7f504ca52e
All checks were successful
CD Pipeline / workflow-shape (push) Successful in 0s
CD Pipeline / cancel-stale-cd (push) Has been skipped
CD Pipeline / tests (push) Successful in 2m36s
CD Pipeline / build-and-deploy (push) Successful in 15m32s
CD Pipeline / post-deploy-checks (push) Successful in 1m58s
433 lines
15 KiB
TypeScript
433 lines
15 KiB
TypeScript
export type SecurityControlStatus = "ready" | "degraded";
|
|
|
|
const PUBLIC_DISCOVERY_COLLECTOR_IDS = new Set([
|
|
"k8s_replicasets",
|
|
"k8s_nodes",
|
|
"k8s_pods",
|
|
"k8s_deployments",
|
|
"k8s_statefulsets",
|
|
"k8s_daemonsets",
|
|
"k8s_services",
|
|
"k8s_configmaps",
|
|
"k8s_persistentvolumeclaims",
|
|
"k8s_ingresses",
|
|
"k8s_cronjobs",
|
|
"prometheus_targets",
|
|
"database_catalog",
|
|
"ai_catalog",
|
|
"gitea_bundle_backup",
|
|
"gitea_ci",
|
|
"domain_tls_inventory",
|
|
]);
|
|
|
|
export type SecurityControlPlaneSummary = {
|
|
source_count: number;
|
|
ready_source_count: number;
|
|
unavailable_source_count: number;
|
|
managed_asset_count: number;
|
|
expected_asset_type_count: number;
|
|
present_asset_type_count: number;
|
|
asset_type_coverage_percent: number;
|
|
scope_count: number;
|
|
controlled_scope_count: number;
|
|
unowned_asset_count: number;
|
|
stale_asset_count: number;
|
|
orphan_asset_count: number;
|
|
relationship_count: number;
|
|
package_digest_unpinned_count?: number;
|
|
forbidden_github_supply_chain_asset_count?: number;
|
|
certificate_live_unverified_count?: number;
|
|
certificate_live_unhealthy_count?: number;
|
|
automation_coverage_green_percent: number;
|
|
automation_coverage_unknown_count: number;
|
|
compliance_violation_count: number;
|
|
compliance_unknown_count: number;
|
|
nist_controlled_percent: number;
|
|
security_program_domain_count: number;
|
|
security_program_controlled_domain_count: number;
|
|
security_program_controlled_percent: number;
|
|
overall_security_completion_percent: number;
|
|
siem_stage_count: number;
|
|
siem_observed_stage_count: number;
|
|
siem_stage_coverage_percent: number;
|
|
ai_loop_stage_count: number;
|
|
ai_loop_observed_stage_count: number;
|
|
ai_loop_stage_coverage_percent: number;
|
|
verified_remediation_receipt_count_24h: number;
|
|
active_work_item_count: number;
|
|
};
|
|
|
|
export type SecurityControlPlaneFunction = {
|
|
function_id: string;
|
|
label: string;
|
|
controlled_percent: number;
|
|
status: string;
|
|
};
|
|
|
|
export type SecurityControlPlaneStage = {
|
|
stage_id: string;
|
|
label: string;
|
|
status: "observed" | "missing";
|
|
evidence_count_24h?: number;
|
|
receipt_count_24h?: number;
|
|
};
|
|
|
|
export type SecurityControlPlaneScope = {
|
|
scope_id: string;
|
|
label: string;
|
|
managed_asset_count: number;
|
|
expected_type_count: number;
|
|
present_type_count: number;
|
|
missing_type_count: number;
|
|
type_coverage_percent: number;
|
|
status: string;
|
|
};
|
|
|
|
export type SecurityControlPlaneWorkItem = {
|
|
work_item_id: string;
|
|
priority: string;
|
|
control_id: string;
|
|
title: string;
|
|
gap_count: number;
|
|
status: string;
|
|
next_action: string;
|
|
};
|
|
|
|
export type SecurityControlPlaneSupplyChain = {
|
|
package_asset_count: number;
|
|
package_inventory_evidenced: boolean;
|
|
package_digest_pinned_count: number;
|
|
package_digest_unpinned_count: number;
|
|
forbidden_github_supply_chain_asset_count: number;
|
|
github_freeze_compliant: boolean;
|
|
runtime_image_policy_compliant: boolean;
|
|
raw_image_identity_returned: false;
|
|
registry_api_called: false;
|
|
github_api_used: false;
|
|
};
|
|
|
|
export type SecurityControlPlaneCertificateInventory = {
|
|
certificate_asset_count: number;
|
|
live_tls_verified_count: number;
|
|
live_tls_evidenced_count?: number;
|
|
live_tls_healthy_count?: number;
|
|
live_tls_unverified_count: number;
|
|
live_tls_unhealthy_count?: number;
|
|
live_tls_health_proven: boolean;
|
|
raw_certificate_path_returned: false;
|
|
certificate_material_read: false;
|
|
private_key_material_read: false;
|
|
};
|
|
|
|
export type SecurityStrictRuntimeCompletion = {
|
|
schema_version: "ai_agent_strict_runtime_completion_v2";
|
|
runtime_contract_schema_version: "ai_automation_runtime_completion_contract_v2";
|
|
contract_compatible: boolean;
|
|
completion_percent: number;
|
|
required_stage_count: number;
|
|
present_stage_count: number;
|
|
missing_stage_count: number;
|
|
same_run_correlation: boolean;
|
|
full_trace_same_run_correlation_proven: boolean;
|
|
execution_loop_closed: boolean;
|
|
closed: boolean;
|
|
reason_code: string | null;
|
|
cache_fallback_active: boolean;
|
|
raw_run_identity_returned: false;
|
|
raw_stage_receipts_returned: false;
|
|
};
|
|
|
|
export type SecurityAssetControlPlanePayload = {
|
|
schema_version: "iwooos_security_asset_control_plane_v1";
|
|
generated_at: string;
|
|
status: SecurityControlStatus;
|
|
source_status: string;
|
|
reason_code?: string;
|
|
summary: SecurityControlPlaneSummary;
|
|
discovery: {
|
|
latest_status: string;
|
|
latest_scan_depth: string;
|
|
latest_started_at: string | null;
|
|
latest_ended_at: string | null;
|
|
latest_success_at: string | null;
|
|
age_seconds: number | null;
|
|
freshness_slo_seconds: number;
|
|
fresh: boolean;
|
|
latest_total_assets: number;
|
|
new_assets: number;
|
|
modified_assets: number;
|
|
disappeared_assets: number;
|
|
failure_reason_code: string | null;
|
|
failed_collector_count: number;
|
|
failed_collector_ids: string[];
|
|
raw_error_returned: false;
|
|
};
|
|
asset_scopes: SecurityControlPlaneScope[];
|
|
nist_csf_functions: SecurityControlPlaneFunction[];
|
|
security_program_domains: Array<{
|
|
domain_id: string;
|
|
label: string;
|
|
controlled_percent: number;
|
|
status: string;
|
|
evidence_count: number;
|
|
gap_code: string | null;
|
|
}>;
|
|
completion: {
|
|
method: "equal_weighted_runtime_conservative_v1";
|
|
dimension_count: number;
|
|
overall_percent: number;
|
|
strict_runtime_closure_percent: number;
|
|
dimensions: Array<{
|
|
dimension_id: string;
|
|
completion_percent: number;
|
|
}>;
|
|
};
|
|
siem: {
|
|
pipeline: SecurityControlPlaneStage[];
|
|
incident_total_24h?: number;
|
|
open_incident_count_24h?: number;
|
|
resolved_incident_count_24h?: number;
|
|
noisy_rule_count?: number;
|
|
mean_time_to_resolve_minutes_24h?: number | null;
|
|
};
|
|
ai_automation: {
|
|
stages: SecurityControlPlaneStage[];
|
|
aggregate_stage_coverage_percent: number;
|
|
accepted_ai_trace_count: number;
|
|
verified_remediation_receipt_count: number;
|
|
rollback_receipt_count: number;
|
|
failed_operation_count: number;
|
|
same_run_closed_loop_proven: boolean;
|
|
same_run_closed_loop_count: number;
|
|
strict_runtime_completion: SecurityStrictRuntimeCompletion;
|
|
};
|
|
security_audit: {
|
|
k8s_execution_audit_count_24h: number;
|
|
k8s_execution_failure_count_24h: number;
|
|
mcp_tool_audit_count_24h: number;
|
|
mcp_tool_failure_count_24h: number;
|
|
asset_change_event_count_24h: number;
|
|
automation_operation_count_24h: number;
|
|
automation_failure_count_24h: number;
|
|
ai_trace_count_24h: number;
|
|
accepted_ai_trace_count_24h: number;
|
|
immutable_external_audit_store_evidenced: boolean;
|
|
};
|
|
supply_chain?: SecurityControlPlaneSupplyChain;
|
|
certificate_inventory?: SecurityControlPlaneCertificateInventory;
|
|
source_health: Array<{
|
|
source_id: string;
|
|
status: "ready" | "unavailable";
|
|
reason_code: string | null;
|
|
}>;
|
|
work_items: SecurityControlPlaneWorkItem[];
|
|
boundaries: {
|
|
aggregate_only: boolean;
|
|
raw_asset_identity_returned: boolean;
|
|
raw_event_payload_returned: boolean;
|
|
raw_discovery_error_returned: boolean;
|
|
secret_value_collection_allowed: boolean;
|
|
live_scan_triggered: boolean;
|
|
runtime_action_triggered: boolean;
|
|
completion_requires_same_run_receipts: boolean;
|
|
};
|
|
};
|
|
|
|
function isRecord(value: unknown): value is Record<string, unknown> {
|
|
return typeof value === "object" && value !== null && !Array.isArray(value);
|
|
}
|
|
|
|
export function isSecurityAssetControlPlanePayload(
|
|
value: unknown,
|
|
): value is SecurityAssetControlPlanePayload {
|
|
if (!isRecord(value)) return false;
|
|
if (value.schema_version !== "iwooos_security_asset_control_plane_v1")
|
|
return false;
|
|
if (!isRecord(value.summary) || !isRecord(value.boundaries)) return false;
|
|
if (
|
|
!isRecord(value.discovery) ||
|
|
!Array.isArray(value.discovery.failed_collector_ids) ||
|
|
!value.discovery.failed_collector_ids.every(
|
|
(collectorId) =>
|
|
typeof collectorId === "string" &&
|
|
PUBLIC_DISCOVERY_COLLECTOR_IDS.has(collectorId),
|
|
) ||
|
|
typeof value.discovery.failed_collector_count !== "number" ||
|
|
value.discovery.failed_collector_count !==
|
|
value.discovery.failed_collector_ids.length ||
|
|
value.discovery.raw_error_returned !== false
|
|
) {
|
|
return false;
|
|
}
|
|
if (
|
|
!Array.isArray(value.asset_scopes) ||
|
|
!Array.isArray(value.nist_csf_functions) ||
|
|
!Array.isArray(value.security_program_domains)
|
|
) {
|
|
return false;
|
|
}
|
|
if (!isRecord(value.siem) || !Array.isArray(value.siem.pipeline))
|
|
return false;
|
|
if (
|
|
!isRecord(value.ai_automation) ||
|
|
!Array.isArray(value.ai_automation.stages)
|
|
) {
|
|
return false;
|
|
}
|
|
const strictRuntime = value.ai_automation.strict_runtime_completion;
|
|
if (
|
|
!isRecord(strictRuntime) ||
|
|
strictRuntime.schema_version !== "ai_agent_strict_runtime_completion_v2" ||
|
|
strictRuntime.runtime_contract_schema_version !==
|
|
"ai_automation_runtime_completion_contract_v2" ||
|
|
typeof strictRuntime.contract_compatible !== "boolean" ||
|
|
typeof strictRuntime.completion_percent !== "number" ||
|
|
typeof strictRuntime.required_stage_count !== "number" ||
|
|
typeof strictRuntime.present_stage_count !== "number" ||
|
|
typeof strictRuntime.missing_stage_count !== "number" ||
|
|
typeof strictRuntime.same_run_correlation !== "boolean" ||
|
|
typeof strictRuntime.full_trace_same_run_correlation_proven !== "boolean" ||
|
|
typeof strictRuntime.execution_loop_closed !== "boolean" ||
|
|
typeof strictRuntime.closed !== "boolean" ||
|
|
typeof strictRuntime.cache_fallback_active !== "boolean" ||
|
|
!(
|
|
strictRuntime.reason_code === null ||
|
|
typeof strictRuntime.reason_code === "string"
|
|
) ||
|
|
strictRuntime.raw_run_identity_returned !== false ||
|
|
strictRuntime.raw_stage_receipts_returned !== false ||
|
|
strictRuntime.required_stage_count !== 18 ||
|
|
strictRuntime.present_stage_count < 0 ||
|
|
strictRuntime.present_stage_count > strictRuntime.required_stage_count ||
|
|
strictRuntime.missing_stage_count !==
|
|
strictRuntime.required_stage_count - strictRuntime.present_stage_count ||
|
|
value.ai_automation.same_run_closed_loop_proven !== strictRuntime.closed ||
|
|
(strictRuntime.closed &&
|
|
(!strictRuntime.contract_compatible ||
|
|
strictRuntime.completion_percent !== 100 ||
|
|
!strictRuntime.same_run_correlation ||
|
|
!strictRuntime.full_trace_same_run_correlation_proven ||
|
|
!strictRuntime.execution_loop_closed)) ||
|
|
(!strictRuntime.closed && strictRuntime.completion_percent !== 0)
|
|
) {
|
|
return false;
|
|
}
|
|
if (value.supply_chain !== undefined) {
|
|
if (!isRecord(value.supply_chain)) return false;
|
|
if (
|
|
typeof value.supply_chain.package_asset_count !== "number" ||
|
|
typeof value.supply_chain.package_inventory_evidenced !== "boolean" ||
|
|
typeof value.supply_chain.package_digest_pinned_count !== "number" ||
|
|
typeof value.supply_chain.package_digest_unpinned_count !== "number" ||
|
|
typeof value.supply_chain.forbidden_github_supply_chain_asset_count !==
|
|
"number" ||
|
|
typeof value.supply_chain.github_freeze_compliant !== "boolean" ||
|
|
typeof value.supply_chain.runtime_image_policy_compliant !== "boolean" ||
|
|
value.supply_chain.raw_image_identity_returned !== false ||
|
|
value.supply_chain.registry_api_called !== false ||
|
|
value.supply_chain.github_api_used !== false
|
|
) {
|
|
return false;
|
|
}
|
|
}
|
|
if (value.certificate_inventory !== undefined) {
|
|
if (!isRecord(value.certificate_inventory)) return false;
|
|
if (
|
|
typeof value.certificate_inventory.certificate_asset_count !== "number" ||
|
|
typeof value.certificate_inventory.live_tls_verified_count !== "number" ||
|
|
(value.certificate_inventory.live_tls_evidenced_count !== undefined &&
|
|
typeof value.certificate_inventory.live_tls_evidenced_count !==
|
|
"number") ||
|
|
(value.certificate_inventory.live_tls_healthy_count !== undefined &&
|
|
typeof value.certificate_inventory.live_tls_healthy_count !==
|
|
"number") ||
|
|
typeof value.certificate_inventory.live_tls_unverified_count !==
|
|
"number" ||
|
|
(value.certificate_inventory.live_tls_unhealthy_count !== undefined &&
|
|
typeof value.certificate_inventory.live_tls_unhealthy_count !==
|
|
"number") ||
|
|
typeof value.certificate_inventory.live_tls_health_proven !== "boolean" ||
|
|
value.certificate_inventory.raw_certificate_path_returned !== false ||
|
|
value.certificate_inventory.certificate_material_read !== false ||
|
|
value.certificate_inventory.private_key_material_read !== false
|
|
) {
|
|
return false;
|
|
}
|
|
}
|
|
return (
|
|
typeof value.summary.managed_asset_count === "number" &&
|
|
typeof value.summary.source_count === "number" &&
|
|
Array.isArray(value.source_health) &&
|
|
typeof value.summary.nist_controlled_percent === "number" &&
|
|
typeof value.summary.overall_security_completion_percent === "number" &&
|
|
isRecord(value.completion) &&
|
|
value.completion.method === "equal_weighted_runtime_conservative_v1" &&
|
|
Array.isArray(value.completion.dimensions) &&
|
|
value.boundaries.aggregate_only === true &&
|
|
value.boundaries.raw_asset_identity_returned === false &&
|
|
value.boundaries.raw_event_payload_returned === false &&
|
|
value.boundaries.raw_discovery_error_returned === false &&
|
|
value.boundaries.secret_value_collection_allowed === false &&
|
|
value.boundaries.live_scan_triggered === false &&
|
|
value.boundaries.runtime_action_triggered === false
|
|
);
|
|
}
|
|
|
|
export type SecurityControlPlaneTone = "healthy" | "warning" | "critical";
|
|
|
|
export function securityControlPlaneTone(
|
|
payload: SecurityAssetControlPlanePayload,
|
|
): SecurityControlPlaneTone {
|
|
if (payload.status !== "ready" || !payload.discovery.fresh) return "critical";
|
|
if (
|
|
!payload.supply_chain ||
|
|
!payload.supply_chain.package_inventory_evidenced ||
|
|
payload.supply_chain.package_digest_unpinned_count > 0 ||
|
|
payload.supply_chain.forbidden_github_supply_chain_asset_count > 0 ||
|
|
!payload.supply_chain.runtime_image_policy_compliant
|
|
) {
|
|
return "critical";
|
|
}
|
|
if (
|
|
!payload.certificate_inventory ||
|
|
payload.certificate_inventory.certificate_asset_count === 0 ||
|
|
payload.certificate_inventory.live_tls_unverified_count > 0 ||
|
|
(payload.certificate_inventory.live_tls_unhealthy_count ?? 0) > 0 ||
|
|
!payload.certificate_inventory.live_tls_health_proven
|
|
) {
|
|
return "critical";
|
|
}
|
|
if (
|
|
payload.summary.compliance_violation_count > 0 ||
|
|
payload.summary.nist_controlled_percent < 50 ||
|
|
payload.summary.siem_stage_coverage_percent < 50 ||
|
|
payload.summary.ai_loop_stage_coverage_percent < 50
|
|
) {
|
|
return "critical";
|
|
}
|
|
if (
|
|
payload.summary.unowned_asset_count > 0 ||
|
|
payload.summary.orphan_asset_count > 0 ||
|
|
payload.summary.automation_coverage_unknown_count > 0 ||
|
|
payload.summary.compliance_unknown_count > 0 ||
|
|
!payload.ai_automation.same_run_closed_loop_proven
|
|
) {
|
|
return "warning";
|
|
}
|
|
return "healthy";
|
|
}
|
|
|
|
export function topSecurityControlPlaneWorkItems(
|
|
payload: SecurityAssetControlPlanePayload,
|
|
limit = 3,
|
|
): SecurityControlPlaneWorkItem[] {
|
|
const rank: Record<string, number> = { P0: 0, P1: 1, P2: 2, P3: 3 };
|
|
return [...payload.work_items]
|
|
.sort(
|
|
(left, right) =>
|
|
(rank[left.priority] ?? 99) - (rank[right.priority] ?? 99) ||
|
|
left.work_item_id.localeCompare(right.work_item_id),
|
|
)
|
|
.slice(0, Math.max(0, limit));
|
|
}
|