security(discovery): enforce Zone isolation and retire unsafe legacy writers

Browse Source

Bind Agent observations, review, enrichment and telemetry to current Zone
and inventory authority. Preserve immutable MAC ownership and historical
snapshots with stale-result rejection and transactional security audits.

Retire unbound direct/range/scheduled discovery and one/bulk legacy summary
writes in both modes. Require reconciled exact inventory identity or
explicit Zone-scoped IP selection for CSV metadata imports.

Independent Blocker #1 application-security re-audit: PASS on tree
cf863aadc9. Evidence: 141 focused PostgreSQL/HTTP
tests passed; Chromium and PowerShell checks passed. Two documented baseline
source assertions remain unchanged. Production deployment is not approved.

...

This commit is contained in:

lussierj committed 2026-10-17 00:45:04 +00:00

1 parent e898f283ab

commit 8b0d32cd6b

26 files changed

+3798 -4092

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

backend/tests/test_discovery_security_postgres.py

+1211

File diff suppressed because it is too large. Load diff