The shadow validator previously awaited the Graph round-trip inline,
adding 200ms-30s of latency to every RegisterSession/Ingest response
on opted-in tenants — defeating the "shadow, never blocks" intent.
Detach the lookup as Task.Run with captured locals so the agent gets
its OK immediately. Result is logged at Warning level (Information
gets filtered by sampling/log-level config and never surfaced).
Drop the now-unused EnrichRequestTelemetryWithDeviceAssociation method
and its tests — Activity.AddTag from a detached task wouldn't make it
into the request telemetry anyway, since the parent activity has
already stopped by the time the background lookup completes.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The DevPrep shadow validator was never executed because the
ValidateSecurityAsync extension constructed SecurityValidator without
passing DeviceAssociationValidator, so _deviceAssociationValidator was
always null and the gate at SecurityValidator.cs:370 silently skipped
the lookup — even with ValidateDeviceAssociation=true on the tenant.
Inject the validator via DI into all 9 agent-facing functions
(RegisterSession, IngestEvents, GetAgentConfig, ReportAgentError,
GetDiagnosticsUploadUrl + 4 Bootstrap variants) and thread it through
the extension to SecurityValidator.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Moves WHfB policy detection, UDR event handling (300/301/358/360/362/376),
HelloForBusiness watcher (3024/6045), Hello wait/completion timers and
HelloOutcome state machine into a dedicated HelloTracker class (820 LOC).
Cross-boundary with ESP (Shell-Core 62404/62407) is narrowed to two
explicit notify methods: NotifyHelloWizardStarted + NotifyEspExited.
Public API of EspAndHelloTracker is unchanged — IsPolicyConfigured,
IsHelloCompleted, HelloOutcome, StartHelloWaitTimer, ForceMarkHelloCompleted,
ResetForEspResumption and the HelloCompleted event now delegate to the
composed HelloTracker. CollectorCoordinator + EnrollmentTracker integration
requires no changes.
Adds 29 xUnit tests covering: UDR terminal events, 6045 skip HRESULT,
wait/completion timer paths (policy-enabled extended wait, policy-disabled
immediate completion, wizard-started vs wizard-not-started outcomes),
cross-boundary notifications, ForceMarkHelloCompleted semantics and
ResetForEspResumption state reset.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Solves the timing gap where WhiteGlove Event 509 fires during OOBE
before the agent starts (pre MDM-enroll). On startup the agent now
scans the ManagementService event log for targeted events within a
configurable lookback window (default 30 min) and emits them with
a backfilled=true marker for trace analysis.
Key changes:
- Extract ProcessModernDeploymentRecord from live handler for reuse
by both EventLogWatcher callback and EventLogReader backfill
- Add BackfillTargetedModernDeploymentEvents() with persisted state
(whiteglove-backfill.json) so subsequent agent restarts skip the
scan and avoid duplicate emissions
- Add config fields ModernDeploymentBackfillEnabled and
ModernDeploymentBackfillLookbackMinutes to CollectorConfiguration
- Wire up stateDirectory and config in MonitoringService
- All emitted events now carry Data["backfilled"] = true/false
https://claude.ai/code/session_01ToApHGezTGcSkA6NVbVZkG
Oliver Kieselbach