0e2e8057cf
Some checks failed
Ansible / Reboot Recovery Contract / validate (push) Successful in 1m14s
Code Review / ai-code-review (push) Has been cancelled
CD Pipeline / tests (push) Successful in 1m41s
E2E Health Check / e2e-health (push) Successful in 27s
CD Pipeline / build-and-deploy (push) Failing after 2m18s
CD Pipeline / post-deploy-checks (push) Has been skipped
324 lines
12 KiB
JSON
324 lines
12 KiB
JSON
{
|
||
"evidence_slots": [
|
||
{
|
||
"accepted": true,
|
||
"next_gate": "manager_registry_acceptance_evidence_review",
|
||
"quarantined": false,
|
||
"received": true,
|
||
"required_fields": [
|
||
"agent_total",
|
||
"agent_active",
|
||
"agent_disconnected",
|
||
"agent_never_connected",
|
||
"registry_export_summary_ref"
|
||
],
|
||
"slot_id": "manager_registry_agent_counts",
|
||
"title": "Manager registry agent counts"
|
||
},
|
||
{
|
||
"accepted": true,
|
||
"next_gate": "manager_registry_acceptance_evidence_review",
|
||
"quarantined": false,
|
||
"received": true,
|
||
"required_fields": [
|
||
"registry_export_scope_aliases",
|
||
"per_host_registry_matrix",
|
||
"registry_gap_reason_by_alias"
|
||
],
|
||
"slot_id": "per_host_agent_scope_matrix",
|
||
"title": "逐主機 agent scope matrix"
|
||
},
|
||
{
|
||
"accepted": true,
|
||
"next_gate": "manager_registry_acceptance_evidence_review",
|
||
"quarantined": false,
|
||
"received": true,
|
||
"required_fields": [
|
||
"dashboard_api_connection_check_status",
|
||
"dashboard_api_version_check_status",
|
||
"dashboard_index_pattern_statuses",
|
||
"dashboard_api_degradation_root_cause",
|
||
"dashboard_api_repair_postcheck_ref"
|
||
],
|
||
"slot_id": "dashboard_api_rbac_tls_repair_readback",
|
||
"title": "Dashboard API / RBAC / TLS 修復讀回"
|
||
},
|
||
{
|
||
"accepted": true,
|
||
"next_gate": "manager_registry_acceptance_evidence_review",
|
||
"quarantined": false,
|
||
"received": true,
|
||
"required_fields": [
|
||
"collection_method",
|
||
"manager_health_ref",
|
||
"redacted_evidence_refs"
|
||
],
|
||
"slot_id": "readonly_credential_metadata_without_secret",
|
||
"title": "唯讀 credential metadata，不含 secret"
|
||
},
|
||
{
|
||
"accepted": true,
|
||
"next_gate": "manager_registry_acceptance_evidence_review",
|
||
"quarantined": false,
|
||
"received": true,
|
||
"required_fields": [
|
||
"owner_role",
|
||
"team",
|
||
"decision",
|
||
"decision_reason",
|
||
"followup_owner",
|
||
"rollback_owner"
|
||
],
|
||
"slot_id": "owner_response_and_rollback_owner",
|
||
"title": "Owner response / rollback owner"
|
||
},
|
||
{
|
||
"accepted": true,
|
||
"next_gate": "manager_registry_acceptance_evidence_review",
|
||
"quarantined": false,
|
||
"received": true,
|
||
"required_fields": [
|
||
"postcheck_plan",
|
||
"redacted_evidence_refs"
|
||
],
|
||
"slot_id": "post_enable_iwooos_readback",
|
||
"title": "Post-enable IwoooS readback"
|
||
}
|
||
],
|
||
"execution_boundaries": {
|
||
"agent_identity_public_display_allowed": false,
|
||
"host_write_authorized": false,
|
||
"internal_ip_public_display_allowed": false,
|
||
"kali_active_scan_authorized": false,
|
||
"not_authorization": true,
|
||
"raw_wazuh_payload_storage_allowed": false,
|
||
"runtime_execution_authorized": false,
|
||
"secret_value_collection_allowed": false,
|
||
"wazuh_active_response_authorized": false,
|
||
"wazuh_agent_reenroll_authorized": false,
|
||
"wazuh_agent_restart_authorized": false,
|
||
"wazuh_api_live_query_authorized": false,
|
||
"wazuh_manager_restart_authorized": false
|
||
},
|
||
"expected_scope_aliases": [
|
||
"managed_core_node_a",
|
||
"managed_core_node_b",
|
||
"managed_dev_node_a",
|
||
"managed_dev_node_b",
|
||
"managed_control_node_a",
|
||
"managed_control_node_b"
|
||
],
|
||
"forbidden_actions": [
|
||
"wazuh_api_live_query",
|
||
"wazuh_agent_reenroll",
|
||
"wazuh_agent_restart",
|
||
"wazuh_manager_restart",
|
||
"wazuh_active_response",
|
||
"wazuh_dashboard_secret_patch",
|
||
"host_write",
|
||
"firewall_change",
|
||
"nginx_reload",
|
||
"k8s_or_argocd_change",
|
||
"kali_active_scan"
|
||
],
|
||
"forbidden_payloads": [
|
||
"raw_wazuh_payload",
|
||
"raw_log",
|
||
"full_journal",
|
||
"full_cli_output",
|
||
"unredacted_screenshot",
|
||
"agent_name",
|
||
"agent_id_plaintext",
|
||
"internal_ip",
|
||
"hostname",
|
||
"authorization_header",
|
||
"bearer_token",
|
||
"basic_auth",
|
||
"password",
|
||
"token",
|
||
"cookie",
|
||
"private_key",
|
||
"client_keys",
|
||
"raw_dashboard_request",
|
||
"dashboard_api_secret",
|
||
"stored_api_password",
|
||
"api_token",
|
||
"active_response_enable",
|
||
"agent_reenroll",
|
||
"agent_restart",
|
||
"host_write",
|
||
"firewall_change",
|
||
"nginx_reload"
|
||
],
|
||
"generated_at": "2026-06-27T22:10:00+08:00",
|
||
"mode": "committed_manager_registry_acceptance_evidence_intake_ready_no_runtime_no_secret_collection",
|
||
"no_false_green_rules": [
|
||
"reviewer validation passed 只代表脫敏 owner export refs 通過 no-persist 驗證。",
|
||
"post-enable IwoooS readback passed 只代表 production API / 前台已讀回 reviewer passed，不代表 live Wazuh 查詢或 runtime action。",
|
||
"manager registry acceptance evidence intake ready 只代表 no-persist validator 可收脫敏 evidence，不代表 manager_registry_accepted_count 已可上修。",
|
||
"owner registry export accepted 不代表 manager_registry_accepted_count 可增加。",
|
||
"Dashboard 可見、index pattern 三綠勾、HTTP 200 或 transport observed 不可替代 manager registry counts。",
|
||
"reviewer accepted 只可更新只讀 posture；active response、agent restart、reenroll、host write、secret rotation 或掃描仍需獨立 runtime gate。"
|
||
],
|
||
"outcome_lanes": [
|
||
"waiting_owner_registry_export",
|
||
"request_missing_fields",
|
||
"request_counts_arithmetic_fix",
|
||
"request_alias_scope_parity_fix",
|
||
"request_per_host_matrix_supplement",
|
||
"request_dashboard_api_repair_postcheck",
|
||
"request_readonly_credential_metadata",
|
||
"request_owner_accountability_supplement",
|
||
"quarantine_sensitive_payload",
|
||
"reject_runtime_action_request",
|
||
"ready_for_reviewer_validation",
|
||
"accepted_for_readonly_posture_only",
|
||
"post_enable_iwooos_readback_passed",
|
||
"manager_registry_acceptance_evidence_review",
|
||
"manager_registry_acceptance_evidence_intake_ready",
|
||
"accepted_for_manager_registry_acceptance_review_only",
|
||
"commit_manager_registry_accepted_readback_evidence"
|
||
],
|
||
"per_host_required_fields": [
|
||
"node_alias",
|
||
"scope_role",
|
||
"registry_presence",
|
||
"agent_status_bucket",
|
||
"last_seen_state",
|
||
"manager_group_ref",
|
||
"agent_id_redacted_ref",
|
||
"gap_reason",
|
||
"redacted_evidence_ref"
|
||
],
|
||
"required_owner_fields": [
|
||
"owner_role",
|
||
"team",
|
||
"decision",
|
||
"decision_reason",
|
||
"affected_scope",
|
||
"collection_method",
|
||
"agent_total",
|
||
"agent_active",
|
||
"agent_disconnected",
|
||
"agent_never_connected",
|
||
"last_seen_window_start",
|
||
"last_seen_window_end",
|
||
"registry_collected_at",
|
||
"registry_export_scope_aliases",
|
||
"per_host_registry_matrix",
|
||
"registry_gap_reason_by_alias",
|
||
"registry_export_summary_ref",
|
||
"manager_health_ref",
|
||
"dashboard_api_status_ref",
|
||
"dashboard_api_connection_check_status",
|
||
"dashboard_api_version_check_status",
|
||
"dashboard_index_pattern_statuses",
|
||
"dashboard_api_degradation_root_cause",
|
||
"dashboard_api_repair_postcheck_ref",
|
||
"redacted_evidence_refs",
|
||
"followup_owner",
|
||
"rollback_owner",
|
||
"postcheck_plan"
|
||
],
|
||
"reviewer_validation_checks": [
|
||
{
|
||
"check_id": "RV-01",
|
||
"failure_lane": "request_missing_fields",
|
||
"required_evidence": "owner_role、team、decision、decision_reason、affected_scope、collection_method 與 redacted evidence refs 必須存在。",
|
||
"title": "Export envelope 欄位齊全"
|
||
},
|
||
{
|
||
"check_id": "RV-02",
|
||
"failure_lane": "request_counts_arithmetic_fix",
|
||
"required_evidence": "agent_total 不得小於 active + disconnected + never_connected，且需有 registry_export_summary_ref。",
|
||
"title": "Registry counts 算術一致"
|
||
},
|
||
{
|
||
"check_id": "RV-03",
|
||
"failure_lane": "request_alias_scope_parity_fix",
|
||
"required_evidence": "registry_export_scope_aliases 必須剛好覆蓋 6 個公開別名，不得加入真實主機名或內網識別。",
|
||
"title": "Alias scope 與 IwoooS 覆蓋矩陣一致"
|
||
},
|
||
{
|
||
"check_id": "RV-04",
|
||
"failure_lane": "request_per_host_matrix_supplement",
|
||
"required_evidence": "每個公開節點別名都要有 9 個 per-host 欄位與 gap reason。",
|
||
"title": "逐主機矩陣欄位完整"
|
||
},
|
||
{
|
||
"check_id": "RV-05",
|
||
"failure_lane": "request_dashboard_api_repair_postcheck",
|
||
"required_evidence": "API connection、API version、index pattern、degradation root cause 與 repair postcheck 需分欄。",
|
||
"title": "Dashboard API 狀態不可用 index pattern 代替"
|
||
},
|
||
{
|
||
"check_id": "RV-06",
|
||
"failure_lane": "request_readonly_credential_metadata",
|
||
"required_evidence": "manager_health_ref 與 readonly credential metadata 只能是脫敏來源資訊，不得含 secret value。",
|
||
"title": "Manager health 與 readonly credential metadata 可追溯"
|
||
},
|
||
{
|
||
"check_id": "RV-07",
|
||
"failure_lane": "quarantine_sensitive_payload",
|
||
"required_evidence": "不得含 raw Wazuh payload、完整 CLI output、未脫敏截圖、agent 原名、內網位址、token、密碼或 client key。",
|
||
"title": "Forbidden payload 一律隔離"
|
||
},
|
||
{
|
||
"check_id": "RV-08",
|
||
"failure_lane": "request_owner_accountability_supplement",
|
||
"required_evidence": "followup_owner、rollback_owner、維護窗口與 postcheck plan 必須能被 reviewer 追蹤。",
|
||
"title": "Owner / followup / rollback 責任可讀"
|
||
},
|
||
{
|
||
"check_id": "RV-09",
|
||
"failure_lane": "reject_runtime_action_request",
|
||
"required_evidence": "owner decision 不可夾帶 active response、agent restart、reenroll、host write、Nginx、firewall、K8s 或 secret rotation。",
|
||
"title": "收件不等於 runtime 授權"
|
||
},
|
||
{
|
||
"check_id": "RV-10",
|
||
"failure_lane": "post_enable_iwooos_readback_passed_no_runtime",
|
||
"required_evidence": "production API 與前台 smoke 已讀回 reviewer passed；此讀回只更新 read-only posture，不查 live Wazuh、不保存 raw payload、不開 runtime gate。",
|
||
"title": "Post-enable IwoooS readback 已讀回但不開 runtime"
|
||
},
|
||
{
|
||
"check_id": "RV-11",
|
||
"failure_lane": "waiting_manager_registry_acceptance_evidence",
|
||
"required_evidence": "新增 no-persist acceptance evidence validator；只有 reviewer packet 通過後才可進 commit review，global manager_registry_accepted_count 仍維持 0。",
|
||
"title": "Manager registry acceptance evidence 可收件但不自動上修"
|
||
}
|
||
],
|
||
"schema_version": "wazuh_manager_registry_reviewer_validation_v1",
|
||
"scope": "wazuh_manager_registry_owner_export_reviewer_validation",
|
||
"source_refs": [
|
||
"docs/security/wazuh-agent-visibility-owner-evidence-preflight.snapshot.json",
|
||
"docs/security/wazuh-managed-host-coverage-gate.snapshot.json"
|
||
],
|
||
"status": "manager_registry_acceptance_evidence_intake_ready_no_runtime_no_secret_collection",
|
||
"summary": {
|
||
"active_response_authorized_count": 0,
|
||
"evidence_slot_count": 6,
|
||
"expected_scope_alias_count": 6,
|
||
"forbidden_action_count": 11,
|
||
"forbidden_payload_count": 27,
|
||
"host_write_authorized_count": 0,
|
||
"manager_registry_acceptance_evidence_received_count": 0,
|
||
"manager_registry_acceptance_evidence_review_ready_count": 0,
|
||
"manager_registry_acceptance_intake_endpoint_available_count": 1,
|
||
"manager_registry_accepted_count": 0,
|
||
"outcome_lane_count": 17,
|
||
"owner_registry_export_accepted_count": 1,
|
||
"owner_registry_export_received_count": 1,
|
||
"per_host_required_field_count": 9,
|
||
"post_enable_readback_passed_count": 1,
|
||
"required_owner_field_count": 28,
|
||
"reviewer_validation_check_count": 11,
|
||
"reviewer_validation_failed_count": 0,
|
||
"reviewer_validation_passed_count": 1,
|
||
"reviewer_validation_quarantined_count": 0,
|
||
"reviewer_validation_ready_count": 1,
|
||
"runtime_gate_count": 0,
|
||
"secret_value_collection_allowed_count": 0
|
||
}
|
||
}
|