wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

fix(iwooos): project canonical siem receipts

Browse Source
This commit is contained in:
ogt
2026-07-15 10:44:58 +08:00
parent 2685a6bc10
commit c0b597573f
2 changed files with 144 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
apps/api/src/services/iwooos_security_asset_control_plane.py
View File

@@ -309,9 +309,13 @@ def _compliance_rows(rows: Iterable[Any]) -> list[dict[str, Any]]:
def _automation_stage_rows(
rows: Iterable[Any], accepted_ai_trace_count: int
rows: Iterable[Any],
accepted_ai_trace_count: int,
*,
runtime_receipt_counts: dict[str, int] | None = None,
) -> list[dict[str, Any]]:
source = list(rows)
external_receipts = runtime_receipt_counts or {}
stages: list[dict[str, Any]] = []
for stage_id, label, operation_types in _AI_LOOP_STAGES:
receipt_count = sum(
@@ -320,6 +324,10 @@ def _automation_stage_rows(
if str(_value(row, "operation_type", "")) in operation_types
and str(_value(row, "status", "")) in {"success", "dry_run"}
)
receipt_count = max(
receipt_count,
max(0, int(external_receipts.get(stage_id, 0) or 0)),
)
if stage_id == "decide":
receipt_count += accepted_ai_trace_count
stages.append(
@@ -809,8 +817,17 @@ def build_iwooos_security_asset_control_plane(
compliance_unknown = sum(row["unknown_count"] for row in compliance)
accepted_ai_trace_count = int(_value(ai_trace_row, "accepted_trace_count", 0) or 0)
runtime_receipt_counts = {
"correlate": int(
_value(siem_row, "correlated_controlled_route_count_24h", 0) or 0
),
"verify": int(_value(siem_row, "independent_verifier_pass_count_24h", 0) or 0),
"learn": int(_value(siem_row, "learning_writeback_count_24h", 0) or 0),
}
automation_stages = _automation_stage_rows(
automation_source, accepted_ai_trace_count
automation_source,
accepted_ai_trace_count,
runtime_receipt_counts=runtime_receipt_counts,
)
observed_automation_stages = sum(
1 for stage in automation_stages if stage["status"] == "observed"
@@ -882,6 +899,9 @@ def build_iwooos_security_asset_control_plane(
"normalized_event_count_24h": int(
_value(siem_row, "normalized_event_count_24h", 0) or 0
),
"correlated_controlled_route_count_24h": runtime_receipt_counts["correlate"],
"independent_verifier_pass_count_24h": runtime_receipt_counts["verify"],
"learning_writeback_count_24h": runtime_receipt_counts["learn"],
"mean_time_to_resolve_minutes_24h": (
round(float(_value(siem_row, "mttr_minutes_24h")), 1)
if _value(siem_row, "mttr_minutes_24h") is not None
@@ -1103,14 +1123,18 @@ def build_iwooos_security_asset_control_plane(
)
)
missing_ai_stages = len(_AI_LOOP_STAGES) - observed_automation_stages
if missing_ai_stages > 0 or verified_receipts == 0:
if (
missing_ai_stages > 0
or verified_receipts == 0
or not same_run_closed_loop_proven
):
work_items.append(
_work_item(
"AIA-P0-008-01",
"P0",
"ai_security_automation",
"完成 AI Agent 同 run 受控閉環",
max(1, missing_ai_stages),
max(1, missing_ai_stages + (0 if same_run_closed_loop_proven else 1)),
"同 trace 串接 decision、check、bounded apply、verifier、rollback/no-write 與 learning。",
)
)
@@ -1927,6 +1951,49 @@ class IwoooSSecurityAssetControlPlaneService:
WHERE project_id = 'awoooi'
AND received_at >= NOW() - INTERVAL '24 hours')
AS normalized_event_count_24h,
(SELECT count(*) FROM automation_operation_log route
WHERE route.operation_type = 'ansible_candidate_matched'
AND route.status IN ('success', 'dry_run')
AND route.created_at >= NOW() - INTERVAL '24 hours'
AND COALESCE(
NULLIF(route.incident_id::text, ''),
NULLIF(route.input ->> 'incident_id', '')
) IS NOT NULL
AND NULLIF(route.input ->> 'catalog_id', '') IS NOT NULL)
AS correlated_controlled_route_count_24h,
(SELECT count(*) FROM incident_evidence verifier
WHERE verifier.collected_at >= NOW() - INTERVAL '24 hours'
AND verifier.verification_result = 'success'
AND NULLIF(
verifier.post_execution_state ->> 'automation_run_id',
''
) IS NOT NULL
AND NULLIF(
verifier.post_execution_state ->> 'apply_op_id',
''
) IS NOT NULL
AND verifier.post_execution_state
->> 'all_postconditions_passed' = 'true'
AND verifier.post_execution_state
->> 'executor_returncode_trusted' = 'false')
AS independent_verifier_pass_count_24h,
(SELECT count(*) FROM automation_operation_log learning
WHERE learning.operation_type
= 'ansible_learning_writeback_recorded'
AND learning.status = 'success'
AND learning.created_at >= NOW() - INTERVAL '24 hours'
AND NULLIF(
learning.input ->> 'automation_run_id',
''
) IS NOT NULL
AND NULLIF(
learning.input ->> 'apply_op_id',
''
) IS NOT NULL
AND learning.output ->> 'learning_recorded' = 'true'
AND learning.output
->> 'repository_readback_verified' = 'true')
AS learning_writeback_count_24h,
(SELECT avg(EXTRACT(EPOCH FROM (resolved_at - created_at)) / 60.0)
FROM incidents
WHERE project_id = 'awoooi'