146 lines
5.4 KiB
JSON
146 lines
5.4 KiB
JSON
{
|
||
"blocked_actions": [
|
||
"collect_wazuh_password",
|
||
"collect_wazuh_token",
|
||
"collect_wazuh_raw_payload",
|
||
"hardcode_wazuh_base_url",
|
||
"hardcode_wazuh_username",
|
||
"hardcode_wazuh_password",
|
||
"disable_tls_verification",
|
||
"enable_env_before_production_route_readback",
|
||
"enable_env_without_secret_owner",
|
||
"enable_wazuh_live_metadata_without_owner_gate",
|
||
"enable_wazuh_active_response",
|
||
"wazuh_manager_restart",
|
||
"wazuh_rule_change",
|
||
"wazuh_decoder_change",
|
||
"k8s_secret_manual_patch",
|
||
"argocd_manual_sync",
|
||
"docker_restart",
|
||
"nginx_or_gateway_workaround_for_404",
|
||
"firewall_change",
|
||
"host_write",
|
||
"kali_active_scan",
|
||
"production_deploy_without_release_lane",
|
||
"mark_predeploy_404_as_passed_readback"
|
||
],
|
||
"execution_boundaries": {
|
||
"argocd_sync_authorized": false,
|
||
"docker_restart_authorized": false,
|
||
"firewall_change_authorized": false,
|
||
"host_write_authorized": false,
|
||
"k8s_secret_patch_authorized": false,
|
||
"kali_active_scan_authorized": false,
|
||
"nginx_gateway_workaround_authorized": false,
|
||
"not_authorization": true,
|
||
"production_deploy_authorized": false,
|
||
"raw_wazuh_payload_storage_allowed": false,
|
||
"repo_write_authorized": false,
|
||
"runtime_execution_authorized": false,
|
||
"secret_value_collection_allowed": false,
|
||
"wazuh_active_response_authorized": false,
|
||
"wazuh_api_live_query_authorized": false
|
||
},
|
||
"generated_at": "2026-06-25T11:19:38+08:00",
|
||
"live_metadata_candidate": {
|
||
"candidate_id": "iwooos_wazuh_readonly_live_metadata_env",
|
||
"not_authorization": true,
|
||
"owner_response_accepted": false,
|
||
"owner_response_received": false,
|
||
"post_enable_readback_command": "python3 scripts/security/wazuh-readonly-production-readback.py --json",
|
||
"production_route_readback_ref": "production_readback_passed_http_200_disabled_owner_gate",
|
||
"readonly_account_scope_ref": null,
|
||
"runtime_gate": false,
|
||
"secret_source_metadata_ref": null,
|
||
"server_side_env_keys": [
|
||
"IWOOOS_WAZUH_READONLY_ENABLED",
|
||
"WAZUH_API_BASE_URL",
|
||
"WAZUH_API_USERNAME",
|
||
"WAZUH_API_PASSWORD"
|
||
],
|
||
"status": "waiting_live_metadata_owner_response",
|
||
"wazuh_active_response_authorized": false,
|
||
"wazuh_api_live_query_authorized": false,
|
||
"wazuh_manager_health_ref": null
|
||
},
|
||
"mode": "repo_gate_no_secret_no_runtime_no_wazuh_query",
|
||
"operator_interpretation": [
|
||
"此 gate 不代表 Wazuh live metadata 已啟用，只代表啟用前欄位與禁止動作已固定。",
|
||
"Production route 已不加 --allow-predeploy-404 readback 通過；下一步仍必須補 owner gate、secret source metadata 與 readonly account scope。",
|
||
"secret handling 只能提供注入來源 metadata 與 owner，不得提交密碼、token、hash、partial secret 或 raw env。",
|
||
"Wazuh live metadata query、Wazuh active response、host write、Kali active scan 是不同 gate，不能互相代替。"
|
||
],
|
||
"outcome_lanes": [
|
||
"waiting_release_readback",
|
||
"waiting_live_metadata_owner_response",
|
||
"request_secret_source_metadata_supplement",
|
||
"request_wazuh_manager_health_supplement",
|
||
"request_readonly_account_scope_supplement",
|
||
"quarantine_secret_or_raw_payload",
|
||
"reject_runtime_workaround",
|
||
"ready_for_live_metadata_reviewer_validation",
|
||
"waiting_post_enable_readback",
|
||
"waiting_runtime_gate"
|
||
],
|
||
"required_owner_fields": [
|
||
"wazuh_live_metadata_owner",
|
||
"release_readback_ref",
|
||
"secret_injection_owner",
|
||
"secret_source_metadata_ref",
|
||
"wazuh_manager_health_ref",
|
||
"wazuh_api_tls_validation_ref",
|
||
"readonly_account_scope_ref",
|
||
"agent_alias_mapping_policy",
|
||
"post_enable_readback_command",
|
||
"rollback_owner",
|
||
"maintenance_window",
|
||
"validation_plan",
|
||
"no_secret_value_attestation",
|
||
"no_raw_payload_attestation",
|
||
"active_response_separate_gate_ack"
|
||
],
|
||
"reviewer_checks": [
|
||
"production_route_readback_passed_before_env_enable",
|
||
"server_side_env_keys_present_as_metadata_only",
|
||
"secret_value_absent",
|
||
"secret_source_metadata_ref_present",
|
||
"wazuh_api_base_url_https_only",
|
||
"readonly_account_scope_present",
|
||
"wazuh_manager_health_ref_present",
|
||
"agent_alias_mapping_policy_present",
|
||
"post_enable_readback_command_present",
|
||
"rollback_owner_present",
|
||
"maintenance_window_present",
|
||
"validation_plan_present",
|
||
"no_raw_wazuh_payload",
|
||
"active_response_gate_separate",
|
||
"runtime_gate_stays_zero_until_reviewer_acceptance"
|
||
],
|
||
"schema_version": "iwooos_wazuh_readonly_live_metadata_env_gate_v1",
|
||
"server_side_env_keys": [
|
||
"IWOOOS_WAZUH_READONLY_ENABLED",
|
||
"WAZUH_API_BASE_URL",
|
||
"WAZUH_API_USERNAME",
|
||
"WAZUH_API_PASSWORD"
|
||
],
|
||
"status": "blocked_waiting_live_metadata_owner_response",
|
||
"summary": {
|
||
"blocked_action_count": 23,
|
||
"host_write_authorized_count": 0,
|
||
"live_metadata_owner_response_accepted_count": 0,
|
||
"live_metadata_owner_response_received_count": 0,
|
||
"outcome_lane_count": 10,
|
||
"post_enable_readback_passed_count": 0,
|
||
"production_route_readback_passed_count": 1,
|
||
"readonly_account_scope_accepted_count": 0,
|
||
"required_owner_field_count": 15,
|
||
"reviewer_check_count": 15,
|
||
"runtime_gate_count": 0,
|
||
"secret_source_metadata_accepted_count": 0,
|
||
"server_side_env_key_count": 4,
|
||
"wazuh_active_response_authorized_count": 0,
|
||
"wazuh_api_live_query_authorized_count": 0,
|
||
"wazuh_manager_health_ref_accepted_count": 0
|
||
}
|
||
}
|