awoooi/docs/security/wazuh-readonly-live-metadata-env-gate.snapshot.json

{
  "blocked_actions": [
    "collect_wazuh_password",
    "collect_wazuh_token",
    "collect_wazuh_raw_payload",
    "hardcode_wazuh_base_url",
    "hardcode_wazuh_username",
    "hardcode_wazuh_password",
    "disable_tls_verification",
    "enable_env_before_production_route_readback",
    "enable_env_without_secret_owner",
    "enable_wazuh_live_metadata_without_owner_gate",
    "enable_wazuh_active_response",
    "wazuh_manager_restart",
    "wazuh_rule_change",
    "wazuh_decoder_change",
    "k8s_secret_manual_patch",
    "argocd_manual_sync",
    "docker_restart",
    "nginx_or_gateway_workaround_for_404",
    "firewall_change",
    "host_write",
    "kali_active_scan",
    "production_deploy_without_release_lane",
    "mark_predeploy_404_as_passed_readback"
  ],
  "execution_boundaries": {
    "argocd_sync_authorized": false,
    "docker_restart_authorized": false,
    "firewall_change_authorized": false,
    "host_write_authorized": false,
    "k8s_secret_patch_authorized": false,
    "kali_active_scan_authorized": false,
    "nginx_gateway_workaround_authorized": false,
    "not_authorization": true,
    "production_deploy_authorized": false,
    "raw_wazuh_payload_storage_allowed": false,
    "repo_write_authorized": false,
    "runtime_execution_authorized": false,
    "secret_value_collection_allowed": false,
    "wazuh_active_response_authorized": false,
    "wazuh_api_live_query_authorized": false
  },
  "generated_at": "2026-06-25T11:19:38+08:00",
  "live_metadata_candidate": {
    "candidate_id": "iwooos_wazuh_readonly_live_metadata_env",
    "not_authorization": true,
    "owner_response_accepted": true,
    "owner_response_received": true,
    "post_enable_readback_command": "python3 scripts/security/wazuh-readonly-production-readback.py --json",
    "production_route_readback_ref": "production_readback_passed_http_200_disabled_owner_gate",
    "readonly_account_scope_ref": "readonly-account-scope-ref-redacted-v1",
    "runtime_gate": false,
    "secret_source_metadata_ref": "secret-source-metadata-ref-redacted-v1",
    "server_side_env_keys": [
      "IWOOOS_WAZUH_READONLY_ENABLED",
      "WAZUH_API_BASE_URL",
      "WAZUH_API_USERNAME",
      "WAZUH_API_PASSWORD"
    ],
    "status": "ready_for_server_side_env_enable_review",
    "wazuh_active_response_authorized": false,
    "wazuh_api_live_query_authorized": false,
    "wazuh_manager_health_ref": "wazuh-manager-health-ref-redacted-v1"
  },
  "mode": "repo_gate_no_secret_no_runtime_no_wazuh_query",
  "operator_interpretation": [
    "此 gate 不代表 Wazuh live metadata 已啟用，只代表啟用前欄位、metadata refs 與禁止動作已固定。",
    "Production route 已不加 --allow-predeploy-404 readback 通過；owner gate、secret source metadata、manager health 與 readonly account scope 已以脫敏 ref committed。",
    "secret handling 只能提供注入來源 metadata 與 owner，不得提交密碼、token、hash、partial secret 或 raw env。",
    "Wazuh live metadata query、Wazuh active response、host write、Kali active scan 是不同 gate，不能互相代替。"
  ],
  "outcome_lanes": [
    "waiting_release_readback",
    "waiting_live_metadata_owner_response",
    "request_secret_source_metadata_supplement",
    "request_wazuh_manager_health_supplement",
    "request_readonly_account_scope_supplement",
    "quarantine_secret_or_raw_payload",
    "reject_runtime_workaround",
    "ready_for_live_metadata_reviewer_validation",
    "ready_for_server_side_env_enable_review",
    "waiting_post_enable_readback",
    "waiting_runtime_gate"
  ],
  "required_owner_fields": [
    "wazuh_live_metadata_owner",
    "release_readback_ref",
    "secret_injection_owner",
    "secret_source_metadata_ref",
    "wazuh_manager_health_ref",
    "wazuh_api_tls_validation_ref",
    "readonly_account_scope_ref",
    "agent_alias_mapping_policy",
    "post_enable_readback_command",
    "rollback_owner",
    "maintenance_window",
    "validation_plan",
    "no_secret_value_attestation",
    "no_raw_payload_attestation",
    "active_response_separate_gate_ack"
  ],
  "reviewer_checks": [
    "production_route_readback_passed_before_env_enable",
    "server_side_env_keys_present_as_metadata_only",
    "secret_value_absent",
    "secret_source_metadata_ref_present",
    "wazuh_api_base_url_https_only",
    "readonly_account_scope_present",
    "wazuh_manager_health_ref_present",
    "agent_alias_mapping_policy_present",
    "post_enable_readback_command_present",
    "rollback_owner_present",
    "maintenance_window_present",
    "validation_plan_present",
    "no_raw_wazuh_payload",
    "active_response_gate_separate",
    "runtime_gate_stays_zero_until_reviewer_acceptance"
  ],
  "schema_version": "iwooos_wazuh_readonly_live_metadata_env_gate_v1",
  "server_side_env_keys": [
    "IWOOOS_WAZUH_READONLY_ENABLED",
    "WAZUH_API_BASE_URL",
    "WAZUH_API_USERNAME",
    "WAZUH_API_PASSWORD"
  ],
  "status": "ready_for_server_side_env_enable_review_no_secret_collection",
  "summary": {
    "blocked_action_count": 23,
    "host_write_authorized_count": 0,
    "live_metadata_owner_response_accepted_count": 1,
    "live_metadata_owner_response_received_count": 1,
    "outcome_lane_count": 11,
    "post_enable_readback_passed_count": 0,
    "production_route_readback_passed_count": 1,
    "readonly_account_scope_accepted_count": 1,
    "required_owner_field_count": 15,
    "reviewer_check_count": 15,
    "runtime_gate_count": 0,
    "secret_source_metadata_accepted_count": 1,
    "server_side_env_key_count": 4,
    "wazuh_active_response_authorized_count": 0,
    "wazuh_api_live_query_authorized_count": 0,
    "wazuh_manager_health_ref_accepted_count": 1
  }
}