251 lines
8.1 KiB
JSON
251 lines
8.1 KiB
JSON
{
|
|
"schema_version": "wazuh_runtime_gate_owner_review_readback_v1",
|
|
"generated_at": "2026-06-28T11:05:00+08:00",
|
|
"status": "runtime_gate_owner_review_packet_committed_no_runtime_action",
|
|
"mode": "committed_owner_review_readback_no_live_wazuh_no_secret_collection",
|
|
"summary": {
|
|
"expected_scope_alias_count": 6,
|
|
"target_selector_count": 6,
|
|
"source_of_truth_diff_count": 1,
|
|
"check_mode_plan_count": 1,
|
|
"dry_run_evidence_count": 1,
|
|
"rollback_plan_count": 1,
|
|
"post_apply_verifier_count": 1,
|
|
"km_playbook_writeback_count": 1,
|
|
"maintenance_window_review_count": 1,
|
|
"owner_review_packet_received_count": 1,
|
|
"owner_review_packet_review_ready_count": 1,
|
|
"owner_review_packet_accepted_count": 1,
|
|
"owner_review_packet_supplement_required_count": 0,
|
|
"owner_review_packet_quarantined_count": 0,
|
|
"owner_review_runtime_action_rejected_count": 0,
|
|
"forbidden_payload_count": 18,
|
|
"forbidden_action_count": 20,
|
|
"runtime_gate_count": 0,
|
|
"wazuh_api_live_query_authorized_count": 0,
|
|
"wazuh_active_response_authorized_count": 0,
|
|
"host_write_authorized_count": 0,
|
|
"secret_value_collection_allowed_count": 0
|
|
},
|
|
"target_selectors": [
|
|
{
|
|
"node_alias": "managed_core_node_a",
|
|
"scope": "wazuh_manager_registry_accepted_alias",
|
|
"selector_kind": "public_alias_only",
|
|
"runtime_write_allowed": false,
|
|
"owner_review_scope": "runtime_gate_review_only"
|
|
},
|
|
{
|
|
"node_alias": "managed_core_node_b",
|
|
"scope": "wazuh_manager_registry_accepted_alias",
|
|
"selector_kind": "public_alias_only",
|
|
"runtime_write_allowed": false,
|
|
"owner_review_scope": "runtime_gate_review_only"
|
|
},
|
|
{
|
|
"node_alias": "managed_core_node_c",
|
|
"scope": "wazuh_manager_registry_accepted_alias",
|
|
"selector_kind": "public_alias_only",
|
|
"runtime_write_allowed": false,
|
|
"owner_review_scope": "runtime_gate_review_only"
|
|
},
|
|
{
|
|
"node_alias": "managed_edge_node_a",
|
|
"scope": "wazuh_manager_registry_accepted_alias",
|
|
"selector_kind": "public_alias_only",
|
|
"runtime_write_allowed": false,
|
|
"owner_review_scope": "runtime_gate_review_only"
|
|
},
|
|
{
|
|
"node_alias": "managed_edge_node_b",
|
|
"scope": "wazuh_manager_registry_accepted_alias",
|
|
"selector_kind": "public_alias_only",
|
|
"runtime_write_allowed": false,
|
|
"owner_review_scope": "runtime_gate_review_only"
|
|
},
|
|
{
|
|
"node_alias": "managed_lab_node_a",
|
|
"scope": "wazuh_manager_registry_accepted_alias",
|
|
"selector_kind": "public_alias_only",
|
|
"runtime_write_allowed": false,
|
|
"owner_review_scope": "runtime_gate_review_only"
|
|
}
|
|
],
|
|
"required_owner_review_fields": [
|
|
"owner_review_intent",
|
|
"owner_reviewer_role",
|
|
"owner_review_decision",
|
|
"owner_review_decision_reason",
|
|
"target_selector_aliases",
|
|
"source_of_truth_diff_ref",
|
|
"check_mode_plan_ref",
|
|
"dry_run_evidence_ref",
|
|
"blast_radius_statement",
|
|
"maintenance_window_ref",
|
|
"rollback_plan_ref",
|
|
"rollback_owner",
|
|
"post_apply_verifier_ref",
|
|
"km_playbook_writeback_ref",
|
|
"followup_owner",
|
|
"audit_receipt_ref",
|
|
"runtime_boundary_ack",
|
|
"secret_boundary_ack",
|
|
"live_wazuh_query_boundary_ack"
|
|
],
|
|
"review_items": [
|
|
{
|
|
"item_id": "owner_decision",
|
|
"title": "Owner review decision for runtime-gate readiness",
|
|
"state_key": "owner_review_decision_committed",
|
|
"accepted": true,
|
|
"required_fields": [
|
|
"owner_reviewer_role",
|
|
"owner_review_decision",
|
|
"owner_review_decision_reason"
|
|
],
|
|
"next_gate": "staged allowlisted check-mode before any future runtime gate change"
|
|
},
|
|
{
|
|
"item_id": "target_selector",
|
|
"title": "Public alias target selector",
|
|
"state_key": "target_selector_reviewed",
|
|
"accepted": true,
|
|
"required_fields": [
|
|
"target_selector_aliases"
|
|
],
|
|
"next_gate": "target selector remains public aliases only"
|
|
},
|
|
{
|
|
"item_id": "source_of_truth_diff",
|
|
"title": "Source-of-truth diff reference",
|
|
"state_key": "source_of_truth_diff_reviewed",
|
|
"accepted": true,
|
|
"required_fields": [
|
|
"source_of_truth_diff_ref"
|
|
],
|
|
"next_gate": "diff must be re-read before any future controlled apply"
|
|
},
|
|
{
|
|
"item_id": "check_mode_dry_run",
|
|
"title": "Check-mode and dry-run evidence",
|
|
"state_key": "check_mode_dry_run_reviewed",
|
|
"accepted": true,
|
|
"required_fields": [
|
|
"check_mode_plan_ref",
|
|
"dry_run_evidence_ref"
|
|
],
|
|
"next_gate": "dry-run evidence stays redacted and no host output is stored"
|
|
},
|
|
{
|
|
"item_id": "rollback_and_maintenance",
|
|
"title": "Rollback and maintenance window",
|
|
"state_key": "rollback_maintenance_reviewed",
|
|
"accepted": true,
|
|
"required_fields": [
|
|
"rollback_plan_ref",
|
|
"rollback_owner",
|
|
"maintenance_window_ref"
|
|
],
|
|
"next_gate": "rollback owner and maintenance window must be revalidated before runtime"
|
|
},
|
|
{
|
|
"item_id": "post_apply_verifier",
|
|
"title": "Post-apply verifier",
|
|
"state_key": "post_apply_verifier_reviewed",
|
|
"accepted": true,
|
|
"required_fields": [
|
|
"post_apply_verifier_ref"
|
|
],
|
|
"next_gate": "future runtime action requires production post-apply verifier readback"
|
|
},
|
|
{
|
|
"item_id": "learning_writeback",
|
|
"title": "KM and PlayBook trust writeback",
|
|
"state_key": "learning_writeback_reviewed",
|
|
"accepted": true,
|
|
"required_fields": [
|
|
"km_playbook_writeback_ref",
|
|
"audit_receipt_ref"
|
|
],
|
|
"next_gate": "writeback receipt must be committed after verifier"
|
|
}
|
|
],
|
|
"outcome_lanes": [
|
|
"accepted_for_runtime_gate_owner_review_readback_only",
|
|
"request_runtime_gate_owner_review_supplement",
|
|
"request_runtime_gate_owner_review_decision_fix",
|
|
"request_target_selector_fix",
|
|
"request_runtime_boundary_ack_fix",
|
|
"quarantine_sensitive_payload",
|
|
"reject_runtime_action_request"
|
|
],
|
|
"forbidden_payloads": [
|
|
"secret_value",
|
|
"token_value",
|
|
"private_key",
|
|
"cookie",
|
|
"session",
|
|
"authorization_header",
|
|
"client.keys",
|
|
"raw_wazuh_payload",
|
|
"raw_agent_identity",
|
|
"raw_hostname",
|
|
"internal_ip",
|
|
"full_cli_output",
|
|
"full_journal",
|
|
"raw_dashboard_request",
|
|
"unredacted_screenshot",
|
|
"private_namespace",
|
|
"raw_env_file",
|
|
"raw_runtime_volume"
|
|
],
|
|
"forbidden_actions": [
|
|
"wazuh_api_live_query",
|
|
"wazuh_active_response",
|
|
"wazuh_agent_restart",
|
|
"wazuh_agent_reenroll",
|
|
"wazuh_manager_restart",
|
|
"host_write",
|
|
"systemd_restart",
|
|
"docker_restart",
|
|
"nginx_reload",
|
|
"firewall_change",
|
|
"kali_active_scan",
|
|
"credentialed_scan",
|
|
"exploit_attempt",
|
|
"secret_rotation",
|
|
"k8s_apply",
|
|
"argocd_sync",
|
|
"database_migration",
|
|
"force_push",
|
|
"repo_ref_delete",
|
|
"workflow_trigger"
|
|
],
|
|
"execution_boundaries": {
|
|
"active_scan_authorized": false,
|
|
"alertmanager_reload_authorized": false,
|
|
"auto_block_authorized": false,
|
|
"credentialed_scan_authorized": false,
|
|
"firewall_change_authorized": false,
|
|
"host_write_authorized": false,
|
|
"kali_execute_authorized": false,
|
|
"kali_scan_authorized": false,
|
|
"nginx_reload_authorized": false,
|
|
"production_write_authorized": false,
|
|
"runtime_execution_authorized": false,
|
|
"runtime_gate_open": false,
|
|
"secret_value_collection_allowed": false,
|
|
"telegram_send_authorized": false,
|
|
"wazuh_active_response_authorized": false,
|
|
"wazuh_api_live_query_authorized": false,
|
|
"not_authorization": true
|
|
},
|
|
"no_false_green_rules": [
|
|
"Owner review packet accepted does not open runtime gate.",
|
|
"Committed owner review readback only records review readiness and does not query live Wazuh.",
|
|
"Target selectors are public aliases only and do not authorize host writes.",
|
|
"Check-mode and dry-run evidence references do not authorize active response.",
|
|
"Maintenance window, rollback, verifier, and writeback readiness must be revalidated before any future runtime action."
|
|
]
|
|
}
|