From 91d566a4bba1a81b27a44ad50ec38308e37bec31 Mon Sep 17 00:00:00 2001 From: Your Name Date: Fri, 26 Jun 2026 18:29:13 +0800 Subject: [PATCH] fix(iwooos): keep security coverage and alert gates closed --- .../iwooos_security_control_coverage.py | 2 +- apps/api/src/services/telegram_gateway.py | 12 ++++------- .../test_iwooos_security_control_coverage.py | 3 ++- .../test_telegram_gateway_error_sanitizer.py | 6 +++--- .../tests/test_telegram_message_templates.py | 20 +++++++++---------- docs/LOGBOOK.md | 2 ++ 6 files changed, 22 insertions(+), 23 deletions(-) diff --git a/apps/api/src/services/iwooos_security_control_coverage.py b/apps/api/src/services/iwooos_security_control_coverage.py index 434542db6..1dbf643fc 100644 --- a/apps/api/src/services/iwooos_security_control_coverage.py +++ b/apps/api/src/services/iwooos_security_control_coverage.py @@ -53,7 +53,7 @@ def load_latest_iwooos_security_control_coverage( return { "schema_version": _SCHEMA_VERSION, - "status": "committed_scope_rollup_ready_runtime_control_blocked", + "status": "committed_scope_rollup_ready_runtime_control_closed", "mode": "committed_snapshot_rollup_only_no_live_runtime_query", "summary": summary, "domains": domains, diff --git a/apps/api/src/services/telegram_gateway.py b/apps/api/src/services/telegram_gateway.py index f01893395..f606a5eb4 100644 --- a/apps/api/src/services/telegram_gateway.py +++ b/apps/api/src/services/telegram_gateway.py @@ -481,7 +481,7 @@ def format_aiops_signal_alert_card(text: str) -> str: "", "AI 自動化判讀", f"├ Lane：{html.escape(spec.lane)}", - "├ Gate：controlled_playbook_queue / runtime_write_gate=controlled", + "├ Gate：controlled_playbook_queue / runtime_write_gate=0", f"└ 下一步：{html.escape(spec.next_step)}", "", "Top evidence", @@ -745,7 +745,7 @@ def format_host_resource_alert_card(text: str) -> str: "", "AI 自動化判讀", f"├ Lane：{html.escape(automation_lane)}", - "├ Gate：controlled_playbook_queue / runtime_write_gate=controlled", + "├ Gate：controlled_playbook_queue / runtime_write_gate=0", f"└ 下一步：{html.escape(automation_next_step)}", "", "Top evidence", @@ -2245,8 +2245,6 @@ def _ai_automation_alert_card_metadata(text: str) -> dict[str, object] | None: gates.append("controlled_playbook_queue") if "runtime_write_gate=0" in text: gates.append("runtime_write_gate=0") - if "runtime_write_gate=controlled" in text: - gates.append("runtime_write_gate=controlled") metadata: dict[str, object] = { "schema_version": "ai_automation_alert_card_mirror_v1", @@ -2257,11 +2255,9 @@ def _ai_automation_alert_card_metadata(text: str) -> dict[str, object] | None: "gates": gates, "candidate_only": "candidate_only" in gates, "controlled_playbook_queue": "controlled_playbook_queue" in gates, - "runtime_write_gate_count": gates.count("runtime_write_gate=controlled"), + "runtime_write_gate_count": 0, "runtime_write_gate_state": ( - "controlled" - if "runtime_write_gate=controlled" in gates - else "closed" + "closed" if "runtime_write_gate=0" in gates else "unknown" ), diff --git a/apps/api/tests/test_iwooos_security_control_coverage.py b/apps/api/tests/test_iwooos_security_control_coverage.py index 8998bfab0..fa16a2320 100644 --- a/apps/api/tests/test_iwooos_security_control_coverage.py +++ b/apps/api/tests/test_iwooos_security_control_coverage.py @@ -19,7 +19,7 @@ def test_iwooos_security_control_coverage_rolls_up_core_scopes() -> None: payload = load_latest_iwooos_security_control_coverage() assert payload["schema_version"] == "iwooos_security_control_coverage_v1" - assert payload["status"] == "committed_scope_rollup_ready_runtime_control_blocked" + assert payload["status"] == "committed_scope_rollup_ready_runtime_control_closed" assert payload["summary"]["source_snapshot_count"] == 8 assert payload["summary"]["control_domain_count"] == 8 assert payload["summary"]["visible_scope_unit_count"] == 160 @@ -76,5 +76,6 @@ def test_iwooos_security_control_coverage_api_is_public_safe() -> None: assert data["summary"]["visible_scope_unit_count"] == 160 assert any(action["priority"] == "P0-01" for action in data["p0_next_actions"]) assert "192.168.0." not in response.text + assert "runtime_control_blocked" not in response.text assert "工作視窗" not in response.text assert "批准！繼續" not in response.text diff --git a/apps/api/tests/test_telegram_gateway_error_sanitizer.py b/apps/api/tests/test_telegram_gateway_error_sanitizer.py index 9b946f039..41da43b2d 100644 --- a/apps/api/tests/test_telegram_gateway_error_sanitizer.py +++ b/apps/api/tests/test_telegram_gateway_error_sanitizer.py @@ -166,11 +166,11 @@ full_log=/var/ossec/logs/alerts/alerts.json Authorization: Bearer abcdefghijklmn assert card_metadata["target"] == "wazuh_dashboard_api" assert card_metadata["gates"] == [ "controlled_playbook_queue", - "runtime_write_gate=controlled", + "runtime_write_gate=0", ] assert card_metadata["controlled_playbook_queue"] is True - assert card_metadata["runtime_write_gate_state"] == "controlled" - assert card_metadata["runtime_write_gate_count"] == 1 + assert card_metadata["runtime_write_gate_state"] == "closed" + assert card_metadata["runtime_write_gate_count"] == 0 assert card_metadata["delivery_receipt_readback_required"] is True assert envelope["source_refs"]["alert_ids"] == [ "wazuh_dashboard_api_readback_degraded" diff --git a/apps/api/tests/test_telegram_message_templates.py b/apps/api/tests/test_telegram_message_templates.py index 395fcdf2c..6f4cce3e2 100644 --- a/apps/api/tests/test_telegram_message_templates.py +++ b/apps/api/tests/test_telegram_message_templates.py @@ -80,7 +80,7 @@ root 364 181 0.7 3491396 494608 ? Rl 05:56 0:18 /opt/hostedto assert "AI 自動化判讀" in result assert "runner_build_resource_pressure" in result assert "controlled_playbook_queue" in result - assert "runtime_write_gate=controlled" in result + assert "runtime_write_gate=0" in result assert "Top evidence" in result assert "PID 259" in result assert "Next.js build" in result @@ -113,7 +113,7 @@ def test_orphan_browser_alert_becomes_runaway_process_event_packet() -> None: assert "check-mode" in result assert "受控 SIGTERM" in result assert "KM / PlayBook / Verifier" in result - assert "runtime_write_gate=controlled" in result + assert "runtime_write_gate=0" in result assert "allowlisted PlayBook" in result assert "受控 apply" in result @@ -133,7 +133,7 @@ def test_ci_runner_load_alert_becomes_capacity_event_packet() -> None: assert "Gitea Actions run" in result assert "合法 CI" in result assert "不做 process remediation" in result - assert "runtime_write_gate=controlled" in result + assert "runtime_write_gate=0" in result assert "受控 cleanup" in result @@ -153,7 +153,7 @@ syscheck integrity changed on /etc/nginx/sites-enabled/awoooi.conf assert "wazuh_intrusion_signal" in result assert "security_intrusion_triage" in result assert "controlled_playbook_queue" in result - assert "runtime_write_gate=controlled" in result + assert "runtime_write_gate=0" in result assert "Top evidence" in result assert "Timeline / KM / PlayBook" in result assert "不封鎖 IP" in result @@ -180,7 +180,7 @@ full_log=/var/ossec/logs/alerts/alerts.json Authorization: Bearer abcdefghijklmn assert "wazuh_dashboard_api_readback_degraded" in result assert "siem_observability_readback_degraded" in result assert "controlled_playbook_queue" in result - assert "runtime_write_gate=controlled" in result + assert "runtime_write_gate=0" in result assert "manager registry 只讀計數" in result assert "no-false-green" in result assert "不重啟 Wazuh" in result @@ -204,7 +204,7 @@ diff_url=https://internal.example.invalid/raw/live.conf assert "nginx_config_drift" in result assert "public_gateway_config_drift" in result assert "redacted live export" in result - assert "runtime_write_gate=controlled" in result + assert "runtime_write_gate=0" in result assert "不執行 nginx -t" in result assert "不 reload" in result assert "/etc/nginx" not in result @@ -269,7 +269,7 @@ def test_aiops_signal_formatter_covers_non_host_alert_lanes( assert event_type in result assert lane in result assert "controlled_playbook_queue" in result - assert "runtime_write_gate=controlled" in result + assert "runtime_write_gate=0" in result assert "Top evidence" in result assert "禁止事項" in result @@ -331,7 +331,7 @@ async def test_send_alert_notification_normalizes_aiops_signal_alert(monkeypatch assert payload["parse_mode"] == "HTML" assert "ai_automation_alert_card_v1" in payload["text"] assert "public_gateway_config_drift" in payload["text"] - assert "runtime_write_gate=controlled" in payload["text"] + assert "runtime_write_gate=0" in payload["text"] assert "/etc/nginx" not in payload["text"] @@ -352,7 +352,7 @@ root 392 0.0 0.0 1096836 53400 ? Ssl 06:27 0:00 /opt/hostedto assert "Prisma generate" in result assert "容器 root 進程：3" in result assert "套件來源" in result - assert "runtime_write_gate=controlled" in result + assert "runtime_write_gate=0" in result assert "root 365" not in result assert "checkpoint.prisma.io" not in result assert "node_modules" not in result @@ -442,7 +442,7 @@ def test_send_request_payload_normalizer_blocks_direct_host_raw_dump() -> None: assert result["parse_mode"] == "HTML" assert "P1 主機資源壓力｜h110-gitea" in result["text"] assert "ai_automation_alert_card_v1" in result["text"] - assert "runtime_write_gate=controlled" in result["text"] + assert "runtime_write_gate=0" in result["text"] assert "root 311" not in result["text"] assert "checkpoint.prisma.io" not in result["text"] assert "/workspace/wooo" not in result["text"] diff --git a/docs/LOGBOOK.md b/docs/LOGBOOK.md index 540448c44..92393791e 100644 --- a/docs/LOGBOOK.md +++ b/docs/LOGBOOK.md @@ -7,9 +7,11 @@ - 新增 `GET /api/v1/iwooos/security-control-coverage`；端點只讀 repo snapshot，不查 live host、不讀 secret、不連 Wazuh / Kali、不 SSH、不啟動掃描、不送 Telegram、不開 runtime gate。 - 前台 `/zh-TW/iwooos` 新增 `IwoooS 資安納管覆蓋總表`，顯示 `visible_scope_unit_count=160`、`control_domain_count=8`、控制面可視 `71%`、runtime acceptance `0%`、owner accepted `0`、Wazuh manager registry accepted `0`。 - 納管域包含：高價值資產與配置總帳、主機服務 / Docker / systemd、監控 / 告警 / 可觀測性、SSH / Firewall / WireGuard / NodePort / NetworkPolicy、AWOOOI runtime surfaces、Wazuh 主機納管、agent-bounty-protocol、AI Agent / Provider / 自動化資產。 +- 併同修復 `e7c368aa` 帶出的 Telegram 卡片 gate 語意：AI 事件卡仍可標 `controlled_playbook_queue`，但 runtime 寫入閘門必須明確顯示 `runtime_write_gate=0`，AwoooP mirror metadata 也固定為 `runtime_write_gate_state=closed`、`runtime_write_gate_count=0`，避免告警卡讓人誤判受控寫入已開門。 **只讀驗證結果**： - `pytest apps/api/tests/test_iwooos_security_control_coverage.py apps/api/tests/test_iwooos_runtime_security_readback.py apps/api/tests/test_iwooos_wazuh_api.py -q`：`12 passed`。 +- `pytest apps/api/tests/test_iwooos_security_control_coverage.py apps/api/tests/test_iwooos_runtime_security_readback.py apps/api/tests/test_iwooos_wazuh_api.py apps/api/tests/test_auto_repair_service.py apps/api/tests/test_awooop_operator_timeline_labels.py apps/api/tests/test_awooop_truth_chain_service.py apps/api/tests/test_operator_outcome.py apps/api/tests/test_telegram_gateway_error_sanitizer.py apps/api/tests/test_telegram_message_templates.py -q`：`254 passed`。 - `pnpm --dir apps/web typecheck`：通過。 - `python3 -m json.tool apps/web/messages/zh-TW.json` / `apps/web/messages/en.json`：通過。 - `python3.11 -m py_compile apps/api/src/api/v1/iwooos.py apps/api/src/services/iwooos_security_control_coverage.py apps/api/src/services/iwooos_runtime_security_readback.py apps/api/src/services/snapshot_paths.py`：通過。