51 lines
2.0 KiB
Python
51 lines
2.0 KiB
Python
# ============================================================
|
||
# 审计完整性告警 v1（moduleId: core-audit-alerts, 可重生 ✅）
|
||
# plan.md §3.6 / 矩阵「全审计」：链/锚定/镜像异常的聚合告警
|
||
# ============================================================
|
||
from __future__ import annotations # 前向类型引用
|
||
|
||
from typing import Any # 类型标注
|
||
|
||
|
||
def build_alerts(chain: dict[str, Any], anchor: dict[str, Any],
|
||
source: str = "world") -> list[dict[str, str]]:
|
||
"""聚合审计完整性告警（纯只读；正常态返回空数组）。
|
||
|
||
触发条件：
|
||
- 链校验失败（critical）
|
||
- 锚定不匹配 / 未锚定（warning）
|
||
- 镜像源异常（warning）
|
||
"""
|
||
alerts: list[dict[str, str]] = []
|
||
if not chain.get("ok"):
|
||
alerts.append({
|
||
"code": "AUDIT_CHAIN_BROKEN",
|
||
"severity": "critical",
|
||
"message": f"审计哈希链断裂于事件 #{chain.get('brokenAt')}（已校验 {chain.get('checked')} 条）",
|
||
})
|
||
if anchor.get("reason") == "mismatch":
|
||
alerts.append({
|
||
"code": "AUDIT_ANCHOR_MISMATCH",
|
||
"severity": "warning",
|
||
"message": "独立介质锚定根与当前事件不一致（可能被篡改）",
|
||
})
|
||
elif anchor.get("reason") == "not-anchored":
|
||
alerts.append({
|
||
"code": "AUDIT_NOT_ANCHORED",
|
||
"severity": "info",
|
||
"message": "审计事件尚未锚定到独立介质",
|
||
})
|
||
elif anchor.get("reason") == "corrupt-ledger":
|
||
alerts.append({
|
||
"code": "AUDIT_LEDGER_CORRUPT",
|
||
"severity": "critical",
|
||
"message": "审计账本文件损坏",
|
||
})
|
||
if source != "mirror":
|
||
alerts.append({
|
||
"code": "AUDIT_SOURCE_WORLD",
|
||
"severity": "info",
|
||
"message": "审计事件源为世界状态（镜像源不可用/未启用）",
|
||
})
|
||
return alerts
|