Внедрение KESL на ВМ2 + замена CLAMAV на KESL

VM2_services/codebase/services/deployment/RUNBOOK.md

@@ -46,7 +46,9 @@ The full step-by-step procedure with gates and copy-paste commands is in
    role. Migration credentials are mounted only into the `ops` profile jobs.
 9. The setup script leaves UFW egress open for bootstrap. Before production,
    constrain egress through Selectel SG/NAT/proxy to the approved PostgreSQL,
-   S3, Secrets Manager, Bitrix24, DNS/NTP, SigNoz and ClamAV destinations.
+   S3, Secrets Manager, Bitrix24, DNS/NTP and SigNoz destinations. Host KESL
+   receives only update-source egress approved by
+   [`deployment/kesl/RUNBOOK.KESL.ru.md`](kesl/RUNBOOK.KESL.ru.md).
    Registry/package access exists only during controlled maintenance windows.
 
 ## Who runs what
@@ -78,8 +80,9 @@ Compose first:
    `bitrix_sync`, separate migration/runtime DSNs; see
    [`arch-10-deployment.md`](../../../../architectory/arch-10-deployment.md) §6.
 3. **Images** — build and push `han-message-safety`, `han-bitrix-sync`; record
-   immutable digests for every `*_IMAGE` in `.env.example` (nginx, redis, clamav,
-   otel-collector, Redis exporter and nginx exporter).
+   immutable digests for every `*_IMAGE` in `.env.example` (nginx, redis,
+   otel-collector, Redis exporter and nginx exporter). `clamd`/`freshclam` are
+   absent from Compose; KESL 12.4 standalone and its broker run on the host.
 4. **Selectel Secrets Manager** — populate all remote names from
    `deployment/secrets/config.example.json` (DSNs, tokens, S3 read-only keys,
    `REDIS_SAFETY_ACL`, `REDIS_EXPORTER_PASSWORD`, internal TLS PEM for `8443`).
@@ -157,6 +160,13 @@ Install managed PostgreSQL CA under `/etc/han/ca`, issue Let's Encrypt cert for
 Execute gates **in order** 1 → 2 → 3 → 4 → 5 → 6 → 7 → 8 → 9. Do not enable
 `han-processing.service` until Gate 5 completes successfully.
 
+Before Message Safety starts in Gate 5, complete the operator KESL runbook,
+then enable/start `han-kesl-scan-broker.socket` and verify KESL/socket status
+plus `root:han-message-safety 0660` on `/run/han-kesl/scan.sock`. Only then
+start Message Safety. The broker is a custom integration: exact output/exit
+semantics of `kesl-control --scan-file --action Inform`, cleanup and throughput
+must pass on the target VM2.
+
 | Gate | Purpose |
 | --- | --- |
 | 1 | Secrets materialized via `han-secrets-vm2.service` |
@@ -195,8 +205,9 @@ Safety cutover on VM1 or Bitrix sync enablement.
    briefly.
 3. Record release evidence: `han-vm2-compose config --images`, `ps`, certbot
    timer, unit journals — without secret values.
-4. Configure operational monitoring (unhealthy/restart/OOM, TLS expiry, ClamAV
-   signature age, OTEL queue, disk/RAM, MOCK mode, private Safety API).
+4. Configure operational monitoring (unhealthy/restart/OOM, TLS expiry, KESL
+   version/database date, hourly update, broker/socket status, OTEL queue,
+   disk/RAM, MOCK mode, private Safety API).
 5. Proceed to controlled Message Safety cutover on VM1 — see
    [`module-10-deployment-vm2.md`](../../../documentation/module-10-deployment-vm2.md) §13.
 6. Keep `BITRIX_SYNC_ENABLED=false` and `BITRIX_SYNC_MODE=disabled`; Bitrix
@@ -209,8 +220,8 @@ Details: [`RUNBOOK.ru.md`](RUNBOOK.ru.md) §7.
 ## Failure policy
 
 - Safety dependency failure is fail-closed: VM1 must not send/promote content.
-- Stale/unavailable ClamAV signatures disable file capability only; they never
-  convert a scan error to allow.
+- A stale/unavailable KESL database or broker error disables file capability
+  only; scan errors remain retryable and eventually return `503`, never allow.
 - Redis loss may remove acceleration but PostgreSQL remains authoritative.
 - OTEL outage queues within the bounded volume and must not change verdicts.
 - Rollback does not downgrade schemas, delete durable tasks/mappings, or run
@@ -234,10 +245,12 @@ health, and restores the previous mode on failure. MOCK has no timeout: keep a
 high-severity alert active until explicit `standard`, then verify normal
 text/link/file capabilities and an EICAR canary.
 
-## Known image exceptions
+## Host KESL and broker
 
-ClamAV images may require UID/path adjustments after validating the exact
-digest. Do not weaken `read_only`, capabilities or mounts globally: document
-the smallest writable signature/runtime paths and compensate with network and
-resource limits. `freshclam` alone receives signature-CDN egress; `clamd`
-receives none.
+KESL 12.4 standalone and the root-owned fail-closed broker are not Compose
+images. The Message Safety worker receives only
+`/run/han-kesl/scan.sock`, not `kesl-control`, the Docker socket or host-root
+access. Runtime records `scanner_engine=kesl`; `signatures_version` is the hash
+of KESL version plus database date. Installation, hourly database updates,
+socket permissions, clean/EICAR/error/stale gates and rollback follow
+[`deployment/kesl/RUNBOOK.KESL.ru.md`](kesl/RUNBOOK.KESL.ru.md).