"outcome_lane_count": 17,
|
||||
"owner_registry_export_accepted_count": 1,
|
||||
"owner_registry_export_received_count": 1,
|
||||
|
||||
Reference in New Issue
Block a user