wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

feat(iwooos): add wazuh runtime owner review readback
Some checks failed
CD Pipeline / tests (push) Successful in 1m48s
Details
Code Review / ai-code-review (push) Failing after 19s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Your Name
2026-06-28 11:28:31 +08:00
parent fde68fb843
commit 119267256a
9 changed files with 1462 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

250
docs/security/wazuh-runtime-gate-owner-review-readback.snapshot.json Normal file
View File

@@ -0,0 +1,250 @@
{
"schema_version": "wazuh_runtime_gate_owner_review_readback_v1",
"generated_at": "2026-06-28T11:05:00+08:00",
"status": "runtime_gate_owner_review_packet_committed_no_runtime_action",
"mode": "committed_owner_review_readback_no_live_wazuh_no_secret_collection",
"summary": {
"expected_scope_alias_count": 6,
"target_selector_count": 6,
"source_of_truth_diff_count": 1,
"check_mode_plan_count": 1,
"dry_run_evidence_count": 1,
"rollback_plan_count": 1,
"post_apply_verifier_count": 1,
"km_playbook_writeback_count": 1,
"maintenance_window_review_count": 1,
"owner_review_packet_received_count": 1,
"owner_review_packet_review_ready_count": 1,
"owner_review_packet_accepted_count": 1,
"owner_review_packet_supplement_required_count": 0,
"owner_review_packet_quarantined_count": 0,
"owner_review_runtime_action_rejected_count": 0,
"forbidden_payload_count": 18,
"forbidden_action_count": 20,
"runtime_gate_count": 0,
"wazuh_api_live_query_authorized_count": 0,
"wazuh_active_response_authorized_count": 0,
"host_write_authorized_count": 0,
"secret_value_collection_allowed_count": 0
},
"target_selectors": [
{
"node_alias": "managed_core_node_a",
"scope": "wazuh_manager_registry_accepted_alias",
"selector_kind": "public_alias_only",
"runtime_write_allowed": false,
"owner_review_scope": "runtime_gate_review_only"
},
{
"node_alias": "managed_core_node_b",
"scope": "wazuh_manager_registry_accepted_alias",
"selector_kind": "public_alias_only",
"runtime_write_allowed": false,
"owner_review_scope": "runtime_gate_review_only"
},
{
"node_alias": "managed_core_node_c",
"scope": "wazuh_manager_registry_accepted_alias",
"selector_kind": "public_alias_only",
"runtime_write_allowed": false,
"owner_review_scope": "runtime_gate_review_only"
},
{
"node_alias": "managed_edge_node_a",
"scope": "wazuh_manager_registry_accepted_alias",
"selector_kind": "public_alias_only",
"runtime_write_allowed": false,
"owner_review_scope": "runtime_gate_review_only"
},
{
"node_alias": "managed_edge_node_b",
"scope": "wazuh_manager_registry_accepted_alias",
"selector_kind": "public_alias_only",
"runtime_write_allowed": false,
"owner_review_scope": "runtime_gate_review_only"
},
{
"node_alias": "managed_lab_node_a",
"scope": "wazuh_manager_registry_accepted_alias",
"selector_kind": "public_alias_only",
"runtime_write_allowed": false,
"owner_review_scope": "runtime_gate_review_only"
}
],
"required_owner_review_fields": [
"owner_review_intent",
"owner_reviewer_role",
"owner_review_decision",
"owner_review_decision_reason",
"target_selector_aliases",
"source_of_truth_diff_ref",
"check_mode_plan_ref",
"dry_run_evidence_ref",
"blast_radius_statement",
"maintenance_window_ref",
"rollback_plan_ref",
"rollback_owner",
"post_apply_verifier_ref",
"km_playbook_writeback_ref",
"followup_owner",
"audit_receipt_ref",
"runtime_boundary_ack",
"secret_boundary_ack",
"live_wazuh_query_boundary_ack"
],
"review_items": [
{
"item_id": "owner_decision",
"title": "Owner review decision for runtime-gate readiness",
"state_key": "owner_review_decision_committed",
"accepted": true,
"required_fields": [
"owner_reviewer_role",
"owner_review_decision",
"owner_review_decision_reason"
],
"next_gate": "staged allowlisted check-mode before any future runtime gate change"
},
{
"item_id": "target_selector",
"title": "Public alias target selector",
"state_key": "target_selector_reviewed",
"accepted": true,
"required_fields": [
"target_selector_aliases"
],
"next_gate": "target selector remains public aliases only"
},
{
"item_id": "source_of_truth_diff",
"title": "Source-of-truth diff reference",
"state_key": "source_of_truth_diff_reviewed",
"accepted": true,
"required_fields": [
"source_of_truth_diff_ref"
],
"next_gate": "diff must be re-read before any future controlled apply"
},
{
"item_id": "check_mode_dry_run",
"title": "Check-mode and dry-run evidence",
"state_key": "check_mode_dry_run_reviewed",
"accepted": true,
"required_fields": [
"check_mode_plan_ref",
"dry_run_evidence_ref"
],
"next_gate": "dry-run evidence stays redacted and no host output is stored"
},
{
"item_id": "rollback_and_maintenance",
"title": "Rollback and maintenance window",
"state_key": "rollback_maintenance_reviewed",
"accepted": true,
"required_fields": [
"rollback_plan_ref",
"rollback_owner",
"maintenance_window_ref"
],
"next_gate": "rollback owner and maintenance window must be revalidated before runtime"
},
{
"item_id": "post_apply_verifier",
"title": "Post-apply verifier",
"state_key": "post_apply_verifier_reviewed",
"accepted": true,
"required_fields": [
"post_apply_verifier_ref"
],
"next_gate": "future runtime action requires production post-apply verifier readback"
},
{
"item_id": "learning_writeback",
"title": "KM and PlayBook trust writeback",
"state_key": "learning_writeback_reviewed",
"accepted": true,
"required_fields": [
"km_playbook_writeback_ref",
"audit_receipt_ref"
],
"next_gate": "writeback receipt must be committed after verifier"
}
],
"outcome_lanes": [
"accepted_for_runtime_gate_owner_review_readback_only",
"request_runtime_gate_owner_review_supplement",
"request_runtime_gate_owner_review_decision_fix",
"request_target_selector_fix",
"request_runtime_boundary_ack_fix",
"quarantine_sensitive_payload",
"reject_runtime_action_request"
],
"forbidden_payloads": [
"secret_value",
"token_value",
"private_key",
"cookie",
"session",
"authorization_header",
"client.keys",
"raw_wazuh_payload",
"raw_agent_identity",
"raw_hostname",
"internal_ip",
"full_cli_output",
"full_journal",
"raw_dashboard_request",
"unredacted_screenshot",
"private_namespace",
"raw_env_file",
"raw_runtime_volume"
],
"forbidden_actions": [
"wazuh_api_live_query",
"wazuh_active_response",
"wazuh_agent_restart",
"wazuh_agent_reenroll",
"wazuh_manager_restart",
"host_write",
"systemd_restart",
"docker_restart",
"nginx_reload",
"firewall_change",
"kali_active_scan",
"credentialed_scan",
"exploit_attempt",
"secret_rotation",
"k8s_apply",
"argocd_sync",
"database_migration",
"force_push",
"repo_ref_delete",
"workflow_trigger"
],
"execution_boundaries": {
"active_scan_authorized": false,
"alertmanager_reload_authorized": false,
"auto_block_authorized": false,
"credentialed_scan_authorized": false,
"firewall_change_authorized": false,
"host_write_authorized": false,
"kali_execute_authorized": false,
"kali_scan_authorized": false,
"nginx_reload_authorized": false,
"production_write_authorized": false,
"runtime_execution_authorized": false,
"runtime_gate_open": false,
"secret_value_collection_allowed": false,
"telegram_send_authorized": false,
"wazuh_active_response_authorized": false,
"wazuh_api_live_query_authorized": false,
"not_authorization": true
},
"no_false_green_rules": [
"Owner review packet accepted does not open runtime gate.",
"Committed owner review readback only records review readiness and does not query live Wazuh.",
"Target selectors are public aliases only and do not authorize host writes.",
"Check-mode and dry-run evidence references do not authorize active response.",
"Maintenance window, rollback, verifier, and writeback readiness must be revalidated before any future runtime action."
]
}