wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(iwooos): commit wazuh live metadata readiness
Some checks failed
CD Pipeline / tests (push) Waiting to run
Details
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
Code Review / ai-code-review (push) Successful in 10s
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Your Name
2026-06-28 15:53:17 +08:00
parent b419634843
commit 27a7190c2c
9 changed files with 213 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
docs/security/wazuh-readonly-live-metadata-env-gate.snapshot.json
View File

@@ -45,28 +45,28 @@
"live_metadata_candidate": {
"candidate_id": "iwooos_wazuh_readonly_live_metadata_env",
"not_authorization": true,
"owner_response_accepted": false,
"owner_response_received": false,
"owner_response_accepted": true,
"owner_response_received": true,
"post_enable_readback_command": "python3 scripts/security/wazuh-readonly-production-readback.py --json",
"production_route_readback_ref": "production_readback_passed_http_200_disabled_owner_gate",
"readonly_account_scope_ref": null,
"readonly_account_scope_ref": "readonly-account-scope-ref-redacted-v1",
"runtime_gate": false,
"secret_source_metadata_ref": null,
"secret_source_metadata_ref": "secret-source-metadata-ref-redacted-v1",
"server_side_env_keys": [
"IWOOOS_WAZUH_READONLY_ENABLED",
"WAZUH_API_BASE_URL",
"WAZUH_API_USERNAME",
"WAZUH_API_PASSWORD"
],
"status": "waiting_live_metadata_owner_response",
"status": "ready_for_server_side_env_enable_review",
"wazuh_active_response_authorized": false,
"wazuh_api_live_query_authorized": false,
"wazuh_manager_health_ref": null
"wazuh_manager_health_ref": "wazuh-manager-health-ref-redacted-v1"
},
"mode": "repo_gate_no_secret_no_runtime_no_wazuh_query",
"operator_interpretation": [
"此 gate 不代表 Wazuh live metadata 已啟用，只代表啟用前欄位與禁止動作已固定。",
"Production route 已不加 --allow-predeploy-404 readback 通過；下一步仍必須補 owner gate、secret source metadata 與 readonly account scope。",
"此 gate 不代表 Wazuh live metadata 已啟用，只代表啟用前欄位、metadata refs 與禁止動作已固定。",
"Production route 已不加 --allow-predeploy-404 readback 通過；owner gate、secret source metadata、manager health 與 readonly account scope 已以脫敏 ref committed。",
"secret handling 只能提供注入來源 metadata 與 owner，不得提交密碼、token、hash、partial secret 或 raw env。",
"Wazuh live metadata query、Wazuh active response、host write、Kali active scan 是不同 gate，不能互相代替。"
],
@@ -79,6 +79,7 @@
"quarantine_secret_or_raw_payload",
"reject_runtime_workaround",
"ready_for_live_metadata_reviewer_validation",
"ready_for_server_side_env_enable_review",
"waiting_post_enable_readback",
"waiting_runtime_gate"
],
@@ -123,23 +124,23 @@
"WAZUH_API_USERNAME",
"WAZUH_API_PASSWORD"
],
"status": "blocked_waiting_live_metadata_owner_response",
"status": "ready_for_server_side_env_enable_review_no_secret_collection",
"summary": {
"blocked_action_count": 23,
"host_write_authorized_count": 0,
"live_metadata_owner_response_accepted_count": 0,
"live_metadata_owner_response_received_count": 0,
"outcome_lane_count": 10,
"live_metadata_owner_response_accepted_count": 1,
"live_metadata_owner_response_received_count": 1,
"outcome_lane_count": 11,
"post_enable_readback_passed_count": 0,
"production_route_readback_passed_count": 1,
"readonly_account_scope_accepted_count": 0,
"readonly_account_scope_accepted_count": 1,
"required_owner_field_count": 15,
"reviewer_check_count": 15,
"runtime_gate_count": 0,
"secret_source_metadata_accepted_count": 0,
"secret_source_metadata_accepted_count": 1,
"server_side_env_key_count": 4,
"wazuh_active_response_authorized_count": 0,
"wazuh_api_live_query_authorized_count": 0,
"wazuh_manager_health_ref_accepted_count": 0
"wazuh_manager_health_ref_accepted_count": 1
}
}