Replace direct TableStorageService injection with ISessionRepository,
IMetricsRepository, and IMaintenanceRepository in 10 Function files.
Add GetSessionEventsAsync to ISessionRepository interface.
Migration in progress — more functions and services to follow.
https://claude.ai/code/session_01NHWJfPaa8TQHuPzMD7gG63
Introduces a clean abstraction layer to decouple domain services from Azure Table Storage,
enabling future migration to Cosmos DB and Event Streaming without touching business logic.
Architecture:
- 10 repository interfaces in Shared/DataAccess/ (ISessionRepository, IRuleRepository, etc.)
- IDataEventPublisher interface with NullDataEventPublisher for future event streaming
- IStorageInitializer for provider-agnostic initialization
- 5 Table Storage implementations that delegate to existing TableStorageService
- DI extension method AddTableStorageDataAccess() with AddEventStreaming<T>() hook
- Migration plan in tasks/todo.md for incremental adoption
https://claude.ai/code/session_01NHWJfPaa8TQHuPzMD7gG63
New read-only report page that shows the full tenant configuration
and computed runtime parameters (AgentConfigResponse) side by side.
Helps Galactic Admins quickly analyze what a tenant has configured.
- Tenant selector to pick any tenant cross-tenant
- All TenantConfiguration fields grouped by section
- Computed runtime parameters with defaults applied
- Non-default values highlighted in purple for quick scanning
- SAS URLs are masked for security
- Added nav item to Galactic Admin section
https://claude.ai/code/session_0136YgG8JDuqAhHvMbALyPoZ
Removed packages that don't belong in the AppX filter:
- Microsoft.ManagementApp (IME is Win32, not AppX)
- Microsoft.MicrosoftOfficeHub (just a launcher, no attack surface)
- Microsoft.PowerBIDesktop (deployed as Win32, not AppX)
- Microsoft.SecHealthUI (UI shell only, Defender version from other sources)
- Microsoft.OneDriveSync (normal Win32 app, not AppX)
https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
Sandboxed AppX/MSIX apps rarely have CVEs and the sandbox limits
blast radius. Allowing all 3rd-party AppX packages through would
dilute the report with irrelevant entries.
Now uses a single whitelist for all publishers — only explicitly
listed packages (CompanyPortal, Teams, Office, Terminal, etc.) pass.
Removes the Microsoft vs 3rd-party distinction and the separate
framework/runtime exclude list (no longer needed).
https://claude.ai/code/session_01CnCJ28kuJcrWtQZcX4kCAw
Claude