From 2cf35eca5bd2668b413fa2596d5515885f021845 Mon Sep 17 00:00:00 2001
From: Oliver Kieselbach <oliver.kieselbach@outlook.com>
Date: Thu, 21 May 2026 18:39:02 +0200
Subject: [PATCH] chore(rules,agent): allowlist RealmJoin registry prefixes +
 bump build counters (Phase E)

- rules/guardrails.json: add new "RealmJoin" category covering
  SYSTEM\CurrentControlSet\Services\realmjoin and SOFTWARE\RealmJoin. Hive-agnostic
  match covers HKLM\SYSTEM\..., HKLM\SOFTWARE\RealmJoin, and HKU\<sid>\SOFTWARE\RealmJoin
  so operator-authored Gather-rules can probe the RJ keys (the RealmJoinWatcher
  itself bypasses GatherRuleGuards and watches the registry directly).
- src/Web/autopilot-monitor-web/lib/guardrails.generated.ts: regenerated via
  node rules/scripts/combine.js so the Web admin UI surface matches the new
  registry allowlist.
- buildcounter.txt (V2 + V1): auto-incremented by the Phase A-D builds.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 rules/guardrails.json                                    | 7 +++++++
 src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt     | 2 +-
 src/Agent/AutopilotMonitor.Agent/buildcounter.txt        | 2 +-
 .../autopilot-monitor-web/lib/guardrails.generated.ts    | 9 +++++++++
 4 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/rules/guardrails.json b/rules/guardrails.json
index 8ae013f4..e26c4096 100644
--- a/rules/guardrails.json
+++ b/rules/guardrails.json
@@ -77,6 +77,13 @@
       "prefixes": [
         "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing"
       ]
+    },
+    {
+      "category": "RealmJoin",
+      "prefixes": [
+        "SYSTEM\\CurrentControlSet\\Services\\realmjoin",
+        "SOFTWARE\\RealmJoin"
+      ]
     }
   ],
   "filePrefixes": [
diff --git a/src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt b/src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt
index dca34d14..4e18fc9c 100644
--- a/src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt
+++ b/src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt
@@ -1 +1 @@
-842
+848
diff --git a/src/Agent/AutopilotMonitor.Agent/buildcounter.txt b/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
index 700bb688..f2523706 100644
--- a/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
+++ b/src/Agent/AutopilotMonitor.Agent/buildcounter.txt
@@ -1 +1 @@
-1391
+1393
diff --git a/src/Web/autopilot-monitor-web/lib/guardrails.generated.ts b/src/Web/autopilot-monitor-web/lib/guardrails.generated.ts
index 06f1e81c..1495c7b9 100644
--- a/src/Web/autopilot-monitor-web/lib/guardrails.generated.ts
+++ b/src/Web/autopilot-monitor-web/lib/guardrails.generated.ts
@@ -91,6 +91,13 @@ export const REGISTRY_PREFIX_CATEGORIES: readonly GuardrailCategory[] = [
       "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing",
     ],
   },
+  {
+    category: "RealmJoin",
+    items: [
+      "SYSTEM\\CurrentControlSet\\Services\\realmjoin",
+      "SOFTWARE\\RealmJoin",
+    ],
+  },
 ];
 
 export const COMMAND_CATEGORIES: readonly GuardrailCategory[] = [
@@ -174,6 +181,8 @@ export const ALLOWED_REGISTRY_PREFIXES: readonly string[] = [
   "SOFTWARE\\Microsoft\\SystemCertificates",
   "SOFTWARE\\Policies\\Microsoft\\SystemCertificates",
   "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing",
+  "SYSTEM\\CurrentControlSet\\Services\\realmjoin",
+  "SOFTWARE\\RealmJoin",
 ];
 
 export const ALLOWED_FILE_PREFIXES: readonly string[] = [