wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(iwooos): commit wazuh live metadata readiness
Some checks failed
CD Pipeline / tests (push) Waiting to run
Details
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
Code Review / ai-code-review (push) Successful in 10s
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Your Name
2026-06-28 15:53:17 +08:00
parent b419634843
commit 27a7190c2c
9 changed files with 213 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
apps/api/src/services/iwooos_runtime_security_readback.py
View File

@@ -94,6 +94,15 @@ def load_latest_iwooos_runtime_security_readback(
dispatch_summary = _summary(snapshots["owner_dispatch"])
intrusion_summary = _summary(snapshots["intrusion_prevention"])
live_wazuh = _wazuh_live_summary(wazuh_live_status, wazuh_live_http_status)
live_metadata_gate_ready = all(
_int(live_metadata_gate_summary.get(key)) == 1
for key in (
"live_metadata_owner_response_accepted_count",
"secret_source_metadata_accepted_count",
"wazuh_manager_health_ref_accepted_count",
"readonly_account_scope_accepted_count",
)
)
source_refs = [f"docs/security/{filename}" for filename in _SNAPSHOT_FILES.values()]
runtime_gate_count = _max_summary_count(
@@ -345,9 +354,13 @@ def load_latest_iwooos_runtime_security_readback(
snapshots["wazuh_live_metadata_gate"].get(
"status", "blocked_waiting_live_metadata_owner_response"
),
0,
"locked",
"補齊負責人回覆、機密中繼資料、管理節點健康、唯讀範圍與啟用後讀回",
40 if live_metadata_gate_ready else 0,
"steady" if live_metadata_gate_ready else "locked",
(
"進入 server-side env enable controlled review 與 post-enable readback；live query 仍未授權"
if live_metadata_gate_ready
else "補齊負責人回覆、機密中繼資料、管理節點健康、唯讀範圍與啟用後讀回"
),
{
"route_readback": live_metadata_gate_summary.get(
"production_route_readback_passed_count", 0

69
apps/api/src/services/iwooos_wazuh_live_metadata_gate.py
View File

@@ -408,8 +408,16 @@ def _items(summary: dict[str, Any]) -> list[dict[str, Any]]:
_item(
"server_env_owner",
"ENV-2",
"waiting_owner_response",
"locked",
(
"owner_metadata_accepted"
if summary["live_metadata_owner_response_accepted_count"]
else "waiting_owner_response"
),
(
"steady"
if summary["live_metadata_owner_response_accepted_count"]
else "locked"
),
{
"owner_received": summary["live_metadata_owner_response_received_count"],
"owner_accepted": summary["live_metadata_owner_response_accepted_count"],
@@ -418,15 +426,23 @@ def _items(summary: dict[str, Any]) -> list[dict[str, Any]]:
_item(
"secret_metadata",
"ENV-3",
"metadata_only_waiting_acceptance",
"locked",
(
"secret_metadata_accepted"
if summary["secret_source_metadata_accepted_count"]
else "metadata_only_waiting_acceptance"
),
"steady" if summary["secret_source_metadata_accepted_count"] else "locked",
{"secret_metadata_accepted": summary["secret_source_metadata_accepted_count"]},
),
_item(
"manager_health",
"ENV-4",
"waiting_manager_health_ref",
"warn",
(
"manager_health_ref_accepted"
if summary["wazuh_manager_health_ref_accepted_count"]
else "waiting_manager_health_ref"
),
"steady" if summary["wazuh_manager_health_ref_accepted_count"] else "warn",
{
"manager_health_accepted": summary["wazuh_manager_health_ref_accepted_count"],
"live_route_degraded": summary["wazuh_live_route_degraded_count"],
@@ -435,8 +451,12 @@ def _items(summary: dict[str, Any]) -> list[dict[str, Any]]:
_item(
"readonly_scope",
"ENV-5",
"waiting_readonly_scope_ref",
"warn",
(
"readonly_scope_ref_accepted"
if summary["readonly_account_scope_accepted_count"]
else "waiting_readonly_scope_ref"
),
"steady" if summary["readonly_account_scope_accepted_count"] else "warn",
{"readonly_scope_accepted": summary["readonly_account_scope_accepted_count"]},
),
_item(
@@ -678,11 +698,42 @@ def _first_blocking_lane(findings: list[dict[str, Any]]) -> str | None:
def _require_boundaries(payload: dict[str, Any]) -> None:
summary = _summary(payload)
readiness_counts = {
"live_metadata_owner_response_received_count": _int(
summary.get("live_metadata_owner_response_received_count")
),
"live_metadata_owner_response_accepted_count": _int(
summary.get("live_metadata_owner_response_accepted_count")
),
"secret_source_metadata_accepted_count": _int(
summary.get("secret_source_metadata_accepted_count")
),
"wazuh_manager_health_ref_accepted_count": _int(
summary.get("wazuh_manager_health_ref_accepted_count")
),
"readonly_account_scope_accepted_count": _int(
summary.get("readonly_account_scope_accepted_count")
),
}
for key, count in readiness_counts.items():
if count not in {0, 1}:
raise ValueError(
f"Wazuh 即時中繼資料閘門 summary.{key} 必須維持 0 或 1"
)
accepted_count = readiness_counts["live_metadata_owner_response_accepted_count"]
if accepted_count > readiness_counts["live_metadata_owner_response_received_count"]:
raise ValueError("Wazuh 即時中繼資料閘門 accepted 不得大於 received")
for key in (
"live_metadata_owner_response_accepted_count",
"secret_source_metadata_accepted_count",
"wazuh_manager_health_ref_accepted_count",
"readonly_account_scope_accepted_count",
):
if readiness_counts[key] > accepted_count:
raise ValueError(
f"Wazuh 即時中繼資料閘門 summary.{key} 不得超過 owner accepted"
)
for key in (
"post_enable_readback_passed_count",
"wazuh_api_live_query_authorized_count",
"wazuh_active_response_authorized_count",