Add shadow Security Finding Inbox

[igor04091968]

Summary

• add security-finding-inbox and containment-engine Rust CLIs
• add ClickHouse schema, Hayabusa integration, examples and runbooks
• keep containment disabled/shadow by default and Windows Firewall apply dry-run unless explicitly executed locally

Verification

• git diff --cached --check
• bash -n scripts/containment_shadow_smoke.sh scripts/security_finding_inbox_smoke.sh aw-server/hayabusa/aw-hayabusa.sh clickhouse-1c/ops/run_ingest_cycle.sh
• CARGO_TARGET_DIR=/home/igor/.cache/aw-split-c-target cargo test -p containment-engine -p security-finding-inbox -p hayabusa-tools -p aw-1c-ingest --locked
• CARGO_TARGET_DIR=/home/igor/.cache/aw-split-c-target cargo build --manifest-path adk-rust/Cargo.toml -p containment-engine -p security-finding-inbox --locked
• CARGO_TARGET_DIR=/home/igor/.cache/aw-split-c-target bash scripts/containment_shadow_smoke.sh
• CARGO_TARGET_DIR=/home/igor/.cache/aw-split-c-target bash scripts/security_finding_inbox_smoke.sh

Production notes

• does not enable executor in production
• no automatic remediation
• no always-on Velociraptor
• DLP runtime can remain disabled/core_only

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 565dd28d-dcfb-4656-afb7-c5b624e70ada

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch detmir-security-finding-inbox-shadow-20260701

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}