|
|
948774f7fc
|
docs(specs): integrate CM-WALL-EGRESS-2026-06 v0.1.0-draft + agent context
Spec stored under docs/specs/ for source of truth.
Module : WALL (paire complémentaire WALL↔MIND), compagnon de
CM-MESH-MPCIE-2026-06. Détection egress + corrélation menaces sur
Gondwana-Air.
Frontière R1/R2 intangible :
R1 — métadonnées (flux, DNS, TLS-méta, IP-intel, NIDS) : licite
sur accès ouvert, détection passive par défaut.
R2 — contenu (TLS-break, DPI profonde, file-extract) : segments
consentis/gérés UNIQUEMENT, opt-in journalisé.
Couches L0-L5 décrites avec outils ARM64 (Suricata 7.x, Zeek,
unbound+RPZ, goflow2/nfdump, feeds abuse.ch/ET/Spamhaus/MISP).
Contrainte ECH 2026 actée : SNI chiffré → poids sur L0 flux + L2
JA4 + L3 IP-intel + cadence, jamais sur SNI seul.
packages/secubox-egress/CLAUDE.md : agent context complet, DoD §1,
garde-fous §2 (R1/R2 intangible, OPAD, ECH-ready, secrets hors
TOML, LCEN), arborescence §3, TOML §4, API §5 (5 endpoints), NIDS
§6, .deb §7, ordre tâches §8, tests bench Maurienne §9.
Refus runtime câblé dans api.py : POST /wall/quarantine avec
regime=r2 + vlan=open_access_vlan → 403 (interception illicite).
Corrélation correlate.py exige multi_signal_threshold concordants
avant verdict quarantine (anti-faux-positif cloud-intel).
|
2026-06-02 11:13:44 +02:00 |
|
|
|
8a853ba3e8
|
docs(specs): integrate CM-MESH-MPCIE-2026-06 v0.2.1-draft
Spec stored under docs/specs/ for source of truth, referenced by the
two module CLAUDE.md files.
Major changes from v0.1.0:
v0.2.0 — hardware matrix FROZEN on real inventory :
- Backhaul WLE900VX / QCA9880 / ath10k_pci (mPCIe PCIe, 3x3)
- Access MT7632U / mt76x2u (USB) or AR9271 / ath9k_htc (firmware-free)
- MT7615 + ath9k mPCIe ABANDONED (not in stock)
- Globalscale NXP card DISCARDED (no mesh point, opaque firmware)
- BLE hole CONFIRMED (no LESC controller in stock)
- ath10k 802.11s = validation item #1
v0.2.1 — refinements :
- "S305-8946-1A4C" shielded modules IDENTIFIED = MT7632U (open #6 closed)
- Method clarified : USB enumeration over mPCIe adapter is artifact ;
chip ID (MT7632U = USB silicon) is what determines bus
- Multi-radio per node ACTED (1 mPCIe + 2 USB3 = up to 3 radios)
- mt76 backhaul fallback documented if ath10k 802.11s disappoints
CLAUDE.md updates:
- secubox-mesh : new prologue section reflecting v0.2.1 matrix figée,
validation priority items, mt76 fallback noted. Code stays
chipset-agnostic, default TOML now reflects retained stock.
- secubox-mesh-bt : new prologue section flagging BLE hardware hole
blocks S2/S3 ; Option A (source BLE 5.x mainline) vs Option B
(ESP32 front-end, in stock) decision REQUIRED before gatt/oob/
session implementation. Architecture impact documented.
|
2026-06-02 11:06:40 +02:00 |
|
