Snapshot device-phase package states before Clear() on phase transition
so final-status.json contains the complete picture (DeviceSetup + AccountSetup
apps) instead of only the last active phase.
The JSON now uses packageStatesByPhase with phase names as keys instead of
a flat packageStates array.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- IME shutdown handler: new imeShutdown action marks all active apps as
Postponed instead of incorrectly marking them Installed on IME restart
- Final status dump: writes comprehensive final-status.json on enrollment
complete/failed with all app states, signal timestamps, error summary
- Device vs user error counts: GetSummaryData() now reports deviceErrors
and userErrors separately for granular diagnostics
- Periodic debug state snapshot: 60s timer logs [StateSnapshot] to agent
log for stuck enrollment debugging (log-only, no event storage cost)
- All new timers properly stopped at every terminal event path
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Desktop arrival during AccountSetup started Hello wait timer, which
timeout-resolved after 30s and triggered enrollment_complete via
desktop_hello path while ESP was still installing apps.
Three fixes:
- NotifyDesktopArrived: only start Hello timer when ESP is NOT active
- TryEmitEnrollmentComplete: ESP gate now blocks both desktop_arrival
and desktop_hello sources
- OnFinalizingSetupPhaseTriggered: try composite completion after ESP
final exit in case Hello was already resolved
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Multi-signal enrollment completion with 3 independent paths:
- IME pattern (existing), ESP final exit + Hello (composite),
Desktop arrival + Hello (no-ESP/WDP v2)
ESP failure detection: terminal failures emit enrollment_failed immediately,
recoverable failures (ESPProgress_Timeout) get 1-min grace period with
recovery cancellation on ESP phase change.
Agent max lifetime timer (6h default, configurable per-tenant) as safety
net against zombie agents. Desktop arrival detector polls explorer.exe
with WMI owner validation. Enrollment state persistence for crash recovery.
Completion check events with full state machine snapshot for observability.
Backend maintenance interval reduced from daily to every 2 hours.
ConfigVersion 12 → 13.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Periodic collectors (Performance, AgentSelfMetrics) now stop after 15 min
(configurable) of no real enrollment activity instead of a fixed 4h window.
They restart automatically when new activity is detected, preventing session
bloat for stuck/unfinished enrollments while keeping data flowing during
legitimately long ones.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Adds a second device validation method alongside existing Autopilot Device
Validation. Corporate Identifier Validation checks devices against Intune
Corporate Device Identifiers (manufacturer + model + serial number) via the
Graph beta searchExistingIdentities endpoint.
Backend: Extract GraphTokenService from AutopilotDeviceValidator for shared
token/consent logic. Add CorporateIdentifierValidator with caching. Update
SecurityValidator with cascading validation (Autopilot first, Corporate
Identifier fallback). Wire new validator through all agent endpoints.
Frontend: Add second toggle in settings gated behind preview mode. Shared
consent flow skips redirect when consent already exists from other toggle.
Section renamed to "Enrollment Device Validation" in preview mode.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- CollectAutopilotProfile now interprets AutopilotMode (User Driven/Self Deploying/White Glove)
and CloudAssignedDomainJoinMethod (Entra Join/Hybrid Azure AD Join) with human-readable labels
- Added IsHybridJoin as first-class session field (SessionRegistration, SessionSummary, Table Storage)
- DetectHybridJoinStatic reads DomainJoinMethod from registry at registration time
- UI session detail shows Autopilot Mode, improved Domain Join Method labels, HybridJoinSkipDCConnectivityCheck
- Dashboard shows purple "Hybrid" badge for Hybrid Azure AD Join sessions
- Note: IsUserDriven/IsPreProvisioned unchanged — profile fields are capabilities, not live state
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Prevent phase regression in the event timeline when a reboot during User
Enrollment (Part 2) emits a new agent_started with Phase=Start. The
groupEventsByPhase function now accepts a preventPhaseRegression option
that tracks the highest phase index seen and suppresses regressions to
earlier phases. Reboot events stay in the active enrollment phase instead
of resetting the timeline to Start. Also adds timestamp as fallback sort
key to handle potential duplicate sequences from agent persistence gaps.
Applied to both UI rendering and text/CSV export for Part 2 only.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Oliver Kieselbach