Replace direct TableStorageService injection with ISessionRepository,
IMetricsRepository, and IMaintenanceRepository in 10 Function files.
Add GetSessionEventsAsync to ISessionRepository interface.
Migration in progress — more functions and services to follow.
https://claude.ai/code/session_01NHWJfPaa8TQHuPzMD7gG63
Introduces a clean abstraction layer to decouple domain services from Azure Table Storage,
enabling future migration to Cosmos DB and Event Streaming without touching business logic.
Architecture:
- 10 repository interfaces in Shared/DataAccess/ (ISessionRepository, IRuleRepository, etc.)
- IDataEventPublisher interface with NullDataEventPublisher for future event streaming
- IStorageInitializer for provider-agnostic initialization
- 5 Table Storage implementations that delegate to existing TableStorageService
- DI extension method AddTableStorageDataAccess() with AddEventStreaming<T>() hook
- Migration plan in tasks/todo.md for incremental adoption
https://claude.ai/code/session_01NHWJfPaa8TQHuPzMD7gG63
The private submodule (.claude/commands) is not needed for builds
and was causing CI failures since the runner has no access to it.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New read-only report page that shows the full tenant configuration
and computed runtime parameters (AgentConfigResponse) side by side.
Helps Galactic Admins quickly analyze what a tenant has configured.
- Tenant selector to pick any tenant cross-tenant
- All TenantConfiguration fields grouped by section
- Computed runtime parameters with defaults applied
- Non-default values highlighted in purple for quick scanning
- SAS URLs are masked for security
- Added nav item to Galactic Admin section
https://claude.ai/code/session_0136YgG8JDuqAhHvMbALyPoZ
Removed packages that don't belong in the AppX filter:
- Microsoft.ManagementApp (IME is Win32, not AppX)
- Microsoft.MicrosoftOfficeHub (just a launcher, no attack surface)
- Microsoft.PowerBIDesktop (deployed as Win32, not AppX)
- Microsoft.SecHealthUI (UI shell only, Defender version from other sources)
- Microsoft.OneDriveSync (normal Win32 app, not AppX)
https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
Sandboxed AppX/MSIX apps rarely have CVEs and the sandbox limits
blast radius. Allowing all 3rd-party AppX packages through would
dilute the report with irrelevant entries.
Now uses a single whitelist for all publishers — only explicitly
listed packages (CompanyPortal, Teams, Office, Terminal, etc.) pass.
Removes the Microsoft vs 3rd-party distinction and the separate
framework/runtime exclude list (no longer needed).
https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
Extend SoftwareInventoryAnalyzer with two new detection sources that
close significant gaps in installed software enumeration:
1. AppX/MSIX packages (AppxAllUserStore\Applications registry):
- Detects modern packaged apps: Company Portal, new Teams, etc.
- Filters out OS components, frameworks, and runtimes to avoid noise
- Parses package full names into vendor/product/version
2. HKU per-user Uninstall keys (via ProfileList SID enumeration):
- Detects per-user installs: VS Code user, Teams Classic, Spotify
- Iterates loaded user hives via Registry.Users
- Skips current user SID to avoid duplicates with existing HKCU read
Both methods are pure registry reads — no WMI, no PowerShell, no
external tools. Typical overhead < 50ms.
https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
Claude