ci: skip CI and CodeQL on gitlink bumps and prose-only commits

Every "chore: bump internal gitlink" commit ran the full CI matrix and
both CodeQL analyses, because a gitlink bump reports the bare path
'internal' (no trailing slash) and the existing 'internal/**' filter
does not match it. Both workflows now ignore the bare and nested forms
of the three private submodule paths plus markdown, LICENSE and the
.github metadata files. CodeQL's weekly unfiltered schedule remains
the backstop.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.claude/CLAUDE.md

@@ -4,34 +4,39 @@
 - **Use subagents liberally** for research, exploration, and parallel analysis — one focus each — to keep the main context clean.
 - **Verify before claiming done.** Run the tests, check the logs, show the evidence. Diff against `main` where behaviour could regress.
 - **Fix bugs autonomously.** Given a report, a failing test, or an error, resolve it — no hand-holding.
-- **Capture corrections.** After any correction from the user, record the pattern and a preventing rule in `tasks/lessons.md`; review it at session start.
 - Read files over 500 LOC in chunks. Never treat one grep as proof of absence.
 
-Codex reviews your output once you are done.
+## Where knowledge lives
+
+| Content | Location | Rule |
+|---|---|---|
+| Customer documentation | separate repo `autopilotmonitor-docs` (GitBook; baked into the MCP `search_docs` corpus) | Any change ⇒ MCP redeploy. Commit in that repo (`cd` first). |
+| Technical concept docs (OKF bundle) | `internal/` — private submodule, entry point `internal/docs/index.md` | Read the index first. Concept docs only for invariants, mechanisms and architecture a later change could silently break. |
+| Decisions, including "we will not build X" | `internal/decisions.md` | One entry per decision: date, decision, why, applies-to, status. |
+| Working files, lessons, plans | `internal/work/` | Rules in `internal/CLAUDE.md`. |
+| Agent review criteria | `internal/docs/agent/architecture-principles.md` | Check every agent change against it. |
+| Private operator instructions | `internal/CLAUDE.md` | Imported at the end of this file. Absent for contributors without submodule access; nothing in it may be copied into this public repo. |
+| Infrastructure and operator scripts | `infra/` — private submodule | Bicep plus deploy/backup/migration scripts. Scripts never carry credentials; secrets come from env or a gitignored file next to the script. |
+| Skills | `.claude/commands/` — private submodule | Each skill's frontmatter says when to use it. |
+| Claude auto-memory | outside the repo, per machine | Private notes only. Anything the project must keep goes into `internal/`. |
+
+## Hard rules
+
+- Agent projects stay on .NET Framework 4.8.
+- .NET build warnings are errors; only the NU1901–NU1904 advisories remain warnings.
+- Never put real customer domains, tenant names or tenant IDs into code, tests, commits, comments or public docs.
+- Deploy order is Backend → Web → MCP. Backend deploys are `workflow_dispatch` only. Verify the deployed version before claiming anything is live.
+- Submodules (`internal/`, `infra/`, `.claude/commands/`): commit inside the submodule first, then bump the gitlink here.
+- Stage explicit file lists; never `git add -A` or a directory. Pushing is the user's call.
+- New API responses need a typed DTO plus the parity fact. MCP vocabularies are generated from the wire types, never retyped.
+- Every route belongs in the route policy catalog; every new event type goes into the MCP resource catalog.
+- The about, terms and privacy pages under `src/Web/autopilot-monitor-web/app/` state facts customers rely on: verify every claim against the code before writing it and update them in the same change as the fact they describe.
 
 ## Code Quality
 
 - Simplicity first: minimal, targeted changes. No temporary fixes — find the root cause.
 - Where architecture is flawed, state is duplicated, or patterns are inconsistent, propose and implement the structural fix. Ask what a perfectionist reviewer would reject, and fix that too.
 - On non-trivial changes, ask whether there is a more elegant way before presenting. Skip it for simple fixes — don't over-engineer.
+- English for code comments and everything that carries knowledge.
 
-## Task Management
-
-Keep the plan in `tasks/todo.md` as checkable items, confirm it before implementing, tick items off as you go, and add a review section when done.
-
-## Customer-Facing Claims
-
-`src/Web/autopilot-monitor-web/app/{about,terms,privacy}/page.tsx` and `autopilotmonitor-docs/trust/*` state facts customers and security reviewers rely on. They drift silently.
-
-- Verify every claim against the code before writing it — never carry one forward because it was already on the page.
-- Update them in the same change as: runtime/framework versions, roles, notification providers, agent deployment or lifecycle, diagnostics payload, isolation/delegation model, retention caps, sub-processors, or any default governing what is collected.
-- Describe only what customers can actually use; operator-only infrastructure is not a feature.
-- Trust pages: durable phrasing over exact figures, and bump their "Last reviewed" date.
-
-## Technical Docs — OKF Bundle (`docs/`)
-
-Contributor/AI-facing docs (customer docs live in the `autopilotmonitor-docs` repo). Start at `docs/index.md` before opening individual files.
-
-- New durable knowledge (architecture decisions, flows, non-obvious mechanisms) → an OKF concept doc with YAML frontmatter: `type` (mandatory), plus `title`, `description`, `resource`, `tags`, `timestamp`.
-- Register it in `docs/index.md`, note the change in `docs/log.md` (ISO date). `index.md` and `log.md` are reserved names.
-- English, structural markdown (`# Schema`, `# Examples`, `# Citations`). Links between docs are RELATIVE — never `/`-prefixed, that breaks GitHub navigation.
+Private half of these instructions (process, working files, technical docs, operations): @../internal/CLAUDE.md

.claude/architecture-principles.md

@@ -1,136 +0,0 @@
-# Autopilot-Monitor — Agent Architecture Principles
-
-The principles are **not nice-to-haves**, they are review criteria: any code
-change that violates a principle is either (a) a bug, (b) a reason to change the principle
-(with user sign-off), or (c) an explicitly documented exception with rationale.
-
----
-
-## L.1 Truth Hierarchy (immutable)
-
-`SignalLog` (input) → `Journal` (decisions) → `Snapshot` (cache) → `Projections` (derivable).
-No projection patches backwards into the journal or the signal log. On inconsistency, the
-lower layer always wins (e.g. discard the snapshot, do not "repair" the signal log).
-
-## L.2 Event Sourcing as Foundation
-
-`SignalLog` is the only input truth. The reducer is pure:
-`(oldState, signal) → (newState, transition, effects)`. The backend can re-derive at any
-time from `SignalLog`. Replay yields the same `Journal` content.
-
-## L.3 Immutable State
-
-All DTOs in the decision core are `sealed` with get-only properties. No in-place mutation.
-"Change" = new instance via `With…` method. This is the difference between "purely testable"
-and "subtle heisenbugs".
-
-## L.4 Hypothesis Model instead of Flow Plugins
-
-Fuzziness is constitutive (White-Glove, enrollment type, device-only). A single reducer with
-hypothesis fields (`Unknown/Weak/Strong/Confirmed/Rejected`), organized by scenario in partial
-classes. **No** plugin runtime, because clean flow boundaries do not match reality.
-
-## L.5 Evidence Determinism
-
-Signal-log determinism is guaranteed: same log → same outcome. Every signal carries an
-`Evidence` record with `Kind` (Raw / Derived / Synthetic) and mandatory fields. A signal
-without evidence = adapter rejection = bug.
-
-## L.6 Signal Schema Versioning
-
-Every `DecisionSignalKind` has a `SchemaVersion`. The reducer dispatches on
-`(Kind, SchemaVersion)` — old versions stay replay-capable. A new version or a new kind
-without a replay fixture in `tests/fixtures/signal-kinds/{kind}-v{n}.json` = merge block.
-
-## L.7 Timer Monopoly
-
-Only the Deadline Scheduler (the EffectRunner role) holds decision-relevant timers. Collectors,
-signal adapters and the orchestrator must not. `Task.Delay` or `new Timer(...)` in those
-layers with session-state impact = merge block. `IClock` interface + virtual clock for
-testability.
-
-## L.8 Classifier as Post-Hook Kernel Service
-
-`IClassifier` interface, swappable. The `ClassifierVerdict` flows back into the log as a
-synthetic `ClassifierVerdictIssued` signal. `InputHash` (SHA256 over classifier-relevant
-snapshot fields) is the anti-loop guard. Classifiers are not baked into the state machine.
-
-## L.9 Clean-Agent Principle on Refactors
-
-For structural refactors: build the new project in parallel to the legacy one, do not flag-
-route inside the same process. Strict separation rule: no direct reference to legacy
-projects. Code is copied, not shared. Legacy runs out, then gets removed.
-
-## L.10 Generic Telemetry Transport
-
-One spool for all telemetry types (events, signals, decision transitions). `TelemetryItemId`
-is the type-agnostic upload cursor; the type-specific counters (`Event.Sequence`,
-`SignalOrdinal`, `StepIndex`) remain storage / UI / reducer semantics. Drain guarantee:
-"coordinated + idempotent + resumable" — **not** cross-table atomic, which is not achievable
-with three separate tables anyway.
-
-## L.11 Separation: Agent Lifecycle vs Session State
-
-`DecisionState` is session-pure. Agent-process flags (crash, admin actions, boot time,
-heartbeat status) live separately in `agent-lifecycle.json`, managed by the orchestrator,
-never by the reducer. Prevents replay dilution by lifecycle events.
-
-## L.12 Flush-on-Append Persistence
-
-No batching of append operations. `FileOptions.WriteThrough` plus an explicit
-`FlushAsync(flushToDisk: true)` per append. Every successful `Append` return means: on disk.
-Durability > performance in the crash-prone OOBE context.
-
-## L.13 UI Primacy — End-Users vs Dev Tooling
-
-Product views (EventTimeline, PhaseTimeline) stay slim and stable. Debug / analysis tools
-(Inspector with DecisionGraph, SignalStream, VerifierReport) live on their own subpage behind
-an `adminMode` gate. The session-detail page does not get overloaded with dev components.
-
-## L.14 Forward Compatibility by Default
-
-Enums via `StringEnumConverter` + `UnknownFallbackEnumConverter` (unknown values → default,
-never crash). New schema fields are nullable. The `ReducerVersion` stamp per journal row
-allows older backends to read newer rows. Deletions only after a major version bump with
-user sign-off.
-
-## L.15 Test Discipline
-
-Flow / scenario tests are prioritized over structural tests. Coverage targets per component
-(DecisionCore ≥95 %, classifier 100 %, backend functions ≥85 %). A missing fixture for a
-scenario = merge block. CI threshold check is a build failure, not a warning.
-
-## L.16 Fail-Safe Reducer Exceptions
-
-Exception in the reducer → `DecisionTransition` with `DeadEndReason=reducer_exception`, state
-unchanged (fail-safe, never destroy state). Signal counts as processed (no retry loop). After
-five consecutive exceptions → the orchestrator emits
-`enrollment_failed(reason=reducer_instability)`.
-
-## L.17 Effect Error Handling by Class
-
-Three effect classes with their own strategy:
-
-- **Transient** (retry with exponential backoff 100 ms / 400 ms / 1600 ms):
-  `EmitEventTimelineEntry`, `PersistSnapshot`
-- **Critical** (session abort, e.g. on timer-register failure): `ScheduleDeadline`,
-  `CancelDeadline`
-- **Optional** (best-effort, classifier exception → `Inconclusive` verdict, no abort):
-  `RunClassifier`
-
-Every effect failure is logged as a `DecisionTransition`.
-
-## L.18 Implementation Discipline
-
-- **R1** Pre-flight plan check before every work step
-- **R2** Delegate self-contained sub-tasks **and exploration** to subagents (Anthropic
-  recommendation: preserve main-context window on large refactors — quality assurance)
-- **R3** Real verification (DB round-trip, index dual-write, agent signal emission) — no
-  "it compiles and runs"
-- **R4** The plan is authority — deviations require user sign-off
-- **R5** Out-of-scope items land in `tasks/todo.md`, not in memory
-- **R6** High test coverage is a prerequisite for future refactorability, not a nice-to-have
-- **R7** Code-structure discipline: small files (guideline ≤300 LoC), clear folders, partial
-  classes by scenario, check in with the user on any uncertainty (placement, naming, scope)
-
----

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,49 @@
+name: Bug report
+description: Something does not work as documented.
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for the report. Please redact tenant IDs, device names, serial numbers, and anything personal before posting.
+        For a failed enrollment in your own tenant, the fastest path is the **Report Session** button in the portal — it attaches the session context for support without exposing it here.
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      options:
+        - Web portal
+        - Agent (on device)
+        - Bootstrap script / Intune deployment
+        - MCP server / AI integration
+        - Analysis rules / log patterns
+        - Backend / API
+        - Documentation
+        - Not sure
+    validations:
+      required: true
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened?
+      description: What did you do, what did you expect, what happened instead?
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. …
+        2. …
+  - type: input
+    id: version
+    attributes:
+      label: Agent version / portal date
+      description: Agent version from the session details, or the date you saw it in the portal.
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs or screenshots
+      description: Relevant excerpts only, redacted. Paste text rather than screenshots of text where possible.
+      render: text

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Question or idea
+    url: https://github.com/okieselbach/AutopilotMonitor/discussions
+    about: Ask how something works or float a feature idea before it becomes a request.
+  - name: Documentation
+    url: https://docs.autopilotmonitor.com
+    about: Setup guides, troubleshooting, and the security FAQ.
+  - name: Security vulnerability
+    url: https://github.com/okieselbach/AutopilotMonitor/security/advisories/new
+    about: Report privately. Please never open a public issue for a security finding.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,34 @@
+name: Feature request
+description: Propose something Autopilot Monitor should do.
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem are you trying to solve?
+      description: Describe the situation, not the solution. What are you doing today instead?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed change
+      description: What would you like to see? Rough is fine.
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - Web portal
+        - Agent (on device)
+        - Analysis rules / diagnostics
+        - MCP server / AI integration
+        - Notifications / integrations
+        - Reporting
+        - Other
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered

.github/assets/social-preview.html

@@ -0,0 +1,55 @@
+<!doctype html>
+<html><head><meta charset="utf-8">
+<link rel="preconnect" href="https://fonts.googleapis.com">
+<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet">
+<style>
+  html,body{margin:0;padding:0;}
+  body{width:1280px;height:640px;overflow:hidden;font-family:Inter,system-ui,-apple-system,"Segoe UI",sans-serif;color:#0f172a;
+    background:
+      radial-gradient(900px 600px at 105% 110%, #dcfce7 0%, rgba(220,252,231,0) 60%),
+      radial-gradient(700px 500px at -10% -10%, #e0f2fe 0%, rgba(224,242,254,0) 60%),
+      linear-gradient(180deg,#ffffff 0%,#f6f8f7 100%);
+    position:relative;}
+  .grid{position:absolute;inset:0;background-image:linear-gradient(rgba(15,23,42,.045) 1px,transparent 1px),linear-gradient(90deg,rgba(15,23,42,.045) 1px,transparent 1px);background-size:40px 40px;mask-image:linear-gradient(180deg,rgba(0,0,0,.7),rgba(0,0,0,0) 85%);}
+  .left{position:absolute;left:72px;top:0;height:640px;width:520px;display:flex;flex-direction:column;justify-content:center;z-index:2;}
+  .brand{display:flex;align-items:center;gap:14px;margin-bottom:26px;}
+  .brand svg{width:44px;height:40px;}
+  .brand span{font-size:22px;font-weight:600;letter-spacing:-.01em;color:#0f172a;}
+  h1{margin:0 0 18px;font-size:50px;line-height:1.06;font-weight:800;letter-spacing:-.035em;}
+  h1 em{font-style:normal;color:#16a34a;}
+  p.tag{margin:0 0 30px;font-size:20px;line-height:1.45;color:#475569;font-weight:400;max-width:480px;}
+  .chips{display:flex;flex-wrap:wrap;gap:10px;margin-bottom:34px;}
+  .chip{display:inline-flex;align-items:center;gap:8px;padding:8px 14px;border-radius:999px;background:#fff;border:1px solid #e2e8f0;box-shadow:0 1px 2px rgba(15,23,42,.05);font-size:15px;font-weight:500;color:#1e293b;}
+  .chip i{width:8px;height:8px;border-radius:50%;background:#22c55e;display:inline-block;}
+  .chip.b i{background:#3b82f6}.chip.p i{background:#8b5cf6}
+  .foot{display:flex;align-items:center;gap:14px;font-size:15px;color:#64748b;font-weight:500;}
+  .foot b{color:#0f172a;font-weight:600;}
+  .foot .dot{width:4px;height:4px;border-radius:50%;background:#cbd5e1;}
+  .shot{position:absolute;left:600px;top:76px;width:1000px;height:640px;border-radius:14px;background:#fff;
+    box-shadow:0 30px 80px -20px rgba(15,23,42,.35),0 0 0 1px rgba(15,23,42,.08);overflow:hidden;z-index:1;}
+  .bar{position:relative;z-index:2;height:34px;background:#f8fafc;border-bottom:1px solid #e2e8f0;display:flex;align-items:center;padding:0 14px;gap:7px;}
+  .bar i{width:10px;height:10px;border-radius:50%;background:#e2e8f0;display:inline-block;}
+  .bar .url{margin-left:12px;flex:0 0 auto;height:20px;padding:0 10px;border-radius:6px;background:#fff;border:1px solid #e2e8f0;font-size:11px;line-height:20px;color:#64748b;}
+  .shot img{position:absolute;left:-214px;top:-16px;width:1440px;height:900px;transform-origin:top left;transform:scale(.94);}
+</style></head>
+<body>
+<div class="grid"></div>
+<div class="left">
+  <div class="brand">
+    <svg viewBox="0 0 209 191" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M0 180.201L208.401 190.502L188.157 76.2438L5.48363e-06 0L0 180.201Z" fill="#33B161"/></svg>
+    <span>Autopilot Monitor</span>
+  </div>
+  <h1>See every Windows<br>enrollment <em>as it happens</em></h1>
+  <p class="tag">Live session timelines, fleet health, and on-demand diagnostics for Windows Autopilot and Intune.</p>
+  <div class="chips">
+    <span class="chip"><i></i>Live session timeline</span>
+    <span class="chip b"><i></i>Fleet health</span>
+    <span class="chip p"><i></i>MCP server for AI troubleshooting</span>
+  </div>
+  <div class="foot"><b>autopilotmonitor.com</b><span class="dot"></span>Open source<span class="dot"></span>Free Community plan</div>
+</div>
+<div class="shot">
+  <div class="bar"><i></i><i></i><i></i><span class="url">portal.autopilotmonitor.com/dashboard</span></div>
+  <img src="social-preview-dashboard.png" alt="">
+</div>
+</body></html>

.github/dependabot.yml

@@ -1,5 +1,10 @@
 version: 2
 
+# Grouping: every ecosystem gets one batched PR for minor/patch version
+# updates and one batched PR for security updates. Groups apply to version
+# updates only by default, so the security-updates groups are declared
+# explicitly — otherwise every advisory lands as its own PR.
+
 updates:
   - package-ecosystem: nuget
     directory: /
@@ -10,6 +15,9 @@ updates:
       dotnet:
         patterns: ['*']
         update-types: [minor, patch]
+      dotnet-security:
+        applies-to: security-updates
+        patterns: ['*']
 
   - package-ecosystem: npm
     directory: /src/Web/autopilot-monitor-web
@@ -20,6 +28,9 @@ updates:
       web:
         patterns: ['*']
         update-types: [minor, patch]
+      web-security:
+        applies-to: security-updates
+        patterns: ['*']
     # Major bumps are breaking and reviewed deliberately, not auto-PR'd.
     # Security updates ignore this filter, so the Security tab stays clean.
     ignore:
@@ -35,6 +46,9 @@ updates:
       mcp:
         patterns: ['*']
         update-types: [minor, patch]
+      mcp-security:
+        applies-to: security-updates
+        patterns: ['*']
     # Major bumps are breaking and reviewed deliberately, not auto-PR'd.
     # Security updates ignore this filter, so the Security tab stays clean.
     ignore:
@@ -45,3 +59,9 @@ updates:
     directory: /
     schedule:
       interval: monthly
+    groups:
+      actions:
+        patterns: ['*']
+      actions-security:
+        applies-to: security-updates
+        patterns: ['*']

.github/scripts/Publish-BootstrapScripts.ps1

@@ -0,0 +1,367 @@
+<#
+.SYNOPSIS
+    Publishes the customer-facing PowerShell scripts behind download.autopilotmonitor.com/agent/.
+
+.DESCRIPTION
+    Single owner of the script-publishing chain. Called from two places:
+
+      * publish-scripts.yml  -- on every push to main that touches the sources,
+                                so a script fix reaches customers without waiting
+                                for an agent release.
+      * build-agent.yml      -- on a publish_as_stable run, so a release always
+                                lands a consistent set (ZIP + manifest + scripts).
+
+    Both callers run the same code. The scripts on the download alias are the live
+    copy the WDP bootstrap MSI (Invoke-BootstrapDownload.ps1) downloads on every
+    enrolling device, so "current" is a correctness property, not cosmetics.
+
+    Steps, in order:
+      1. Parse $ScriptVersion from the bootstrap source.
+      2. Render the -Dev variant by literal substitution of the two URL/manifest
+         defaults. A missing anchor is a hard failure -- a silently un-substituted
+         dev script would point the dev fleet at the stable agent.
+      3. Version-bump guard: if the published bootstrap differs from the source
+         but carries the same $ScriptVersion, abort. Otherwise the docs badge,
+         version.json.bootstrapVersion and the portal's "your script is outdated"
+         hint would all keep asserting a version that is no longer what ships.
+      4. Upload every script blob with Cache-Control: no-cache (they rotate in
+         place), mirrored fail-soft to the legacy account.
+      5. Reconcile the two version oracles: version.json.bootstrapVersion
+         (read-modify-write under If-Match, so a concurrent agent release cannot
+         lose its agent fields) and AdminConfiguration.LatestBootstrapV2ScriptVersion.
+      6. Verify through the alias -- re-download each blob and compare SHA-256.
+
+.PARAMETER SasToken
+    Container SAS for the eu storage account with write permission. Leading '?' tolerated.
+
+.PARAMETER LegacySasToken
+    Container SAS for the legacy account. Optional -- a mirror failure warns, never fails.
+
+.PARAMETER TableSasToken
+    Table SAS for AdminConfiguration. Optional -- omitted or 'XXX' skips the oracle update.
+
+.PARAMETER RepoRoot
+    Repository root. Defaults to the parent of .github/scripts.
+
+.PARAMETER DryRun
+    Run every check and render, upload nothing.
+
+.EXAMPLE
+    ./Publish-BootstrapScripts.ps1 -DryRun
+
+.EXAMPLE
+    ./Publish-BootstrapScripts.ps1 -SasToken $env:SAS -TableSasToken $env:TABLE_SAS
+#>
+[CmdletBinding()]
+param(
+    [string]$SasToken,
+    [string]$LegacySasToken,
+    [string]$TableSasToken,
+    [string]$RepoRoot,
+    [switch]$DryRun
+)
+
+$ErrorActionPreference = 'Stop'
+
+if (-not $RepoRoot) {
+    $RepoRoot = (Resolve-Path (Join-Path $PSScriptRoot '../..')).Path
+}
+if (-not $DryRun -and [string]::IsNullOrWhiteSpace($SasToken)) {
+    throw 'SasToken is required unless -DryRun is used.'
+}
+
+$ContainerUrl       = 'https://autopilotmonitoreu.blob.core.windows.net/agent'
+$LegacyContainerUrl = 'https://autopilotmonitor.blob.core.windows.net/agent'
+$AliasUrl           = 'https://download.autopilotmonitor.com/agent'
+$TableUrl           = "https://autopilotmonitoreu.table.core.windows.net/AdminConfiguration(PartitionKey='GlobalConfig',RowKey='config')"
+
+$BootstrapSource   = Join-Path $RepoRoot 'scripts/Bootstrap/Install-AutopilotMonitor.ps1'
+$BootstrapBlob     = 'Install-AutopilotMonitor.ps1'
+$DevBlob           = 'Install-AutopilotMonitor-Dev.ps1'
+$ScriptContentType = 'text/plain; charset=utf-8'
+
+function Get-HttpStatus {
+    param($ErrorRecord)
+    if ($ErrorRecord.Exception.PSObject.Properties['Response'] -and $ErrorRecord.Exception.Response) {
+        return [int]$ErrorRecord.Exception.Response.StatusCode
+    }
+    return 0
+}
+
+function Get-Sha256 {
+    param([byte[]]$Bytes)
+    $sha = [System.Security.Cryptography.SHA256]::Create()
+    try { return [BitConverter]::ToString($sha.ComputeHash($Bytes)).Replace('-', '').ToLowerInvariant() }
+    finally { $sha.Dispose() }
+}
+
+# Raw bytes of a published blob, or $null when it does not exist yet.
+function Get-PublishedBytes {
+    param([string]$Url)
+    try {
+        $resp = Invoke-WebRequest -Uri $Url -Method Get -UseBasicParsing
+    } catch {
+        if ((Get-HttpStatus $_) -eq 404) { return $null }
+        throw
+    }
+    # Comma operator: PowerShell unrolls an array returned from a function into the output
+    # stream and reassembles it as Object[], which would silently defeat every [byte[]] use
+    # downstream. ',' wraps it so the byte[] survives the return.
+    if ($resp.Content -is [byte[]]) { return ,$resp.Content }
+    return ,[System.Text.Encoding]::UTF8.GetBytes([string]$resp.Content)
+}
+
+# Deterministic publish form: CRLF, UTF-8 without BOM. Git normalises line endings on
+# checkout (a Windows runner yields CRLF, a core.autocrlf=false clone yields LF), so
+# publishing the raw working-copy bytes would emit different blobs for identical source
+# and make every byte comparison -- guard and verify alike -- environment-dependent.
+# CRLF is also what PS 5.1 on the device expects and what is published today.
+function Get-PublishBytes {
+    param([string]$Text)
+    $normalised = $Text.Replace("`r`n", "`n").Replace("`n", "`r`n")
+    # ',' keeps this a byte[]: without it PowerShell unrolls the array into the output stream
+    # and the caller receives Object[]. Invoke-RestMethod then serialises an Object[] body as
+    # space-separated decimals instead of raw bytes -- a silent corruption of the upload.
+    return ,(New-Object System.Text.UTF8Encoding $false).GetBytes($normalised)
+}
+
+function Get-BootstrapScriptVersion {
+    param([string]$Content, [string]$Origin, [switch]$Optional)
+    if ($Content -match '\$ScriptVersion\s*=\s*"([\d\.\-a-zA-Z]+)"') { return $Matches[1] }
+    # Unreadable SOURCE is fatal. An unreadable PUBLISHED copy must not be: that is exactly
+    # the state a republish is meant to repair, and a guard that blocks the repair is worse
+    # than no guard.
+    if ($Optional) { return $null }
+    throw "Could not parse ScriptVersion from $Origin"
+}
+
+# What the script actually DOES, with comments and layout removed: the PowerShell token
+# stream minus comments, newlines and line continuations. Lets the version-bump guard tell
+# a behaviour change (must be versioned -- consumers act on the version) apart from a
+# comment fix or reflow (nobody needs to know). Tokenising rather than regex-stripping
+# keeps '#' inside strings from being mistaken for a comment.
+function Get-CodeFingerprint {
+    param([string]$Text, [string]$Origin)
+    $tokens = $null
+    $errors = $null
+    [System.Management.Automation.Language.Parser]::ParseInput($Text, [ref]$tokens, [ref]$errors) | Out-Null
+    if ($errors -and $errors.Count -gt 0) {
+        throw "Parse error in ${Origin}: $($errors[0])"
+    }
+    $ignored = @('Comment', 'NewLine', 'LineContinuation', 'EndOfInput')
+    return (($tokens | Where-Object { $ignored -notcontains $_.Kind.ToString() } | ForEach-Object { $_.Text }) -join "`n")
+}
+
+# ------------------------------------------------------------------ 1. source
+$sourceContent = Get-Content $BootstrapSource -Raw
+$sourceBytes   = Get-PublishBytes $sourceContent
+$scriptVersion = Get-BootstrapScriptVersion -Content $sourceContent -Origin $BootstrapSource
+Write-Host "Bootstrap script version: $scriptVersion"
+
+# ------------------------------------------------------------------ 2. dev render
+$stableUrlLiteral = '$AgentDownloadUrl = "https://download.autopilotmonitor.com/agent/AutopilotMonitor-Agent.zip"'
+$devUrlLiteral    = '$AgentDownloadUrl = "https://download.autopilotmonitor.com/agent/AutopilotMonitor-Agent-dev.zip"'
+$stableManLiteral = '$VersionJsonName = "version.json"'
+$devManLiteral    = '$VersionJsonName = "version-dev.json"'
+
+if ($sourceContent.IndexOf($stableUrlLiteral) -lt 0 -or $sourceContent.IndexOf($stableManLiteral) -lt 0) {
+    throw "Bootstrap dev-render: anchor literal missing in $BootstrapSource"
+}
+$devContent = $sourceContent.Replace($stableUrlLiteral, $devUrlLiteral).Replace($stableManLiteral, $devManLiteral)
+Write-Host "Rendered $DevBlob (dev agent URL + version-dev.json)"
+
+# ------------------------------------------------------------------ 3. bump guard
+$publishedBytes = Get-PublishedBytes "$AliasUrl/$BootstrapBlob"
+if ($null -eq $publishedBytes) {
+    Write-Host 'No published bootstrap yet -- version-bump guard skipped (first publish)'
+} elseif ((Get-Sha256 $publishedBytes) -eq (Get-Sha256 $sourceBytes)) {
+    Write-Host 'Published bootstrap is already byte-identical to the source'
+} else {
+    $publishedText    = [System.Text.Encoding]::UTF8.GetString($publishedBytes)
+    $publishedVersion = Get-BootstrapScriptVersion -Content $publishedText -Origin "$AliasUrl/$BootstrapBlob" -Optional
+
+    if ($null -eq $publishedVersion) {
+        Write-Host "::warning::The published $BootstrapBlob is not a readable bootstrap script (no ScriptVersion found). Republishing over it."
+    } elseif ($publishedVersion -ne $scriptVersion) {
+        Write-Host "Version bump: $publishedVersion -> $scriptVersion"
+    } elseif ((Get-CodeFingerprint -Text $publishedText -Origin "$AliasUrl/$BootstrapBlob") -eq
+              (Get-CodeFingerprint -Text $sourceContent -Origin $BootstrapSource)) {
+        # Comments, typos in comments, reflow -- nothing a consumer of the version can act on.
+        Write-Host "::warning::$BootstrapBlob changed in comments or formatting only; publishing under the unchanged version $scriptVersion."
+    } else {
+        throw ("Version-bump guard: $BootstrapBlob changed behaviour but ScriptVersion is still $scriptVersion. " +
+               "Bump it in $BootstrapSource -- the docs badge, version.json.bootstrapVersion and the " +
+               'portal outdated-script hint all read that value, and customers decide from it whether ' +
+               'to re-upload their Intune copy. Comment-only and formatting changes do not need a bump.')
+    }
+}
+
+# ------------------------------------------------------------------ 4. upload
+# Sources beyond the bootstrap pair, read straight from the repo.
+$extraSources = @(
+    @{ Path = 'scripts/Bootstrap/Test-ShouldBootstrapAgent.ps1';       BlobName = 'Test-ShouldBootstrapAgent.ps1' }
+    # Customer-side Graph add-on grant script -- docs and admin UI link it directly.
+    @{ Path = 'scripts/CustomerSetup/Grant-AutopilotMonitorAddOn.ps1'; BlobName = 'Grant-AutopilotMonitorAddOn.ps1' }
+)
+# Uninstall-AutopilotMonitor.ps1 is deliberately NOT published: nothing links it, and
+# an unauthenticated uninstall script on the public download host is not a feature.
+
+$publishSet = [System.Collections.Generic.List[object]]::new()
+$publishSet.Add([pscustomobject]@{ BlobName = $BootstrapBlob; Bytes = $sourceBytes })
+$publishSet.Add([pscustomobject]@{ BlobName = $DevBlob;       Bytes = (Get-PublishBytes $devContent) })
+foreach ($extra in $extraSources) {
+    $extraPath = Join-Path $RepoRoot $extra.Path
+    if (-not (Test-Path $extraPath)) {
+        throw "Publish source missing: $extraPath"
+    }
+    $publishSet.Add([pscustomobject]@{ BlobName = $extra.BlobName; Bytes = (Get-PublishBytes (Get-Content $extraPath -Raw)) })
+}
+
+$legacySas = if ($LegacySasToken) { $LegacySasToken.TrimStart('?') } else { '' }
+$writeSas  = if ($SasToken) { $SasToken.TrimStart('?') } else { '' }
+
+foreach ($item in $publishSet) {
+    # Explicit type, not a convenience: an Object[] body is uploaded as space-separated
+    # decimals rather than raw bytes, and every hash check still passes because [byte[]]
+    # parameter coercion repairs it everywhere EXCEPT the wire.
+    [byte[]]$bytes = $item.Bytes
+    $item | Add-Member -NotePropertyName Sha256 -NotePropertyValue (Get-Sha256 $bytes) -Force
+
+    if ($DryRun) {
+        # Doubles as a drift check: says per blob whether the alias already serves this source.
+        $served = Get-PublishedBytes "$AliasUrl/$($item.BlobName)"
+        $state = if ($null -eq $served) { 'MISSING on the alias' }
+                 elseif ((Get-Sha256 $served) -eq $item.Sha256) { 'already current' }
+                 else { 'STALE on the alias' }
+        Write-Host "  [dry-run] $($item.BlobName) ($($bytes.Length) bytes, sha256 $($item.Sha256)) -- $state"
+        continue
+    }
+
+    # no-cache on every blob: they all rotate in place and the download alias fronts them
+    # with Front Door. Route caching is disabled there, but a stale script paired with a
+    # fresh manifest would fail the bootstrap SHA check -- this keeps that class of bug
+    # impossible even if caching is ever re-enabled.
+    $headers = @{ 'x-ms-blob-type' = 'BlockBlob'; 'Content-Type' = $ScriptContentType; 'x-ms-blob-cache-control' = 'no-cache' }
+    Invoke-RestMethod -Uri "$ContainerUrl/$($item.BlobName)?$writeSas" -Method Put -Headers $headers -Body $bytes | Out-Null
+
+    # Read straight back from the blob (authoritative, no CDN in the way) before touching the
+    # mirror or the next file. The alias verification at the end would catch a bad body too,
+    # but only after every blob was already overwritten -- these are live customer downloads.
+    $written = Get-PublishedBytes "$ContainerUrl/$($item.BlobName)"
+    if ($null -eq $written -or (Get-Sha256 $written) -ne $item.Sha256) {
+        $writtenLength = if ($null -eq $written) { 'missing' } else { "$($written.Length) bytes" }
+        throw ("Upload of $($item.BlobName) did not round-trip: sent $($bytes.Length) bytes, " +
+               "blob now holds $writtenLength. Publishing stopped before the mirror and the " +
+               'remaining files, so no further blob was touched.')
+    }
+    Write-Host "  uploaded $($item.BlobName) ($($bytes.Length) bytes, round-trip verified)"
+
+    if ($legacySas) {
+        try {
+            Invoke-RestMethod -Uri "$LegacyContainerUrl/$($item.BlobName)?$legacySas" -Method Put -Headers $headers -Body $bytes | Out-Null
+            Write-Host "  mirrored $($item.BlobName) to legacy storage"
+        } catch {
+            Write-Host "::warning::legacy mirror failed for $($item.BlobName) -- $($_.Exception.Message)"
+        }
+    }
+}
+
+# ------------------------------------------------------------------ 5. version oracles
+# version.json is the agent manifest; only bootstrapVersion belongs to us. Read from the
+# blob (not the alias) for an authoritative ETag, write back under If-Match so a concurrent
+# agent release cannot lose its version/sha256 fields.
+if (-not $DryRun) {
+    try {
+        $manifestResp = Invoke-WebRequest -Uri "$ContainerUrl/version.json" -Method Get -UseBasicParsing
+        $manifestRaw = if ($manifestResp.Content -is [byte[]]) {
+            [System.Text.Encoding]::UTF8.GetString($manifestResp.Content)
+        } else { [string]$manifestResp.Content }
+        $manifest = $manifestRaw | ConvertFrom-Json
+
+        if ($manifest.bootstrapVersion -eq $scriptVersion) {
+            Write-Host "version.json already reports bootstrapVersion $scriptVersion"
+        } else {
+            $etag = '"' + ([string]($manifestResp.Headers['ETag'] | Select-Object -First 1)).Trim('"') + '"'
+            $manifest | Add-Member -NotePropertyName 'bootstrapVersion' -NotePropertyValue $scriptVersion -Force
+            $body = [System.Text.Encoding]::UTF8.GetBytes(($manifest | ConvertTo-Json -Compress))
+            $manifestHeaders = @{
+                'x-ms-blob-type'          = 'BlockBlob'
+                'Content-Type'            = 'application/json'
+                'x-ms-blob-cache-control' = 'no-cache'
+                'If-Match'                = $etag
+            }
+            Invoke-RestMethod -Uri "$ContainerUrl/version.json?$writeSas" -Method Put -Headers $manifestHeaders -Body $body | Out-Null
+            Write-Host "version.json bootstrapVersion -> $scriptVersion (agent fields untouched)"
+
+            if ($legacySas) {
+                try {
+                    $legacyHeaders = @{ 'x-ms-blob-type' = 'BlockBlob'; 'Content-Type' = 'application/json'; 'x-ms-blob-cache-control' = 'no-cache' }
+                    Invoke-RestMethod -Uri "$LegacyContainerUrl/version.json?$legacySas" -Method Put -Headers $legacyHeaders -Body $body | Out-Null
+                } catch {
+                    Write-Host "::warning::legacy mirror failed for version.json -- $($_.Exception.Message)"
+                }
+            }
+        }
+    } catch {
+        if ((Get-HttpStatus $_) -eq 412) {
+            throw 'version.json changed while publishing (concurrent agent release). Re-run this workflow.'
+        }
+        throw
+    }
+}
+
+$tableSas = if ($TableSasToken) { $TableSasToken.TrimStart('?') } else { '' }
+if ($DryRun) {
+    Write-Host "  [dry-run] would set AdminConfiguration.LatestBootstrapV2ScriptVersion = $scriptVersion"
+} elseif ([string]::IsNullOrEmpty($tableSas) -or $tableSas -eq 'XXX') {
+    Write-Host 'SKIPPED: AdminConfiguration update -- set AZURE_TABLE_ADMIN_SAS_TOKEN to enable the portal version oracle'
+} else {
+    $tableHeaders = @{
+        'Content-Type' = 'application/json'
+        'Accept'       = 'application/json;odata=nometadata'
+        'If-Match'     = '*'
+    }
+    $tableBody = @{ LatestBootstrapV2ScriptVersion = $scriptVersion } | ConvertTo-Json
+    Invoke-RestMethod -Uri "$TableUrl`?$tableSas" -Method Merge -Headers $tableHeaders -Body $tableBody | Out-Null
+    Write-Host "AdminConfiguration.LatestBootstrapV2ScriptVersion = $scriptVersion"
+}
+
+# ------------------------------------------------------------------ 6. verify via alias
+if (-not $DryRun) {
+    $pending = [System.Collections.ArrayList]::new()
+    $publishSet | ForEach-Object { [void]$pending.Add($_) }
+
+    for ($attempt = 1; $attempt -le 6 -and $pending.Count -gt 0; $attempt++) {
+        if ($attempt -gt 1) { Start-Sleep -Seconds 20 }
+        foreach ($item in @($pending)) {
+            $servedBytes = Get-PublishedBytes "$AliasUrl/$($item.BlobName)"
+            if ($null -ne $servedBytes -and (Get-Sha256 $servedBytes) -eq $item.Sha256) {
+                Write-Host "  verified $($item.BlobName) via $AliasUrl"
+                $pending.Remove($item)
+            }
+        }
+        if ($pending.Count -gt 0) {
+            Write-Host "  attempt $attempt : $($pending.Count) blob(s) not current on the alias yet"
+        }
+    }
+
+    if ($pending.Count -gt 0) {
+        $names = ($pending | ForEach-Object { $_.BlobName }) -join ', '
+        throw ("Alias still serves stale content for: $names. The blobs were written, so this is a Front Door " +
+               'cache issue -- purge with: az afd endpoint purge --resource-group rg-autopilotmonitor-prd-gwc ' +
+               "--profile-name autopilotmonitor-fd --endpoint-name apm-download --content-paths '/agent/*'")
+    }
+}
+
+if ($env:GITHUB_STEP_SUMMARY) {
+    $mode = if ($DryRun) { 'DRY RUN -- nothing uploaded' } else { 'published + verified via the download alias' }
+    $summary = @(
+        "### Bootstrap scripts: $mode",
+        '',
+        "Bootstrap script version: **$scriptVersion**",
+        ''
+    ) + ($publishSet | ForEach-Object { "- $($_.BlobName) -- sha256 $($_.Sha256)" })
+    ($summary -join [Environment]::NewLine) | Out-File -FilePath $env:GITHUB_STEP_SUMMARY -Append -Encoding utf8
+}
+
+Write-Host 'Done.'

.github/scripts/Request-BuildNumber.ps1

@@ -65,7 +65,7 @@ function Read-Counter {
         $resp = Invoke-WebRequest -Uri $CounterUrl -Method Get -UseBasicParsing
     } catch {
         if ((Get-HttpStatus $_) -eq 404) {
-            throw "Counter blob not found at $CounterUrl. Seed it once with the last used build number: PUT the plain integer with 'x-ms-blob-type: BlockBlob' and 'If-None-Match: *'. See docs/versioning.md."
+            throw "Counter blob not found at $CounterUrl. Seed it once with the last used build number: PUT the plain integer with 'x-ms-blob-type: BlockBlob' and 'If-None-Match: *'. See internal/docs/versioning.md."
         }
         throw
     }

.github/workflows/bootstrap-script-gates.yml

@@ -0,0 +1,63 @@
+name: Bootstrap script gates
+
+# Quality gate for the customer-facing PowerShell scripts, factored out so it exists
+# once and both callers run the identical checks:
+#   * pester.yml           -- pull requests (reports, does not block the merge button)
+#   * publish-scripts.yml  -- pushes to main, where it BLOCKS the upload to the
+#                             download alias. Devices execute these scripts as SYSTEM
+#                             during enrollment, so a red suite must never ship.
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  gates:
+    name: Bootstrap guard tests (PS 5.1)
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Install Pester 5+
+        shell: powershell
+        run: |
+          Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser | Out-Null
+          Install-Module Pester -Scope CurrentUser -Force -SkipPublisherCheck -MinimumVersion 5.5.0
+
+      # Windows PowerShell 5.1 on purpose: that is the runtime IME uses to execute
+      # platform scripts, so guard/relax logic is verified without resetting a device.
+      - name: Run Pester
+        shell: powershell
+        run: |
+          Import-Module Pester -MinimumVersion 5.5.0
+          $c = New-PesterConfiguration
+          $c.Run.Path = 'scripts/Bootstrap'
+          $c.Run.Exit = $true
+          $c.Output.Verbosity = 'Detailed'
+          Invoke-Pester -Configuration $c
+
+      - name: Guard scripts stay pure ASCII
+        shell: powershell
+        run: |
+          $failed = $false
+          Get-ChildItem 'scripts/Bootstrap' -Filter '*.ps1' | ForEach-Object {
+            $bytes = [System.IO.File]::ReadAllBytes($_.FullName)
+            for ($i = 0; $i -lt $bytes.Length; $i++) {
+              if ($bytes[$i] -gt 127) {
+                Write-Host "::error file=scripts/Bootstrap/$($_.Name)::Non-ASCII byte 0x$('{0:X2}' -f $bytes[$i]) at offset $i. PS 5.1 (IME) reads BOM-less files as ANSI and corrupts multi-byte chars."
+                $failed = $true
+                break
+              }
+            }
+          }
+          if ($failed) { exit 1 }
+          Write-Host 'All bootstrap scripts are pure ASCII.'
+
+      # The publish chain renders the -Dev variant by literal substitution and refuses to
+      # ship when an anchor moved. Running it dry here surfaces that (and any drift against
+      # the alias) on the PR instead of on the push that would have published.
+      - name: Publish dry run (dev-render anchors + version-bump guard + drift)
+        shell: pwsh
+        run: ./.github/scripts/Publish-BootstrapScripts.ps1 -DryRun

.github/workflows/build-agent.yml

@@ -33,6 +33,13 @@ permissions:
   id-token: write      # keyless Sigstore signing (artifact attestation)
   attestations: write  # store the provenance attestation
 
+# Shared with publish-scripts.yml: both write version.json (this workflow the agent fields,
+# the script publisher bootstrapVersion under If-Match). Serialising them keeps a script push
+# from colliding with a release. Never cancel -- a half-published set is worse than a queue.
+concurrency:
+  group: agent-blob-publish
+  cancel-in-progress: false
+
 env:
   LINE_MAJOR: 2
   AGENT_PROJECT: src/Agent/AutopilotMonitor.Agent.V2/AutopilotMonitor.Agent.V2.csproj
@@ -46,8 +53,6 @@ env:
   VERSIONED_ZIP: AutopilotMonitor-Agent-v2.zip
   STABLE_ZIP: AutopilotMonitor-Agent.zip
   STABLE_MANIFEST: version.json
-  STABLE_BOOTSTRAP: Install-AutopilotMonitor.ps1
-  STABLE_BOOTSTRAP_DEV: Install-AutopilotMonitor-Dev.ps1
 
 jobs:
   build:
@@ -71,12 +76,23 @@ jobs:
       - name: Reserve build number (counter blob CAS)
         id: version
         shell: pwsh
+        # Input and secret reach the script only as environment variables, never as script
+        # text: ${{ }} is substituted before pwsh parses the block, so a crafted
+        # build_number could otherwise break out of the quotes and run arbitrary code.
+        env:
+          BUILD_NUMBER_OVERRIDE: ${{ inputs.build_number }}
+          AGENT_SAS_TOKEN: ${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}
         run: |
           $override = 0
-          if ('${{ inputs.build_number }}' -ne '') { $override = [int]'${{ inputs.build_number }}' }
+          if ($env:BUILD_NUMBER_OVERRIDE -ne '') {
+            if ($env:BUILD_NUMBER_OVERRIDE -notmatch '^\d+$') {
+              throw "build_number must be a positive integer, got '$($env:BUILD_NUMBER_OVERRIDE)'"
+            }
+            $override = [int]$env:BUILD_NUMBER_OVERRIDE
+          }
 
           $counterUrl = "https://autopilotmonitoreu.blob.core.windows.net/agent/buildcounter-v$($env:LINE_MAJOR).txt"
-          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl $counterUrl -SasToken '${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}' -Override $override
+          $buildNumber = & ./.github/scripts/Request-BuildNumber.ps1 -CounterUrl $counterUrl -SasToken $env:AGENT_SAS_TOKEN -Override $override
 
           $csproj = Get-Content $env:CSPROJ_PATH -Raw
           if ($csproj -match '<VersionPrefix>(\d+\.\d+)</VersionPrefix>') {
@@ -181,6 +197,8 @@ jobs:
           # commit/buildUtc are the same two fields the backend and MCP manifests carry —
           # additive, and the bootstrap reads this file by field name, so older installers
           # ignore them. sha256/bootstrapVersion stay: those are the customer contract.
+          # bootstrapVersion is seeded here so the published manifest is never briefly
+          # missing it; Publish-BootstrapScripts.ps1 owns and re-asserts the field afterwards.
           $manifest | Add-Member -NotePropertyName "sha256" -NotePropertyValue $sha256Hash -Force
           $manifest | Add-Member -NotePropertyName "commit" -NotePropertyValue '${{ github.sha }}'.Substring(0, 7) -Force
           $manifest | Add-Member -NotePropertyName "buildUtc" -NotePropertyValue ([DateTime]::UtcNow.ToString('o')) -Force
@@ -190,29 +208,12 @@ jobs:
           $manifest | ConvertTo-Json -Compress | Set-Content $env:MANIFEST_NAME -Encoding UTF8
           Write-Host "$env:MANIFEST_NAME content: $(Get-Content $env:MANIFEST_NAME)"
 
-          # Bootstrap = single generic source. Stable variant = source 1:1.
-          # Dev variant = literal-string substitution of the two URL/manifest defaults.
-          # Both are uploaded only on -PublishAsStable runs (versioned namespace doesn't carry bootstrap).
-          if ('${{ inputs.publish_as_stable }}' -eq 'true') {
-            $stableUrl = '$AgentDownloadUrl = "https://autopilotmonitor.blob.core.windows.net/agent/AutopilotMonitor-Agent.zip"'
-            $devUrl    = '$AgentDownloadUrl = "https://autopilotmonitor.blob.core.windows.net/agent/AutopilotMonitor-Agent-dev.zip"'
-            $stableMan = '$VersionJsonName = "version.json"'
-            $devMan    = '$VersionJsonName = "version-dev.json"'
-
-            Copy-Item $env:BOOTSTRAP_SOURCE $env:STABLE_BOOTSTRAP -Force
-            $content = Get-Content $env:BOOTSTRAP_SOURCE -Raw
-            if ($content.IndexOf($stableUrl) -lt 0 -or $content.IndexOf($stableMan) -lt 0) {
-              Write-Error "Bootstrap dev-render: anchor literal missing in $env:BOOTSTRAP_SOURCE"
-              exit 1
-            }
-            $devContent = $content.Replace($stableUrl, $devUrl).Replace($stableMan, $devMan)
-            [System.IO.File]::WriteAllText("$env:STABLE_BOOTSTRAP_DEV", $devContent, (New-Object System.Text.UTF8Encoding $false))
-          }
+          # The customer-facing scripts (stable + dev render, test script, grant script) are
+          # published by .github/scripts/Publish-BootstrapScripts.ps1 -- see the upload step.
 
           "versioned_zip_release=$versionedZip" >> $env:GITHUB_OUTPUT
           "sha256=$sha256Hash" >> $env:GITHUB_OUTPUT
           "exe_sha256=$exeSha256Hash" >> $env:GITHUB_OUTPUT
-          "bootstrap_version=$bootstrapVersion" >> $env:GITHUB_OUTPUT
 
       - name: Upload to Azure Blob Storage
         if: inputs.upload_blob
@@ -264,16 +265,21 @@ jobs:
             Write-Host "PUBLISH AS STABLE -- writing V2 into stable namespace (customer-facing)" -ForegroundColor Magenta
             Send-Blob -Local $env:VERSIONED_ZIP -BlobName $env:STABLE_ZIP -ContentType "application/zip"
             Send-Blob -Local $env:MANIFEST_NAME -BlobName $env:STABLE_MANIFEST -ContentType "application/json"
-            Send-Blob -Local $env:STABLE_BOOTSTRAP -BlobName $env:STABLE_BOOTSTRAP -ContentType "text/plain; charset=utf-8"
-            Send-Blob -Local $env:STABLE_BOOTSTRAP_DEV -BlobName $env:STABLE_BOOTSTRAP_DEV -ContentType "text/plain; charset=utf-8"
 
-            if (Test-Path "scripts/Bootstrap/Test-ShouldBootstrapAgent.ps1") {
-              Send-Blob -Local "scripts/Bootstrap/Test-ShouldBootstrapAgent.ps1" -BlobName "Test-ShouldBootstrapAgent.ps1" -ContentType "text/plain; charset=utf-8"
-            }
+            # Customer-facing scripts: same publisher publish-scripts.yml runs on every push
+            # to main, so a release lands a set that is consistent with what is already live
+            # (dev render, version-bump guard, bootstrapVersion oracles, alias verification).
+            # Runs AFTER version.json so its bootstrapVersion read sees this build's manifest.
+            ./.github/scripts/Publish-BootstrapScripts.ps1 `
+              -SasToken '${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}' `
+              -LegacySasToken '${{ secrets.AZURE_BLOB_AGENT_LEGACY_SAS_TOKEN }}' `
+              -TableSasToken '${{ secrets.AZURE_TABLE_ADMIN_SAS_TOKEN }}'
           }
 
           # Update AdminConfiguration LatestAgentV2* -- ONLY on stable cutover. The hash-oracle
           # must never point at a build that is not actually in the stable namespace.
+          # LatestBootstrapV2ScriptVersion is NOT set here: it belongs to the script publisher
+          # above, which also owns it on script-only pushes. One writer per field.
           $tableSasToken = "${{ secrets.AZURE_TABLE_ADMIN_SAS_TOKEN }}".TrimStart('?')
           if ('${{ inputs.publish_as_stable }}' -ne 'true') {
             Write-Host "SKIPPED: AdminConfiguration update (versioned-only run -- stable namespace unchanged)"
@@ -283,22 +289,18 @@ jobs:
             $sha256 = "${{ steps.artifact.outputs.sha256 }}"
             $exeSha256 = "${{ steps.artifact.outputs.exe_sha256 }}"
             $agentVersion = "${{ steps.version.outputs.version }}"
-            $bootstrapVersion = "${{ steps.artifact.outputs.bootstrap_version }}"
             $tableUrl = "https://autopilotmonitoreu.table.core.windows.net/AdminConfiguration(PartitionKey='GlobalConfig',RowKey='config')?$tableSasToken"
             $tableBody = @{
               LatestAgentV2Version    = $agentVersion
               LatestAgentV2Sha256     = $sha256
               LatestAgentV2ExeSha256  = $exeSha256
             }
-            if ($bootstrapVersion) {
-              $tableBody["LatestBootstrapV2ScriptVersion"] = $bootstrapVersion
-            }
             Invoke-RestMethod -Uri $tableUrl -Method Merge -Headers @{
               "Content-Type" = "application/json"
               "Accept"       = "application/json;odata=nometadata"
               "If-Match"     = "*"
             } -Body ($tableBody | ConvertTo-Json)
-            Write-Host "AdminConfiguration updated: V2 version=$agentVersion, sha256=$sha256, exeSha256=$exeSha256, bootstrapVersion=$bootstrapVersion"
+            Write-Host "AdminConfiguration updated: V2 version=$agentVersion, sha256=$sha256, exeSha256=$exeSha256"
           }
 
       # Sigstore keyless provenance: binds the ZIP digest to this workflow run (repo, ref,
@@ -322,13 +324,19 @@ jobs:
           name: version-metadata
           path: ${{ env.MANIFEST_NAME }}
 
+      # First-party `gh` instead of a third-party action: this job holds contents:write,
+      # id-token:write and attestations:write, so no code we do not control runs here.
+      # --generate-notes appends the auto-generated notes below the body.
       - name: Create GitHub Release
         if: inputs.create_release
-        uses: softprops/action-gh-release@v3
-        with:
-          tag_name: ${{ steps.version.outputs.tag }}
-          name: Autopilot Monitor Agent ${{ steps.version.outputs.version }}
-          body: |
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ steps.version.outputs.tag }}
+          RELEASE_NAME: Autopilot Monitor Agent ${{ steps.version.outputs.version }}
+          RELEASE_PRERELEASE: ${{ inputs.prerelease }}
+          RELEASE_ZIP: ${{ steps.artifact.outputs.versioned_zip_release }}
+          RELEASE_BODY: |
             ## Autopilot Monitor Agent ${{ steps.version.outputs.version }}
 
             ### Installation
@@ -353,9 +361,22 @@ jobs:
             ```
             gh attestation verify AutopilotMonitor-Agent-v${{ steps.version.outputs.version }}.zip --repo okieselbach/AutopilotMonitor
             ```
-          draft: false
-          prerelease: ${{ inputs.prerelease }}
-          files: |
-            ${{ steps.artifact.outputs.versioned_zip_release }}
-            ${{ env.MANIFEST_NAME }}
-          generate_release_notes: true
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $notesFile = Join-Path $env:RUNNER_TEMP 'release-notes.md'
+          Set-Content -Path $notesFile -Value $env:RELEASE_BODY -Encoding utf8 -NoNewline
+
+          $ghArgs = @(
+            'release', 'create', $env:RELEASE_TAG,
+            $env:RELEASE_ZIP, $env:MANIFEST_NAME,
+            '--repo', $env:GITHUB_REPOSITORY,
+            '--target', $env:GITHUB_SHA,
+            '--title', $env:RELEASE_NAME,
+            '--notes-file', $notesFile,
+            '--generate-notes'
+          )
+          if ($env:RELEASE_PRERELEASE -eq 'true') { $ghArgs += '--prerelease' }
+
+          & gh @ghArgs
+          if ($LASTEXITCODE -ne 0) { throw "gh release create failed with exit code $LASTEXITCODE" }
+          Write-Host "Release $env:RELEASE_TAG created"

.github/workflows/build-msi.yml

@@ -0,0 +1,139 @@
+name: Build & Publish Bootstrap MSI
+
+# Thin MDM LOB delivery vehicle for WDP (Autopilot v2) — see
+# src/Agent/AutopilotMonitor.BootstrapMsi/Package.wxs. The MSI carries no bootstrap
+# logic (only the runner script that downloads the CURRENT server-hosted
+# Install-AutopilotMonitor.ps1), so it is rebuilt rarely: only when the runner script
+# or the WiX package changes. Version lives in Package.wxs — bump it there before
+# dispatching so Intune LOB update detection sees a new ProductVersion.
+
+on:
+  workflow_dispatch:
+    inputs:
+      upload_blob:
+        description: 'Upload to blob (customer-facing via download.autopilotmonitor.com/agent/)'
+        required: true
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+  id-token: write      # keyless Sigstore signing (artifact attestation)
+  attestations: write  # store the provenance attestation
+
+env:
+  MSI_PROJECT_DIR: src/Agent/AutopilotMonitor.BootstrapMsi
+  RUNNER_SCRIPT: src/Agent/AutopilotMonitor.BootstrapMsi/Invoke-BootstrapDownload.ps1
+  STABLE_MSI: AutopilotMonitor-Bootstrap.msi
+
+jobs:
+  build:
+    runs-on: windows-latest
+    name: Build Bootstrap MSI
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      # The runner executes as SYSTEM on every enrolling device — a parse error or
+      # non-ASCII mojibake (PS 5.1 codepage roulette) must fail the build, not the fleet.
+      - name: Validate runner script (parse + ASCII-only)
+        shell: pwsh
+        run: |
+          $errs = $null
+          [System.Management.Automation.Language.Parser]::ParseFile((Resolve-Path $env:RUNNER_SCRIPT), [ref]$null, [ref]$errs) | Out-Null
+          if ($errs) { $errs | ForEach-Object { Write-Error $_.ToString() }; exit 1 }
+          if ((Get-Content $env:RUNNER_SCRIPT -Raw) -match '[^\x00-\x7F]') {
+            Write-Error "Runner script contains non-ASCII characters"
+            exit 1
+          }
+          Write-Host "Runner script parse + ASCII check passed"
+
+      - name: Read MSI version from Package.wxs
+        id: version
+        shell: pwsh
+        run: |
+          $wxs = Get-Content "$env:MSI_PROJECT_DIR/Package.wxs" -Raw
+          if ($wxs -notmatch 'Version="(\d+\.\d+\.\d+)"') {
+            Write-Error "Could not parse Version from Package.wxs"
+            exit 1
+          }
+          $version = $Matches[1]
+          Write-Host "MSI version (from Package.wxs): $version"
+          "version=$version" >> $env:GITHUB_OUTPUT
+
+      - name: Install WiX toolset
+        run: dotnet tool install --global wix --version "5.*"
+
+      - name: Build MSI
+        shell: pwsh
+        run: |
+          # wix resolves File/@Source relative to the working directory, not the wxs —
+          # build from inside the project dir (same as the local build documented in the wxs).
+          $out = Join-Path (Get-Location) $env:STABLE_MSI
+          Push-Location $env:MSI_PROJECT_DIR
+          wix build Package.wxs -arch x64 -o $out
+          Pop-Location
+          if (-not (Test-Path $env:STABLE_MSI)) { Write-Error "wix build produced no MSI"; exit 1 }
+          $sha256 = (Get-FileHash $env:STABLE_MSI -Algorithm SHA256).Hash.ToLowerInvariant()
+          Write-Host "Built $env:STABLE_MSI ($([math]::Round((Get-Item $env:STABLE_MSI).Length / 1KB)) KB)"
+          Write-Host "SHA-256: $sha256"
+
+      - name: Upload to Azure Blob Storage
+        if: inputs.upload_blob
+        shell: pwsh
+        run: |
+          $containerUrl = "https://autopilotmonitoreu.blob.core.windows.net/agent"
+          $sasToken = "${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}".TrimStart('?')
+          $version = "${{ steps.version.outputs.version }}"
+
+          # Same Send-Blob contract as build-agent.yml: no-cache on every blob because the
+          # stable name rotates in place behind the download alias. No legacy mirror — the
+          # MSI channel never existed on the legacy account.
+          function Send-Blob {
+            param([string]$Local, [string]$BlobName)
+            $bytes = [System.IO.File]::ReadAllBytes($Local)
+            $headers = @{
+              "x-ms-blob-type" = "BlockBlob"
+              "Content-Type" = "application/octet-stream"
+              "x-ms-blob-cache-control" = "no-cache"
+            }
+            $md5 = [System.Security.Cryptography.MD5]::Create()
+            $headers["Content-MD5"] = [Convert]::ToBase64String($md5.ComputeHash($bytes))
+            $md5.Dispose()
+            Write-Host "Uploading $BlobName ($([math]::Round($bytes.Length / 1KB)) KB)..."
+            Invoke-RestMethod -Uri "$containerUrl/$BlobName`?$sasToken" -Method Put -Headers $headers -Body $bytes
+            Write-Host "  uploaded $BlobName"
+          }
+
+          # Versioned copy for provenance/rollback + stable customer-facing name.
+          Send-Blob -Local $env:STABLE_MSI -BlobName "AutopilotMonitor-Bootstrap-v$version.msi"
+          Send-Blob -Local $env:STABLE_MSI -BlobName $env:STABLE_MSI
+
+      # E2E: the Front Door route /agent/* must serve the fresh bytes on the public alias.
+      - name: Verify download alias serves the MSI
+        if: inputs.upload_blob
+        shell: pwsh
+        run: |
+          $localSize = (Get-Item $env:STABLE_MSI).Length
+          $resp = Invoke-WebRequest -Uri "https://download.autopilotmonitor.com/agent/$env:STABLE_MSI" -Method Head -UseBasicParsing
+          if ($resp.StatusCode -ne 200) { Write-Error "Alias HEAD returned $($resp.StatusCode)"; exit 1 }
+          $remoteSize = [long]$resp.Headers['Content-Length'][0]
+          if ($remoteSize -ne $localSize) {
+            Write-Error "Size mismatch: alias serves $remoteSize bytes, local MSI is $localSize bytes"
+            exit 1
+          }
+          Write-Host "Alias verified: https://download.autopilotmonitor.com/agent/$env:STABLE_MSI ($remoteSize bytes)"
+
+      # Sigstore keyless provenance, same as the agent ZIP. Verify:
+      # gh attestation verify AutopilotMonitor-Bootstrap.msi --repo okieselbach/AutopilotMonitor
+      - name: Attest build provenance (MSI)
+        uses: actions/attest-build-provenance@v4
+        with:
+          subject-path: ${{ env.STABLE_MSI }}
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: AutopilotMonitor-Bootstrap-v${{ steps.version.outputs.version }}
+          path: ${{ env.STABLE_MSI }}

.github/workflows/ci.yml

@@ -7,12 +7,44 @@ name: CI
 # The deploy workflows build but never test, so this is the only place the suites
 # actually run. It does not gate anything — main is deliberately unprotected, so a
 # red run reports rather than blocks. Read the result and follow up.
-
+#
+# Path filters: commits that only bump a private submodule gitlink (internal/, infra/,
+# .claude/commands) or touch prose cannot change anything the suites cover, so they are
+# skipped instead of burning ~15 runner-minutes each. A gitlink bump reports the bare
+# path ('internal', no trailing slash), which 'internal/**' does NOT match — both forms
+# are listed. GitHub skips only when EVERY changed path matches; a commit that touches
+# docs AND code still runs.
 on:
   push:
     branches: [main]
+    paths-ignore:
+      - 'internal'
+      - 'internal/**'
+      - 'infra'
+      - 'infra/**'
+      - '.claude/**'
+      - '.gitmodules'
+      - '**/*.md'
+      - 'LICENSE'
+      - '.github/ISSUE_TEMPLATE/**'
+      - '.github/FUNDING.yml'
+      - '.github/dependabot.yml'
+      - '.github/assets/**'
   pull_request:
     branches: [main]
+    paths-ignore:
+      - 'internal'
+      - 'internal/**'
+      - 'infra'
+      - 'infra/**'
+      - '.claude/**'
+      - '.gitmodules'
+      - '**/*.md'
+      - 'LICENSE'
+      - '.github/ISSUE_TEMPLATE/**'
+      - '.github/FUNDING.yml'
+      - '.github/dependabot.yml'
+      - '.github/assets/**'
   workflow_dispatch:
 
 permissions:
@@ -41,16 +73,16 @@ jobs:
         run: dotnet build AutopilotMonitor.sln --configuration Release --no-restore
 
       - name: Backend tests
-        run: dotnet test src/Backend/AutopilotMonitor.Functions.Tests --configuration Release --no-build --verbosity quiet
+        run: dotnet test src/Backend/AutopilotMonitor.Functions.Tests --configuration Release --no-build --verbosity quiet --logger "console;verbosity=minimal"
 
       - name: Agent V2 Core tests
-        run: dotnet test src/Agent/AutopilotMonitor.Agent.V2.Core.Tests --configuration Release --no-build --verbosity quiet
+        run: dotnet test src/Agent/AutopilotMonitor.Agent.V2.Core.Tests --configuration Release --no-build --verbosity quiet --logger "console;verbosity=minimal"
 
       - name: Decision Core tests
-        run: dotnet test src/Agent/AutopilotMonitor.DecisionCore.Tests --configuration Release --no-build --verbosity quiet
+        run: dotnet test src/Agent/AutopilotMonitor.DecisionCore.Tests --configuration Release --no-build --verbosity quiet --logger "console;verbosity=minimal"
 
       - name: Summary Dialog tests
-        run: dotnet test src/Agent/AutopilotMonitor.SummaryDialog.Tests --configuration Release --no-build --verbosity quiet
+        run: dotnet test src/Agent/AutopilotMonitor.SummaryDialog.Tests --configuration Release --no-build --verbosity quiet --logger "console;verbosity=minimal"
 
   web:
     name: Web (typecheck + tests)
@@ -69,9 +101,20 @@ jobs:
 
       - run: npm ci
 
+      # next-env.d.ts + .next type stubs are gitignored (Next-managed since
+      # v16); typegen generates them so tsc sees the same types as a build.
+      - name: Generate Next.js types
+        run: npx next typegen
+
       - name: Typecheck
         run: npx tsc --noEmit
 
+      # Errors fail outright, and so does ANY warning: the codebase is
+      # warning-clean and must stay that way — fix new findings, never
+      # raise the cap.
+      - name: Lint
+        run: npm run lint -- --max-warnings 0
+
       - name: Tests
         run: npm test
 
@@ -95,8 +138,22 @@ jobs:
       - name: Typecheck
         run: npx tsc --noEmit
 
+      # The vector-search tests tokenize with the real all-MiniLM-L6-v2 model
+      # (~23 MB tokenizer + ONNX weights). transformers.js caches under
+      # node_modules by default, which npm ci recreates — so every CI run
+      # re-downloaded from huggingface.co and rate-limits (429) failed the job
+      # (run 31252869254). Persist the model across runs instead; HF_CACHE_DIR
+      # is honored by vector-search-provider.ts.
+      - name: Cache embedding model
+        uses: actions/cache@v6
+        with:
+          path: ${{ github.workspace }}/.hf-cache
+          key: hf-model-Xenova-all-MiniLM-L6-v2
+
       - name: Tests
         run: npm test
+        env:
+          HF_CACHE_DIR: ${{ github.workspace }}/.hf-cache
 
   guardrails-in-sync:
     name: Generated guardrails match rules/guardrails.json
@@ -118,3 +175,29 @@ jobs:
             git diff --stat
             exit 1
           fi
+
+  shared-manifests-in-sync:
+    name: Generated wire types match shared-manifests.json
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+
+      # JSON ↔ C# parity is the dotnet job's SharedManifestParityTests; this job pins
+      # JSON ↔ generated TS (shared-manifests.generated.ts, wire-types.generated.ts and the
+      # MCP's wire-types + wire-vocabularies copies - the vocabularies are what the MCP
+      # tool input schemas derive their z.enum() from).
+      - name: Regenerate
+        run: node scripts/generate-shared-manifest-types.js
+        working-directory: src/Web/autopilot-monitor-web
+
+      - name: Fail if the generated files drifted
+        run: |
+          if ! git diff --quiet -- src/Web/autopilot-monitor-web/utils/shared-manifests.generated.ts src/Web/autopilot-monitor-web/utils/wire-types.generated.ts src/McpServer/autopilot-monitor-mcp/src/generated/wire-types.generated.ts src/McpServer/autopilot-monitor-mcp/src/generated/wire-vocabularies.generated.ts; then
+            echo "::error::Generated wire types are out of date. Run 'npm run generate:manifests' in src/Web/autopilot-monitor-web and commit the result."
+            git diff --stat
+            exit 1
+          fi

.github/workflows/codeql.yml

@@ -1,22 +1,43 @@
 name: CodeQL
 
-# Documentation-only changes cannot affect what CodeQL analyzes (C# and
-# TypeScript), so they are filtered out rather than spending ~10 minutes to
-# re-report an unchanged result. A commit that touches docs AND code still runs:
-# GitHub skips only when EVERY changed path matches the filter.
+# Documentation-only changes and private-submodule gitlink bumps (internal/, infra/,
+# .claude/commands) cannot affect what CodeQL analyzes (C# and TypeScript), so they
+# are filtered out rather than spending ~10 minutes to re-report an unchanged result.
+# A gitlink bump reports the bare path ('internal', no trailing slash), which
+# 'internal/**' does NOT match — both forms are listed. A commit that touches docs
+# AND code still runs: GitHub skips only when EVERY changed path matches the filter.
+# Same list as ci.yml; keep them in step.
 on:
   push:
     branches: [main]
     paths-ignore:
-      - 'docs/**'
+      - 'internal'
+      - 'internal/**'
+      - 'infra'
+      - 'infra/**'
+      - '.claude/**'
+      - '.gitmodules'
       - '**/*.md'
       - 'LICENSE'
+      - '.github/ISSUE_TEMPLATE/**'
+      - '.github/FUNDING.yml'
+      - '.github/dependabot.yml'
+      - '.github/assets/**'
   pull_request:
     branches: [main]
     paths-ignore:
-      - 'docs/**'
+      - 'internal'
+      - 'internal/**'
+      - 'infra'
+      - 'infra/**'
+      - '.claude/**'
+      - '.gitmodules'
       - '**/*.md'
       - 'LICENSE'
+      - '.github/ISSUE_TEMPLATE/**'
+      - '.github/FUNDING.yml'
+      - '.github/dependabot.yml'
+      - '.github/assets/**'
   schedule:
     # Weekly, so advisories published after a merge still surface. Deliberately
     # unfiltered — it re-analyzes the whole tree regardless of what changed, which
@@ -57,7 +78,7 @@ jobs:
           dotnet-version: '10.0.x'
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v4.37.9
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -68,6 +89,6 @@ jobs:
         run: dotnet build AutopilotMonitor.sln --configuration Release
 
       - name: Analyze
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v4.37.9
         with:
           category: /language:${{ matrix.language }}

.github/workflows/combine-rules.yml

@@ -8,6 +8,7 @@ on:
       - 'rules/ime-log-patterns/**'
       - 'rules/schema/**'
       - 'rules/scripts/**'
+      - 'rules/guardrails.json'
   pull_request:
     paths:
       - 'rules/gather/**'
@@ -15,6 +16,7 @@ on:
       - 'rules/ime-log-patterns/**'
       - 'rules/schema/**'
       - 'rules/scripts/**'
+      - 'rules/guardrails.json'
 
 jobs:
   validate-and-combine:
@@ -52,12 +54,32 @@ jobs:
             ajv validate -s rules/schema/ime-log-pattern.schema.json -d "$f" --spec=draft2020 -c ajv-formats
           done
 
+      # guardrails.json values are baked verbatim into generated TypeScript that is
+      # auto-committed to main and shipped to the portal - the schema forbids control
+      # and line-terminator characters so a "data" PR can never become code.
+      - name: Validate Guardrails
+        run: ajv validate -s rules/schema/guardrails.schema.json -d rules/guardrails.json --spec=draft2020 -c ajv-formats
+
       - name: Combine rules into dist/
         run: node rules/scripts/combine.js
 
-      - name: Commit dist/ changes
+      # Plain git instead of a third-party action: this step runs with contents:write on
+      # main, so no code we do not control gets to push. Checkout leaves the job's
+      # GITHUB_TOKEN in the remote credential helper, which is all `git push` needs.
+      # NOTE: combine.js writes THREE outputs; committing only dist/ would silently discard
+      # the two generated TS modules and leave the guardrails-in-sync CI check red.
+      - name: Commit generated outputs
         if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-        uses: stefanzweifel/git-auto-commit-action@v7
-        with:
-          commit_message: "chore: regenerate rules/dist from individual files"
-          file_pattern: "rules/dist/*"
+        run: |
+          set -euo pipefail
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add -- rules/dist/ \
+            src/Web/autopilot-monitor-web/utils/guardrails.generated.ts \
+            src/McpServer/autopilot-monitor-mcp/src/rule-authoring.generated.ts
+          if git diff --cached --quiet; then
+            echo "Generated outputs unchanged - nothing to commit"
+            exit 0
+          fi
+          git commit -m "chore: regenerate rules/dist + generated TS from individual files"
+          git push origin HEAD:main

.github/workflows/deploy-backend.yml

@@ -22,7 +22,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Login to Azure (OIDC)
-        uses: azure/login@v3
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -65,7 +65,7 @@ jobs:
         run: dotnet publish ${{ env.CSPROJ_PATH }} --configuration Release --output ./publish --no-build -p:SourceRevisionId=${{ github.sha }} -p:BuildNumber=${{ steps.version.outputs.build_number }} -p:BuildTimestampUtc=${{ steps.version.outputs.build_utc }}
 
       - name: Deploy to Azure Functions
-        uses: Azure/functions-action@v1
+        uses: Azure/functions-action@c5060b3b8bb1ebbcb531abd00c822ecbaa8ea656 # v1
         with:
           app-name: ${{ env.FUNCTION_APP }}
           package: ./publish

.github/workflows/deploy-mcp.yml

@@ -11,7 +11,11 @@ env:
   ACR_NAME: autopilotmonitoreuacr
   CONTAINER_APP_NAME: autopilotmonitor-mcp
   RESOURCE_GROUP: ${{ secrets.AZURE_MCP_RESOURCE_GROUP }}
-  IMAGE_TAG: ${{ github.sha }}
+  # Unique per RUN, not per commit: the docs corpus is baked into the image, so a
+  # docs-only redeploy at an unchanged code sha must still produce a new image
+  # reference — with a sha-only tag `az containerapp update` saw the same image
+  # and silently created no revision (2026-08-28).
+  IMAGE_TAG: ${{ github.sha }}-${{ github.run_number }}
   HEALTH_URL: https://mcp.autopilotmonitor.com/health
   VERSIONS_CONTAINER: https://autopilotmonitoreu.blob.core.windows.net/versions
   PACKAGE_JSON: src/McpServer/autopilot-monitor-mcp/package.json
@@ -28,8 +32,9 @@ jobs:
       # baked into the image as the search_docs corpus (see the Dockerfile). No
       # token is needed. Checking it out here rather than vendoring it keeps the
       # docs single-sourced — but it also means EDITING THE DOCS DOES NOT UPDATE A
-      # RUNNING SERVER; this workflow must be re-run. /health reports the SHA
-      # captured below so that staleness is checkable.
+      # RUNNING SERVER; this workflow must be re-run (IMAGE_TAG is per run so the
+      # re-run actually rolls a new revision). /health reports the SHA captured
+      # below so that staleness is checkable.
       - name: Check out documentation bundle
         uses: actions/checkout@v7
         with:
@@ -41,7 +46,7 @@ jobs:
         run: echo "sha=$(git -C mcp-docs rev-parse HEAD)" >> "$GITHUB_OUTPUT"
 
       - name: Login to Azure (OIDC)
-        uses: azure/login@v3
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}

.github/workflows/deploy-web.yml

@@ -1,5 +1,13 @@
 name: Deploy Web (Static Web App)
 
+# Build here, upload with the pinned SWA CLI. No third-party action sees the deploy token
+# (the CLI is Microsoft-published npm code at an exact version), the build runs on the same
+# path ci.yml tests (setup-node 22 + npm ci + next build) instead of Oryx guessing inside the
+# action's container, and the exported site is attested like the agent ZIP and the MSI.
+#
+# PR preview environments were dropped with the action: their per-PR URLs are never
+# registered as redirect URIs, so nobody could log in on them anyway.
+
 on:
   push:
     branches:
@@ -8,68 +16,140 @@ on:
       - 'src/Web/autopilot-monitor-web/**'
       - '.github/workflows/deploy-web.yml'
   workflow_dispatch:
-  pull_request:
-    types: [opened, synchronize, reopened, closed]
-    branches:
-      - main
-    paths:
-      - 'src/Web/autopilot-monitor-web/**'
-      - '.github/workflows/deploy-web.yml'
+
+permissions:
+  contents: read
+  id-token: write      # keyless Sigstore signing (artifact attestation)
+  attestations: write  # store the provenance attestation
+
+env:
+  PORTAL_VERSION_URL: https://portal.autopilotmonitor.com/version.json
+  VERSIONS_CONTAINER: https://autopilotmonitoreu.blob.core.windows.net/versions
+  WEB_DIR: src/Web/autopilot-monitor-web
+  # Exact version: `npx --package` resolves from the registry at run time, so the pin is the
+  # only thing that keeps the deploy step's code fixed. Bump deliberately.
+  SWA_CLI_VERSION: 2.0.10
 
 jobs:
   build_and_deploy_job:
-    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.action != 'closed')
     runs-on: ubuntu-latest
     name: Build and Deploy Job
-    # Dependabot PRs run without repo secrets, so the deploy token is absent.
-    # Surface it as an env var so the deploy step can gate on it — secrets
-    # cannot be referenced directly in an `if:` expression.
-    env:
-      DEPLOY_TOKEN: ${{ secrets.AZURE_SWA_DEPLOY_TOKEN }}
     steps:
       - uses: actions/checkout@v7
         with:
           lfs: false
           fetch-depth: 0  # Full history needed for git-based sitemap lastmod dates
-      - name: Build And Deploy
-        id: builddeploy
-        # Skip (green) instead of failing when the token is missing (Dependabot
-        # PRs); real deploys on main and internal PRs still have it.
-        if: env.DEPLOY_TOKEN != ''
-        uses: Azure/static-web-apps-deploy@v1
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: ${{ env.WEB_DIR }}/package-lock.json
+
+      - name: Install dependencies
+        working-directory: ${{ env.WEB_DIR }}
+        run: npm ci
+
+      # next.config output:'export' -- `next build` writes the static site to out/
+      # (prebuild: sync-error-codes, generate-lastmod, generate-version).
+      - name: Build
+        working-directory: ${{ env.WEB_DIR }}
         env:
           NEXT_PUBLIC_ENTRA_CLIENT_ID: ${{ vars.NEXT_PUBLIC_ENTRA_CLIENT_ID }}
+          # Dual app-reg window: previous app registration (unset = single-app behaviour)
+          # and the default app for browsers without a stored selection (legacy|primary).
+          NEXT_PUBLIC_ENTRA_LEGACY_CLIENT_ID: ${{ vars.NEXT_PUBLIC_ENTRA_LEGACY_CLIENT_ID }}
+          NEXT_PUBLIC_ENTRA_DEFAULT_APP: ${{ vars.NEXT_PUBLIC_ENTRA_DEFAULT_APP }}
           NEXT_PUBLIC_ENTRA_REDIRECT_URI: ${{ vars.NEXT_PUBLIC_ENTRA_REDIRECT_URI }}
           NEXT_PUBLIC_ENTRA_POST_LOGOUT_REDIRECT_URI: ${{ vars.NEXT_PUBLIC_ENTRA_POST_LOGOUT_REDIRECT_URI }}
           NEXT_PUBLIC_API_BASE_URL: ${{ vars.NEXT_PUBLIC_API_BASE_URL }}
           NEXT_PUBLIC_PLATFORM_STATS_MANIFEST_URL: ${{ vars.NEXT_PUBLIC_PLATFORM_STATS_MANIFEST_URL }}
           NEXT_PUBLIC_APPINSIGHTS_CONNECTION_STRING: ${{ secrets.NEXT_PUBLIC_APPINSIGHTS_CONNECTION_STRING }}
+          # Build stamp for public/version.json (scripts/generate-version.js in prebuild);
+          # the verify step below polls the deployed file for exactly this commit.
+          GITHUB_SHA: ${{ github.sha }}
+        run: |
+          npm run build
+          test -f out/version.json || { echo "out/version.json missing - export did not run"; exit 1; }
+
+      # One archive of the exact bytes that get uploaded, so the attestation has a single subject.
+      - name: Package export
+        id: package
+        run: |
+          archive="portal-${GITHUB_SHA::7}.tar.gz"
+          tar -C "$WEB_DIR/out" -czf "$archive" .
+          echo "archive=$archive" >> "$GITHUB_OUTPUT"
+          sha256sum "$archive"
+
+      # Sigstore keyless provenance: binds the export digest to this workflow run (repo, ref,
+      # commit, workflow file) in a public transparency log.
+      # Verify: gh attestation verify portal-<sha>.tar.gz --repo okieselbach/AutopilotMonitor
+      - name: Attest build provenance (portal export)
+        uses: actions/attest-build-provenance@v4
         with:
-          azure_static_web_apps_api_token: ${{ secrets.AZURE_SWA_DEPLOY_TOKEN }}
-          repo_token: ${{ secrets.GITHUB_TOKEN }} # Used for Github integrations (i.e. PR comments)
-          action: "upload"
-          ###### Repository/Build Configurations - These values can be configured to match your app requirements. ######
-          # For more information regarding Static Web App workflow configurations, please visit: https://aka.ms/swaworkflowconfig
-          app_location: "src/Web/autopilot-monitor-web" # App source code path
-          api_location: "" # Api source code path - optional
-          output_location: "" # Built app content directory - optional
-          ###### End of Repository/Build Configurations ######
+          subject-path: ${{ steps.package.outputs.archive }}
 
-  close_pull_request_job:
-    if: github.event_name == 'pull_request' && github.event.action == 'closed'
-    runs-on: ubuntu-latest
-    name: Close Pull Request Job
-    env:
-      DEPLOY_TOKEN: ${{ secrets.AZURE_SWA_DEPLOY_TOKEN }}
-    steps:
-      - name: Close Pull Request
-        id: closepullrequest
-        if: env.DEPLOY_TOKEN != ''
-        uses: Azure/static-web-apps-deploy@v1
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v7
         with:
-          azure_static_web_apps_api_token: ${{ secrets.AZURE_SWA_DEPLOY_TOKEN }}
-          action: "close"
+          name: portal-${{ github.sha }}
+          path: ${{ steps.package.outputs.archive }}
 
+      # Upload only -- out/ is already built. --swa-config-location points at the app root,
+      # where staticwebapp.config.json lives (next export does not copy it into out/).
+      - name: Deploy to Static Web App
+        env:
+          SWA_CLI_DEPLOYMENT_TOKEN: ${{ secrets.AZURE_SWA_DEPLOY_TOKEN }}
+        run: |
+          npx --yes --package "@azure/static-web-apps-cli@${SWA_CLI_VERSION}" swa deploy \
+            --app-location "$WEB_DIR" \
+            --output-location out \
+            --swa-config-location "$WEB_DIR" \
+            --env production \
+            --no-use-keychain
 
+      # The CLI reporting success proves the upload, not that the production host serves the
+      # new build -- verify against the live /version.json (Cache-Control: no-store via
+      # staticwebapp.config.json) before publishing the version manifest.
+      - name: Verify deployed portal build is live
+        shell: pwsh
+        run: |
+          $expectedCommit = '${{ github.sha }}'.Substring(0, 7)
+          $deadline = [DateTime]::UtcNow.AddMinutes(5)
+          $attempt = 0
 
+          while ([DateTime]::UtcNow -lt $deadline) {
+            $attempt++
+            try {
+              $v = Invoke-RestMethod -Uri '${{ env.PORTAL_VERSION_URL }}' -Method Get -TimeoutSec 30 -Headers @{ 'Cache-Control' = 'no-cache' }
+              if ($v.commit -eq $expectedCommit) {
+                Write-Host "Live after $attempt attempt(s): web @ $($v.commit), built $($v.buildUtc)"
+                exit 0
+              }
+              Write-Host "Attempt ${attempt}: serving $($v.commit) -- waiting for $expectedCommit"
+            } catch {
+              Write-Host "Attempt ${attempt}: /version.json not answering yet -- $($_.Exception.Message)"
+            }
+            Start-Sleep -Seconds 15
+          }
 
+          throw "Portal did not serve commit $expectedCommit within 5 minutes -- deployment not verified, version manifest NOT published"
+
+      # Cross-component deploy record, written last and only on a verified deploy --
+      # same contract as versions/backend.json and versions/mcp.json.
+      - name: Publish version manifest
+        shell: pwsh
+        run: |
+          $manifest = [ordered]@{
+            component   = 'web'
+            commit      = '${{ github.sha }}'.Substring(0, 7)
+            deployedUtc = [DateTime]::UtcNow.ToString('o')
+            runId       = '${{ github.run_id }}'
+          } | ConvertTo-Json
+
+          $sas = '${{ secrets.AZURE_BLOB_VERSIONS_SAS_TOKEN }}'.TrimStart('?')
+          $url = "${{ env.VERSIONS_CONTAINER }}/web.json?$sas"
+          # no-cache: rotating pointer, must never be served stale by any fronting cache.
+          Invoke-RestMethod -Uri $url -Method Put -Headers @{ 'x-ms-blob-type' = 'BlockBlob'; 'x-ms-blob-cache-control' = 'no-cache' } -Body $manifest -ContentType 'application/json' | Out-Null
+          Write-Host "Published versions/web.json"
+          Write-Host $manifest

.github/workflows/oidc-login-test.yml

@@ -15,7 +15,7 @@ jobs:
     name: Federated login + read check
     steps:
       - name: Login to Azure (OIDC)
-        uses: azure/login@v3
+        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}

.github/workflows/pester.yml

@@ -0,0 +1,29 @@
+name: Pester (Bootstrap scripts)
+
+# Pull-request view of the bootstrap script gates. Like ci.yml it reports rather than
+# blocks the merge button.
+#
+# There is deliberately no push trigger: publish-scripts.yml runs the very same
+# reusable gate workflow on every push to main and blocks the upload to the download
+# alias on it. A push trigger here would only duplicate that run, with no consequence.
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'scripts/Bootstrap/**'
+      - 'scripts/CustomerSetup/**'
+      - '.github/scripts/Publish-BootstrapScripts.ps1'
+      - '.github/workflows/bootstrap-script-gates.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pester-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gates:
+    uses: ./.github/workflows/bootstrap-script-gates.yml

.github/workflows/publish-scripts.yml

@@ -0,0 +1,56 @@
+name: Publish customer scripts
+
+# Keeps the scripts behind download.autopilotmonitor.com/agent/ current WITHOUT waiting
+# for an agent release. Before this workflow existed, the script blobs rotated only on a
+# publish_as_stable run of build-agent.yml, so a bootstrap fix sat unpublished until the
+# next agent cutover -- while the WDP bootstrap MSI downloads the published copy on every
+# enrolling device.
+#
+# Same publish code as the release path (.github/scripts/Publish-BootstrapScripts.ps1);
+# this workflow only supplies a second trigger for it.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'scripts/Bootstrap/**'
+      - 'scripts/CustomerSetup/**'
+      - '.github/scripts/Publish-BootstrapScripts.ps1'
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: 'Run every check and report drift, upload nothing'
+        required: true
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+# Shared with build-agent.yml: a script publish and an agent release both touch
+# version.json, and the bootstrapVersion read-modify-write must not interleave with the
+# release writing its agent fields. Never cancel -- a half-published set is worse than a queue.
+concurrency:
+  group: agent-blob-publish
+  cancel-in-progress: false
+
+jobs:
+  gates:
+    uses: ./.github/workflows/bootstrap-script-gates.yml
+
+  publish:
+    name: Publish to the download alias
+    needs: gates
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Publish bootstrap + customer scripts
+        shell: pwsh
+        run: |
+          $dryRun = '${{ inputs.dry_run }}' -eq 'true'
+          ./.github/scripts/Publish-BootstrapScripts.ps1 `
+            -SasToken '${{ secrets.AZURE_BLOB_AGENT_SAS_TOKEN }}' `
+            -LegacySasToken '${{ secrets.AZURE_BLOB_AGENT_LEGACY_SAS_TOKEN }}' `
+            -TableSasToken '${{ secrets.AZURE_TABLE_ADMIN_SAS_TOKEN }}' `
+            -DryRun:$dryRun

.gitignore

@@ -15,7 +15,7 @@ bld/
 [Ll]ogs/
 
 # Build counter files: the authoritative counter is the shared blob
-# (agent container, buildcounter-v{N}.txt, ETag-CAS — see docs/agent/build-counter-blob.md).
+# (agent container, buildcounter-v{N}.txt, ETag-CAS — see internal/docs/agent/build-counter-blob.md).
 # The local file is only an offline fallback for -SkipUpload/bare-dotnet smoke builds.
 buildcounter.txt
 
@@ -53,6 +53,9 @@ __azurite_db*__.json
 node_modules/
 .next/
 out/
+# Managed by Next.js since v16 (regenerated by next dev/build/typegen; path
+# inside flips between .next/types and .next/dev/types) — must not be tracked.
+next-env.d.ts
 build/
 dist/
 !rules/dist/
@@ -111,17 +114,10 @@ tmpclaude-*-cwd
 # Claude skills and scripts are now in a private submodule (.claude/commands/)
 # No individual file ignores needed — the submodule handles everything
 
-# Deployment scripts (local only — contain tokens + SAS URLs)
-scripts/Deployment/
-
-# Migration tooling (local only, vorerst) — cross-tenant storage/cert migration scripts
-scripts/Migration/
-
 # Infra: tracked. The Bicep templates carry no credentials — every secret is a
 # @secure() parameter with an empty default, injected at deploy time, and image
 # pull runs on managed identity. Keep it that way: never commit a resolved secret
 # value or a *.parameters.json holding one.
-infra/*.parameters.json
 
 # M2 — local raw session fixtures before anonymization (plan §4 M2)
 tests/fixtures/enrollment-sessions-local/
@@ -132,19 +128,24 @@ tests/fixtures/enrollment-sessions-local/
 TODO.txt
 tools/orphan-analysis.py
 tools/export-session-fixture.mjs
-tasks/
 
 # Azure Table cleanup backups (dry-run exports + delete manifests)
-# Produced by /cleanup-table skill — never commit deletion payloads
+# Produced by operator tooling — never commit deletion payloads
 db-backups/
 plans/REFACTOR_AGENT_V2.md
 .claude/scheduled_tasks.lock
 .claude/plans/health-script-remediation-fix.md
+internal/docs/Introduction-AutopilotMonitor.pptx
+internal/docs/~$Introduction-AutopilotMonitor.pptx
 
-# Operator-local Azure setup helper — applies lifecycle policy + container
-# creation against a live storage account. Not portable across environments
-# (storage account name, resource group are operator-specific) so it stays
-# out of the repo. Each operator keeps their own copy.
-scripts/Backup/setup-backup-container.ps1
-docs/Introduction-AutopilotMonitor.pptx
-docs/~$Introduction-AutopilotMonitor.pptx
+# Playwright MCP browser artifacts (snapshots, screenshots, console logs)
+.playwright-mcp/
+
+# Web build stamp: generated by scripts/generate-version.js on every build (buildUtc
+# changes each run) and served at /version.json from the static export.
+src/Web/autopilot-monitor-web/public/version.json
+
+
+# Local IME installer scratch (MSI + extracted payload per version, for grepping
+# in binaries). Operator-only, never committed.
+ime-files/

.gitmodules

@@ -1,3 +1,9 @@
 [submodule ".claude/commands"]
 	path = .claude/commands
 	url = https://github.com/okieselbach/Autopilot-Monitor-dotclaude.git
+[submodule "docs"]
+	path = internal
+	url = https://github.com/okieselbach/Autopilot-Monitor-internal.git
+[submodule "infra"]
+	path = infra
+	url = https://github.com/okieselbach/Autopilot-Monitor-infra.git

.mcp.json

@@ -3,6 +3,10 @@
     "autopilot-monitor": {
       "type": "http",
       "url": "https://mcp.autopilotmonitor.com/mcp"
+    },
+    "playwright": {
+      "command": "cmd",
+      "args": ["/c", "npx", "@playwright/mcp@latest"]
     }
   }
 }

CODE_OF_CONDUCT.md

@@ -0,0 +1,19 @@
+# Code of Conduct
+
+This applies to all project spaces: issues, pull requests, discussions, and the documentation repository.
+
+## Expectations
+
+- Be respectful and constructive. Disagree with ideas, not with people.
+- Assume good intent. Most confusion is a documentation gap, not malice.
+- Keep discussions on topic and searchable: clear titles, reproducible steps, text instead of screenshots of text where possible.
+- Never post customer data, tenant IDs, device identifiers, tokens, or log excerpts containing personal data in public issues or discussions. Redact first.
+
+## Not acceptable
+
+Harassment, personal attacks, discriminatory language, publishing others' private information, and sustained disruption of discussions.
+
+## Enforcement
+
+The maintainers may edit, hide, or delete content and may block accounts that violate this code. To raise a concern, contact the maintainers privately through
+[GitHub](https://github.com/okieselbach) rather than in a public thread.

CONTRIBUTING.md

@@ -0,0 +1,17 @@
+# Feedback and Issues
+
+Autopilot Monitor is developed and operated by its maintainers. The source is published so that customers and security reviewers can see what runs on their devices and with their data. This page explains where feedback goes.
+
+| I want to… | Go to |
+|---|---|
+| Report a bug | [New issue → Bug report](https://github.com/okieselbach/AutopilotMonitor/issues/new/choose) |
+| Suggest a feature | [New issue → Feature request](https://github.com/okieselbach/AutopilotMonitor/issues/new/choose) |
+| Ask a question or discuss an idea | [Discussions](https://github.com/okieselbach/AutopilotMonitor/discussions) |
+| Report a security issue | [SECURITY.md](SECURITY.md) — privately, never as a public issue |
+| Read how the product works | [docs.autopilotmonitor.com](https://docs.autopilotmonitor.com) |
+
+## Reporting a problem in your own tenant
+
+For a failed or odd enrollment, the **Report Session** button in the portal is the fastest path. It hands the session context to support without exposing any of it publicly. Use a GitHub issue for problems that are reproducible and not tied to your data.
+
+Please redact tenant IDs, device names, serial numbers, and anything personal before posting in a public issue or discussion.

Directory.Build.props

@@ -0,0 +1,12 @@
+<Project>
+  <!-- Warning freeze (2026-08-13, backlog cleared to zero): every .NET build in this repo
+       must stay warning-free. Compiler, MSBuild and NuGet restore warnings are all fatal.
+       Exception: NuGet audit advisories (NU1901-NU1904) stay warnings — a CVE published
+       against an already-referenced package must not block an unrelated hotfix deploy;
+       advisories are handled by bumping the package, not by failing the build. -->
+  <PropertyGroup>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <MSBuildTreatWarningsAsErrors>true</MSBuildTreatWarningsAsErrors>
+    <WarningsNotAsErrors>NU1901;NU1902;NU1903;NU1904</WarningsNotAsErrors>
+  </PropertyGroup>
+</Project>

LICENSE

@@ -1,39 +1,673 @@
-Autopilot Monitor - Split License
+GNU AFFERO GENERAL PUBLIC LICENSE
+Version 3, 19 November 2007
 
-Copyright (c) 2026 Autopilot Monitor Contributors
+Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
 
-This project uses a split licensing model. Different components are
-licensed under different terms:
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
 
-## MIT License
+                            Preamble
 
-The following components are licensed under the MIT License:
+The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
 
-- src/Agent/    - The Autopilot Monitor Agent (deployed to devices)
-- src/Shared/   - Shared DTOs, enums, and constants
+The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains
+free software for all its users.
 
-See src/Agent/LICENSE and src/Shared/LICENSE for the full MIT license text.
+When we speak of free software, we are referring to freedom, not price.
+Our General Public Licenses are designed to make sure that you have the
+freedom to distribute copies of free software (and charge for them if
+you wish), that you receive source code or can get it if you want it,
+that you can change the software or use pieces of it in new free
+programs, and that you know you can do these things.
 
-## GNU Affero General Public License v3.0 (AGPL-3.0)
+Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
 
-The following components are licensed under the AGPL-3.0:
+A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
 
-- src/Backend/   - Azure Functions backend
-- src/Web/       - Next.js web frontend
-- src/McpServer/ - MCP Server
+The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
 
-See src/Backend/LICENSE for the full AGPL-3.0 license text.
+An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing
+under this license.
 
-## Why Split Licensing?
+The precise terms and conditions for copying, distribution and
+modification follow.
 
-The Agent runs on end-user devices and is licensed under MIT to allow
-unrestricted use, modification, and distribution without copyleft
-obligations.
+                       TERMS AND CONDITIONS
 
-The server-side components (Backend, Web, McpServer) are licensed under
-AGPL-3.0 to ensure that modifications to the server infrastructure
-remain open source, especially when deployed as a network service.
+0. Definitions.
 
-The Shared library is MIT-licensed because it is a dependency of the
-MIT-licensed Agent. Using AGPL for Shared would effectively make the
-Agent AGPL as well.
+"This License" refers to version 3 of the GNU Affero General Public
+License.
+
+"Copyright" also means copyright-like laws that apply to other kinds
+of works, such as semiconductor masks.
+
+"The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of
+an exact copy.  The resulting work is called a "modified version" of
+the earlier work or a work "based on" the earlier work.
+
+A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user
+through a computer network, with no transfer of a copy, is not
+conveying.
+
+An interactive user interface displays "Appropriate Legal Notices" to
+the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+1. Source Code.
+
+The "source code" for a work means the preferred form of the work for
+making modifications to it.  "Object code" means any non-source form
+of a work.
+
+A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that is
+widely used among developers working in that language.
+
+The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+The Corresponding Source need not include anything that users can
+regenerate automatically from other parts of the Corresponding Source.
+
+The Corresponding Source for a work in source code form is that same
+work.
+
+2. Basic Permissions.
+
+All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+You may make, run and propagate covered works that you do not convey,
+without conditions so long as your license otherwise remains in force.
+You may convey covered works to others for the sole purpose of having
+them make modifications exclusively for you, or provide you with
+facilities for running those works, provided that you comply with the
+terms of this License in conveying all material for which you do not
+control copyright.  Those thus making or running the covered works for
+you must do so exclusively on your behalf, under your direction and
+control, on terms that prohibit them from making any copies of your
+copyrighted material outside their relationship with you.
+
+Conveying under any other circumstances is permitted solely under the
+conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such measures.
+
+When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such
+circumvention is effected by exercising rights under this License with
+respect to the covered work, and you disclaim any intention to limit
+operation or modification of the work as a means of enforcing, against
+the work's users, your or third parties' legal rights to forbid
+circumvention of technological measures.
+
+4. Conveying Verbatim Copies.
+
+You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the
+code; keep intact all notices of the absence of any warranty; and give
+all recipients a copy of this License along with the Program.
+
+You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+5. Conveying Modified Source Versions.
+
+You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these
+conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under
+    section 7.  This requirement modifies the requirement in section
+    4 to "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not used
+to limit the access or legal rights of the compilation's users beyond
+what the individual works permit.  Inclusion of a covered work in an
+aggregate does not cause this License to apply to the other parts of
+the aggregate.
+
+6. Conveying Non-Source Forms.
+
+You may convey a covered work in object code form under the terms of
+sections 4 and 5, provided that you also convey the machine-readable
+Corresponding Source under the terms of this License, in one of these
+ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the Corresponding
+    Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in
+    accord with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to
+    the Corresponding Source in the same way through the same place
+    at no further charge.  You need not require recipients to copy
+    the Corresponding Source along with the object code.  If the
+    place to copy the object code is a network server, the
+    Corresponding Source may be on a different server (operated by
+    you or a third party) that supports equivalent copying
+    facilities, provided you maintain clear directions next to the
+    object code saying where to find the Corresponding Source.
+    Regardless of what server hosts the Corresponding Source, you
+    remain obligated to ensure that it is available for as long as
+    needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission,
+    provided you inform other peers where the object code and
+    Corresponding Source of the work are being offered to the general
+    public at no charge under subsection 6d.
+
+A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for
+incorporation into a dwelling.  In determining whether a product is a
+consumer product, doubtful cases shall be resolved in favor of
+coverage.  For a particular product received by a particular user,
+"normally used" refers to a typical or common use of that class of
+product, regardless of the status of the particular user or of the way
+in which the particular user actually uses, or expects or is expected
+to use, the product.  A product is a consumer product regardless of
+whether the product has substantial commercial, industrial or
+non-consumer uses, unless such uses represent the only significant
+mode of use of the product.
+
+"Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to
+install and execute modified versions of a covered work in that User
+Product from a modified version of its Corresponding Source.  The
+information must suffice to ensure that the continued functioning of
+the modified object code is in no case prevented or interfered with
+solely because modification has been made.
+
+If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or
+updates for a work that has been modified or installed by the
+recipient, or for the User Product in which it has been modified or
+installed.  Access to a network may be denied when the modification
+itself materially and adversely affects the operation of the network
+or violates the rules and protocols for communication across the
+network.
+
+Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+7. Additional Terms.
+
+"Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright
+holders of that material) supplement the terms of this License with
+terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material,
+    or requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors
+    or authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions
+    of it) with contractual assumptions of liability to the recipient,
+    for any liability that these contractual assumptions directly
+    impose on those licensors and authors.
+
+All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions; the
+above requirements apply either way.
+
+8. Termination.
+
+You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+However, if you cease all violation of this License, then your license
+from a particular copyright holder is reinstated (a) provisionally,
+unless and until the copyright holder explicitly and finally terminates
+your license, and (b) permanently, if the copyright holder fails to
+notify you of the violation by some reasonable means prior to 60 days
+after the cessation.
+
+Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+9. Acceptance Not Required for Having Copies.
+
+You are not required to accept this License in order to receive or run
+a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+10. Automatic Licensing of Downstream Recipients.
+
+Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+11. Patents.
+
+A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+A contributor's "essential patent claims" are all patent claims owned
+or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the
+patent license to downstream recipients.  "Knowingly relying" means
+you have actual knowledge that, but for the patent license, your
+conveying the covered work in a country, or your recipient's use of
+the covered work in a country, would infringe one or more identifiable
+patents in that country that you have reason to believe are valid.
+
+If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+A patent license is "discriminatory" if it does not include within the
+scope of its coverage, prohibits the exercise of, or is conditioned on
+the non-exercise of one or more of the rights that are specifically
+granted under this License.  You may not convey a covered work if you
+are a party to an arrangement with a third party that is in the
+business of distributing software, under which you make payment to the
+third party based on the extent of your activity of conveying the
+work, and under which the third party grants, to any of the parties
+who would receive the covered work from you, a discriminatory patent
+license (a) in connection with copies of the covered work conveyed by
+you (or copies made from those copies), or (b) primarily for and in
+connection with specific products or compilations that contain the
+covered work, unless you entered into that arrangement, or that patent
+license was granted, prior to 28 March 2007.
+
+Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+12. No Surrender of Others' Freedom.
+
+If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey
+a covered work so as to satisfy simultaneously your obligations under
+this License and any other pertinent obligations, then as a
+consequence you may not convey it at all.  For example, if you agree
+to terms that obligate you to collect a royalty for further conveying
+from those to whom you convey the Program, the only way you could
+satisfy both those terms and this License would be to refrain entirely
+from conveying the Program.
+
+13. Remote Network Interaction; Use with the GNU General Public
+License.
+
+Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your
+version supports such interaction) an opportunity to receive the
+Corresponding Source of your version by providing access to the
+Corresponding Source from a network server at no charge, through some
+standard or customary means of facilitating copying of software.  This
+Corresponding Source shall include the Corresponding Source for any
+work covered by version 3 of the GNU General Public License that is
+incorporated pursuant to the following paragraph.
+
+Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+14. Revised Versions of this License.
+
+The Free Software Foundation may publish revised and/or new versions
+of the GNU Affero General Public License from time to time.  Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever
+published by the Free Software Foundation.
+
+If the Program specifies that a proxy can decide which future versions
+of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+15. Disclaimer of Warranty.
+
+THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT
+WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND
+PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE PROGRAM PROVE
+DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR
+CORRECTION.
+
+16. Limitation of Liability.
+
+IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR
+CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES
+ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT
+NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR
+LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM
+TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER
+PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+17. Interpretation of Sections 15 and 16.
+
+If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                 END OF TERMS AND CONDITIONS
+
+    How to Apply These Terms to Your New Programs
+
+If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these
+terms.
+
+To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as
+    published by the Free Software Foundation, either version 3 of the
+    License, or (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public
+    License along with this program.  If not, see
+    <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper
+mail.
+
+If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application,
+its interface could display a "Source" link that leads users to an
+archive of the code.  There are many ways you could offer source, and
+different solutions will be better for different programs; see section
+13 for the specific requirements.
+
+You should also get your employer (if you work as a programmer) or
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  For more information on this, and how to apply and follow
+the GNU AGPL, see <https://www.gnu.org/licenses/>.

README.md

@@ -1,22 +1,22 @@
-# <img src="docs/images/logo.svg" height="28" alt="" /> AutopilotMonitor
+# <img src=".github/assets/logo.svg" height="28" alt="" /> Autopilot Monitor
 
-[![Status](https://img.shields.io/badge/status-Private%20Preview-orange)](https://www.autopilotmonitor.com)
+[![Status](https://img.shields.io/badge/status-live-brightgreen)](https://www.autopilotmonitor.com)
 [![License](https://img.shields.io/badge/license-MIT%20%2B%20AGPL--3.0-blue)](LICENSE)
 [![Website](https://img.shields.io/badge/website-autopilotmonitor.com-2ea44f)](https://www.autopilotmonitor.com)
 
 Advanced monitoring and troubleshooting solution for Windows Autopilot deployments. Gain full visibility into every enrollment session with a detailed event timeline, fleet health dashboards, and session reporting. Define custom analysis rules to automatically detect issues and gather rules to collect targeted evidence. Retrieve diagnostics packages on demand, configure agent settings like auto-reboot behavior and automatic timezone adjustment — all managed centrally from the web dashboard.
 
-## Private Preview
+## Availability
 
-Autopilot Monitor is currently running as a **Private Preview**. Visit **[autopilotmonitor.com](https://www.autopilotmonitor.com)** to request access and learn more.
+Autopilot Monitor is **publicly available** — the Community plan is free. Sign in with your work account at **[autopilotmonitor.com](https://www.autopilotmonitor.com)**; new organizations complete a short activation step after first sign-in.
 
 <p align="center">
-  <img src="docs/images/SessionList.png" width="45%" />
-  <img src="docs/images/FleetHealth.png" width="45%" />
+  <img src=".github/assets/SessionList.png" width="45%" />
+  <img src=".github/assets/FleetHealth.png" width="45%" />
 </p>
 <p align="center">
-  <img src="docs/images/SessionDetails.png" width="45%" />
-  <img src="docs/images/SessionTimeline.png" width="45%" />
+  <img src=".github/assets/SessionDetails.png" width="45%" />
+  <img src=".github/assets/SessionTimeline.png" width="45%" />
 </p>
 
 ## Overview
@@ -27,20 +27,31 @@ Autopilot Monitor provides real-time tracking, intelligent diagnostics, and auto
 - **Monitoring Agent** — Lightweight .NET application that collects telemetry and evidence during enrollment
 - **Backend API** — Azure Functions-based ingestion and processing pipeline
 - **Web Dashboard** — Next.js application for real-time monitoring and fleet analytics
+- **MCP Server** — Model Context Protocol server that lets AI assistants query and troubleshoot enrollments in natural language
 
-## Architecture
+## AI Integration (MCP)
 
-For detailed information about the system architecture, components, and data flow, see [Architecture Documentation](docs/architecture.md).
+Autopilot Monitor ships a hosted **[Model Context Protocol](https://modelcontextprotocol.io)** server. Connect Claude Desktop, VS Code, or any MCP client that speaks Streamable HTTP with OAuth, and ask questions like:
+
+- *"Show me all failed enrollments from the last 24 hours and group them by failure reason."*
+- *"Why did session X fail, and which app install caused the delay?"*
+- *"Which devices in my fleet are affected by CVE-2024-30078?"*
+
+Server URL: `https://mcp.autopilotmonitor.com/mcp` — sign-in runs through your existing work account, access is scoped to your tenant exactly like in the portal, and no credentials are stored. Setup guide: **[AI Integration (MCP)](https://docs.autopilotmonitor.com/integrations/ai-integration-mcp)**.
 
 ## Documentation
 
 Full admin documentation is available at **[docs.autopilotmonitor.com](https://docs.autopilotmonitor.com)**
 
+## Feedback
+
+Bug reports and feature requests go through [Issues](https://github.com/okieselbach/AutopilotMonitor/issues/new/choose), questions and ideas through [Discussions](https://github.com/okieselbach/AutopilotMonitor/discussions). Security issues are reported privately, see [SECURITY.md](SECURITY.md). For a problem in your own tenant, the **Report Session** button in the portal is the fastest path.
+
 ## License
 
-This project uses a **split licensing model**:
+This project uses a **split licensing model**. The root [LICENSE](LICENSE) is AGPL-3.0, which covers the server-side components; the device-side components carry their own MIT license file:
 
-- **MIT License** — Agent (`src/Agent/`) and Shared library (`src/Shared/`) — unrestricted use on end-user devices
-- **AGPL-3.0** — Backend (`src/Backend/`), Web Dashboard (`src/Web/`), and MCP Server (`src/McpServer/`) — server-side components remain open source
+- **MIT License** — Agent ([`src/Agent/`](src/Agent/LICENSE)) and Shared library ([`src/Shared/`](src/Shared/LICENSE)) — unrestricted use on end-user devices, no copyleft obligations
+- **AGPL-3.0** — Backend ([`src/Backend/`](src/Backend/LICENSE)), Web Dashboard ([`src/Web/`](src/Web/LICENSE)), and MCP Server ([`src/McpServer/`](src/McpServer/LICENSE)) — modifications to server-side components remain open source, especially when deployed as a network service
 
-See [LICENSE](LICENSE) for full details.
+The Shared library is MIT because it is a dependency of the MIT-licensed Agent. The license file inside each component directory is authoritative for that component.

SECURITY.md

@@ -0,0 +1,37 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report security issues **privately** through
+[GitHub Security Advisories](https://github.com/okieselbach/AutopilotMonitor/security/advisories/new).
+Private vulnerability reporting is enabled, so a report reaches the maintainers without ever being public.
+
+Please do not open a public issue, post on social media, or send email for security findings.
+
+## What to expect
+
+- An acknowledgement and an initial severity assessment.
+- A fix or a mitigation plan, with a shared view of timing before anything is disclosed.
+- Credit in the advisory if you want it, and none if you prefer to stay anonymous.
+
+Reports are read by the maintainers directly. There is no guaranteed response time and no bug bounty.
+
+## Scope and rules of engagement
+
+Security research against the hosted service is welcome and is not a violation of the
+[Terms of Use](https://www.autopilotmonitor.com/terms). While testing, please:
+
+- do not access data of tenants you do not own,
+- do not degrade the service for others,
+- do not run automated scanners against production.
+
+## Supported versions
+
+The hosted service always runs the current `main`. For the on-device agent, only the
+[latest release](https://github.com/okieselbach/AutopilotMonitor/releases/latest) receives fixes.
+
+## More
+
+The [Security FAQ](https://docs.autopilotmonitor.com/trust-and-security/security-faq) and
+[Data Flows](https://docs.autopilotmonitor.com/trust-and-security/data-flows) pages describe the security model,
+data handling, and isolation in detail.

build.ps1

@@ -1,166 +0,0 @@
-<#
-.SYNOPSIS
-    Build script for Autopilot Monitor solution.
-
-.DESCRIPTION
-    Builds all .NET projects and optionally the web UI.
-    Run this after cloning or when you want to rebuild everything.
-
-.PARAMETER Configuration
-    Build configuration: Debug or Release (default: Debug)
-
-.PARAMETER IncludeWeb
-    Also build the web UI (requires Node.js)
-
-.PARAMETER Clean
-    Clean before building
-
-.EXAMPLE
-    .\build.ps1
-    Builds all .NET projects in Debug mode
-
-.EXAMPLE
-    .\build.ps1 -Configuration Release -IncludeWeb
-    Builds everything in Release mode including web UI
-#>
-
-[CmdletBinding()]
-param(
-    [ValidateSet("Debug", "Release")]
-    [string]$Configuration = "Debug",
-
-    [switch]$IncludeWeb,
-
-    [switch]$Clean
-)
-
-$ErrorActionPreference = "Stop"
-
-Write-Host "============================================" -ForegroundColor Cyan
-Write-Host " Autopilot Monitor Build Script" -ForegroundColor Cyan
-Write-Host "============================================" -ForegroundColor Cyan
-Write-Host ""
-
-$rootPath = $PSScriptRoot
-$slnPath = Join-Path $rootPath "AutopilotMonitor.sln"
-
-# Check prerequisites
-Write-Host "[1/4] Checking prerequisites..." -ForegroundColor Yellow
-
-# Check .NET SDK
-try {
-    $dotnetVersion = & dotnet --version
-    Write-Host "  ✓ .NET SDK version: $dotnetVersion" -ForegroundColor Green
-}
-catch {
-    Write-Host "  ✗ .NET SDK not found. Please install .NET 10 SDK." -ForegroundColor Red
-    exit 1
-}
-
-# Check Node.js if building web
-if ($IncludeWeb) {
-    try {
-        $nodeVersion = & node --version
-        Write-Host "  ✓ Node.js version: $nodeVersion" -ForegroundColor Green
-    }
-    catch {
-        Write-Host "  ✗ Node.js not found. Please install Node.js 18+." -ForegroundColor Red
-        exit 1
-    }
-}
-
-Write-Host ""
-
-# Clean if requested
-if ($Clean) {
-    Write-Host "[2/4] Cleaning solution..." -ForegroundColor Yellow
-    & dotnet clean $slnPath -c $Configuration
-    Write-Host "  ✓ Clean completed" -ForegroundColor Green
-    Write-Host ""
-}
-else {
-    Write-Host "[2/4] Skipping clean (use -Clean to clean first)" -ForegroundColor Gray
-    Write-Host ""
-}
-
-# Restore packages
-Write-Host "[3/4] Restoring NuGet packages..." -ForegroundColor Yellow
-& dotnet restore $slnPath
-
-if ($LASTEXITCODE -ne 0) {
-    Write-Host "  ✗ Restore failed" -ForegroundColor Red
-    exit 1
-}
-
-Write-Host "  ✓ Restore completed" -ForegroundColor Green
-Write-Host ""
-
-# Build solution
-Write-Host "[4/4] Building solution ($Configuration)..." -ForegroundColor Yellow
-& dotnet build $slnPath -c $Configuration --no-restore
-
-if ($LASTEXITCODE -ne 0) {
-    Write-Host "  ✗ Build failed" -ForegroundColor Red
-    exit 1
-}
-
-Write-Host "  ✓ Build completed" -ForegroundColor Green
-Write-Host ""
-
-# Build web if requested
-if ($IncludeWeb) {
-    Write-Host "[BONUS] Building web UI..." -ForegroundColor Yellow
-    $webPath = Join-Path $rootPath "src\Web\autopilot-monitor-web"
-
-    Push-Location $webPath
-    try {
-        Write-Host "  Installing npm packages..." -ForegroundColor Gray
-        & npm install --silent
-
-        if ($LASTEXITCODE -ne 0) {
-            Write-Host "  ✗ npm install failed" -ForegroundColor Red
-            exit 1
-        }
-
-        Write-Host "  Building Next.js app..." -ForegroundColor Gray
-        & npm run build
-
-        if ($LASTEXITCODE -ne 0) {
-            Write-Host "  ✗ Web build failed" -ForegroundColor Red
-            exit 1
-        }
-
-        Write-Host "  ✓ Web build completed" -ForegroundColor Green
-    }
-    finally {
-        Pop-Location
-    }
-    Write-Host ""
-}
-
-# Summary
-Write-Host "============================================" -ForegroundColor Cyan
-Write-Host " Build Completed Successfully!" -ForegroundColor Green
-Write-Host "============================================" -ForegroundColor Cyan
-Write-Host ""
-Write-Host "Output locations:" -ForegroundColor White
-Write-Host "  Agent:     src\Agent\AutopilotMonitor.Agent.V2\bin\$Configuration\net48\" -ForegroundColor Gray
-Write-Host "  Functions: src\Backend\AutopilotMonitor.Functions\bin\$Configuration\net10.0\" -ForegroundColor Gray
-
-if ($IncludeWeb) {
-    Write-Host "  Web UI:    src\Web\autopilot-monitor-web\.next\" -ForegroundColor Gray
-}
-
-Write-Host ""
-Write-Host "Next steps:" -ForegroundColor White
-Write-Host "  1. Start Azurite: azurite --silent --location c:\azurite" -ForegroundColor Gray
-Write-Host "  2. Start Functions: cd src\Backend\AutopilotMonitor.Functions && func start" -ForegroundColor Gray
-
-if ($IncludeWeb) {
-    Write-Host "  3. Start Web UI: cd src\Web\autopilot-monitor-web && npm run dev" -ForegroundColor Gray
-    Write-Host "  4. Test Agent: cd src\Agent\AutopilotMonitor.Agent.V2\bin\$Configuration\net48 && .\AutopilotMonitor.Agent.exe --console" -ForegroundColor Gray
-}
-else {
-    Write-Host "  3. Test Agent: cd src\Agent\AutopilotMonitor.Agent.V2\bin\$Configuration\net48 && .\AutopilotMonitor.Agent.exe --console" -ForegroundColor Gray
-}
-

docs/agent/autopilot-ztd-diagnostics.md

@@ -1,156 +0,0 @@
----
-type: Reference
-title: Autopilot ZTD Diagnostics — Event IDs, Registry Surfaces, Endpoints, Error Codes
-description: Windows' own diagnostic surfaces for the Autopilot profile-download (ZTD) flow and known deployment error codes — what the agent reads, what each identifier means, and where the knowledge comes from.
-resource: /src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/DeviceInfo/ZtdEvidence.cs
-tags:
-  - agent
-  - autopilot
-  - ztd
-  - diagnostics
-  - event-log
-  - troubleshooting
-timestamp: 2026-07-16T00:00:00+02:00
----
-
-# Autopilot ZTD Diagnostics
-
-Windows documents its own diagnostic surfaces for the Autopilot profile-download flow
-(the Zero-Touch Deployment / "ZTD" service round-trip during OOBE). The agent consumes
-three of them to turn the `autopilot_profile_missing` warning from a guess into an
-evidence-backed verdict, and the backend rule engine uses the error-code map for
-known-issue enrichment.
-
-Consumers in this repo:
-
-* `ZtdEvidence.cs` (agent) — one-shot event-log query + `Diagnostics\Autopilot` registry
-  dump + deployment-service reachability probe on the profile-missing path.
-* `ModernDeploymentTracker.cs` (agent) — continuous watcher of the same channel,
-  Level ≤ 3 only (Warning/Error/Critical) plus targeted Info IDs.
-* Analyze rules (backend) — HRESULT/known-issue map (see [Error codes](#schema--error-codes)).
-
-# Schema — ModernDeployment Autopilot event channel
-
-Channel: `Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot`
-(Event Viewer: Application and Services Logs → Microsoft → Windows →
-ModernDeployment-Diagnostics-Provider → Autopilot).
-
-| Event ID | Level | Meaning | Agent verdict mapping (`ztdVerdict`) |
-| --- | --- | --- | --- |
-| 100 | Warning | "Autopilot policy [name] not found" — temporary, device is waiting for the profile download. Windows can log hundreds of these per minute (harmless-rollup in `ModernDeploymentTracker`). | `waiting_for_profile_no_internet_confirmation` (when nothing else was logged) |
-| 101/103/109/111 | Info | Profile settings retrieval/processing details. | not queried |
-| 153 | Info | `ProfileState_Unknown → ProfileState_Available` — a profile was downloaded and is ready. | `profile_downloaded` |
-| 160 | Info | Profile settings acquisition beginning. | context only |
-| 161 | Info | Profile download succeeded. | `profile_downloaded` |
-| 163 | Info | Download not required — device already provisioned (typically after `Sysprep /Generalize`, i.e. Autopilot-for-existing-devices images). | `already_provisioned` |
-| 164 | Info | Internet available to attempt policy download — the authoritative witness that the ZTD round-trip could run at OOBE time. | with no 161: `download_attempted_no_profile_returned` (the assignment-gap signature, session 423b5360) |
-| 171 | Error | TPM identity confirmation failed (HRESULT in payload) — self-deploying/pre-prov attestation. | context only (`inconclusive` if alone) |
-| 172 | Error | Failed to set profile as available — usually follows 171. | context only |
-| 807 | Error | `ZtdDeviceIsNotRegistered` — hardware hash not registered in Autopilot. | `device_not_registered` |
-| 809 | Error | `ZtdDeviceHasNoAssignedProfile` — the assigned profile was deleted without cleanup. | `assigned_profile_deleted` |
-| 815 | Error | `ZtdDeviceHasNoAssignedProfile` — no profile assigned and no tenant default profile. | `no_profile_assigned` |
-| 908 | Error | `SerialNumberMismatch` / `ProductKeyIdMismatch` between Autopilot registration and physical hardware. | `serial_or_product_key_mismatch` |
-
-Verdict priority: error IDs are authoritative (807 → 908 → 809 → 815), then the Info-flow
-reconstruction (161/153 → 163 → 164 → 100). Implemented in
-`ZtdEvidence.ComputeZtdVerdict`, pinned by `ZtdEvidenceVerdictTests`.
-
-# Schema — Diagnostics registry key
-
-`HKLM\SOFTWARE\Microsoft\Provisioning\Diagnostics\Autopilot` — written by the ZTD client,
-dumped verbatim by the agent into the `autopilot_profile` event (`diagnosticsRegistry`):
-
-| Value | Meaning |
-| --- | --- |
-| `AadTenantId` | GUID of the tenant the user signed into. |
-| `CloudAssignedTenantDomain` | Tenant the device is registered with; **blank = not registered with Autopilot**. |
-| `CloudAssignedTenantId` | GUID matching `CloudAssignedTenantDomain`; blank when not registered. |
-| `IsAutopilotDisabled` | 1 = device not registered **or** profile download failed (network/firewall/timeout) — Microsoft's own catch-all indicator. **Casing caveat:** Windows actually writes `IsAutoPilotDisabled` (capital P; observed session e7dbac7a, 24H2) while the FAQ documents `IsAutopilotDisabled` — all agent lookups are case-insensitive for this reason. |
-| `TenantMatched` | 0 = user's tenant ≠ registration tenant → the "username belongs to another organization" OOBE error. |
-| `CloudAssignedOobeConfig` | Bitmap of configured OOBE settings (SkipCortanaOptIn=1, OobeUserNotLocalAdmin=2, SkipExpressSettings=4, SkipOemRegistration=8, SkipEula=16). |
-
-The profile cache itself lives in `HKLM\SOFTWARE\Microsoft\Provisioning\AutopilotPolicyCache`
-(`PolicyJsonCache`, `ProfileAvailable`) — `ProfileAvailable=0` plus an empty
-`ZeroTouchConfig` is the "blank profile cached" state the troubleshooting FAQ describes
-when no profile exists at check time. A reboot re-runs the download and can replace the
-blank cache.
-
-# Schema — Endpoints
-
-| Endpoint | Purpose | Agent behavior |
-| --- | --- | --- |
-| `https://ztd.dds.microsoft.com` | Autopilot Deployment Service — profile delivery during OOBE. | Reachability probe on profile-missing (any HTTP status = reachable). **Note:** several third-party blogs cite `ztd.ssd.microsoft.com`; the official requirements page says `ztd.dds.microsoft.com`. |
-| `https://login.live.com` | Second Deployment-Service URL; also needed by the Microsoft Sign-in Assistant (`wlidsvc`) — a policy that disables wlidsvc breaks profile download. | not probed |
-| `*.microsoftaik.azure.net` (+ per-vendor EK cert URLs) | TPM attestation for self-deploying/pre-provisioning. | not probed |
-| `lgmsapeweu.blob.core.windows.net` | Intune automatic diagnostics upload. | deliberately not probed (decision 2026-07-16: not mission-critical) |
-
-# Observability — when the agent can actually see these errors
-
-The agent's install timing bounds what the known-issue rules can ever observe. In the
-normal deployment model the agent is installed by an **Intune platform script via IME —
-i.e. only AFTER MDM enrollment succeeded**. Everything that happens before that point
-(profile download, TPM attestation in self-deploying/pre-provisioning, the MDM enrollment
-handshake itself) is over before our process exists.
-
-| Failure class | Normal flow (IME install) | Bootstrap token mode | Await-enrollment mode |
-| --- | --- | --- | --- |
-| Enrollment blocked (0x80180014/18, 0xC1036501, 0x801C03F3 → ANALYZE-ENRL-004) | **Invisible** — no enrollment ⇒ no agent, no session. | **Visible** — the bootstrap token exists precisely to report pre-MDM (as of 2026-07: one customer piloting). | **Invisible to the backend** — the agent binary is present but only polls for the MDM certificate; without the cert it cannot authenticate, and monitoring starts only after the cert appears. A hard blocker ends in the await timeout (default 480 min) with nothing uploaded. |
-| TPM attestation (ANALYZE-ENRL-003) | **Visible via error backfill** — attestation precedes enrollment, but the startup error backfill (below) replays Autopilot-channel Level 1-2 records from the last 4h, so retry-then-success attempts surface as `backfilled=true` events. | Visible. | Visible via error backfill once monitoring starts. |
-| Hybrid-join 0x80004005 (ANALYZE-ENRL-005) | **Visible** — the ODJ/hybrid phase runs during device ESP while the agent is active. | Visible. | Visible after cert arrival. |
-| Clock skew (ANALYZE-DEV-007) | **Always** — ntp_time_check is our own event. | Always. | Always. |
-
-The rules stay enabled despite the narrow normal-flow windows: they are evidence-gated
-(zero cost when the codes never appear) and they future-proof the bootstrap and
-await-enrollment paths.
-
-## Startup error backfill (ModernDeploymentTracker)
-
-At agent start (backfill enabled), the tracker replays Autopilot-channel **Level 1-2**
-records from the last **4 hours** through the normal emission pipeline — this is what makes
-pre-install errors (TPM attestation retries, ZTD errors 807/809/815/908) visible in the
-normal IME deployment flow. Spam containment, in order:
-
-1. **Errors only** — the Warning-level 100 heartbeat storm is excluded by the XPath.
-2. **Harmless-ID downgrade + burst rollup** still applies to backfilled records.
-3. **Cap** of 25 records per scan (newest first; the tail is logged, not emitted).
-4. **RecordId watermark** (`autopilot-error-backfill.json`, advanced by both the backfill
-   scan and the live watcher) — restarts never re-emit records a previous run forwarded.
-5. Backfilled events carry `backfilled: true` plus the original `timeCreated` in their
-   payload; the event's own timestamp is the emission time, so the session's `StartedAt`
-   (which the backend aligns to the earliest event) is not dragged backwards.
-
-# Schema — Error codes (backend known-issue map)
-
-Codes documented in the known-issues / troubleshooting-FAQ pages that appear in ESP/enrollment
-failures we can observe:
-
-| Code | Meaning / context | Actionable guidance |
-| --- | --- | --- |
-| `0x800705B4` | Timeout; in self-deploying mode usually "device is not TPM 2.0 capable" (e.g. a VM). | Don't use self-deploying on VMs / non-TPM-2.0 hardware. |
-| `0x801C03EA` | TPM attestation failed → Entra join with device token failed. | TPM/firmware issue; check attestation endpoints. |
-| `0x81039001` | `E_AUTOPILOT_CLIENT_TPM_MAX_ATTESTATION_RETRY_EXCEEDED` (intermittent, "Securing your hardware"). | Retry provisioning; persistent → firmware. |
-| `0x81039023` | TPM attestation failure on Windows 11 (pre-prov/self-deploy). | Fixed by KB5013943 (21H2) or later CU. |
-| `0x81039024` | TPM has known vulnerabilities → attestation refused. | Update TPM firmware from OEM. |
-| `0x80070490` | TPM attestation failure on AMD ASP fTPM platforms. | Update AMD firmware. |
-| `0xC1036501` | Automatic MDM enrollment impossible — multiple MDM configurations in Entra ID. | Consolidate MDM configs. |
-| `0x801C03F3` | Entra device object for the Autopilot device was deleted (logged in `Microsoft-Windows-User Device Registration/Admin`). | Deregister + re-register the device (recreates the object). |
-| `0x80180014` | Device-record reuse in self-deploying/pre-prov mode, or Windows MDM enrollment disabled ("Enrollment blocked for AP device by SDM One Time Limit Check"). | Intune → Autopilot device → **Unblock device**, or allow Windows (MDM) in enrollment restrictions. |
-| `0x80180018` | MDM enrollment refused — licensing (missing Intune/EMS license) or device cap. | Check user license + device limits. |
-| `0x80070774` | Hybrid-join ESP failure — domain mismatch between Intune Connector for AD and device targeting. | Install/configure the connector in the matching domain. |
-| `0x80004005` | Hybrid-join deployment timeout — **build-dependent known issue**, fixed in KB5065789 (25H2, ≥ 26200.6725), KB5065426 (24H2, ≥ 26100.6584), KB5070312 (23H2, ≥ 22631.6276). | Update the image / install the KB. |
-
-Related non-code known issues worth remembering: clock skew of minutes causes TPM
-attestation errors and ESP timeouts (`w32tm /resync /force`; the agent's `ntp_time_check`
-event carries the measured offset); multiple/unexpected OOBE reboots can delete kiosk
-autologon registry entries (fixed in 24H2 KB5058411); ESP does not support mixing LOB and
-Win32 apps ("Another installation is in progress").
-
-# Citations
-
-* [Windows Autopilot troubleshooting FAQ](https://learn.microsoft.com/en-us/autopilot/troubleshooting-faq) — event IDs, registry values, process flow. (Checked 2026-07-16.)
-* [Windows Autopilot known issues](https://learn.microsoft.com/en-us/autopilot/known-issues) — error codes, KB fixes. (Checked 2026-07-16.)
-* [Windows Autopilot requirements — Networking](https://learn.microsoft.com/en-us/autopilot/requirements?tabs=networking) — endpoint list incl. `ztd.dds.microsoft.com`. (Checked 2026-07-16.)
-* Re-check cadence: both Learn pages change regularly (known-issues carries an RSS feed:
-  `https://learn.microsoft.com/api/search/rss?search=%22Be+informed+about+known+issues+that+might+occur+during+Windows+Autopilot+deployment.%22&locale=en-us&%24filter=`).
-  When new event IDs / error codes appear, update `ZtdEvidence.cs`, the backend rule map,
-  and this document together.

docs/agent/build-counter-blob.md

@@ -1,65 +0,0 @@
----
-type: Concept
-title: Agent Build Numbers — Shared Counter Blob with ETag-CAS
-description: Why agent build numbers come from a public counter blob reserved before the build, how the compare-and-swap protocol works, and what the repo's buildcounter.txt still does.
-resource: /.github/workflows/build-agent.yml
-tags:
-  - agent
-  - build
-  - ci
-  - release
-  - versioning
-timestamp: 2026-07-17T00:00:00+02:00
----
-
-# Agent Build Numbers — Shared Counter Blob
-
-Agent (V2 line) build numbers — the `<n>` in `2.0.<n>` — are minted from a single
-shared counter blob so that **local builds (`scripts/Deployment/build.ps1`) and CI
-builds (`.github/workflows/build-agent.yml`) can never collide**. Both build paths
-stay first-class: local daily-ops builds remain possible, CI builds add provenance
-attestation on top.
-
-# Schema
-
-The reserve-before-build CAS protocol itself is shared with the backend and the MCP
-server and is documented once in [Version Contract](../versioning.md); the single
-implementation is `.github/scripts/Request-BuildNumber.ps1`. Agent-specific:
-
-- **Counter blob**: `https://autopilotmonitoreu.blob.core.windows.net/agent/buildcounter-v{LINE}.txt`
-  — one per release line, analogous to `version-v{LINE}.json`, and kept in the `agent`
-  container next to the artifacts it numbers rather than in `versions/`. Content: the
-  **last used** build number as plain text. Public-read like the rest of the container
-  (the number is visible in `version-v{LINE}.json` anyway); writes require the SAS.
-- The reserved number reaches the build as `BUILD_NUMBER` in the environment. The
-  csproj honors it and then skips its `PersistBuildCounter` target, so the repo file
-  is not touched.
-- **CI manual override** (`build_number` input): numbers `<=` counter are re-builds
-  and leave the blob unchanged; numbers `>` counter advance it (monotonic guard).
-- V2 was seeded with `1356` on 2026-07-17.
-
-# Consequences
-
-- `src/Agent/AutopilotMonitor.Agent.V2/buildcounter.txt` is now only an **offline
-  fallback** for `-SkipUpload` smoke builds and bare `dotnet build` (where the version
-  does not matter). It is never committed anymore; the CI step that pushed counter
-  bumps to `main` was removed.
-- `AdminConfiguration.LatestAgentV2*` (backend hash-oracle) is updated **only on
-  stable cutover** (`publish_as_stable` / default `build.ps1` run without
-  `-VersionedOnly`/`-Dev`) — it must never point at a build that is not actually in
-  the stable namespace.
-- CI builds additionally attest build provenance for the release ZIP via
-  `actions/attest-build-provenance` (Sigstore keyless, bound to the workflow OIDC
-  identity). The digest covers the identical bytes uploaded to blob, so one
-  attestation covers all copies. Verify:
-  `gh attestation verify <zip> --repo okieselbach/AutopilotMonitor`. Local builds
-  cannot produce this attestation — provenance is a CI-only property.
-
-# Citations
-
-- [Version Contract](../versioning.md) — the shared CAS protocol and manifest format
-- `.github/workflows/build-agent.yml` — "Reserve build number (counter blob CAS)" step
-- `.github/scripts/Request-BuildNumber.ps1` — the shared implementation
-- `scripts/Deployment/build.ps1` (gitignored, contains SAS) — local build path
-- `src/Agent/AutopilotMonitor.Agent.V2/AutopilotMonitor.Agent.V2.csproj` —
-  `BUILD_NUMBER` property + `PersistBuildCounter` target

docs/agent/decision-engine.md

@@ -1,196 +0,0 @@
----
-type: Reference
-title: V2 Agent — Decision Engine (DecisionCore)
-description: The pure-reducer state machine that decides enrollment completion/failure — signals, state, effects, the A/B/C completion arms, and its invariants.
-resource: /src/Shared/AutopilotMonitor.DecisionCore
-tags:
-  - agent
-  - decision-engine
-  - reducer
-  - completion
-timestamp: 2026-07-11T00:00:00+02:00
----
-
-# V2 Agent — Decision Engine (DecisionCore)
-
-DecisionCore (`src/Shared/AutopilotMonitor.DecisionCore`, netstandard2.0) is a **pure
-reducer**: a deterministic state machine with no I/O, no clock reads, no threads. The
-agent feeds it an ordered stream of *signals*; it returns a new immutable state plus a
-list of *effects* the host must execute. Because it is pure, the same persisted signal
-stream always reproduces the same journal and terminal outcome — that is what makes
-crash recovery a replay instead of a guess (determinism guarantee "L.5",
-`Engine/IDecisionEngine.cs`).
-
-# The reducer contract
-
-```
-DecisionStep step = engine.Reduce(DecisionState oldState, DecisionSignal signal)
-// DecisionStep = { NewState, Transition, Effects[] }
-```
-
-- `Reduce` never throws: a handler exception advances only bookkeeping and journals a
-  `reducer_exception` dead-end (fail-safe L.16).
-- Dispatch is a switch on `(signal.Kind, signal.KindSchemaVersion)`; unknown pairs
-  become journaled dead-ends, never crashes.
-- Every step yields a `DecisionTransition` journal record: `Taken` (state change vs
-  dead-end + reason), `StepIndex`, `FromStage/ToStage`, `Trigger`, `Guards`,
-  `ReducerVersion`.
-
-# State
-
-`DecisionState` (schema **v4**) is an immutable value object; "change" = builder copy.
-Key content:
-
-- Identity + progress: `SessionId`, `TenantId`, `Stage`, `Outcome`, `StepIndex`,
-  `LastAppliedSignalOrdinal`, `AgentBootUtc` (replay-safety anchor).
-- **Facts** as `SignalFact<T>` — value **plus** `SourceSignalOrdinal` provenance, e.g.
-  `AccountSetupEnteredUtc`, `EspFinalExitUtc`, `DesktopArrivedUtc`, `HelloResolvedUtc`,
-  `ImeUserSessionCompletedUtc`, `HelloPolicyEnabled`, `HelloOutcome`.
-- Aggregates: `AppInstallFacts`, `ScenarioProfile` + `ScenarioObservations`
-  (enrollment-scenario classification, monotonic), `ClassifierOutcomes`, `RealmJoinFacts`.
-- `Deadlines` — active timers the host has been asked to arm.
-
-Stages: `SessionStarted → EspDeviceSetup → EspAccountSetup → AwaitingHello →
-AwaitingDesktop → Finalizing → Completed` (plus `Failed`, `WhiteGloveCandidate/Sealed`,
-`AwaitingDeviceOnlyEsp` for self-deploying, and edge stages). Terminal =
-`Completed | Failed | WhiteGloveSealed`. `Finalizing` is deliberately non-terminal
-(grace window). Outcomes: `EnrollmentComplete`, `EnrollmentFailed`,
-`WhiteGlovePart1Sealed`, `Aborted`, `AdminPreempted`.
-
-# Signals
-
-`DecisionSignal` is the only input. Fields: `Kind` + `KindSchemaVersion` (dispatch key),
-`SessionSignalOrdinal` (monotonic, assigned **only** by the ingress worker — never by
-collectors), `OccurredAtUtc`, mandatory `Evidence` (classified `Raw | Derived |
-Synthetic` — a signal without evidence is a bug), `Payload` (string dict) and
-`TypedPayload` (structured sidecar).
-
-Signal kinds by family (`Signals/DecisionSignalKind.cs`):
-
-- **Raw observations**: `EspPhaseChanged`, `EspExiting`, `EspResumed`,
-  `EspTerminalFailure`, `DesktopArrived`, `HelloResolved`, `ImeUserSessionCompleted`,
-  `DeviceSetupProvisioningComplete`, `AccountSetupProvisioningComplete`,
-  `AppInstallCompleted/Failed`, `AadUserJoinedLate`, `SystemRebootObserved`,
-  `EspConfigDetected`, `HelloPolicyDetected`, WhiteGlove + RealmJoin kinds, …
-- **Synthetic**: `DeadlineFired` (scheduler timer), `ClassifierVerdictIssued`,
-  `EffectInfrastructureFailure`.
-- **Lifecycle**: `SessionStarted`, `SessionAborted`, `AdminPreemptionDetected`.
-- **`InformationalEvent`** — the single-rail pass-through: telemetry that must appear
-  on the Events timeline but never influences decisions.
-
-**Ordering is the ingest ordinal, never wall-clock.** Replayed IME/CMTrace lines carry
-backdated source timestamps; all before/after comparisons in the reducer therefore
-compare `SourceSignalOrdinal`s (e.g. "final exit after AccountSetup entry").
-
-# Effects — the only side-channel
-
-`DecisionEffect` kinds and how the host's `EffectRunner` treats failures:
-
-| Kind | Purpose | Failure class |
-| --- | --- | --- |
-| `ScheduleDeadline` / `CancelDeadline` | arm/cancel OS timers that come back as `DeadlineFired` | **critical** — failure aborts the session (a lost timer means silent parking) |
-| `EmitEventTimelineEntry` | timeline events incl. terminal `enrollment_complete` / `enrollment_failed` | transient — retried 100/400/1600 ms |
-| `PersistSnapshot` | hint to write the recovery snapshot | transient |
-| `RunClassifier` | scenario classification; verdict returns as a `ClassifierVerdictIssued` signal | optional — exception ⇒ Inconclusive, never aborts |
-
-Terminal and state-changing timeline effects carry a structured **audit trail** in
-`TypedPayload` (built by `DecisionAuditTrailBuilder`): `decisionSource`, `trigger`,
-`sessionStage`, `stepIndex`, `signalsSeen`, `signalEvidence`, `signalTimestamps`,
-`scenario` — so every completion/failure in the portal is explainable from its own
-event payload.
-
-# Completion logic
-
-## The A/B/C arms
-
-The arms are **not** three pipelines — they are three alternative sufficient conditions
-inside one guard, `ShouldTransitionToAwaitingHello`
-(`Engine/DecisionEngine.Shared.cs`), which gates promotion out of the ESP stages toward
-Hello/desktop completion:
-
-- **Arm A — registry-strong AccountSetup success**: `AccountSetupProvisioningSucceededUtc`
-  is set (the ESP registry reported `categorySucceeded`). Merely *entering* AccountSetup
-  is insufficient — Shell-Core 62407 fires at every ESP page transition.
-- **Arm B — SkipUser flow**: `ScenarioObservations.SkipUserEsp == true` — with no
-  User-ESP page, the first `esp_exiting` *is* the genuine final exit.
-- **Arm C — 4-fact eager completion** (all four mandatory):
-  1. AccountSetup was entered, and
-  2. a post-AccountSetup ESP final exit occurred (ordinal-ordered), and
-  3. a *genuine* IME user-session completion (at-or-after the AccountSetup anchor —
-     guards against the `defaultuser0` ghost), and
-  4. a DAD-validated real-user desktop arrival.
-  Arm C applies eagerly the same conjunction the 30-minute `AdvisoryCompletion`
-  backstop would eventually trust.
-
-**Layering note:** Arm C's app-install hardening lives in the **adapter**, not the
-reducer. `ImeLogTrackerAdapter` defers posting `ImeUserSessionCompleted` while required
-user-ESP Install-intent apps are still pending (IME logs "Completed user session" per
-*pass*, not once per session — sessions 14690fc2/6cb01530). The reducer stays free of
-app-pending guards; adapters sanitize evidence before it becomes a signal.
-
-## Completion attempt sites and sequence
-
-Completion can be attempted from whichever fact arrives last: `HelloResolved`,
-`DesktopArrived` (including the Hello-disabled fast-path when `HelloPolicyEnabled ==
-false` and an arm holds), `EspExiting`, `ImeUserSessionCompleted`,
-`AccountSetupProvisioningComplete`, the Hello safety deadline, or the 30-minute
-advisory backstop. All routes converge on `CompleteThroughFinalizingOrDefer`:
-
-1. **Completion gates** (currently only the RealmJoin AND-gate): if RealmJoin was
-   detected and has no terminal outcome yet, completion is *deferred* — the session
-   stays in stage and emits `completion_waiting`. Three terminals open the gate:
-   `Resolved` (DeploymentPhase 110), `FirstDeploymentIncomplete` (phase left the
-   first-deployment window 100/101 for 200/210 without 110 — the RJ ESP was aborted,
-   typically by an interactive logon reclassifying the run as secondary-user; emits
-   the `realmjoin_first_deployment_incomplete` Warning, session 224b2087), and
-   `Timeout` (hard 60-min deadline). The abort rule reads the *persisted*
-   `RealmJoinFacts.LastDeploymentPhase` (updated by the typed `RealmJoinPhaseChanged`
-   signal), so it survives agent restarts — the `RealmJoinDetected` replay path
-   evaluates it too. A first observation of 210 does **not** release (RJ may have
-   completed before agent boot and deploy afterwards).
-2. `Finalizing` stage + ~5 s `FinalizingGrace` deadline.
-3. Grace fires → `Completed`, `EnrollmentComplete` outcome, `enrollment_complete`
-   timeline event with full audit payload.
-
-**Self-deploying/kiosk** is a separate rail: no Hello, no user desktop —
-`AwaitingDeviceOnlyEsp` with a detection deadline as the sole terminal entry, protected
-by stale-fire and race guards. A registry-confirmed self-deploying profile also waives
-IME false-positive AccountSetup entries.
-
-# Invariants (violating any of these is a bug)
-
-- **Post-terminal dispatch guard**: after `Completed`/`Failed`, every signal is a
-  bookkept dead-end — **except `InformationalEvent`** (single-rail pass-through must
-  keep flowing). `WhiteGloveSealed` is unguarded on purpose (Part 2 resumes fresh).
-- **`InformationalEvent` never mutates decision state** — exactly one pass-through
-  timeline effect, payload copied 1:1.
-- **`AadUserJoinedLate` is observation-only** — never completion evidence.
-- **Hello policy is orthogonal to completion** — `HelloPolicyEnabled` tunes wait
-  cadence, never gates the outcome.
-- **Raw IME "Completed user session" is weak evidence** — can run under `defaultuser0`;
-  only meaningful with a real-user desktop and the AccountSetup anchor (Arm C).
-- **Deadline bases are floored at `AgentBootUtc`** — replayed backdated signals must
-  not arm past-due timers at boot.
-- **Reducer-side deadline cancels need an explicit `CancelDeadline` effect** — a
-  builder-only removal leaves the OS timer live.
-- **No silent parking**: a non-terminal post-AccountSetup session must always hold a
-  resolution-capable deadline; a 10-min dwell tripwire emits
-  `session_parked_without_deadline`.
-
-# Hosting & threading (inside the agent)
-
-Wired by `EnrollmentOrchestrator.Start` (`src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/`):
-
-- `SignalIngress` — bounded queue (256, back-pressure) + **one** worker thread. Per
-  signal, in order: assign ordinals → `SignalLog.Append` (durable, *before* reducing;
-  append failure ⇒ reducer does not run, no ordinal gap) → `engine.Reduce` →
-  `DecisionStepProcessor.ApplyStep`.
-- `DecisionStepProcessor.ApplyStep` (same thread, no locks): journal append (the only
-  hard-throwing path; 3 consecutive failures escalate to quarantine) → effects run
-  synchronously via `EffectRunner` → best-effort snapshot → advance `CurrentState` →
-  one-shot terminal-stage hook (raises the agent's `Terminated` event off-thread).
-- The `DeadlineScheduler`'s `Fired` event loops back in as synthetic `DeadlineFired`
-  signals.
-- On restart, `RecoveryCoordinator` folds the persisted signal log through a transient
-  `new DecisionEngine()` before the live pipeline starts — see
-  [logs & persistence](logs-and-persistence.md).

docs/agent/endpoint-migration.md

@@ -1,88 +0,0 @@
----
-type: Concept
-title: Agent Endpoint Migration — Config-Channel Re-Home
-description: How the backend re-homes agents to a new API base URL (backend move or per-tenant region move) via MigrateToApiBaseUrl on the agent config response, and why HTTP redirects were rejected.
-resource: /src/Agent/AutopilotMonitor.Agent.V2.Core/Configuration/EndpointMigration.cs
-tags:
-  - agent
-  - backend
-  - config
-  - migration
-  - security
-timestamp: 2026-07-18T00:00:00+02:00
----
-
-# Problem
-
-The agent's API base URL is compiled into the binary (`Constants.ApiBaseUrl`). No DNS/domain
-indirection is possible in front of the API: mTLS client-cert auth does not survive a reverse
-proxy (Front Door), and Flex Consumption custom-domain TLS is broken. A backend move (like the
-2026-07-18 WEU→GWC subscription migration) therefore hard-cuts every deployed agent still
-pointing at the old hostname. In-flight agents self-terminate safely (local MaxLifetime watchdog
-+ CleanupService), but their sessions are lost and a per-tenant region move (EU→US) has no
-mechanism at all.
-
-# Mechanism
-
-`AgentConfigResponse.MigrateToApiBaseUrl` — served on `GET /api/agent/config` (incl. the
-bootstrap wrapper), the same control channel as the kill switch, fetched at every agent
-process start.
-
-Agent flow (`Program.RunAgent`, Phase 4):
-
-1. Config fetched from the compiled-in (old) base URL.
-2. Kill-switch check runs FIRST — **kill wins over migrate**.
-3. `AgentRuntimeConfig.Resolve` detects the migration signal directly after the fetch and
-   returns early, BEFORE merge / binary-integrity / bootstrap-cleanup — none of those side
-   effects may run against a config from the backend being abandoned (a migration stub may
-   advertise stale agent hashes; a spurious `IntegrityCheckFailed` + force-update would be
-   harmful).
-4. `Program.RunAgent` swaps `AgentConfiguration.ApiBaseUrl`, disposes the old client stack,
-   rebuilds Phase 3 (auth clients) and re-runs Phase 4 against the new URL —
-   `allowEndpointMigration: false`, so the new backend's config **cannot chain a second hop**.
-5. Kill-switch check runs again on the NEW backend's config; startup continues normally
-   (Phase 5+ builds mTLS/telemetry clients from the updated base URL).
-
-# Hardening (mirrors the kill switch)
-
-* **Live fetch only** — the on-disk config cache strips `MigrateToApiBaseUrl` on write AND
-  read (`RemoteConfigService.CacheConfig` / `LoadCachedConfig`); `EndpointMigration.ResolveTarget`
-  re-checks `LastFetchOutcome == Succeeded` as defence-in-depth. A planted cache file can
-  never re-home an agent.
-* **Allowlist validated on BOTH sides** — `AgentEndpointMigrationRules` (Shared, single
-  source): https only, host must end in `.azurewebsites.net` on a label boundary, no
-  path/query/userinfo/port. The backend refuses to serve an invalid admin value
-  (`AgentMigrateRejected` warning); the agent refuses to honour one even if the backend was
-  compromised.
-* **One hop, no loops** — second Resolve pass never migrates; a target equal to the current
-  base URL is a no-op (steady state during the migration window).
-
-# Operation
-
-Global admin settings (`AdminConfiguration`, admin portal → Global Settings):
-
-* `AgentMigrateApiBaseUrl` — global target, set on the backend being **abandoned**; clear it
-  after the migration window.
-* `AgentMigrateTenantOverridesJson` — JSON object `tenantId → URL` for per-tenant moves.
-  An entry with an **empty string** pins that tenant against the global target (staged rollout).
-  Overrides win over the global value.
-
-Delivery evidence: every served target logs `AgentMigrateServed` (Warning — reaches App
-Insights) with tenant, serial, agent version and target. Agent-side, the re-home is logged as
-`Endpoint migration: backend re-homed this agent from … to …`.
-
-Reach limitation: agents that cannot complete an authenticated config fetch (e.g. cert-broken
-devices) never see the signal — they fall back to the local MaxLifetime/emergency-break
-lifecycle. During a migration window the old backend must keep running as a serving stub;
-keeping the old `*.azurewebsites.net` name parked afterwards also prevents hostname
-re-registration by third parties while stragglers drain.
-
-# Citations
-
-* `src/Shared/AutopilotMonitor.Shared/Services/AgentEndpointMigrationRules.cs` — shared validation rules
-* `src/Shared/AutopilotMonitor.Shared/Models/Config/AgentConfigResponse.cs` — wire field
-* `src/Backend/AutopilotMonitor.Functions/Functions/Config/GetAgentConfigFunction.cs` — `ResolveMigrateTarget` + serving (ConfigVersion 33)
-* `src/Agent/AutopilotMonitor.Agent.V2.Core/Configuration/EndpointMigration.cs` — agent-side evaluation
-* `src/Agent/AutopilotMonitor.Agent.V2/Runtime/AgentRuntimeConfig.cs` — early return before merge/integrity
-* `src/Agent/AutopilotMonitor.Agent.V2/Program.cs` — one-hop rebuild in `RunAgent`
-* Tests: `AgentEndpointMigrationTests` (backend), `EndpointMigrationTests` + `RemoteConfigServiceCacheHardeningTests` (agent)

docs/agent/esp-policy-provider-stall.md

@@ -1,151 +0,0 @@
----
-type: Concept
-title: ESP Policy-Provider Stall Detection — the no-timeout Setup/Apps wait and the co-management Sidecar gap
-description: Why the ESP's Apps wait is keyed to the Intune-registered "Sidecar" provider by name — a foreign provider (ConfigMgr) with TrackingPoliciesCreated=1 does not satisfy it — plus the classic never-completes stall, and how the always-on two-arm esp_policy_provider_stalled tripwire (reason=provider_incomplete | sidecar_provider_missing, 15-min wall-clock dwell, StartupEventGate cross-restart dedup) surfaces both.
-resource: /src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/EspPolicyProviderProbe.cs
-tags:
-  - agent
-  - esp
-  - enrollment-status-tracking
-  - co-management
-  - stall-detection
-timestamp: 2026-07-24T00:00:00+02:00
----
-
-# ESP Policy-Provider Stall Detection
-
-## Schema
-
-The Enrollment Status Page decides when its "Apps" category may progress from
-"Identifying" using the **EnrollmentStatusTracking CSP**
-(<https://learn.microsoft.com/en-us/windows/client-management/mdm/enrollmentstatustracking-csp>),
-mirrored in the registry under
-`HKLM\SOFTWARE\Microsoft\Windows\Autopilot\EnrollmentStatusTracking\{Device|<UserSID>}\…`.
-Two contracts matter:
-
-1. **`Setup/Apps/PolicyProviders/<Name>`** — per the CSP doc: *"Existence of this node
-   indicates to the ESP that it shouldn't show the tracking status message until the
-   TrackingPoliciesCreated node has been set to true."* This wait has **no timeout**. A
-   registered provider that never sets `TrackingPoliciesCreated=1` parks the ESP at
-   "Apps (Identifying)" indefinitely — observed for days in the field. Exists in device
-   scope (`Device`) and user scope (`S-<SID>`, appears at sign-in).
-2. **`DevicePreparation/PolicyProviders/<Name>/InstallationState`** — must reach 2
-   (NotRequired) or 3 (Completed); 1=NotInstalled, 4=Error. Device scope only. The ESP
-   applies a default 15-minute timeout here, so these stalls self-surface as ESP errors —
-   the detector still records them for the diagnostic trail.
-
-Known provider names: **`Sidecar` is the Intune Management Extension** (the CSP doc names
-"Intune's agents, such as SideCar"); **`ConfigMgr`** is the Configuration Manager client,
-registered during Autopilot-into-co-management — the troubleshooting section of
-<https://learn.microsoft.com/en-us/intune/configmgr/comanage/autopilot-enrollment> queries
-exactly these registry paths. The same document states that ESP policy providers **are not
-aware of each other** and that **pre-provisioning is unsupported** with Autopilot into
-co-management.
-
-## The field case (issue #106)
-
-A tenant pre-provisions devices and installs the ConfigMgr client as a blocking app.
-Occasionally the user-phase ESP reaches "Apps (Identifying)" and never leaves it — for
-hours to days. On those devices `Device\Setup\Apps\PolicyProviders` contains **only a
-`ConfigMgr` key (no `Sidecar`)** — and, per the customer's follow-up, **`TrackingPoliciesCreated=1`
-IS set under it**. The provider is "complete" by the CSP value contract, yet the ESP
-still waits. Manually renaming the key to `Sidecar` — which creates no tracking entries,
-only satisfies the name — unblocks the ESP instantly.
-
-The naive CSP-doc reading ("any provider with TrackingPoliciesCreated=1 satisfies the
-wait") is therefore wrong for this case. What the evidence supports instead: provider
-nodes are registered **by the Intune service at enrollment**, and its ESP-policy WAP
-payload always registers `Sidecar` (ConfigMgr joins only via a co-management settings
-policy — see the payload documented by Niehaus). The ESP waits on the provider it
-expects **by name**; a foreign provider occupying the slot does not satisfy it,
-regardless of its completion values. On the affected devices the CM client (installed
-as a plain Win32 app, no co-management settings policy) evidently displaced the
-Sidecar node — consistent with Microsoft's warning that providers "aren't currently
-aware of others" and that pre-provisioning is unsupported with co-management. The exact
-CloudExperienceHost mechanism is not publicly documented; the registry signature —
-setupApps providers present, `Sidecar` absent — is deterministic either way.
-
-## Detection
-
-`EspPolicyProviderProbe` (fail-soft, static, `ScopedOverride` test seam — structural clone
-of `EspTrackingInfoProbe`) enumerates all providers in both kinds and scopes.
-`EspPolicyProviderStallDetector` evaluates a pure transition function on a 60-second tick
-from the always-on `EspPolicyProviderStallHost` — **two arms**, same 15-minute wall-clock
-dwell, one shared event type discriminated by `reason`:
-
-* **Arm 1, `reason=provider_incomplete`** — a provider **continuously incomplete for
-  ≥ 15 minutes**. The dwell clock starts at first incomplete observation and resets on
-  completion or disappearance. Missing values parse as incomplete
-  (fail-toward-observation). Catches e.g. Sidecar itself never reporting.
-* **Arm 2, `reason=sidecar_provider_missing`** — **≥ 1 `Setup\Apps` provider registered
-  but none named `Sidecar`**, continuously for ≥ 15 minutes. Deliberately ignores
-  provider completeness (the field case had `TrackingPoliciesCreated=1`). Sidecar
-  registering later — the legitimate startup ordering — clears the condition and resets
-  the clock. DevicePreparation-only snapshots don't activate it.
-* When both arms cross in the same round, ONE event is emitted and
-  `sidecar_provider_missing` wins as `reason` (it explains the hang regardless of the
-  foreign provider's state).
-* Missing root key / empty provider list = normal early enrollment: clears all dwell
-  state (both arms), never fires.
-* One `esp_policy_provider_stalled` **Warning** per newly stalled condition set
-  (`ImmediateUpload`), one-shot per condition in-process, cross-restart deduped via a
-  `StartupEventGate` fingerprint over the sorted currently-active fired conditions
-  (provider keys + a `sidecarMissing` sentinel) — a restart into the same stall stays
-  silent, a new condition joining re-reports.
-* Payload: `reason`, `providers[]` (full table: name, scope, kind, raw values, complete
-  flag), `stalledProviders[]` with `stalledForMinutes`, `sidecarMissingForMinutes`
-  (arm 2 only), `sidecarRegistered`, `dwellMinutes`.
-* **Purely observational**: emitted via `InformationalEventPost` (dispatch-guard exempt
-  pass-through) — never touches decision state. No config toggle, no ConfigVersion bump
-  (precedent: `disk_space_low`).
-
-Deliberately **not** built on `StallProbeCollector` (its idle clock resets on any session
-activity — a provider stall coexists with a chatty session) and not on the periodic
-collectors (idle-stopped after 15 minutes — exactly the dormant window the dwell must
-observe).
-
-## Guardrail companion
-
-`rules/guardrails.json` allow-lists `SOFTWARE\Microsoft\Windows\Autopilot` (category
-"Autopilot / OOBE / Setup") so tenants can build their own gather rules on the subtree —
-e.g. a `not_exists` registry rule on the `Sidecar` provider key. The subtree carries
-deployment state only (provider registrations, tracking lists, app IDs, per-user SIDs);
-sensitivity is at or below existing entries. Enforcement is agent-side (embedded
-resource), so both the detector and the guardrail change ship with the agent release.
-
-## Examples
-
-Customer-case event (abbreviated) — note the provider is "complete" by CSP values, the
-hang is carried entirely by `reason=sidecar_provider_missing`:
-
-```json
-{
-  "eventType": "esp_policy_provider_stalled",
-  "severity": "Warning",
-  "data": {
-    "reason": "sidecar_provider_missing",
-    "dwellMinutes": 15,
-    "sidecarRegistered": false,
-    "sidecarMissingForMinutes": 15.0,
-    "providers": [
-      { "name": "ConfigMgr", "scope": "device", "kind": "setupApps",
-        "trackingPoliciesCreated": 1, "installationState": null, "complete": true }
-    ],
-    "stalledProviders": []
-  }
-}
-```
-
-`reason=sidecar_provider_missing` is the co-management signature;
-`reason=provider_incomplete` with `sidecarRegistered=true` covers a stalled Sidecar or
-third-party provider — the generalized contract violation.
-
-# Citations
-
-* EnrollmentStatusTracking CSP — <https://learn.microsoft.com/en-us/windows/client-management/mdm/enrollmentstatustracking-csp>
-* Windows Autopilot into co-management (requirements, provider-conflict warning, troubleshooting registry paths) — <https://learn.microsoft.com/en-us/intune/configmgr/comanage/autopilot-enrollment>
-* Troubleshoot the ESP (models app tracking exclusively via the `Sidecar` subkey) — <https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/understand-troubleshoot-esp>
-* Niehaus: the Intune ESP-policy WAP payload registering the provider nodes (`Sidecar` always, `ConfigMgr` only with a co-management settings policy) — <https://oofhours.com/2023/08/25/run-an-sccm-task-sequence-during-autopilot/>
-* Niehaus: ESP tracks arbitrarily named providers when they are properly registered — <https://oofhours.com/2023/09/18/track-anything-using-esp/>
-* Agent code: `EspPolicyProviderProbe.cs`, `EspPolicyProviderStallDetector.cs`, `EspPolicyProviderStallHost.cs` (SystemSignals / Orchestration.Hosts)
-* Related: [MDM Reboot Coalescing](mdm-reboot-coalescing.md), [Gather-Rule Guardrails](../rules/gather-rule-guardrails.md)

docs/agent/hello-wizard-unskip.md

@@ -1,108 +0,0 @@
----
-type: Concept
-title: Hello Wizard Un-Skip — vetoing the policy-disabled Hello shortcut
-description: Why a single "WHfB disabled" policy read is not trusted for completion decisions — the HelloWizardStarted signal (prevention + cure) and the HelloTracker confirmation second read.
-resource: /src/Shared/AutopilotMonitor.DecisionCore
-tags:
-  - agent
-  - decision-engine
-  - hello
-  - completion
-  - whfb
-timestamp: 2026-07-13T00:00:00+02:00
----
-
-# Hello Wizard Un-Skip
-
-Session `772fe502` (2026-07-13) completed as *Succeeded* while the user was inside the
-Windows Hello wizard. Cause: the user-scoped WHfB CSP value
-(`HKLM\SOFTWARE\Microsoft\Policies\PassportForWork\{tenant}\{scope}\Policies\UsePassportForWork`)
-**flip-flops** during User-ESP while Intune policy sync is still writing. A single read
-caught "disabled", the engine set `HelloPolicyEnabled=false` (set-once, poll stops), and
-the arm-C completion synthesized `HelloOutcome="Skipped"` → 5 s `finalizing_grace` →
-`enrollment_complete` — 230 ms *after* Shell-Core event 62404 (CXID `AADHello`) proved
-the wizard had launched. The wizard-start was previously an `InformationalEvent` only
-(timeline pass-through, no state mutation).
-
-Two independent defense layers fix this:
-
-# Layer 1 — `DecisionSignalKind.HelloWizardStarted` (engine)
-
-Shell-Core 62404 with CXID `AADHello`/`NGC` is a **genuine wizard-lifecycle observation**
-(unlike the unreliable `hello_provisioning_willlaunch` registry snapshot). It is now a
-dedicated signal: `ShellCoreTracker.HelloWizardStarted` event → coordinator forward
-(`EspAndHelloTracker`, timestamp mirror) → `EspAndHelloTrackerAdapter` (fire-once) →
-reducer. The startup backfill also replays 62404 (5-min lookback), so an agent restart
-mid-wizard does not lose the observation. The reducer records the set-once fact
-`DecisionState.HelloWizardStartedUtc`.
-
-**Prevention** — every "may policy-disabled stand in for a Hello resolution?" decision
-routes through one predicate (`DecisionEngine.Completion.cs`):
-
-```
-HelloPolicyDisabledWithoutWizard = HelloPolicyEnabled == false && HelloWizardStartedUtc == null
-HelloSatisfiedForCompletion     = HelloResolvedUtc != null || HelloPolicyDisabledWithoutWizard
-```
-
-Once a wizard start is on record, the policy-disabled shortcut is vetoed at all five
-Skipped-synthesis sites (EspExiting DeferredCompletion, DesktopArrived fast-path,
-ImeUserSessionCompleted arm-C, AdvisoryCompletion deadline, AccountSetupProvisioningComplete
-DeferredCompletion) *and* in the `completion_waiting` missing-prerequisites computation.
-Sessions then take their pessimistic path: promote to `AwaitingHello` + arm HelloSafety
-(300 s). The AdvisoryCompletion handler needed a dedicated
-`HelloWizardObservedPromote` branch — its fallthrough is re-arm-or-**fail**, and
-prevention alone would have failed a live-wizard session there.
-
-**Cure** — `HandleHelloWizardStartedV1` (`DecisionEngine.Classic.cs`): when the state
-already carries the engine-synthesized skip, the handler retracts it — cancel
-`finalizing_grace` (if armed), null `HelloResolvedUtc`/`HelloOutcome`, back to
-`AwaitingHello`, arm HelloSafety, emit `completion_waiting` (trigger
-`HelloWizardStarted:UnSkip`). A real `HelloResolved` — or the HelloSafety timeout —
-then decides the session.
-
-Two deliberate design points:
-
-1. **Synthetic-outcome discriminator.** The engine's synthesized outcomes are exact-case
-   `"Skipped"` / `"Timeout"` (constants `SyntheticHelloOutcomeSkipped`/`...Timeout`);
-   the tracker vocabulary is all-lowercase (`completed`, `skipped`, `not_configured`,
-   `timeout`, `wizard_not_started`). The cure only ever retracts the exact-case
-   `"Skipped"` — tracker-posted resolutions and the deliberate HelloSafety `"Timeout"`
-   are never touched.
-2. **First fact-nulling reducer.** DecisionState facts are otherwise set-once/monotonic.
-   The retraction is legal exactly here because the fact is provably engine-synthesized
-   and provably wrong (the wizard it claimed would never appear is running). The cure is
-   **stage-agnostic** (guarded by the synthetic outcome, not by `Stage==Finalizing`):
-   a synthetic skip can also sit parked behind a closed RealmJoin completion gate, whose
-   release path completes on `HelloResolvedUtc != null` — the same bug through another
-   door.
-
-# Layer 2 — confirmation second read (HelloTracker)
-
-`HelloTracker.ApplyPolicyRead` (extracted state machine, `HelloTracker.cs`):
-
-| Read | Effect |
-|------|--------|
-| `enabled` (first) | commit immediately (pessimistic direction; `confirmedReads=1`) |
-| `disabled` (first) | mark pending only; 10 s poll timer stays alive |
-| `disabled` while pending | commit disabled (`confirmedReads=2`) |
-| `enabled` while pending | commit enabled + `flipFlopDetected=true` (the 772fe502 catch) |
-| `null` while pending | clear pending, keep polling (a vanished value is flip-flop evidence) |
-
-While pending, `_isPolicyConfigured` stays false, so the Hello wait timers use the
-longer policy-unknown cadence — the safe direction. The confirmation audit fields ride
-on the `hello_policy_detected` event `Data`.
-
-# Residual risk
-
-A wizard that starts only *after* `Completed` (agent already terminal + shut down) is
-still not catchable — the dispatch guard dead-ends post-terminal signals by design. The
-confirmation read shrinks the window for the stale-disabled commit; the wizard signal
-closes it for every ordering where 62404 fires before the 5 s grace elapses.
-
-# Citations
-
-- Reducer handler + prevention predicate: `src/Shared/AutopilotMonitor.DecisionCore/Engine/DecisionEngine.Classic.cs` (`HandleHelloWizardStartedV1`), `.../DecisionEngine.Completion.cs` (`HelloSatisfiedForCompletion`), `.../DecisionEngine.Edge.cs` (`HelloWizardObservedPromote`)
-- Agent signal path: `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/ShellCoreTracker.cs` (62404 + backfill), `EspAndHelloTracker.cs`, `SignalAdapters/EspAndHelloTrackerAdapter.cs`
-- Confirmation read: `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals/HelloTracker.cs` (`ApplyPolicyRead`)
-- Fixtures: `tests/fixtures/signal-kinds/hello-wizard-started-v1.json`, `tests/fixtures/enrollment-sessions/userdriven-hello-wizard-unskip-v1.jsonl`
-- Related: [Decision Engine](decision-engine.md)

docs/agent/index.md

@@ -1,12 +0,0 @@
-# V2 Agent
-
-How the on-device agent works:
-
-* [Runtime Overview](overview.md) - lifecycle (install → boot guards → runtime → termination), collector hosts, the single-rail event pipeline to the backend, config & kill switch, on-disk layout.
-* [Decision Engine](decision-engine.md) - the pure-reducer state machine (DecisionCore): signals, state, effects, the A/B/C completion arms, invariants, threading.
-* [Logs, Persistence & Crash Recovery](logs-and-persistence.md) - every persisted file and why it exists; signal log vs spool; snapshot/journal; the replay-based recovery flow and quarantine.
-* [Hello Wizard Un-Skip](hello-wizard-unskip.md) - why a single "WHfB disabled" policy read never decides completion: the HelloWizardStarted signal (prevention + cure) and the HelloTracker confirmation second read.
-* [Autopilot ZTD Diagnostics](autopilot-ztd-diagnostics.md) - Windows' own diagnostic surfaces for the profile-download flow: ModernDeployment event IDs (807/815/164/...), the Diagnostics\Autopilot registry key, deployment-service endpoints, and the known-issue error-code map.
-* [MDM Reboot Coalescing](mdm-reboot-coalescing.md) - attributing the mid-ESP coalesced reboot ("second sign-in") to the device-assigned policy URIs that forced it: aggregated 2800 observations (neutral, flush-time watermark) + ANALYZE-ESP-005 gated on an actually-observed reboot.
-
-Reading order for newcomers: overview → decision engine → persistence.

docs/agent/logs-and-persistence.md

@@ -1,141 +0,0 @@
----
-type: Reference
-title: V2 Agent — Logs, Persistence & Crash Recovery
-description: Every file the agent persists under %ProgramData%\AutopilotMonitor, why each exists (especially the signal log), and the exact recovery/replay flow after a crash or reboot.
-resource: /src/Agent/AutopilotMonitor.Agent.V2.Core/Orchestration/RecoveryCoordinator.cs
-tags:
-  - agent
-  - persistence
-  - signal-log
-  - recovery
-  - durability
-timestamp: 2026-07-11T00:00:00+02:00
----
-
-# V2 Agent — Logs, Persistence & Crash Recovery
-
-An enrollment spans multiple reboots and can be killed at any moment (app-forced
-restart, self-update, crash, power loss). The agent therefore persists three distinct
-tiers of state — each answers a different question:
-
-1. **Decision truth** (`State\`): *what did the decision engine see and decide?*
-   Signal log + journal + snapshot. Must be deterministic and replayable.
-2. **Transport** (`Spool\`): *what telemetry still has to reach the backend?*
-   Durable upload queue + cursor. Best-effort; the backend dedups.
-3. **Diagnostics** (`Logs\`, `Crashes\`): *what happened, for humans?* Trace log and
-   crash dumps. Never allowed to affect decisions.
-
-Plus small markers (session identity, completion, quarantine) that steer the next
-process start.
-
-# Why a signal log AND an event spool?
-
-They look similar (both JSONL) but serve opposite masters:
-
-- The **signal log** is the *input* truth of the decision engine. Recovery rebuilds
-  decision state by replaying it; the snapshot is only a cache. An append failure here
-  **blocks the reducer** — a signal that was never durably logged must not change state,
-  or a post-crash replay would diverge from what the live run decided (determinism L.1/L.5).
-- The **spool** is a *projection* for upload. Writing it is best-effort — a spool
-  failure must never break ingress, and a lost non-critical item is acceptable because
-  the backend dedups on `(PartitionKey, RowKey)`.
-
-Same data, two files, because durability requirements differ: the signal log fsyncs
-every line; the spool fsyncs only items flagged `RequiresImmediateFlush`.
-
-# Artifact inventory
-
-| Artifact | Path | Format | fsync | Rotation/cap |
-| --- | --- | --- | --- | --- |
-| Signal log | `State\signal-log.jsonl` | JSONL (`DecisionSignal`/line) | every append (WriteThrough + Flush, bufferSize=1) | none (per-enrollment lifecycle) |
-| Journal | `State\journal.jsonl` | JSONL (`DecisionTransition`/line) | every append | atomic truncate only (phantom tail) |
-| Snapshot | `State\snapshot.json` | JSON + SHA-256 checksum envelope | temp-write + `File.Replace` | single file |
-| Event sequence | `State\event-sequence.json` | `{ LastAssignedSequence }` | atomic | none; survives WhiteGlove Part-2 resume |
-| Spool | `Spool\spool.jsonl` | JSONL (`TelemetryItem`/line) | only `RequiresImmediateFlush` items | none — never truncated, cursor skips uploaded items |
-| Upload cursor | `Spool\upload-cursor.json` | `{ LastUploadedItemId }` | atomic | idempotent, never regresses |
-| Agent trace log | `Logs\agent_YYYYMMDD[_NNN].log` | text `[utc] [LEVEL] msg` | no | 50 MB → suffix rotation; consumed by `/diag-agent-log` |
-| Crash dump + record | `Crashes\<stem>.dmp` + `.json` | MiniDump + JSON | n/a (process dying) | 5 files / 7 days |
-| Startup-event gate | `State\startup-event-state.json` | JSON dict | no (atomic) | cross-reboot dedup of one-shot probes |
-| Bandwidth state | `State\bandwidth-state.json` | JSON samples/counters | no (atomic) | reboot-survivor for the DO bandwidth estimate |
-| Session identity | `session.id`, `session.created`, `whiteglove.complete` (root) | text | no | drives emergency-break age check + WG resume |
-| Markers | `clean-exit.marker` (root), `enrollment-complete.marker` (State), `quarantine-requested.marker` (State) | text | no | consumed at next start |
-| Config cache | `Config\remote-config.json` | JSON | no | security-sensitive fields stripped |
-
-Per-collector state files (`OfficeInstallStatePersistence`, IME tracker state, script
-execution state, log-file positions) follow the same fail-soft atomic-replace pattern.
-Cleanup (`CleanupService`) removes the agent dirs on self-destruct but **keeps `Logs\`**
-for forensics.
-
-# The decision-truth triad
-
-## Signal log — authoritative input
-
-- Written by the single ingress worker, one line per accepted signal, **before** the
-  reducer runs. Monotonic-ordinal guard on append.
-- `bufferSize: 1` is load-bearing: session `b9b92d89` (2026-07-09) was killed mid-append
-  by a self-update `Environment.Exit`; the default 4096-byte buffer flushed the same
-  buffered line twice → byte-identical duplicate → non-monotonic ordinal → **recovery
-  crash-loop**. Fixes (commits `57e4334b` + `a0238a4b`):
-  - unbuffered append (nothing left for `Dispose` to re-flush),
-  - read-side tolerance: a byte-identical *consecutive* duplicate line is skipped as a
-    known crash artifact,
-  - self-update restarts now route through graceful shutdown (full drain, bounded 15 s
-    hard-exit fallback) instead of `Environment.Exit`,
-  - poison-replay quarantine (below) so a corrupt log can never loop the agent again.
-- Corrupt-tail rule: readers stop at the first unparsable line (a torn final write is
-  expected, not fatal).
-
-## Journal — authoritative applied-transition record
-
-One `DecisionTransition` per reducer step, appended in `ApplyStep` step 1 — the **only**
-persistence path that hard-throws. Three consecutive append failures escalate to a
-quarantine request. Used during recovery to detect BEHIND/AHEAD crash windows against
-the snapshot; AHEAD phantom entries are truncated to `.quarantine\<ts>\journal-phantom-tail.jsonl`.
-
-## Snapshot — recovery cache, never truth
-
-Full `DecisionState` (schema **v4**) in a checksum envelope, written best-effort after
-meaningful steps (stage transition / non-telemetry effect) or every 100 pass-through
-steps. Atomic temp-write + `File.Replace`; a crash mid-save leaves the old file intact.
-Load returns `null` on any doubt (missing, IO error, checksum mismatch) — recovery then
-falls back to full signal-log replay. Aborted/phantom states are never snapshotted.
-
-# Recovery flow on restart
-
-`RecoveryCoordinator.Recover` runs before the live pipeline; order is load-bearing:
-
-1. **Death-rattle peek**: if the previous exit was unclean, read the prior snapshot
-   *non-mutatingly* (`TryReadRaw`) for the `previous_crash_detected` context — before
-   the pipeline may quarantine it.
-2. **Quarantine marker** (`quarantine-requested.marker`, written mid-run when the
-   journal became unappendable): quarantine all segments + snapshot *now*, at a moment
-   when no writer holds them. Marker is deleted only on full success.
-3. **WhiteGlove Part-2 resume**: prior stage `WhiteGloveSealed` → archive the reducer
-   segments to `.part1-<ts>\` but **preserve `event-sequence.json`** (the Web UI splits
-   Part 1/2 on the sequence).
-4. **Open writers** — each scans its file for the last ordinal/step, stopping at the
-   first unparsable line.
-5. **Pick seed + replay stream**:
-   - snapshot loads → seed from it, re-stamp `AgentBootUtc` to *now* (replayed signals
-     must not arm past-due deadlines), replay only the signal-log **tail**
-     (`ordinal > snapshot.LastAppliedSignalOrdinal`);
-   - snapshot corrupt → quarantine snapshot only, replay the full signal log;
-   - log head-corrupt → total-loss quarantine of everything, fresh Initial seed.
-6. **Journal alignment**: truncate AHEAD phantoms to the seed's `StepIndex`.
-7. **Replay + backfill**: fold the stream through a transient `DecisionEngine`,
-   re-appending any missing journal entries (closes the BEHIND window).
-8. **Poison guard**: if replay itself throws, quarantine snapshot + all segments and
-   reseed Initial — the agent keeps running with fresh state instead of crash-looping.
-
-**Duplicate avoidance, end to end**: monotonic append guards (signal log + journal) →
-consecutive-duplicate skip on read → tail-replay past the snapshot ordinal → AHEAD
-truncation → backend `(PartitionKey, RowKey)` dedup for re-uploaded spool items.
-
-**Quarantine semantics**: files are *moved*, never deleted, into
-`State\.quarantine\<utc-ts>\` with a `reason.txt` sidecar — evidence survives for
-diagnostics ZIPs while the agent restarts from clean state.
-
-# Related
-
-- Pipeline that produces these files: [runtime overview](overview.md)
-- What replay must reproduce deterministically: [decision engine](decision-engine.md)

docs/agent/mdm-reboot-coalescing.md

@@ -1,100 +0,0 @@
----
-type: Concept
-title: MDM Reboot Coalescing — attributing the mid-ESP reboot and second sign-in to policy URIs
-description: How the agent observes reboot-required MDM policy flags (DM-Enterprise EventID 2800, aggregated) and how ANALYZE-ESP-005 attributes an actually-observed enrollment reboot to them — including why the raw events stay neutral and why the Shell-Core RebootCoalescing match was removed.
-resource: /src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Enrollment/SystemSignals
-tags:
-  - agent
-  - esp
-  - reboot
-  - policy-attribution
-  - second-sign-in
-timestamp: 2026-07-20T00:00:00+02:00
----
-
-# MDM Reboot Coalescing
-
-Device-assigned MDM policies whose CSP URIs match the OS reboot-required catalog
-(`HKLM\SOFTWARE\Microsoft\Provisioning\SyncML\RebootRequiredURIs`) force a **coalesced
-reboot at the end of ESP DeviceSetup** — the user sees an unexpected restart and a
-**second sign-in screen** before AccountSetup. Invisible in the Intune console; most
-admins live with it, not knowing that reassigning the profiles to user groups removes the
-reboot entirely. Source research: Patch My PC,
-["Avoid the second sign-in screen after Autopilot"](https://patchmypc.com/blog/autopilot-unexpected-reboot-autopilot-second-login-screen/).
-
-The session already counts reboots (`system_reboot_detected` → `session.rebootCount`);
-this feature adds the **cause attribution**.
-
-# Verified signal facts (session b2e890c1, 2026-07-20)
-
-* **EventID 2800**, `Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin`,
-  one record per URI, verified description shape:
-  `The following URI has triggered a reboot: (./Device/Vendor/MSFT/Policy/Config/ServiceControlManager/SvchostProcessMitigation).`
-  Records arrive in sub-second bursts during policy sync.
-* **Timing semantics (the critical nuance)**: 2800 fires at EVERY policy sync. Only URIs
-  applied **during ESP DeviceSetup** are coalesced into the forced mid-ESP restart. In the
-  verified session the flags fired during AccountSetup (after DeviceSetup completed) —
-  **no reboot occurred**, and `omadmRebootRequiredFlag` read `false`. A detector that
-  claims "reboot incoming" on every 2800 is therefore wrong.
-* **Shell-Core 62407 "RebootCoalescing" — REMOVED as a signal.** The token appears in the
-  ROUTINE bootstrap marker on every enrollment:
-  `Name: 'CommercialOOBE_BootstrapStatusCategory_SubcategoryProcessing_Started', Value: '{"message":"BootstrapStatus: Starting subcategory DeviceSetup.RebootCoalescing...","errorCode":0}'`
-  — the ESP merely *processes* the RebootCoalescing subcategory (which checks whether a
-  reboot is needed). A substring match on it is a false positive by construction. If a
-  real coalesced-reboot record is ever captured on the E2E VM, a precise pattern can be
-  added then.
-
-# Detector — `MdmRebootPolicyTracker` (`MdmRebootPolicyWatcherHost`)
-
-Live `EventLogWatcher` on the DM-Enterprise Admin channel (EventID 2800) + startup
-backfill (default 60 min lookback). Records are **buffered and debounced (10 s)**, then
-flushed as **ONE aggregated `mdm_policy_reboot_required` event** per burst:
-
-* `Severity=Info`, neutral message ("Windows flagged N MDM policy URIs as
-  reboot-required: … (+N more)") — the raw event never claims a reboot.
-* `Data`: `rebootUris` (distinct, sorted, capped 20), `uriCount` (uncapped distinct),
-  `firstRebootUri` (record-time order, drives rule interpolation), `recordCount`,
-  `unparsedCount`/`sampleDescription` (extraction diagnostics), `backfilled` (all-backfill),
-  fail-soft `omadmRebootRequiredFlag` probe of
-  `HKLM\SOFTWARE\Microsoft\Provisioning\OMADM\SyncML\RebootRequired` (null = unknown).
-* `Timestamp` = earliest record time (backfilled bursts land at their historical instant);
-  `ImmediateUpload=true` (one event per burst is cheap, and a DeviceSetup burst precedes a
-  reboot that kills the agent).
-* **Watermark is persisted at FLUSH, not at claim** (`mdm-reboot-watermark.json`): if the
-  coalesced reboot kills the process before the debounced emit, nothing is marked — the
-  post-restart backfill re-reads and emits the burst. A flushed burst is never repeated.
-
-URI extraction: EventData values starting with `./` preferred, permissive regex over the
-description as fallback (trailing punctuation trimmed — the verified text wraps the URI in
-parens and ends with a period). Unparsed records still count into the aggregate.
-
-Config (internal steering only, no admin UI — agent-native collector, NOT an
-`IAgentAnalyzer`): `Collectors.MdmRebootPolicyWatcherEnabled` (default true),
-`Collectors.MdmRebootPolicyBackfillLookbackMinutes` (default 60). ConfigVersion 35.
-
-# Advisory — ANALYZE-ESP-005
-
-The reboot **claim** lives here, and only here. Required conditions (BOTH):
-
-1. `mdm_policy_reboot_required.firstRebootUri` exists (→ `{{firstRebootUri}}` interpolation)
-2. `system_reboot_detected` count ≥ 1 — **an actually-observed reboot**
-
-Policy flags alone (e.g. AccountSetup user-policy sync) stay advisory-silent. Optional
-confidence: `uriCount ≥ 2` (+10), `omadmRebootRequiredFlag == true` (+15) on base 70 /
-threshold 70. Remediation: map URIs to Intune profiles, reassign device → user groups (or
-exclude the Autopilot device group), or accept + communicate the restart.
-
-# Non-goals / invariants
-
-* Event type **deliberately distinct from `system_reboot_detected`** — the backend
-  RebootCount matches that string exactly in two places
-  (`EventIngestProcessor.Classification` + terminal recount); attribution must never
-  inflate the reboot count.
-* No session-level field / SessionInfoCard change in this iteration (follow-up candidate).
-* The `RebootRequiredURIs` catalog itself is not read; only the 2800 events (which carry
-  the actually-triggered URIs) are consumed.
-
-# Citations
-
-* [Patch My PC — Avoid the second sign-in screen after Autopilot](https://patchmypc.com/blog/autopilot-unexpected-reboot-autopilot-second-login-screen/)
-* [Microsoft Learn — Enrollment Status Page tracking](https://learn.microsoft.com/en-us/autopilot/enrollment-status)

docs/agent/overview.md

@@ -1,153 +0,0 @@
----
-type: Component Overview
-title: V2 Agent — Runtime Overview
-description: How the V2 agent boots during Autopilot enrollment, which collectors it runs, how telemetry flows to the backend, and how it decides to stop.
-resource: /src/Agent/AutopilotMonitor.Agent.V2/Program.cs
-tags:
-  - agent
-  - runtime
-  - collectors
-  - telemetry
-timestamp: 2026-07-11T00:00:00+02:00
----
-
-# V2 Agent — Runtime Overview
-
-The agent is a .NET Framework 4.8 executable (`AutopilotMonitor.Agent.exe`) that runs as
-SYSTEM on Windows devices during Autopilot enrollment. It observes the enrollment
-(ESP phases, IME app installs, Hello, desktop arrival, …), streams telemetry to the
-backend, and decides locally — via the [decision engine](decision-engine.md) —
-when the enrollment is complete or failed. When it reaches a terminal decision it shows
-the optional summary dialog, uploads diagnostics, and removes itself.
-
-Projects: `src/Agent/AutopilotMonitor.Agent.V2` (exe) + `AutopilotMonitor.Agent.V2.Core`
-(library) + `src/Shared/AutopilotMonitor.DecisionCore` (portable decision engine).
-
-# Lifecycle
-
-## Install (bootstrap during OOBE)
-
-`AutopilotMonitor.Agent.exe --install` is invoked by the Intune Platform Script
-(bootstrap) and never runs the monitoring runtime
-(`src/Agent/AutopilotMonitor.Agent.V2/Program.InstallMode.cs`):
-
-1. Copy payload to `%ProgramData%\AutopilotMonitor\Agent\`.
-2. Persist `bootstrap-config.json` (bootstrap token, tenant id) and `await-enrollment.json`.
-3. Register the `AutopilotMonitor-Agent` scheduled task (BootTrigger, SYSTEM,
-   `ExecutionTimeLimit=PT0S`, survives battery conditions).
-4. Immediate runtime handoff: WMI `Win32_Process.Create` → `schtasks /Run` fallback →
-   defer to BootTrigger on next reboot. `--install` exits 0 even if both immediate
-   launches fail (fail-soft; the BootTrigger is the net).
-5. Write `HKLM\SOFTWARE\AutopilotMonitor\Deployed` = UTC timestamp — the **bootstrap
-   re-entry lock** read by the install script. Never consulted by the agent itself;
-   intentionally preserved across cleanup.
-
-## Runtime start (each process start / boot)
-
-`Program.Main` → `RunAgent` runs numbered phases (V1-parity exit codes 0–7):
-
-1. **Guards & bootstrap** (`AgentBootstrap.Run`): classify previous exit
-   (`clean` / `exception_crash` / `hard_kill` / `reboot_kill` via `clean-exit.marker`,
-   crash logs, boot event 6009); ghost-restart guard (`enrollment-complete.marker`
-   → cleanup + exit 0); absolute session-age emergency break; optional waits
-   (`--await-enrollment` MDM cert poll, `--tenant-id-wait` registry wait); resolve
-   TenantId from `HKLM:\SOFTWARE\Microsoft\Enrollments`; get-or-create SessionId.
-2. **Auth clients** (mTLS with the Intune MDM device client certificate).
-3. **Remote config** (`GET /api/agent/config`): live fetch → cached
-   `Config\remote-config.json` → built-in defaults. Config-channel **kill switch**
-   checked here, honoured only from a *live* fetch (cache strips all security-sensitive
-   fields).
-4. **Telemetry clients**, **backend session registration**.
-5. **`AgentRuntimeHost.Run`**: builds the `EnrollmentOrchestrator`, starts collector
-   hosts, decision pipeline and upload drain loop, then blocks until shutdown.
-
-## Stop triggers
-
-- **Terminal decision** of the engine (Completed / Failed / WhiteGloveSealed) — the normal path.
-- **Max-lifetime watchdog**: `AgentMaxLifetimeMinutes` (default 360) — hard cap per session.
-- Backend **kill switch** (config channel at start; telemetry channel via upload responses
-  → synthesized `terminate_session` action).
-- Auth-failure threshold, self-update restart, Ctrl+C / ProcessExit.
-
-Distinct from agent lifetime: `CollectorIdleTimeoutMinutes` (default 15) stops only the
-periodic collectors (Performance, AgentSelfMetrics) when nothing "real" happens; they
-restart on new activity.
-
-## Termination sequence
-
-On terminal decision (`EnrollmentTerminationHandler`): stop collectors → build
-`FinalStatus` → write `final-status.json` + launch `SummaryDialog` (separate WPF exe in
-the user session, opt-in) → 2 s late-event grace → diagnostics ZIP upload →
-write `enrollment-complete.marker` → optional reboot → self-destruct cleanup
-(skipped for WhiteGlove Part 1, which instead writes the `whiteglove.complete` marker
-and leaves state for Part 2).
-
-# Collector model
-
-Collectors are wrapped in **collector hosts** (`ICollectorHost`, built by
-`DefaultComponentFactory.CreateCollectorHosts`). Each host owns collector/tracker
-classes plus a **signal adapter** that translates raw callbacks into decision signals.
-Main hosts (gating in parentheses; several more are opt-in via remote config):
-
-| Host | Watches |
-| --- | --- |
-| EspAndHelloHost | ESP phases, Shell-Core events, provisioning status, Hello (always) |
-| ImeLogHost | IME log tailer (CMTrace) + IME process watcher — app installs (always) |
-| DesktopArrivalHost | real-user desktop arrival (always) |
-| AadJoinHost | AAD join events + hybrid login pending (always) |
-| DeviceInfoHost | one-shot hardware/OS/network inventory (always) |
-| StallProbeHost | idle/stall probes (config) |
-| WindowsUpdateWatcherHost / OsBuildChangeHost | WU during OOBE, build changes (config / always) |
-| DeliveryOptimizationHost | DO counters for bandwidth estimate (config, dormant until installs run) |
-| OfficeInstallDetectorHost, ConsoleBypassHost, ProvisioningPackageHost, NetworkChangeHost, RealmJoinHost, GatherRuleExecutorHost, … | feature-specific (mixed gating) |
-
-# Event pipeline (single rail)
-
-Everything a collector observes flows through **one** path — no collector emits
-telemetry directly:
-
-```
-Collector callback
-  → SignalAdapter (dual emission: decision signal + InformationalEvent)
-    → SignalIngress.Post()            (bounded queue 256, back-pressure blocks producer)
-      → single worker thread:
-          assign ordinals → SignalLog.Append (durable)   ← source of truth
-          → DecisionEngine.Reduce → apply step/effects
-          → telemetry projection (best-effort)
-            → TelemetrySpool → batch (≤100) → gzip → POST /api/agent/telemetry
-```
-
-- Wire model: `EnrollmentEvent` (`EventType` from `Constants.EventTypes`, monotonic
-  `Sequence` = canonical order, `Phase`, `ImmediateUpload` for lifecycle-critical items),
-  wrapped in `TelemetryItem` (Kind = Event / Signal / DecisionTransition, monotonic
-  `TelemetryItemId` as upload cursor).
-- Auth per request: client-cert mTLS + hardware headers (`X-Tenant-Id`,
-  `X-Device-Manufacturer/-Model/-SerialNumber`, `X-Bootstrap-Token` pre-MDM-cert,
-  `X-Agent-Version`).
-- Retry: 100/400/1600 ms for transient (408/429/5xx); 413 → split batch and halve batch
-  size; unknown 4xx → items retained (cursor holds) unless the backend flags explicit
-  poison row keys; offline → spool keeps everything, backend dedups on re-upload;
-  `DeviceBlocked` pauses the drain until `UnblockAt`.
-
-# Decision integration
-
-Adapters post `DecisionSignal`s; the engine's terminal stage fires
-`Terminated` (off the worker thread) → termination sequence above. Engine *effects*
-(timeline events like `enrollment_complete`, deadline scheduling, classifier runs,
-snapshots) are executed by the `EffectRunner` — the reducer itself is pure. Details:
-[decision engine](decision-engine.md); durability and replay:
-[logs & persistence](logs-and-persistence.md).
-
-# On-disk layout (`%ProgramData%\AutopilotMonitor\`)
-
-| Path | Contents |
-| --- | --- |
-| `\` | `bootstrap-config.json`, `await-enrollment.json`, `clean-exit.marker`, session-id persistence |
-| `\Agent\` | deployed binaries |
-| `\State\` | decision persistence (SignalLog, Journal, Snapshot), `enrollment-complete.marker`, `final-status.json`, self-update state, `.quarantine/`, `.part1-<ts>/` |
-| `\Spool\` | telemetry spool (offline queue) |
-| `\Logs\` | agent trace log, `crash_*.log`, `ime_pattern_matches.log` |
-| `\Config\` | `remote-config.json` cache |
-| `\Agent-Update\`, `\Updates\` | self-update staging/download |
-
-Per-file details and the recovery flow: [logs & persistence](logs-and-persistence.md).

docs/agent/secureboot-ca2023-detection.md

@@ -1,100 +0,0 @@
----
-type: Concept
-title: Secure Boot CA-2023 Detection — firmware evidence vs. Windows servicing status
-description: Why ANALYZE-SEC-001 v3 reads the UEFI db/KEK variables directly (GetFirmwareEnvironmentVariableExW + SeSystemEnvironmentPrivilege) instead of trusting the SecureBoot\Servicing registry key, and how the one-sided uefiCa2023FirmwareConfirmed marker plus a not_exists precondition give absence-tolerant rule suppression across old and new agents.
-resource: /src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/UefiSecureBootCertReader.cs
-tags:
-  - agent
-  - secureboot
-  - ca2023
-  - analyze-rules
-  - backward-compatibility
-timestamp: 2026-07-23T00:00:00+02:00
----
-
-# Secure Boot CA-2023 Detection
-
-## Schema
-
-Two independent evidence sources describe the Windows UEFI CA 2023 rollout state:
-
-1. **Servicing registry** (`HKLM\SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing\UEFICA2023Status`)
-   — reflects whether the *Windows Update* rollout ran and self-verified. Lags reality:
-   devices whose firmware received the certificate another way (OEM factory image, WinCS
-   CLI, manual deployment) or where WU simply has not run yet show `unknown`/`notfound`.
-2. **Firmware itself** — the UEFI variables `db` (signature database, GUID
-   `{d719b2cb-3d3a-4596-a3bc-dad00e67656f}`) and `KEK` (GUID
-   `{8be4df61-93ca-11d2-aa0d-00e098032b8c}`). Authoritative. Certificate subject CNs are
-   ASCII bytes inside the DER signature lists, so a byte-substring search for
-   `Windows UEFI CA 2023` / `Microsoft Corporation KEK 2K CA 2023` decides presence —
-   the same check `Get-SecureBootUEFI` enables from PowerShell.
-
-`UefiSecureBootCertReader` (agent, `Monitoring/Interop`) reads both variables natively via
-`GetFirmwareEnvironmentVariableExW` — no PowerShell runspace during OOBE. The call needs
-`SeSystemEnvironmentPrivilege`: SYSTEM holds it default-disabled, so the reader enables it
-on the process token (`AdjustTokenPrivileges`) and restores the previous state afterwards.
-Fail-soft contract like `OobeStateReader`: never throws; failures map to status strings
-(`not_uefi` = legacy BIOS via `ERROR_INVALID_FUNCTION`, `variable_not_found`,
-`privilege_denied`, `error_<code>`).
-
-This is the repo's only privilege-adjustment code, so it also carries the ownership rules
-any future one should copy:
-
-* The process token lives in a `SafeHandle` assigned by the P/Invoke marshaler, so the CLR
-  owns it from the moment `OpenProcessToken` returns — the critical finalizer releases it
-  even if `Dispose` never runs (async exception before the instance reaches its `using`).
-* The restore obligation is recorded immediately after the successful `AdjustTokenPrivileges`,
-  and only when the privilege was not *already* enabled; nothing that can throw sits between
-  the adjustment and that assignment. `Dispose` is idempotent, swallows a failed restore, and
-  releases the handle in a `finally`.
-* The privilege is adjusted on the **process** token, so enable → read → restore is a
-  process-wide side effect and runs under a static gate. Without it a concurrent reader would
-  see "already enabled", correctly skip its own restore, and then lose the privilege mid-read
-  when the first reader disposes — a spurious `privilege_denied` on a machine that holds it.
-
-Fields land on the existing `secureboot_status` event (once per agent start,
-restart-deduped by the StartupEventGate): `uefiFirmwareReadStatus`, per-cert booleans
-(`uefiDbHasWindowsUefiCa2023`, `uefiDbHasWindowsProductionPca2011`,
-`uefiKekHasMicrosoftKek2kCa2023`, …) — emitted only when the respective read succeeded —
-plus the marker below.
-
-## The one-sided marker (absence-tolerant suppression)
-
-Rule-engine constraints (pinned by `RuleEnginePreconditionTests`):
-
-* **Conditions** never match on an absent field (null guard) — new fields must stay
-  `required: false` or the rule dies for every old agent.
-* **Preconditions**: `not_exists` passes while the field is absent/empty and fails as soon
-  as the field is present with *any* value; comparison operators fail closed on absence.
-
-A two-sided boolean therefore cannot drive suppression: `not_exists` on
-`uefiDbHasWindowsUefiCa2023` would also suppress the rule when the field is present with
-`false`. Hence the **one-sided marker** `uefiCa2023FirmwareConfirmed = true`, emitted
-ONLY when the db read succeeded AND the 2023 certificate was found — never as `false`.
-ANALYZE-SEC-001 v3 adds a `not_exists` precondition on it:
-
-| Device state | Marker | Rule |
-|---|---|---|
-| Old agent (no firmware fields) | absent | evaluates exactly like v2 |
-| New agent, cert missing or firmware unreadable | absent | evaluates; optional conditions `uefiDbHasWindowsUefiCa2023=false` (+20) / `uefiKekHasMicrosoftKek2kCa2023=false` (+10) raise confidence |
-| New agent, firmware confirms cert | present | silently suppressed (the customer-reported false positive) |
-
-Because the marker exists nowhere until the new agent ships, the v3 rule is safe to seed
-**before** the agent rollout.
-
-## Examples
-
-Customer-equivalent verification from PowerShell (authoritative, matches the reader):
-
-```powershell
-[Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI -Name db).Bytes).Contains('Windows UEFI CA 2023')
-[Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI -Name KEK).Bytes).Contains('Microsoft Corporation KEK 2K CA 2023')
-```
-
-## Citations
-
-* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/UefiSecureBootCertReader.cs` — native reader
-* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/DeviceInfo/DeviceInfoCollector.NetworkAndSecurity.cs` — `CollectSecureBootStatus` / `AppendFirmwareCertFields`
-* `rules/analyze/ANALYZE-SEC-001.json` — v3.0.0 rule definition
-* `src/Backend/AutopilotMonitor.Functions.Tests/RuleEnginePreconditionTests.cs` — pinned precondition semantics + v3 mirror tests
-* Microsoft: [Act now — Secure Boot certificates expire June 2026](https://techcommunity.microsoft.com/blog/windows-itpro-blog/act-now-secure-boot-certificates-expire-in-june-2026/4426856)

docs/architecture.md

@@ -1,135 +0,0 @@
----
-type: Architecture Guide
-title: Autopilot Monitor – Architecture Guide
-description: High-level architecture overview and solution layout for contributors.
-tags:
-  - architecture
-  - agent
-  - backend
-  - web
-  - mcp
-timestamp: 2026-07-06T21:39:29+02:00
----
-
-# Autopilot Monitor – Architecture Guide
-
-> High-level architecture overview and solution layout for contributors.
-> Full product documentation lives at https://docs.autopilotmonitor.com.
-
----
-
-## High-Level Overview
-
-```text
-+----------------------------------------------------------------------------------+
-|                         Autopilot Monitor - Architecture                         |
-+----------------------------------------------------------------------------------+
-
- [Admin/User Browser]
-          |
-          | HTTPS
-          v
-+-----------------------------+      OIDC        +-------------------------------+
-| Web App (Next.js)           |<---------------->| Microsoft Identity (Entra ID) |
-| Dashboard / Progress        |                  | Auth / Authorization          |
-+-----------------------------+                  +-------------------------------+
-          ^    ^
-          |    |
-          |    | Live updates
-          |    |
-          |    |                         +---------------------------+
-          |    +-------------------------| SignalR Hub               |
-          |                              | Real-time event stream    |
-          |                              +---------------------------+
-          |                                          ^
-          | REST / API                               |
-          v                                          | events
-+---------------------------+        Data &          |
-| Azure Functions Backend   |------> Integrations ---+
-| APIs / Ingestion / Rules  |               \
-+---------------------------+                \       +---------------------------+
-          ^                                   +----->| Storage Tables            |
-          | mTLS                                     | Sessions / Events / Rules |
-          | telemetry / events                       +---------------------------+
-          |                                          +---------------------------+
-+---------------------------+                        | Notifications             |
-| Agent on Windows Devices  |                        | Teams / Slack / Webhooks  |
-| Enrollment + app progress |                        +---------------------------+
-+---------------------------+
-                                                     +---------------------------+
-                                                     | MCP Server                |
-                                                     | Azure Container App       |
-                                                     +---------------------------+
-```
-
-**Core Data Flow:**
-```
-Device (Agent) ──JSON telemetry+gzip──► Azure Functions ──► Azure Table Storage
-                                      │                     │
-                                      ├── SignalR ─────────►│
-                                      │                     │
-                              Web Dashboard ◄── REST API ◄──┘
-```
-
-| Component | Technology | Purpose |
-|-----------|------------|---------|
-| **Agent** | .NET Framework 4.8 (Windows) | Runs on devices during enrollment, collects telemetry |
-| **SummaryDialog** | .NET Framework 4.8 (WPF) | Post-enrollment summary UI (outcome, app timeline, auto-close) |
-| **Backend** | Azure Functions .NET 8 (Isolated Worker) | REST API, event processing, rule engine, storage |
-| **Web** | Next.js 15 + TypeScript + React 18 | Dashboard, settings, analytics, real-time UI |
-| **Shared** | .NET Standard 2.0 | DTOs, models, enums, constants shared between Agent & Backend |
-| **MCP Server** | Azure Container App | Model Context Protocol server for AI-assisted analysis |
-
----
-
-## Solution Structure
-
-```
-AutopilotMonitor.sln
-├── src/
-│   ├── Shared/
-│   │   ├── AutopilotMonitor.Shared/             (netstandard2.0 – DTOs, models, enums, constants)
-│   │   └── AutopilotMonitor.DecisionCore/       (netstandard2.0 – completion decision engine)
-│   ├── Agent/
-│   │   ├── AutopilotMonitor.Agent.V2/           (net48, Exe – entry point; output named AutopilotMonitor.Agent.exe)
-│   │   ├── AutopilotMonitor.Agent.V2.Core/      (net48, Lib – core logic)
-│   │   ├── AutopilotMonitor.Agent.V2.Core.Tests/ (net48, xUnit – agent unit tests)
-│   │   ├── AutopilotMonitor.DecisionCore.Tests/ (net48, xUnit – decision engine tests)
-│   │   ├── AutopilotMonitor.SummaryDialog/      (net48, WPF – enrollment summary UI)
-│   │   └── AutopilotMonitor.SummaryDialog.Tests/ (net48, xUnit)
-│   ├── Backend/
-│   │   ├── AutopilotMonitor.Functions/          (net8.0, Azure Functions v4)
-│   │   └── AutopilotMonitor.Functions.Tests/    (net8.0, xUnit)
-│   ├── McpServer/
-│   │   └── autopilot-monitor-mcp/               (TypeScript/Node – MCP server; deployed as Azure Container App)
-│   └── Web/
-│       └── autopilot-monitor-web/               (Next.js 15, TypeScript)
-├── rules/
-│   ├── gather/                                   Individual gather rule JSONs
-│   ├── analyze/                                  Individual analyze rule JSONs
-│   ├── ime-log-patterns/                         IME regex pattern JSONs
-│   ├── schema/                                   JSON Schema definitions
-│   ├── guardrails.json                           Gather-rule guardrail allow-lists (source)
-│   ├── scripts/                                  combine.js
-│   └── dist/                                     Combined output (embedded in Functions)
-├── infra/                                        Bicep templates (MCP server)
-├── scripts/
-│   ├── Backup/                                   Table backup/restore tooling
-│   ├── Bootstrap/                                Intune deployment scripts
-│   ├── CustomerSetup/                            Customer onboarding helpers
-│   └── Deployment/                               CI/CD build scripts
-└── .github/workflows/                            CI/CD pipelines
-```
-
-**Project References:**
-```
-Shared + DecisionCore ◄── Agent.V2.Core ◄── Agent.V2
-                                          ◄── Agent.V2.Core.Tests
-Shared + DecisionCore ◄── DecisionCore.Tests
-Shared + DecisionCore ◄── Functions ◄── Functions.Tests
-SummaryDialog ◄── SummaryDialog.Tests   (standalone; compiled alongside the agent build)
-Web (independent – communicates via REST + SignalR)
-McpServer (independent – talks to the backend REST API)
-```
-
----

docs/backend/business-timestamps.md

@@ -1,95 +0,0 @@
----
-type: Concept
-title: Business Timestamps vs. the Azure Tables System Timestamp
-description: Why the system Timestamp is never authoritative, how the 2026-07-18 migration exposed that, and the OccurredUtc + RowKey-decode compensation (mappers, RowKey-range date filters, retention, backfill).
-resource: /src/Backend/AutopilotMonitor.Functions/Helpers/BusinessTimestamp.cs
-tags:
-  - backend
-  - table-storage
-  - audit-log
-  - ops-events
-  - events
-  - migration
-timestamp: 2026-07-20T00:00:00+02:00
----
-
-# Problem
-
-Azure Table Storage's `Timestamp` is a **system property**: the server ignores any supplied
-value on write and stamps the row's *write* time; every row rewrite (storage-account
-migration, MERGE) resets it. Three tables nevertheless treated it as the business event
-time — writes like `["Timestamp"] = evt.Timestamp` were silent no-ops, unnoticed because
-write time ≈ event time in normal operation.
-
-The 2026-07-18 EU storage migration rewrote every row, so all migrated rows in
-**AuditLogs**, **OpsEvents**, and **Events** read as "2026-07-18 ~13:58 UTC": displays were
-wrong, date-window filters matched the wrong rows, and retention froze (nothing older than
-the migration moment) with a mass-delete cliff one retention period later.
-
-# Rule
-
-**The system Timestamp is never authoritative.** Every table that needs an event time
-stores it in the custom column `OccurredUtc` (`BusinessTimestamp.OccurredUtcColumn`).
-Custom columns are copied verbatim by `scripts/Migration/Copy-TableStorage.ps1`, so future
-migrations preserve chronology. Migration checklist: any table whose reads/filters depend
-on a timestamp must carry it as a custom column — audit this before every storage move.
-
-# Recovery sources per table
-
-The original time survives migrations inside the RowKey:
-
-| Table | RowKey scheme | Decodable |
-|---|---|---|
-| AuditLogs | `!{MaxTicks-ticks:D19}_{guid:N}` (since 2026-05-06) | Yes; legacy bare-GUID rows (pre-2026-05) are lost |
-| OpsEvents | `{MaxTicks-ticks:D19}` | Yes, all rows |
-| Events | `{ts:yyyyMMddHHmmssfff}_{seq:D10}` (sanitized agent time) | Yes, all rows (ms precision) |
-
-# Mechanism
-
-`BusinessTimestamp` (Functions/Helpers) is the single source of truth: RowKey decoders,
-the OData clause builders, and `GetUtcDateTime` (datetime columns materialize as
-`DateTimeOffset` *or* `DateTime` depending on payload shape — always read via this helper).
-
-1. **Read mappers** resolve `OccurredUtc` → RowKey decode → system Timestamp (last
-   resort; only audit legacy GUID rows end there). Resolvers:
-   `TableStorageService.ResolveAuditTimestamp`, `TableOpsEventRepository.ResolveTimestamp`,
-   `TableStorageService.ResolveEventTimestamp` (also used by
-   `GetEarliestSessionEventTimestampAsync`, which feeds StartedAt/Duration reconciliation —
-   a system-Timestamp read there would rewrite migrated sessions' derived fields).
-2. **Date-window filters and retention use RowKey ranges**, not property comparisons:
-   OData excludes rows missing a compared property (an `OccurredUtc` filter would drop
-   every not-yet-backfilled row), and RowKey ranges are index-backed. Boundary semantics
-   are tick-exact equivalents of the old `Timestamp ge/le` clauses.
-   **Trap:** audit legacy GUID RowKeys (hex first char) sort *after* all `!`-rows, so
-   every lower bound `RowKey ge '!…'` must be paired with `RowKey lt '"'`
-   (`AuditTimeEncodedUpperBound`) — without the guard, a retention sweep would delete all
-   legacy rows. Pinned by `BusinessTimestampFilterClauseTests`.
-3. **Writes** in all three tables now set `OccurredUtc`; the no-op `["Timestamp"]`
-   entries were removed.
-4. **Backfill** (`POST /api/maintenance/backfill-occurred-utc`, GlobalAdminOnly, dry-run
-   by default, `table=audit|ops`, batched via `maxRows`/`continuation`): MERGE that adds
-   only `OccurredUtc` decoded from the RowKey — deterministic and idempotent. **Events
-   rows are deliberately never backfilled** (read-path decode is sufficient; no bulk
-   mutation of enrollment evidence). Note: a MERGE resets the row's system Timestamp —
-   irrelevant once nothing depends on it.
-5. **Audit retention** runs two passes until ~2027-01: RowKey-range for `!`-rows plus a
-   `RowKey ge '0' and Timestamp lt …` pass that ages legacy GUID rows out via their frozen
-   migration-date system Timestamp (remove after 2027-03-01).
-
-# Consequences
-
-* Audit legacy GUID rows have "unknown date" semantics: excluded from date-filtered
-  views, shown with the (wrong but honest) 2026-07-18 fallback in unfiltered views.
-* Raw endpoints (`/api/raw/*`, `query_table`) intentionally keep showing the raw system
-  Timestamp — they are storage-state inspectors, not business views.
-* Event timestamps for pre-cutover rows resolve to the RowKey's sanitized agent time
-  (ms precision); `ReceivedAt` (server ingest time, rows since 2026-03-19) and
-  `OriginalTimestamp` (pre-clamp agent time, clamped rows only) remain separate fields.
-
-# Citations
-
-* `src/Backend/AutopilotMonitor.Functions/Helpers/BusinessTimestamp.cs` — decoders + clause builders
-* `src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.Maintenance.cs` — audit write/mapper/filters/retention
-* `src/Backend/AutopilotMonitor.Functions/DataAccess/TableStorage/TableOpsEventRepository.cs` — ops write/mapper/filters/retention
-* `src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.Sessions.cs` — event writes, `ResolveEventTimestamp`, earliest-event read
-* `src/Backend/AutopilotMonitor.Functions/Services/OccurredUtcBackfillService.cs` + `Functions/Admin/BackfillOccurredUtcFunction.cs` — backfill

docs/backend/device-journeys.md

@@ -1,122 +0,0 @@
----
-type: Concept
-title: Device Journeys & First-Time-Right (F2)
-description: How a device's terminal enrollment attempts are grouped into journeys (device key, junk-serial exclusion, first-success end, 30-day gap), where the DeviceHistories chain and the daily FTR aggregates are computed, stored and pruned, and which surfaces serve them.
-resource: src/Backend/AutopilotMonitor.Functions/Helpers/DeviceJourneyCalculator.cs
-tags:
-  - backend
-  - metrics
-  - device-history
-  - first-time-right
-  - insights
-timestamp: 2026-07-27T12:00:00+02:00
----
-
-# Device Journeys & First-Time-Right (F2)
-
-Answers "how many devices enrolled right on the first try?" and "show me every attempt
-this device made". Session success rate hides wipe-and-retry loops — every retry that
-eventually succeeds counts as a success; First-Time-Right (FTR) exposes the real pain.
-All grouping semantics live server-side in `DeviceJourneyCalculator` (JourneyVersion 1);
-no consumer re-derives them.
-
-# Schema
-
-## Device key
-
-`(TenantId, normalized serial)` — normalization is trim + lower-case. Junk/placeholder
-serials are excluded entirely (never a chain, never in FTR, disclosed as a per-day
-exclusion count): `System Serial Number`, `To Be Filled By O.E.M.`, `Default string`,
-`0`, `None`, `INVALID`, `Unknown` (the agent's WMI-failure sentinel), empty, or shorter
-than 4 characters. A motherboard swap changes the serial and therefore the device key;
-re-enrollment under a different tenant is a separate key by design.
-
-## Journey
-
-Terminal sessions of a device key ordered by StartedAt. The terminal set is
-**Succeeded / Failed / Incomplete** — `Pending` (a sealed WhiteGlove part 1),
-`AwaitingUser`, `Stalled` and `InProgress` are OPEN sessions and never attempts.
-
-* A journey **ends** with the first terminal success; the next session starts a new
-  journey (redeployment).
-* A gap of **more than 30 days** since the previous attempt's terminal moment
-  (`CompletedAt`, fallback StartedAt) starts a new journey even without a success
-  (device shelved/repurposed). Constant, not a setting — production gaps: median 4.9 h,
-  92 % < 7 d.
-* WhiteGlove part 1 + part 2 share ONE session row, so a completed WG enrollment is ONE
-  attempt; a WG device still waiting for its user session leaves the journey open —
-  never a failed attempt.
-* **Attempt count** = terminal sessions in the journey (`Failed` and `Incomplete` are
-  non-successful attempts).
-* **FTR rate** = completed journeys with attempt count 1 ÷ all completed journeys.
-  Open and gap-abandoned journeys never enter numerator or denominator.
-
-Durations shown for attempts are the sessions' authoritative `DurationSeconds` verbatim
-(WhiteGlove pause excluded; `Incomplete` deliberately has none) — never
-`CompletedAt − StartedAt`, which is later in ~25 % of terminal sessions.
-
-## Persistence & compute
-
-* `DeviceHistories` (PK = TenantId, RK = percent-encoded normalized serial): the chain of
-  the device's terminal session refs `{sessionId, startedAt, completedAt, status,
-  enrollmentType, isPreProvisioned, durationSeconds, adminMarked}` capped at the 20 most
-  recent, plus derived `CurrentJourneyAttempts` (the LAST journey's attempts — the
-  banner's "Attempt N"), `JourneyCount` (chain-scoped) and `JourneyVersion`. Written
-  inline at the session-terminal single-writer seam
-  (`TableSessionRepository.UpdateSessionStatusAsync`, all three terminal statuses,
-  DeletionState-guarded) so the session banner is fresh; healed by the maintenance sweep.
-  Deliberately NOT part of the per-session deletion manifest — the row aggregates many
-  sessions. Wiped on tenant offboarding.
-* Sweep (`SweepDeviceJourneysAsync`, 30-day rolling window, 2h tick): (1) drops chain
-  refs of deleted sessions **tombstone-driven** — every session deletion (cascade and
-  retention both run through the cascade worker) leaves a `SessionTombstones` marker for
-  ~7 days, far longer than the sweep cadence, and even an expired-but-unpruned marker is
-  valid deletion evidence; a chain left empty deletes its row. (2) Merges the window's
-  terminal sessions into their chains (backfill, inline-miss healing, re-terminal
-  reclassifications). (3) Recomputes the daily FTR aggregates idempotently.
-* `DeviceJourneyAggregates` (PK = TenantId or `global`, RK = `{yyyy-MM-dd}`): per day —
-  completed journeys, first-time-right count, attempt histogram, junk-serial exclusion
-  count, `JourneyVersion`. A journey buckets on the StartedAt date of its completing
-  success session (the platform's StartedAt-date convention; late terminals converge via
-  the sweep). All counts are **additive**, so a window rate is the ratio of summed daily
-  rows — there is no rolling-window row (unlike the median-based time-attribution
-  aggregates, which cannot merge). 180-day retention. Rows exist below the ≥20 UI gate
-  on purpose (the UI needs the n for "insufficient data (n=…)").
-
-# Surfaces
-
-* `GET api/metrics/device-history?serialNumber=&sessionId=` (MemberRead + tenant query
-  param — the same route serves the web banner and MCP; a Global Admin passes `tenantId`)
-  — the chain plus, with `sessionId`, that session's server-computed attempt number
-  (live sessions get their would-be position via a virtual non-successful attempt, so the
-  redeploy and gap rules apply). `history: null` = no recorded history.
-* `GET api/metrics/device-journeys?days=` (MemberRead) /
-  `GET api/global/metrics/device-journeys?days=&tenantId=` (GlobalReadOrAdmin) —
-  `{ windowDays, totals, daily, repeatDevices }`. The days selector is honored because
-  counts are additive. Without `tenantId` the global variant serves the cross-tenant
-  aggregate rows and `repeatDevices: null` — a per-device list would require scanning
-  every tenant's partition.
-* Repeat devices (violator list, capped 10): devices whose LAST journey took ≥2 attempts
-  and whose newest terminal session falls inside the window, ordered by attempts then
-  recency; the failure reason comes from the newest failed attempt (bounded point-reads).
-* Web: "Attempt N for this device · View history" banner on session detail (expandable
-  chain); "First-time-right" section on Fleet Health (rate + weekly trend + attempt
-  histogram + repeat devices). MCP: `get_device_history` (serial mode / fleet FTR mode).
-
-# Examples
-
-A device fails ESP twice and succeeds on the third try within one week: one journey,
-three attempts, completed — counts once in the FTR denominator, not in the numerator,
-and the histogram's bucket `3` gains one. The same device redeployed a month later and
-succeeding immediately starts journey 2 with attempt count 1 — first-time-right. A
-device with `serialNumber = "Unknown"` (WMI failure) never gets a chain; its terminal
-sessions surface only as that day's disclosed exclusion count.
-
-# Citations
-
-* `src/Backend/AutopilotMonitor.Functions/Helpers/DeviceJourneyCalculator.cs` — device key, junk list, grouping, attempt numbers (JourneyVersion 1).
-* `src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.DeviceHistory.cs` — persistence + inline seam entry.
-* `src/Backend/AutopilotMonitor.Functions/Services/MaintenanceService.DeviceJourneys.cs` — sweep, tombstone pruning, daily aggregation.
-* `src/Backend/AutopilotMonitor.Functions/Functions/Metrics/GetDeviceJourneyFunctions.cs` — read surfaces.
-* `src/Backend/AutopilotMonitor.Functions.Tests/DeviceJourneyAndFtrTests.cs` — table-driven grouping/aggregation/attempt-number tests.
-* `tasks/insights-expansion-spec.md` — F2 specification and source-data audit (§0.5).

docs/backend/rule-regression-radar.md

@@ -1,112 +0,0 @@
----
-type: Concept
-title: Rule Regression Radar (F3)
-description: How the radar detects analyze rules whose hit rate suddenly rose (7-day window vs 28-day baseline, Wilson-separated), which suppressions keep it quiet, how alert episodes live in the notification tracker, and which surfaces show them.
-resource: src/Backend/AutopilotMonitor.Functions/Helpers/RuleRegressionRadar.cs
-tags:
-  - backend
-  - rules
-  - regression-radar
-  - insights
-timestamp: 2026-07-27T16:00:00+02:00
----
-
-# Rule Regression Radar (F3)
-
-Detects "this analyze rule suddenly fires much more often" before helpdesk volume does, and
-says what the spike correlates with — with honest statistics and honest wording. Analyze
-rules only in v1: their daily stats are audit-verified session-deduplicated
-(`FireCount` ≈ distinct sessions with a hit, `SessionsEvaluated` the same-source
-denominator). Gather rules are excluded until their per-batch stats dedup is fixed —
-never silently included with bad math.
-
-# Schema
-
-## Signal & detection
-
-Per (tenant, ruleId), daily hit rate = `FireCount ÷ SessionsEvaluated` from the
-`RuleStats` rows — RATES, not counts (absolute counts spike with every rollout wave).
-A regression fires only when ALL hold for the trailing 7-day window vs. the prior
-28-day baseline:
-
-1. window has ≥ 5 hit sessions AND ≥ 20 evaluated sessions;
-2. window rate ≥ 2× baseline rate;
-3. the Wilson 95 % intervals are disjoint in the increase direction
-   (`MetricsMath.WilsonInterval` / `RateIncreaseSeparated` — deterministic, unit-pinned),
-   so small-n noise never alerts.
-
-## Suppression (false positives are trust damage)
-
-* Rule entity missing (deleted) — never alerts.
-* Rule younger than baseline + window (`CreatedAt` within 35 days — grace period for new
-  rules; the entity timestamp is the honest gate, a stats-row count would fail on
-  low-volume tenants whose quiet days simply have no rows).
-* Rule edited inside the window (`UpdatedAt` ≥ window start) — edits legitimately change
-  hit rates.
-* Empty baseline denominator (rule disabled throughout the baseline).
-* Platform kill switch: app setting `RuleRegressionRadarDisabled=true` skips the radar
-  (fail-open — it only notifies, never mutates data).
-
-## Alert episodes (tracker keyspace)
-
-An episode lives as `ruleregression|{ruleId}` in the notification-tracker table
-(the `tpmpss|` pattern): the row IS the dedup (bell + ops event fire exactly once per
-episode), the badge state and the `regressions[]` payload — window/baseline counts,
-rates, lift (null for a zero-baseline "new signal" — no finite lift is invented), window
-dates, and the dimension concentration captured at first fire. Numbers refresh on every
-radar pass while the episode stays active; `FirstNotifiedAt` never moves. The episode
-closes (badge clears, dedup re-arms) when the window rate falls back under 1.5× baseline
-or fires stop entirely; the tracker's 30-day retention sweep also re-arms, so a
-month-old still-burning regression rings once more by design.
-
-## Dimension correlation (on fire only)
-
-Hit sessions (RuleResults scan: tenant partition range + RowKey = ruleId + DetectedAt in
-window, intersected with the window's sessions) are compared against all window sessions
-across `osBuild`, `model` (manufacturer + model), `agentVersion` and `imeVersion`. The
-top value by lift is reported with BOTH shares — wording contract: "X % of affected
-sessions are on … vs Y % of all sessions — correlated, not necessarily causal". No value
-with ≥ 5 hit sessions at ≥ 2× lift → "no clear dimension concentration"; a correlation
-failure also yields no claim. App-version correlation for `ANALYZE-APP-*` rules is a
-follow-up (needs rule→app matching semantics), tracked with the gather-rule fix.
-
-## Compute & alert path
-
-Runs in the daily maintenance pass right after the rule-stats aggregation
-(`RunRuleRegressionRadarAsync`), anchored on YESTERDAY — whole days only, a partial
-today would understate the window rate. One 35-day stats read covers all tenants;
-evaluation is the pure `RuleRegressionRadar` core. On a NEW episode:
-
-1. `RuleFrequencyRegression` ops event (category Tenant, Warning) with the full numbers
-   — dual-registered in the web `OPS_EVENT_TYPES` catalog for alert-rule routing.
-2. Tenant bell notification (type `rule_frequency_regression`, Admin audience) with the
-   same numbers and a deep link to the rule's card (`/analyze-rules#rule-card-{ruleId}`).
-   A sessions-list pre-filtered to rule hits needs a rule filter the session search does
-   not have yet — follow-up alongside the gather-rule work.
-3. v1 channel: bell + ops event only. Provider fan-out (webhook/Telegram) follows once
-   alert quality is proven — a noisy first version burns trust permanently.
-
-# Surfaces
-
-* `GET api/metrics/rule-stats` (and the global variant with `tenantId`) carries
-  `regressions[]` — the active episodes. MCP `get_rule_stats` inherits the block.
-* Analyze-rules page: per-rule 30-day fire-count sparkline (densified from the `trend`
-  rows the endpoint already served) and a red "↑ Regression" badge while an episode is
-  active, with the full numbers in the tooltip.
-
-# Examples
-
-A rule firing on 2 % of sessions for a month jumps to 15 % over a week (15/100 vs
-10/500): lift 7.5×, Wilson-separated → one bell, one ops event, badge until the rate
-falls back under 3 %. The same jump on 5/20 sessions with a 12 % baseline stays silent —
-the intervals overlap, so the spike is not statistically real yet. A rule that never
-fired in the baseline and now hits 15 % alerts as a "new signal" with no lift figure.
-
-# Citations
-
-* `src/Backend/AutopilotMonitor.Functions/Helpers/RuleRegressionRadar.cs` — gates, suppression, re-arm, dimension concentration.
-* `src/Backend/AutopilotMonitor.Functions/Helpers/MetricsMath.cs` — Wilson interval + separation primitive.
-* `src/Backend/AutopilotMonitor.Functions/Services/MaintenanceService.RuleRegression.cs` — sweep, episode reconcile, bell/ops wiring.
-* `src/Backend/AutopilotMonitor.Functions/DataAccess/TableStorage/TableHardwareRejectionNotificationTracker.cs` — episode keyspace.
-* `src/Backend/AutopilotMonitor.Functions.Tests/RuleRegressionRadarTests.cs` — hand-computed Wilson vectors + every suppression branch.
-* `tasks/insights-expansion-spec.md` — F3 specification and source-data audit (§0.5).

docs/backend/server-actions-on-demand-diagnostics.md

@@ -1,102 +0,0 @@
----
-type: Concept
-title: ServerActions & On-Demand Diagnostics Collection
-description: The queue-on-session, deliver-on-ingest ServerAction channel (terminate_session / rotate_config / request_diagnostics), the operator-tier authorization split, the portal's Collect Logs flow including the admin quick-config path, and why the offboarding cascade sweeps the hosted diagnostics prefix.
-resource: /src/Backend/AutopilotMonitor.Functions/Functions/Sessions/QueueSessionActionFunction.cs
-tags:
-  - backend
-  - agent
-  - web
-  - server-actions
-  - diagnostics
-  - authorization
-timestamp: 2026-07-24T00:00:00+02:00
----
-
-# Schema
-
-**Channel.** A `ServerAction` (`Type`, `Reason`, `RuleId`, `Params`, `QueuedAt`) is queued onto
-`Sessions.PendingActionsJson` by server-side writers — the admin endpoint
-`POST /api/sessions/{sessionId}/actions`, the RuleEngine, maintenance — and delivered
-piggy-backed on the agent's next ingest response. No polling channel exists; delivery latency
-equals the agent's telemetry cadence (seconds to ~1 minute during enrollment). Delivery is
-at-least-once: the agent's `ServerActionDispatcher` dedups on `Type|RuleId|QueuedAt` and
-processes a batch sequentially in queue order. Unknown types are logged and skipped, so new
-types roll out server-first. Every action emits `server_action_received` and then
-`server_action_executed` or `server_action_failed` into the session timeline.
-
-**Authorization (two layers).** The route sits on `EndpointPolicy.TenantAdminOrOperator`
-(tenant Admin, tenant Operator, or Global Admin — no Viewer, no Global Reader: it is a write
-tier). Because the route serves multiple action kinds, `QueueSessionActionFunction`
-re-gates per type via `IsTypeAllowedForCaller`: Operators may queue only
-`request_diagnostics`; `terminate_session` and `rotate_config` require
-`RequestContext.IsTenantAdmin || IsGlobalAdmin` (403 otherwise). Any route on this tier with
-a multi-kind body MUST follow this same in-function re-gating pattern.
-
-**On-demand collection (`request_diagnostics`).** The dispatcher calls
-`DiagnosticsPackageService.CreateAndUploadAsync(enrollmentSucceeded: false, suffix:
-"server-requested")` — producing `AgentDiagnostics-{sessionId}-{timestamp}-server-requested.zip`.
-Passing `enrollmentSucceeded: false` is what makes on-demand collection work under
-`DiagnosticsUploadMode=OnFailure`; only `Off` (or an unconfigured destination) blocks it,
-surfacing as `server_action_failed`. The `diagnostics_uploaded` event stamps
-`DiagnosticsBlobName` + `Destination` onto the Sessions row (latest wins — an on-demand name
-is later replaced by the terminal package), and the SignalR `sessionUpdate` delta carries the
-field, so the portal's Download button flips live.
-
-**Portal flow (Collect Logs, session detail header).** The button is always rendered; the
-disabled states carry tooltips (inactive session, cross-tenant view, missing role, diagnostics
-not configured) as a deliberate nudge. Members below Admin cannot read the tenant config, so
-the member-readable feature-flags endpoint exposes `diagnosticsUploadConfigured`
-(`mode != Off && (customer SAS present || destination Hosted)`). Progress tracking is
-sequence-based (backend-assigned, monotonic), never timestamp-based — agent clock skew and
-at-least-once redelivery of older actions cannot produce false matches
-(`collectLogsLogic.ts`). Cross-tenant views are gated off because `TenantHelper.GetTenantId`
-resolves the tenant strictly from the caller's JWT.
-
-**Admin quick-config.** For an unconfigured tenant, a Tenant Admin's click opens a dialog
-that switches the tenant to `Destination=Hosted`, `Mode=OnFailure` (GET full config → patch
-exactly those two fields → PUT verbatim), then queues `rotate_config` **before**
-`request_diagnostics` — the dispatcher's sequential ordering guarantees the agent refetches
-the now-enabled config (the `RemoteConfigMerger` applies diagnostics fields live, remote wins)
-before building the package. This works against the already-deployed agent fleet; a
-"one-time override" variant would not, because the `mode=Off` check is client-side in
-`CreateAndUploadAsync` and the deployed handler reads no params.
-
-**Offboarding cascade.** Latest-wins on `DiagnosticsBlobName` means a session can leave more
-hosted blobs behind than the deletion manifest references. The cascade's Hosted branch
-therefore sweeps the canonical prefix `{tenantId}/AgentDiagnostics-{sessionId}-`
-(`HostedDiagnosticsBlobService.DeleteBySessionPrefixAsync`) plus the manifest-named blob as
-belt-and-braces; a non-GUID legacy `SessionId` degrades to the single-name delete instead of
-poisoning the cascade. The CustomerSas branch is unchanged (delete only with the `d`
-permission; the customer's lifecycle rules stay authoritative).
-
-# Examples
-
-Queue an on-demand collection (Admin or Operator, own tenant):
-
-```
-POST /api/sessions/{sessionId}/actions
-{ "type": "request_diagnostics", "reason": "On-demand log collection from portal" }
-→ 202 { "success": true, "queuedAt": "..." }
-```
-
-Operator queueing an admin-only type:
-
-```
-POST /api/sessions/{sessionId}/actions
-{ "type": "terminate_session" }
-→ 403 { "message": "Action type 'terminate_session' requires the Tenant Admin role" }
-```
-
-Timeline for a successful round trip: `server_action_received` → `server_action_executed`
-(with `blobName`) → `diagnostics_uploaded` → Sessions row + SignalR delta carry the new
-`DiagnosticsBlobName`.
-
-# Citations
-
-* `src/Backend/AutopilotMonitor.Functions/Functions/Sessions/QueueSessionActionFunction.cs` — allowed types, per-type caller gate.
-* `src/Backend/AutopilotMonitor.Functions/Security/EndpointAccessPolicyCatalog.cs` — `TenantAdminOrOperator` tier definition.
-* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Runtime/ServerActionDispatcher.cs` — dedup, sequential dispatch, telemetry contract.
-* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Runtime/DiagnosticsPackageService.cs` — mode gates, archive build, suffix.
-* `src/Backend/AutopilotMonitor.Functions/Services/Diagnostics/DiagnosticsBlobCascadeDeleter.cs` — hosted prefix sweep.
-* `src/Web/autopilot-monitor-web/app/sessions/[sessionId]/components/collectLogsLogic.ts` — button gating matrix, sequence-based progress evaluation.

docs/backend/time-attribution.md

@@ -1,124 +0,0 @@
----
-type: Concept
-title: Enrollment Time Attribution (F1)
-description: How a terminal session's wall clock is partitioned into named segments with an explicit unattributed remainder, how ESP-blocking apps and reboots are attributed, and where breakdowns and fleet aggregates are computed, stored and served.
-resource: src/Backend/AutopilotMonitor.Functions/Helpers/TimeAttributionCalculator.cs
-tags:
-  - backend
-  - metrics
-  - time-attribution
-  - insights
-timestamp: 2026-07-26T20:00:00+02:00
----
-
-# Enrollment Time Attribution (F1)
-
-Answers "where did the 47 minutes go?" per session and per fleet. Every number is
-traceable to observed events; a missing signal produces "unknown" or an explicit
-unattributed remainder — never a guess, and the partition is never normalized to 100 %.
-
-# Schema
-
-## Invariant
-
-For every computed breakdown:
-
-```
-sum(span seconds) + UnattributedSeconds == WallClockSeconds == session DurationSeconds
-```
-
-`DurationSeconds` is the authoritative wall clock — for WhiteGlove it is part 1 + part 2
-WITHOUT the pause, and re-terminal stamps move `CompletedAt`, so `CompletedAt − StartedAt`
-is never used (it diverges in ~25 % of terminal sessions). Span seconds are floored;
-sub-second dust lands in the unattributed remainder.
-
-## Observation windows
-
-Windows are end-anchored on authoritative timestamps and constructed so their lengths sum
-exactly to `DurationSeconds`:
-
-* Non-WhiteGlove: one window `[CompletedAt − DurationSeconds, CompletedAt]`.
-* WhiteGlove (ONE session row, two windows): part 2 = `[ResumedAt, CompletedAt]`; part 1 =
-  `[part1End − (DurationSeconds − part2), part1End]` where `part1End` is anchored on the
-  `whiteglove_part1_complete` event. The pause between the windows is never attributed.
-  Fallback anchors set the `WhiteGloveAnchorsIncomplete` quality flag.
-
-## Segments
-
-Spans are sliced at phase-declaration events (only declaration events carry
-`Phase != Unknown`) plus `desktop_arrived`, in canonical Sequence order; anchors whose
-timestamp runs backward are dropped (`ClockSkewDropped`).
-
-| EnrollmentPhase | Segment key |
-|---|---|
-| Start / DevicePreparation / DeviceSetup | `device_prep` |
-| AppsDevice | `esp_apps` |
-| AccountSetup / FinalizingSetup | `identity_hello` |
-| AppsUser | `user_esp` |
-| Complete, `desktop_arrived` event | `desktop_handoff` |
-| Failed | attribution ends — tail stays unattributed |
-
-## ESP-blocking apps (positive evidence only)
-
-Per-app intervals use EVENT timestamps (first started/download event → LAST terminal
-event, covering IME retries) — never the agent payload timing, which freezes at the first
-terminal transition. Blocking membership joins the app id against the session's latest
-list-carrying `esp_config_detected` emission: listed ⇒ blocking; absent ⇒ unknown, never
-false (`BlockingSetUnknown` / `BlockingSetTruncated` flags). Critical-path occupancy =
-overlap-merged union of blocking intervals clipped to the `esp_apps` spans;
-`EspAppsOccupancySeconds` is null (unknown) when no lists were observed.
-
-The fleet what-if bound per app X is `max(0, cpEnd − cpEndWithoutX)` (latest interval end
-with vs. without X; the idle gap before X counts — the ESP also waits for X to start).
-It is an upper bound by construction; every consumer says "up to", never "you will save".
-
-## Reboots
-
-`system_reboot_detected` is detection-time-stamped by the NEXT agent run; the real boot
-moment is its `lastBootUtc` payload. Reboot spans are therefore the event-stream gap
-bracketing `lastBootUtc`, deduped per boot, clipped to the observation windows, and carried
-as a cross-cutting annotation (they overlap the segment they started in — never a slice of
-the partition).
-
-## Persistence & compute
-
-* `SessionTimeBreakdowns` (PK = TenantId, RK = SessionId): spans, reboot spans, blocking
-  intervals (top 20 + uncapped count), quality flags, `AttributionVersion`. Written once at
-  the session-terminal single-writer seam (`TableSessionRepository.UpdateSessionStatusAsync`,
-  Succeeded/Failed only — Incomplete deliberately has no duration). Deleted with its session
-  (deletion-manifest step) and on tenant offboarding.
-* Self-healing 30-day maintenance sweep (2h tick): backfills missing breakdowns, folds
-  late-terminating sessions into their StartedAt-date aggregates, and enforces version
-  purity — a stale-version row whose events aged out counts as missing, never mixed.
-* `TimeAttributionAggregates` (PK = TenantId or `global`, RK = `{yyyy-MM-dd}|{class}` and
-  `rolling30|{class}`): per enrollment class (`user_driven`, `whiteglove`, `self_deploying`,
-  `device_preparation` — never mixed) median/p75/p90 per segment over the fixed six-segment
-  stack (incl. `unattributed`; a session without a segment contributes 0), plus top blocking
-  apps (≥5 sessions per app row). Clean/flagged/missing counts are part of every row; rows
-  exist below the ≥20 UI gate on purpose (the UI needs the n for "insufficient data (n=…)").
-  Daily rows retain 180 days; `rolling30` rows are refreshed whole (a median of per-day
-  medians is not the range median — the rolling rows are the honest range statistics).
-
-## Surfaces
-
-* `GET api/sessions/{sessionId}/time-attribution` (MemberRead + tenant query param) —
-  breakdown row or `breakdown: null` (pre-feature / non-terminal / Incomplete = no lane).
-* `GET api/metrics/time-attribution` (MemberRead) / `GET api/global/metrics/time-attribution`
-  (GlobalReadOrAdmin, optional `tenantId`) — `{ windowDays, classes (rolling), daily }`.
-* Web: attribution lane under the session-detail phase timeline; "Time attribution" section
-  on Fleet Health. MCP: `get_time_attribution` (sessionId mode / fleet mode).
-
-# Examples
-
-A 30-minute user-driven session: `device_prep` 5m → `esp_apps` 10m (occupancy 4m by one
-blocking app) → `identity_hello` 8m → `user_esp` 5m → `desktop_handoff` 2m, unattributed 0.
-A WhiteGlove session with a 2-day pause reports wall clock = part1 + part2 only; the resume
-gap before the first part-2 phase declaration is unattributed, not guessed.
-
-# Citations
-
-* `src/Backend/AutopilotMonitor.Functions/Helpers/TimeAttributionCalculator.cs` — calculator + semantics (AttributionVersion 1).
-* `src/Backend/AutopilotMonitor.Functions/Services/TableStorageService.TimeAttribution.cs` — persistence.
-* `src/Backend/AutopilotMonitor.Functions/Services/MaintenanceService.Aggregation.cs` — sweep + aggregation.
-* `src/Backend/AutopilotMonitor.Functions.Tests/TimeAttributionCalculatorTests.cs` — golden fixtures pinning the invariant.
-* `tasks/insights-expansion-spec.md` — F1 specification and source-data audit (§0.5).

docs/index.md

@@ -1,57 +0,0 @@
----
-okf_version: "0.1"
----
-
-# Autopilot Monitor — Technical Knowledge Bundle
-
-Contributor-facing technical documentation for Autopilot Monitor, organized as an
-[Open Knowledge Format (OKF)](https://github.com/GoogleCloudPlatform/knowledge-catalog/blob/main/okf/SPEC.md)
-knowledge bundle. Customer-facing product documentation lives at
-https://docs.autopilotmonitor.com (separate repository).
-
-# Architecture
-
-* [Architecture Guide](architecture.md) - High-level architecture overview and solution layout for contributors.
-* [Version Contract](versioning.md) - One version shape for agent, backend and MCP: the ETag-CAS counter blob that mints build numbers, and the manifests published only after a deploy is verified live.
-* [URL Registry](url-registry.md) - Every well-known host lives in one registry file per component (Constants.cs / utils/config.ts / src/config.ts), enforced by guard tests; includes the agent-download migration to the download alias and its deploy-order constraint.
-
-# Agent
-
-* [V2 Agent](agent/index.md) - How the on-device agent works: [runtime overview](agent/overview.md), [decision engine](agent/decision-engine.md) (reducer, signals, completion arms), [logs & persistence](agent/logs-and-persistence.md) (signal log, snapshot, crash recovery), [Hello wizard un-skip](agent/hello-wizard-unskip.md) (why a single "WHfB disabled" read never decides completion), [Autopilot ZTD diagnostics](agent/autopilot-ztd-diagnostics.md) (event IDs, diagnostic registry, endpoints, error-code map).
-* [Build Counter Blob](agent/build-counter-blob.md) - How agent build numbers are minted: shared counter blob with ETag-CAS so local and CI builds never collide; CI additionally attests build provenance (Sigstore).
-* [Agent Endpoint Migration](agent/endpoint-migration.md) - How the backend re-homes agents to a new API base URL via the config channel (backend move or per-tenant region move): live-fetch-only, allowlist-validated on both sides, one hop, kill wins.
-* [MDM Reboot Coalescing](agent/mdm-reboot-coalescing.md) - Attributing the mid-ESP coalesced reboot ("second sign-in") to the device-assigned policy URIs that forced it: aggregated DM-Enterprise 2800 observations (neutral, flush-time watermark) + the ANALYZE-ESP-005 advisory gated on an actually-observed reboot.
-* [Secure Boot CA-2023 Detection](agent/secureboot-ca2023-detection.md) - Why ANALYZE-SEC-001 v3 reads the UEFI db/KEK variables directly instead of trusting the SecureBoot\Servicing registry, and how the one-sided uefiCa2023FirmwareConfirmed marker plus a not_exists precondition give absence-tolerant suppression across old and new agents.
-* [ESP Policy-Provider Stall Detection](agent/esp-policy-provider-stall.md) - The EnrollmentStatusTracking CSP's no-timeout Setup/Apps wait is keyed to the Intune-registered "Sidecar" provider by NAME: co-management's "ConfigMgr" parks the user ESP at "Apps (Identifying)" for days even with TrackingPoliciesCreated=1 (issue #106); the always-on two-arm esp_policy_provider_stalled tripwire (provider_incomplete | sidecar_provider_missing) and the SOFTWARE\Microsoft\Windows\Autopilot gather-rule allowlist entry that surface it.
-
-# Rules
-
-* [Gather Rule Phase Scoping, One-Shot Triggers & Emit-on-Change](rules/gather-rule-phase-scoping.md) - Restricting gather rules to enrollment phases (activePhases / activeFromPhase sticky latch), one-shot collection at a phase's start/end (phase_change / phase_exit), and emitMode "on_change" result-dedup.
-* [Gather Rule Guardrails](rules/gather-rule-guardrails.md) - Why the allowlists in rules/guardrails.json are enforced on the agent and nowhere else, which hard blocks survive unrestricted mode, and the rule that every collector must call a guard and emit security_warning on refusal.
-
-# Backend
-
-* [Business Timestamps](backend/business-timestamps.md) - Why the Azure Tables system Timestamp is never authoritative (migrations reset it), and the OccurredUtc + RowKey-decode compensation for AuditLogs/OpsEvents/Events after the 2026-07-18 migration.
-* [Device Journeys & First-Time-Right](backend/device-journeys.md) - How a device's terminal enrollment attempts are grouped into journeys (trim+casefold device key with junk-serial exclusion, first-success end, 30-day gap, WhiteGlove = one attempt), the DeviceHistories chain with its tombstone-driven deleted-session pruning, the additive daily FTR aggregates, and the banner/fleet/MCP surfaces.
-* [Enrollment Time Attribution](backend/time-attribution.md) - How a terminal session's authoritative wall clock (DurationSeconds, WhiteGlove pause excluded) is partitioned into named segments with an explicit unattributed remainder, ESP-blocking apps as positive evidence with "up to" what-if bounds, reboot spans from event gaps, and the breakdown/aggregate tables the sweep maintains.
-* [Rule Regression Radar](backend/rule-regression-radar.md) - How analyze-rule hit-rate regressions are detected (7-day window ≥2× the 28-day baseline with disjoint Wilson intervals), which suppressions keep the radar quiet (grace period, edit-in-window, kill switch), how alert episodes live in the ruleregression tracker keyspace with re-arm semantics, and the on-fire dimension correlation with its "correlated, not necessarily causal" wording contract.
-* [ServerActions & On-Demand Diagnostics](backend/server-actions-on-demand-diagnostics.md) - The queue-on-session, deliver-on-ingest action channel, the TenantAdminOrOperator tier with in-function per-type re-gating, the portal's Collect Logs flow (quick-config orders rotate_config before request_diagnostics), and the hosted-prefix sweep in the offboarding cascade.
-
-# MCP Server
-
-* [MCP Docs Corpus](mcp/docs-corpus.md) - How the published customer documentation becomes the `search_docs` corpus: CRLF-safe heading chunking, build-time embedding as a third precomputed section, and why a docs edit needs an MCP redeploy.
-
-# Web Portal
-
-* [Portal Navigation Prefetch & the SWA Runtime Bottleneck](web/portal-navigation-prefetch.md) - Why every navigation Link sets `prefetch={false}`: the App Router's viewport prefetch fans out one RSC request per visible link against an HTTP/1.1 Static Web Apps runtime, and its latency tail starves the six connections that also serve the document and the route chunks. Includes where browser telemetry actually lives.
-
-# Security & Identity
-
-* [MCP OAuth Flow](mcp-oauth-flow.md) - Who authenticates where when connecting an AI client to the MCP server; two identities, three parties plus Entra ID.
-
-# Conventions for this bundle
-
-* Every concept document is a markdown file with YAML frontmatter; `type` is mandatory, `title`, `description`, `resource`, `tags`, and `timestamp` are recommended.
-* Use standard **relative** markdown links between documents (e.g. `agent/overview.md`, `../architecture.md`). Do NOT use the spec's `/`-prefixed bundle-absolute form — GitHub resolves those against the repo root (missing `/docs`) and navigation breaks.
-* Record notable additions and changes in [log.md](log.md).
-* `index.md` and `log.md` are reserved names — never use them for concept documents.

docs/log.md

@@ -1,85 +0,0 @@
-# Log
-
-## 2026-07-27
-
-* **Creation**: Added `web/portal-navigation-prefetch.md` (and a `Web Portal` section to the index) — root cause of the minute-long portal freezes. `GlobalSidebar` and `Navbar` render the whole navigation on every page, so the App Router's default viewport prefetch issued one `?_rsc=` request per visible link against `portal.autopilotmonitor.com` (~10,400 in 14 days). That origin serves the document, the route chunks and the RSC payloads over **HTTP/1.1**, so the six-connection-per-origin cap applies; when the Static Web Apps managed runtime queued the prefetches (p50 91 ms, p95 896 ms, but max 234 s / 21 samples over 30 s), the in-flight prefetches held every socket and the navigation the user wanted could not get one. Measured on the 2026-07-27 17:25 CEST incident: `/admin/presence?_rsc=` 151 s, three siblings finishing within 340 ms of each other at ~37.5 s, all `200`, while the backend API answered in 1.6–2.2 s and `browserTimings` showed `networkDuration` 16 ms against `processingDuration` 225 s. Every navigation Link now sets `prefetch={false}` — these routes are client components behind `ProtectedRoute` that fetch their own data, so the prefetched RSC payload carried no benefit. The doc also records that browser telemetry lives in a **separate** App Insights resource (`AUTOPILOT_MONITOR_WEB_APPINSIGHTS_ID`) that the MCP `query_backend_logs` tool cannot reach, which is why the freezes left no trace in the backend logs.
-
-* **Creation**: Added `backend/rule-regression-radar.md` — F3 regression radar (analyze rules only; gather rules wait for their per-batch stats dedup fix): per (tenant, rule) daily hit rate from `RuleStats`, firing only when the trailing 7-day window has ≥5 hit sessions and ≥20 evaluated sessions, the rate is ≥2× the prior 28-day baseline AND the Wilson 95 % intervals are disjoint (deterministic `MetricsMath` primitive with hand-computed test vectors). Suppressed for deleted rules, rules younger than baseline+window (`CreatedAt` grace), rules edited inside the window (`UpdatedAt`), empty baselines, and the `RuleRegressionRadarDisabled` app-setting kill switch. Alert episodes live as `ruleregression|{ruleId}` tracker rows (one bell + one `RuleFrequencyRegression` ops event per episode; numbers refreshed while active; re-armed under 1.5× baseline, on fire-stop, or by the 30-day tracker retention). On-fire dimension correlation over osBuild/model/agentVersion/imeVersion with the "correlated, not necessarily causal" wording contract. Surfaces: `regressions[]` in the rule-stats response (MCP inherits), the analyze-rules page's 30-day sparkline and regression badge.
-
-* **Creation**: Added `backend/device-journeys.md` — F2 device history / First-Time-Right: the device key (trim + case-fold serial, junk/placeholder exclusion incl. the agent's `Unknown` WMI sentinel), journey grouping over the terminal set Succeeded/Failed/Incomplete (first success ends a journey, a >30-day gap from the previous attempt's CompletedAt starts one, WhiteGlove's single session row is ONE attempt, open sessions are never attempts), the `DeviceHistories` chain (cap 20, written inline at the terminal seam, healed by the sweep, deleted-session refs pruned tombstone-driven, deliberately not in the per-session deletion manifest) and the additive `DeviceJourneyAggregates` daily rows (window rate = ratio of sums — no rolling row needed, 180-day retention). Surfaces: the session-detail "Attempt N" banner with server-computed attempt numbers (virtual-attempt rule for live sessions), the Fleet Health First-time-right section (≥20-journey gate, attempt histogram, repeat-devices violator list), and the MCP `get_device_history` tool (serial mode / fleet FTR mode).
-
-## 2026-07-25
-
-* **Update**: `agent/secureboot-ca2023-detection.md` — review follow-up on 90012d9 hardened the privilege scope, the repo's only privilege-adjustment code and therefore the precedent for any future one. The process token moved from a raw `IntPtr` to a `SafeHandle` assigned by the P/Invoke marshaler, so the CLR owns it from the moment `OpenProcessToken` returns and the critical finalizer releases it even when `Dispose` never runs — previously an async exception between the successful open and the caller's `using` leaked the handle *with the privilege enabled and no owner left to restore it*. `Dispose` became idempotent and now releases the handle in a `finally`, so a throwing restore cannot strand it; the restore obligation is recorded immediately after the successful `AdjustTokenPrivileges` with nothing throwable in between. The whole enable → read → restore sequence runs under a static gate because the privilege is adjusted on the *process* token: a concurrent reader would see "already enabled", correctly skip its own restore, and then lose the privilege mid-read when the first reader disposed, reporting `privilege_denied` on a machine that holds it.
-
-## 2026-07-24
-
-* **Creation**: Added `backend/server-actions-on-demand-diagnostics.md` — the ServerAction channel (queue on `Sessions.PendingActionsJson`, deliver piggy-backed on the next ingest response, at-least-once with `Type|RuleId|QueuedAt` dedup and sequential dispatch) and the on-demand log collection built on it: the portal's always-visible **Collect Logs** button, the new `EndpointPolicy.TenantAdminOrOperator` tier with the mandatory in-function per-type re-gate (Operators queue only `request_diagnostics`), the member-readable `diagnosticsUploadConfigured` feature flag, the admin quick-config path that must queue `rotate_config` before `request_diagnostics` (works against the deployed fleet — a one-time override would not, the mode gate is agent-side), sequence-based progress matching immune to agent clock skew, and the offboarding cascade's hosted-prefix sweep closing the latest-wins orphan-blob gap.
-
-* **Update**: `agent/esp-policy-provider-stall.md` — the customer's follow-up on issue #106 corrected the field-case mechanics: `TrackingPoliciesCreated=1` WAS set under the foreign `ConfigMgr` provider, so the ESP ignores a foreign provider's completion values and waits on the Intune-registered `Sidecar` provider by name (the rename to `Sidecar` creates no tracking entries yet unblocks instantly). The completeness-keyed detector would have missed exactly this — the incident it was built for. The tripwire is now two-armed under one event type discriminated by `reason`: `provider_incomplete` (unchanged dwell on continuously-incomplete providers) and `sidecar_provider_missing` (≥ 1 Setup/Apps provider registered without `Sidecar`, completeness deliberately ignored, clock reset when Sidecar registers later). Sidecar-missing wins the `reason` when both arms cross in one round; the cross-restart fingerprint gains a `sidecarMissing` sentinel; payload adds `reason` and `sidecarMissingForMinutes`. Evidence for the name-keyed wait: Niehaus' documented Intune WAP payload always registers `Sidecar` (ConfigMgr only via a co-management settings policy) and Microsoft's ESP troubleshooting models app tracking exclusively through the Sidecar subkey.
-
-* **Creation**: Added `agent/esp-policy-provider-stall.md` — a customer diagnosed that pre-provisioned devices with the ConfigMgr client as a blocking app occasionally park the user ESP at "Apps (Identifying)" for days: only a `ConfigMgr` provider is registered under `EnrollmentStatusTracking\Device\Setup\Apps\PolicyProviders` (no `Sidecar` = IME) and `TrackingPoliciesCreated` never becomes 1 — a wait the CSP defines without any timeout; renaming the key to `Sidecar` unblocks immediately. The agent now ships the always-on `esp_policy_provider_stalled` tripwire (60-s tick, 15-min continuous-incompleteness dwell, one-shot per provider, `StartupEventGate` fingerprint across restarts, purely observational via the InformationalEvent rail — no toggle, no ConfigVersion bump), generalized to any provider in both `Setup/Apps` and `DevicePreparation` kinds rather than hardcoding the ConfigMgr case. Companion change: `SOFTWARE\Microsoft\Windows\Autopilot` joins the gather-rule registry allowlist so tenants can target the subtree with custom rules (e.g. `not_exists` on the Sidecar key).
-
-* **Creation**: Added `agent/secureboot-ca2023-detection.md` — ANALYZE-SEC-001 warned on devices whose firmware already carried the 2023 certificate, because the agent only read the `SecureBoot\Servicing\UEFICA2023Status` registry value, which mirrors the Windows Update rollout rather than the firmware (customer report). The agent now reads the UEFI `db`/`KEK` variables natively (`GetFirmwareEnvironmentVariableExW` with `SeSystemEnvironmentPrivilege` enabled on the process token — first privilege-adjustment code in the repo) and emits per-certificate booleans on `secureboot_status`. Suppression rides on a one-sided marker, `uefiCa2023FirmwareConfirmed`, emitted only on positive confirmation: the engine's `not_exists` precondition fails on any present value, so a two-sided boolean could not distinguish "confirmed" from "checked and missing", while the marker's absence keeps old agents and firmware-missing devices on the v2 path. Rule v3.0.0 is therefore safe to seed before the agent release.
-
-* **Update**: `url-registry.md` — the first release after the alias migration surfaced Front Door caching as a correctness hazard: the alias served the previous `version.json` (`X-Cache: TCP_REMOTE_HIT`) after the origin had rotated, and since manifest and ZIP are independent cache entries, a stale manifest with a fresh ZIP fails the bootstrap SHA-256 check. Route caching on `/agent/*` is now disabled and every blob upload stamps `Cache-Control: no-cache` (CI `Send-Blob`, local `build.ps1`, `versions/*.json` manifests) — all agent-container blobs rotate in place, so nothing there is safely cacheable.
-
-* **Update**: `agent/decision-engine.md` — the RealmJoin completion gate has a third terminal, `FirstDeploymentIncomplete`. Session 224b2087 showed why: an interactive logon 17 s after DeploymentPhase 101 makes RealmJoin reclassify the run as a secondary-user deployment, whose branch writes 200/210 and never 110 — the gate stayed closed until the 60-min hard timeout although Hello and desktop were long resolved. `realmjoin_phase_changed` is now a typed `RealmJoinPhaseChanged` signal, so `RealmJoinFacts.LastDeploymentPhase` is persisted across agent restarts (this also fixes every `realmjoin_timeout` event claiming "last phase: 0"); a transition out of 100/101 into 200/210 releases the gate with the `realmjoin_first_deployment_incomplete` Warning, and the `RealmJoinDetected` replay path evaluates the same rule for restarts that swallow the transition. A first observation of 210 deliberately does not release — session 6f1959c0 started at 210 and only deployed afterwards.
-
-* **Creation**: Added `url-registry.md` — all well-known hosts (own subdomains, both blob accounts, API origin, Graph, Entra login) are now defined once per component (`Constants.cs`, web `utils/config.ts`, MCP `src/config.ts`) and referenced everywhere else; three guard tests fail the build on any literal outside the registries. Written because the EU cutover missed two hardcoded copies of the legacy blob host — `LatestVersionsService` (feeds the portal's version badge) and `ValidateBootstrapCodeFunction` — which kept working only through the fail-soft legacy mirror in `build-agent.yml`; those two plus the agent `SelfUpdater` now use the `download.autopilotmonitor.com` alias (verified serving all four artifacts first). The portal's bootstrap allow-list accepts alias AND legacy host during the transition, which imposes a deploy order: web before (or with) backend. The sweep also surfaced a fourth copy of the www/portal host pair in `middleware.ts` (now derived from the registry via `hostRouting.ts`) and a backend short-link built on the bare apex domain, which only worked through a registrar-level 301.
-
-## 2026-07-22
-
-* **Creation**: Added `versioning.md` — agent, backend and MCP now share one version shape (`<major>.<minor>.<build>` + 7-char commit + build timestamp) and one implementation of the build-number reservation (`.github/scripts/Request-BuildNumber.ps1`, previously copy-pasted between `build-agent.yml` and `build.ps1`). The backend had been pinned at a hand-written `1.0.0` since inception and now starts at `1.5.1000`; the MCP server's `package.json` version was bumped by hand and now starts at `1.5.300`, and it reports its own commit on `/health` instead of only the documentation bundle's. Both deploy workflows poll their health endpoint until it reports the build just deployed and publish `versions/<component>.json` only then, so a manifest that disagrees with the live endpoint means the instance drifted rather than the pipeline failing halfway. `agent/build-counter-blob.md` keeps the agent-specific parts and now points at the shared protocol; its counter URL was still the pre-cutover storage account.
-
-* **Creation**: Added `rules/gather-rule-guardrails.md` — the gather-rule allowlists are enforced only on the agent (the backend validates no `collectorType`, `target`, or `parameters`), so a collector that forgets to call its guard *is* the vulnerability. Written because two had: `LogParserCollector` read any path in `rule.Target`, bypassing even the `C:\Users` hard block that every other file collector honours, and `EventLogCollector` read any channel including `Security` — while the customer-facing documentation already promised both were allowlisted. Both now guard, with `logparser` checking the directory for wildcard targets (`Path.GetFullPath` throws on `*`) and re-checking each resolved path. Added an event-log channel allowlist (`eventLogChannels`) plus hard-blocked channels held in C# rather than JSON, so a parse error cannot lift them. Also fixed the command timeout, which was inert: `ReadToEnd()` blocks until the pipe closes, so `WaitForExit(30000)` was only reached after the process had already exited and a hung command pinned its worker forever — now read asynchronously and killed at the timeout.
-
-* **Update**: Added `.github/workflows/ci.yml` — the full suite (backend, agent V2 Core, DecisionCore, SummaryDialog, web, MCP) now runs on every pull request and every push to main, plus a job that fails if the generated guardrail files drift from `rules/guardrails.json`. Previously **no** workflow ran tests on a PR: the deploy workflows build without testing, and `build-agent.yml` tested only `DecisionCore.Tests` on manual dispatch — while `trust/security-faq.md` already told customers that automated tests run in CI. Added CodeQL (C# and TypeScript) and Dependabot (nuget, npm ×2, actions). Marked `OfficeBinaryWatcherTests` `[Collection("SerialThreading")]`: its bounded re-probe races the shared ThreadPool and failed once under full-suite load.
-
-## 2026-07-21
-
-* **Update**: `search_docs` and `search_knowledge` now state in their tool descriptions that queries must be in English. Both corpora and `all-MiniLM-L6-v2` are English-only, and the failure is total rather than gradual — a German question returns zero results, not weak ones. The caller is a language model, so translating the question before the call and answering in the user's language costs nothing; a multilingual embedding model would be the alternative but is much larger and would have to be measured against the eval harness first, since it changes English retrieval too.
-
-* **Update**: Added `scripts/eval-docs-search.ts`, an offline retrieval evaluation harness (2465 queries in three classes: chunk headings as a regression detector, rare identifiers, and hand-written questions as the reality anchor), and used it to close a third `search_docs` gap found during the live test. The keyword fallback only fired when semantic search returned *fewer* than `topK`; a pasted identifier like `WOW6432Node` instead returned three chunks at ~0.29 that did not contain the word while the one chunk that did was never considered. It now also fires on a weak semantic head (<0.35), letting exact matches take the front while keeping one semantic result. The threshold is measured, not guessed: 0.35 fixes 335 queries and breaks 0 (identifier recall 66.2% → 81.1%), while 0.40 fixes more but starts demoting hand-written questions. The measurement also resized the problem — identifier queries were only succeeding 66.2% of the time, so the reported case was one of roughly 750.
-
-* **Update**: Closed the two measured recall gaps in `search_docs` (`mcp/docs-corpus.md`). (1) **Token windows** — 87 of 324 chunks exceeded the model's 256-token context and 13% of all tokens never reached the ranking; a character budget cannot fix this (the corpus ranges 2.43–5.81 chars/token), so long text is now embedded as 250-token windows with 40 overlap and scored by its BEST window (`embeddings: number[][]`, max not mean). Token coverage 87% → 100%; "proxy configuration blocking app downloads" went from absent to 0.559 at rank 1; the ten reference queries kept byte-identical scores. Costs +31% vectors, index 2.63 → 3.12 MB. The rules corpus gained the same treatment (128 rules → 172 vectors). (2) **Keyword fallback** — when the semantic pass returns fewer than `topK`, results are topped up via literal `lexicalMatch` on distinctive query terms, requiring two matching terms for corroboration (one incidental substring match returned a page about LLM providers for a sourdough query). Fuzzy matching was measured and rejected: at a threshold low enough to surface "RealmJoin" it invents 5 hits for "SCEPman", which the corpus never mentions. Also sharpened the tool description with the measured context argument for preferring it over fetching the docs site.
-
-* **Creation**: Added `mcp/docs-corpus.md` (new `mcp/` section) — the MCP server gains `search_docs`, a third semantic corpus built from the published customer documentation repository (`autopilotmonitor-docs`, checked out into the Docker build context by the deploy workflow). Documents the h2/h3 + `<details>` chunking with breadcrumb prefixes, the two deliberate size exceptions (tables never split, unbroken changelog lists split at line level), the CRLF precondition (`.` does not match `\r` in JS — headings silently stop matching, which produced 286 wrong-but-plausible chunks before it was found), the optional `docs` section in `search-index.json` and its validation asymmetry, embedding rounding to 6 decimals, and the cross-repo coupling: a docs edit reaches clients only after an MCP redeploy, made checkable via `DOCS_COMMIT` on `/health`. Container resources raised to 0.5 vCPU / 1.0 GiB for the cold-start query-embedder load.
-
-## 2026-07-20
-
-* **Update**: `rules/gather-rule-phase-scoping.md` — the gather-rule form now shows the phase-scope and emit-mode controls only where they can change behavior (`supportsPhaseScope` / `supportsEmitMode`), nulls hidden-control state out of the payload, and rejects a scope mode selected but left unfilled. Offering all three "when" controls unconditionally allowed combinations that could only suppress a one-shot rule, plus a silent no-op state.
-* **Update**: Extended `rules/gather-rule-phase-scoping.md` with the `phase_exit` trigger — the closing bookend to `phase_change`, for one-shot collection when a phase is LEFT (e.g. "state at the end of Account Setup"). Documents the evaluation-before-phase-advance rule (triggerPhase match and scope gate see the phase being left), firing into `Failed`, the disjoint `exit:` dedup key space, and why no ConfigVersion bump is needed (no new field — old agents simply never fire the rule).
-* **Update**: Reworked `agent/mdm-reboot-coalescing.md` after the first real enrollment (session b2e890c1): 2800 records are now **aggregated per burst** into ONE neutral Info event (`rebootUris[]`/`uriCount`/`firstRebootUri`; watermark persisted at flush so a pre-emit reboot kill loses nothing); the raw event no longer claims a reboot — ANALYZE-ESP-005 is gated on an actually-observed `system_reboot_detected`. **Removed** the Shell-Core `esp_reboot_coalescing` event entirely: the "RebootCoalescing" token appears in the routine `SubcategoryProcessing_Started` bootstrap marker on every enrollment (false positive by construction). Verified 2800 description shape recorded.
-* **Creation**: Added `agent/mdm-reboot-coalescing.md` — the agent now attributes the "unexpected mid-ESP reboot + second sign-in" pattern (PMPC research) to the device-assigned policy URIs that forced it: new `MdmRebootPolicyTracker` (DM-Enterprise EventID 2800, per-URI `mdm_policy_reboot_required` events, cross-restart RecordId watermark), a `RebootCoalescing` branch in `ShellCoreTracker` (`esp_reboot_coalescing`, backfill-emitting by design), and the `ANALYZE-ESP-005` advisory (reassign device → user groups). ConfigVersion 35; event types deliberately distinct from `system_reboot_detected` so RebootCount stays uninflated.
-
-* **Creation**: Added `backend/business-timestamps.md` (new `backend/` section) — the 2026-07-18 migration reset every row's system Timestamp, exposing that AuditLogs/OpsEvents/Events had (unknowingly) displayed and filtered on it all along; documents the `OccurredUtc` column, the RowKey decoders and RowKey-range date/retention clauses in `BusinessTimestamp`, the GUID-guard trap, the audit/ops backfill endpoint, and the "system Timestamp is never authoritative" migration rule.
-* **Creation**: Added `rules/gather-rule-phase-scoping.md` (new `rules/` section) — gather rules gain `activePhases` (run only during listed phases), `activeFromPhase` (sticky latch from a phase onwards, never via Failed) and `emitMode: "on_change"` (canonical-hash result dedup with `suppressedPolls` observability), ConfigVersion 34. Includes the prerequisite backend fix: the custom-rule toggle PUT no longer wipes the stored rule definition (partial-merge in `GatherRuleService.UpdateRuleAsync`).
-
-## 2026-07-18
-
-* **Creation**: Added `agent/endpoint-migration.md` — config-channel agent re-home (`MigrateToApiBaseUrl` on `GET agent/config`, ConfigVersion 33): backend or per-tenant API-URL moves without DNS indirection (impossible due to mTLS/Flex-TLS). Live-fetch-only with cache strip, `AgentEndpointMigrationRules` allowlist validated on both sides, one hop, kill-switch wins. Built as the lesson from the 2026-07-18 WEU→GWC cutover, which hard-cut all in-flight agents.
-
-## 2026-07-26
-
-* **Creation**: Added `backend/time-attribution.md` — the F1 enrollment time attribution: exact-partition invariant against the session's authoritative DurationSeconds, two-window WhiteGlove model, segment mapping from phase-declaration events, positive-evidence ESP-blocking join with "up to" what-if bounds, reboot spans from event gaps around `lastBootUtc`, and the SessionTimeBreakdowns / TimeAttributionAggregates tables with their terminal-seam + maintenance-sweep compute paths and read surfaces (web lane, fleet panel, MCP `get_time_attribution`).
-
-## 2026-07-17
-
-* **Creation**: Added `agent/build-counter-blob.md` — agent build numbers now come from a shared public counter blob (`buildcounter-v{N}.txt`, reserve-before-build with ETag-CAS) so local `build.ps1` and CI `build-agent.yml` builds can never mint the same number. Documents the CI parity fixes (SummaryDialog.exe.config in the ZIP, EXE-vs-manifest version check, hash-oracle update gated on stable cutover) and the Sigstore provenance attestation on CI-built ZIPs.
-
-## 2026-07-16
-
-* **Creation**: Added `agent/autopilot-ztd-diagnostics.md` — reference for Windows' own ZTD diagnostic surfaces (ModernDeployment Autopilot event IDs incl. 807/809/815/908, the `Diagnostics\Autopilot` registry key, deployment-service endpoints, known-issue error-code map with KB fixes). Backs the agent's `ZtdEvidence` collector (`ztdVerdict` on `autopilot_profile_missing`) and the backend known-issue rules; sources carry a re-check RSS feed.
-
-## 2026-07-13
-
-* **Removal**: Moved `customer-graph-add-on-permissions.md` out of this contributor bundle into the customer documentation repository (`reference/optional-graph-permissions.md`). It was customer-facing product content and did not belong in the tech-docs bundle; removed the entry from `index.md`.
-
-* **Creation**: Added `agent/hello-wizard-unskip.md` — session 772fe502 fix: the `HelloWizardStarted` decision signal (prevention veto + un-skip cure for the policy-disabled Hello shortcut) and the HelloTracker confirmation second read against flip-flopping WHfB CSP values.
-
-## 2026-07-11
-
-* **Creation**: Added the `agent/` section — three concept documents on the V2 agent: `agent/overview.md` (runtime, collectors, telemetry pipeline), `agent/decision-engine.md` (DecisionCore reducer, signals, A/B/C completion arms, invariants), `agent/logs-and-persistence.md` (persisted artifacts, signal log vs spool, recovery/replay flow) plus `agent/index.md`.
-
-* **Creation**: Converted `docs/` into an OKF v0.1 knowledge bundle — added YAML frontmatter to `architecture.md`, `mcp-oauth-flow.md`, and `customer-graph-add-on-permissions.md`; created `index.md` and this log.

docs/mcp-oauth-flow.md

@@ -1,126 +0,0 @@
----
-type: Reference
-title: MCP OAuth Flow — Who Authenticates Where
-description: How the two unrelated identities (AI-product account vs. Entra ID work account) and three parties interact when connecting an AI client to the Autopilot Monitor MCP server.
-resource: /src/McpServer/autopilot-monitor-mcp/src/oauth.ts
-tags:
-  - mcp
-  - oauth
-  - entra-id
-  - security
-timestamp: 2026-07-11T10:59:31+02:00
----
-
-# MCP OAuth Flow — Who Authenticates Where
-
-**Status:** Reference · **Owner:** MCP Server · **Code:** [`src/McpServer/autopilot-monitor-mcp/src/oauth.ts`](../../src/McpServer/autopilot-monitor-mcp/src/oauth.ts)
-
-## Why this document exists
-
-Connecting an AI client (Claude Desktop, claude.ai, VS Code, ChatGPT) to the
-Autopilot Monitor MCP server involves **two unrelated identities** and **three
-parties plus Entra ID**. This regularly confuses users during setup, because
-the account signed in to the AI product and the account used for Autopilot
-Monitor are usually different people-in-one: e.g. **Luke** uses his normal
-account `luke` for his Claude subscription, but his admin account `adm.luke`
-for Autopilot Monitor.
-
-The two identities never mix:
-
-* **`luke` (AI-product account)** — only authenticates Luke against Claude
-  itself. Anthropic needs it to associate the OAuth callback with the right
-  Claude user and connector. The MCP server never sees this identity.
-* **`adm.luke` (Entra ID work account)** — the identity *inside* the token.
-  Every MCP tool call is authorized as `adm.luke`; roles and tenant scope
-  derive from it. Anthropic never sees this password, only the issued tokens.
-
-## The parties
-
-1. **AI client + its backend** (e.g. Claude Desktop + claude.ai) — the OAuth
-   *client*. For hosted surfaces the token exchange and token storage happen
-   in the vendor's backend, not on the user's machine.
-2. **MCP server** (Container App) — acts as a stateless **OAuth proxy /
-   authorization-server façade** in front of Entra ID. It is *not* an IdP:
-   it registers clients dynamically (RFC 7591, HMAC-signed stateless
-   `client_id`), enforces the redirect-URI allowlist and PKCE, and exchanges
-   codes at Entra using its confidential client secret.
-3. **Entra ID** — the real identity provider. This is where `adm.luke` lives.
-
-## Full sequence
-
-```
-Claude Desktop        Browser (user's           MCP server              Entra ID
-+ claude.ai backend   DEFAULT browser!)         (OAuth proxy)
-     │                      │                        │                      │
- 1.  │─ POST /mcp ──────────┼───────────────────────▶│ 401 + WWW-Auth       │
- 2.  │─ Discovery ──────────┼───────────────────────▶│ RFC 9728/8414 docs   │
- 3.  │─ POST /oauth/register┼───────────────────────▶│ client_id (HMAC-     │
-     │                      │                        │ signed, embeds the   │
-     │                      │                        │ registered callback) │
-     │                      │                        │                      │
- 4.  │─ opens browser ─────▶│─ GET /oauth/authorize ▶│─ 302 to Entra ──────▶│
-     │                      │  (PKCE challenge)      │  app-reg client_id,  │
-     │                      │                        │  prompt=select_acct  │
-     │                      │                        │                      │
- 5.  │                      │◀── Microsoft sign-in: account picker ────────│
-     │                      │    ➜ user picks adm.luke HERE                │
-     │                      │                        │                      │
- 6.  │                      │◀─ 302 /oauth/callback?code=... ──────────────│
-     │                      │─ code ────────────────▶│ verifies HMAC state, │
-     │                      │                        │ re-checks allowlist  │
-     │                      │◀─ 302 claude.ai/api/mcp/auth_callback?code=..│
-     │                      │                        │                      │
-     │◀═ browser hits claude.ai ═════╗               │                      │
-     │   ➜ the browser MUST have an  │               │                      │
-     │     active claude.ai session  │               │                      │
-     │     as luke — otherwise       │               │                      │
-     │     Anthropic cannot map the  │               │                      │
-     │     code to a user/connector  │               │                      │
-     │     and the connect fails ════╝               │                      │
-     │                      │                        │                      │
- 7.  │─ Anthropic backend: POST /oauth/token ───────▶│─ + client_secret ───▶│
-     │   (code + PKCE verifier)                      │◀─ access + refresh ──│
-     │◀─ tokens (stored server-side at Anthropic, per connector)            │
-     │                      │                        │                      │
- 8.  │─ POST /mcp + Bearer ─┼───────────────────────▶│ validates Entra JWT  │
-     │                      │                        │ ➜ acts as adm.luke   │
-```
-
-## Key properties
-
-* **Step 5 vs. step 6 is the double sign-in.** The whole browser leg runs in
-  the user's *default* browser. That one browser profile needs **both** an
-  active session at the AI product (`luke` at claude.ai — same account as in
-  the desktop app) *and* the Entra sign-in as `adm.luke`. `prompt=
-  select_account` forces the Entra account picker so an existing SSO session
-  for the wrong account cannot be silently reused.
-* **Step 6 is authenticated at the vendor.** `claude.ai/api/mcp/auth_callback`
-  is an authenticated Anthropic endpoint; the authorization code is bound to
-  the Claude user via the browser's claude.ai session cookies. No claude.ai
-  session (or a different browser profile) → the code lands on a login page
-  and the connect stalls, even though the Entra half succeeded. This is the
-  single most common setup failure.
-* **The MCP server is a pure intermediary.** Its client secret never leaves
-  the server; the AI client never talks to Entra directly. The redirect
-  target is checked twice (authorize + callback) against a strict allowlist
-  of exact vendor callback URIs, and the proxy state that transits the
-  user-agent is HMAC-signed with a 10-minute lifetime.
-* **PKCE is end-to-end.** The AI client generates the verifier; the proxy
-  forwards the challenge (step 4) and the verifier (step 7) untouched, and
-  Entra validates the pair. The proxy additionally *requires* S256 PKCE and
-  rejects downgrades.
-* **Tokens are Entra tokens for `adm.luke`** with audience
-  `api://<client_id>/access_as_user`. For hosted surfaces they are stored in
-  the vendor's backend per connector (which is why the connector then works
-  across desktop, web and mobile). Renewal is a silent `refresh_token` grant
-  through the same `/oauth/token` proxy — no account picker again.
-* **Native CLIs skip step 6's hosted callback.** Claude Code, Gemini CLI and
-  VS Code's loopback flow use RFC 8252 `http://localhost:<port>` /
-  `http://127.0.0.1:<port>` redirects instead; there the token exchange runs
-  on the user's machine and no vendor-side session is involved.
-
-## One-line summary
-
-`luke` authenticates the *return path* of the authorization code to the AI
-vendor (step 6); `adm.luke` is the identity *inside* the token that the MCP
-server authorizes on every tool call (step 8).

docs/mcp/docs-corpus.md

@@ -1,305 +0,0 @@
----
-type: Concept
-title: MCP Docs Corpus — search_docs and the Cross-Repo Build Coupling
-description: How the published customer documentation becomes a third semantic search corpus in the MCP server — CRLF-safe heading chunking, build-time embedding, the corpus hash guard, and why editing the docs does not update a running server.
-resource: /src/McpServer/autopilot-monitor-mcp/src/docs-corpus.ts
-tags:
-  - mcp
-  - search
-  - embeddings
-  - documentation
-  - build
-timestamp: 2026-07-21T19:30:00+02:00
----
-
-# Purpose
-
-The MCP server answers two different kinds of question, and they need two
-different corpora.
-
-* *"Why did this enrollment fail?"* → analysis rules, gather rules, IME log
-  patterns. That is `search_knowledge`, backed by `knowledge-base.ts`.
-* *"How do I deploy the agent?" / "Where is my data stored?"* → the published
-  customer documentation. That is `search_docs`, backed by `docs-corpus.ts`.
-
-They are deliberately **separate indexes**. Merged into one, they would compete
-for the same `topK` and dilute each other: a rules query would surface prose
-pages, and a product question would surface rule definitions.
-
-# Schema
-
-## Corpus source
-
-The corpus is the `autopilotmonitor-docs` repository — a public OKF bundle
-published at `docs.autopilotmonitor.com`. It is **not** vendored into this repo.
-The deploy workflow checks it out into `mcp-docs/` of the Docker build context;
-the Dockerfile copies it to `/app/docs` in both the build and the final stage
-(byte-identical, or the boot-time corpus hash rejects the precomputed index).
-
-`SUMMARY.md` and `log.md` are skipped as navigation scaffolding. `index.md` is
-kept — it is the documentation map and answers "what documentation exists" — but
-gets no `url`, because the bundle deliberately keeps it out of `SUMMARY.md` and
-GitBook therefore never renders it.
-
-## Chunking
-
-A whole page cannot be one document: `trust/security-faq.md` is 36 KB, while
-MiniLM-L6-v2 truncates at ~256 tokens. An un-chunked page would silently embed
-only its first paragraph.
-
-Chunks are cut at **h2/h3 headings**, which in this bundle are also the semantic
-boundaries — `security-faq.md` carries 37 h3s, one per question.
-`<details><summary>Q</summary>` blocks (used by `troubleshooting/faq.md`) are
-treated the same way, with the summary as the section title. Each chunk is
-prefixed with a `Page Title › Section › Subsection` breadcrumb so a hit lifted
-out of the middle of a page is self-describing to both the embedder and the
-reader.
-
-Two deliberate exceptions to the ~1500-character budget:
-
-* **Markdown tables are never split.** A table broken across chunks leaves
-  `| --- |` rows with no header — unreadable in a result and meaningless to
-  embed. Tables carry real answers here (the role matrix, the settings
-  reference), so an over-long table is allowed to exceed the budget.
-* **Unbroken lists split at line level.** The changelog pages are one bullet
-  list per release with no blank lines, so paragraph splitting cannot touch
-  them; left whole, everything past the model's window would be truncated away
-  and become unsearchable.
-
-Short sections are **kept**, not filtered. A one-line answer ("Is it free?" →
-"Yes, the Community plan is free") is often the most valuable hit, and the
-breadcrumb supplies the context the short body lacks. Only structural residue
-(under 25 alphanumeric characters) is dropped.
-
-## CRLF is a correctness precondition
-
-The docs repo is authored on Windows and ships CRLF. In JavaScript `.` does not
-match `\r`, so a pattern like `/^(#{2,3})\s+(.*)$/` matches **nothing** on a CRLF
-file: `(.*)` stops before the `\r` and `$` never reaches end-of-string.
-
-This was observed during development, and the failure mode is what makes it
-dangerous: no crash, no error — headings and frontmatter simply stop being
-recognized and every page silently degrades to unlabelled paragraph splits. The
-first working build produced 286 plausible-looking chunks that were almost all
-wrong; after normalizing, `security-faq.md` went from 29 blind splits to 46 real
-question sections.
-
-`normalizeNewlines()` runs before any parsing. Do not remove it, and do not
-"fix" a future parsing bug here by adding `\r?` to one pattern.
-
-## Token windows: why a chunk can hold several vectors
-
-Chunking at heading boundaries keeps sections coherent, but it does not bound the
-result by *tokens* — and it cannot. Measured on this corpus the ratio ranges from
-**2.43 to 5.81 characters per token**, a factor of 2.4, so no character budget maps
-reliably onto the model's 256-token window. A budget safe for the worst case
-(~620 characters) would shred prose and tables alike.
-
-Left alone, 87 of 324 chunks exceeded the window and **13% of all tokens never
-reached the ranking** — silently, since the tokenizer truncates without complaint.
-The effect was concrete: in `built-in-rules.md :: Apps` (734 tokens), the strings
-`ANALYZE-APP-013`, `ANALYZE-OFFICE-001`, `ANALYZE-CORR-003` and `Click-to-Run` all
-sit past the cutoff, so *"proxy configuration blocking app downloads"* did not
-retrieve that section at all.
-
-So the *chunk* stays whole and the *embedding* is split instead:
-`VectorSearchProvider.index()` cuts long text into 250-token windows with 40 tokens
-of overlap and embeds each. A document therefore carries `embeddings: number[][]`,
-and `search()` scores it by its **best** window.
-
-- **Max, not mean.** Averaging window vectors would blur a long section's several
-  topics into one mediocre direction — the same dilution that makes large context
-  windows worse than chunking. Max keeps a document findable by any one thing it
-  discusses.
-- **The tokenizer is a build-time dependency only.** `index()` runs during the
-  Docker build; production boots from precomputed vectors and never loads it. It is
-  also only the vocabulary, not the ONNX weights (~93 ms).
-- Cost: 324 chunks → 424 vectors (+31%), index 2.63 → 3.12 MB, and 424 instead of
-  324 dot products per query — still microseconds.
-- The rules corpus benefits too, unplanned: 128 rules now carry 172 vectors.
-
-Measured effect: token coverage 87% → **100%**, *"Office Click-to-Run install never
-finished"* 0.318 → **0.442**, *"proxy configuration blocking app downloads"* absent
-→ **0.559 at rank 1**. The ten reference queries kept byte-identical scores — their
-chunks are short, hence one window, hence the same vector as before.
-
-## Keyword fallback
-
-Semantic ranking alone leaves a gap: proper nouns embed poorly. `RealmJoin` occurs
-in 3 chunks yet scores under the threshold.
-
-Fuzzy matching is the wrong remedy, and the corpus says so. At a threshold low
-enough to surface `RealmJoin` (0.28), Fuse also returns 5 hits for `SCEPman` — a
-word this corpus contains **zero** times. Literal containment has neither problem.
-
-So when the semantic pass returns fewer than `topK`, `search_docs` tops the list up
-via `lexicalMatch`, the substring scan every provider already exposes:
-
-- Query terms are filtered to distinctive ones (≥4 characters, non-stopword, max 6).
-- A hit needs **corroboration**: at least two matching terms, unless the query has
-  only one. Without this rule, "how do I bake sourdough bread" matched a page about
-  LLM providers, because "bake" is a substring of "baked into the image".
-- Hits are **appended, never merged**: they carry no cosine similarity, so semantic
-  results keep the head of the list and keyword hits fill the tail, flagged
-  `matchType: "keyword"` with `keywordFallback` in the response.
-
-### Language
-
-The corpus and `all-MiniLM-L6-v2` are both English-only, and the failure is total
-rather than gradual: "wo werden meine Daten gespeichert" returns **zero** results,
-not weak ones, because the query vector lands nowhere near any English chunk.
-
-The fix is a sentence in the tool description telling the caller to query in English
-and answer in the user's language — the caller is a language model, so translating
-the question before the call costs nothing. A multilingual embedding model would
-handle it natively but is substantially larger and would need to be measured against
-`scripts/eval-docs-search.ts` first, since it changes English retrieval too.
-`search_knowledge` carries the same note for the same reason.
-
-### When it fires
-
-Two triggers, and the second one exists because the first was not enough:
-
-1. **Fewer than `topK` semantic hits** — the obvious case.
-2. **A weak semantic head** (best score below `WEAK_SEMANTIC_SCORE`, 0.35). Topping
-   up only a short list misses the more common failure: a pasted identifier like
-   `WOW6432Node` returns three chunks at ~0.29 that do not contain the word, while
-   the single chunk that does never gets considered. When nothing semantic is
-   convincing, exact matches take the front — keeping at least one semantic result,
-   so a weak-but-correct hit is never pushed out entirely.
-
-The threshold was chosen by measurement, not intuition. `scripts/eval-docs-search.ts`
-scores strategies over 2465 queries in three classes — every chunk heading
-(known-item, a regression detector), rare identifiers (the class this fallback
-serves), and hand-written questions (the reality anchor, not derived from the
-corpus):
-
-| strategy | known-item | literal | handwritten MRR | fixed | broken |
-| --- | --- | --- | --- | --- | --- |
-| append-only (previous) | 71.9% | 66.2% | 1.000 | — | — |
-| weak < 0.30 | 71.9% | 72.6% | 1.000 | 142 | 0 |
-| **weak < 0.35** | **73.7%** | **81.1%** | **1.000** | **335** | **0** |
-| weak < 0.40 | 76.3% | 88.2% | 0.944 | 502 | 3 |
-| weak < 0.45 | 77.2% | 93.0% | 0.889 | 613 | 5 |
-
-0.35 is strictly dominant: better in every class, worse in none. Higher thresholds
-keep repairing more identifier queries but start demoting hand-written questions —
-the class that most resembles real use — so the gain is not free past that point.
-
-The measurement also corrected the size of the problem: identifier queries were
-succeeding only 66.2% of the time, so `WOW6432Node` was not an outlier but one of
-roughly 750 such failures.
-
-## Build-time embedding
-
-Like the rules corpus, docs are embedded once at Docker build time by
-`precompute-embeddings.js <rulesDir> <outFile> [docsDir]`, into a third
-`PrecomputedSection` (`docs`) of `search-index.json`. The container never embeds
-a corpus at boot — only the incoming query.
-
-The `docs` section is **optional** in the file format, which is what makes a
-local checkout without the docs repo work: `validatePrecomputedIndex` skips it
-when the booting server loaded zero doc chunks. The asymmetry is intentional —
-if the server *has* a docs corpus and the file does *not*, that is staleness and
-is rejected like any other mismatch.
-
-Embeddings are rounded to 6 decimals on serialize. A float64 component
-serializes to ~20 characters of JSON, so 384 dims cost ~7.8 KB per vector;
-rounding roughly halves the index file, which is `JSON.parse`d on every
-scale-to-zero cold start. The induced L2 norm error (~1e-5 over 384 dims) sits
-two orders of magnitude inside `UNIT_NORM_EPSILON`.
-
-## Registration
-
-`search_docs` is registered for **every role**, unlike the platform tools: this
-is public documentation carrying no tenant data, and a tenant user asking "how do
-I deploy the agent" has as much business here as a Global Admin. It is skipped
-entirely when the corpus is empty, so a doc-less build advertises no broken tool.
-
-# Cold start
-
-`minReplicas: 0` means every idle period ends in a cold start someone waits through.
-Measured from outside: **24.5 s** to first byte after `ScaledToZero`, against **60 ms**
-warm.
-
-Where those seconds go could not be answered from outside the process. Log Analytics
-stamps every console line of one ingestion batch with the same time, so the boot
-sequence collapses to a single instant however it is queried. The server therefore
-times itself — `[boot +Nms]` marks from `process.uptime()`, which includes Node's own
-startup and module loading.
-
-Measured in production on a real cold start (31.5 s to first byte that time):
-
-```
-+244ms  node started (startup + module loading)
-+431ms  corpora read from disk         (+187ms)
-+491ms  index read, validated, hydrated (+60ms  <- for 3.12 MB)
-+504ms  listening
-+677ms  query embedder warm            (background)
-```
-
-**The application accounts for half a second of it.** The other ~31 s — 98% — is
-Container Apps activation: KEDA reacting to the request, scheduling a pod, mounting
-the 236 MB image, starting the container. The container also boots *faster* than a
-development laptop (504 ms against 1273 ms), so nothing here is CPU-starved.
-
-Three conclusions, and two of them overturn assumptions this file previously stated:
-
-- **Index size is irrelevant to startup.** 3.12 MB hydrates in 60 ms. Growing the
-  corpus is effectively free, and the embedding rounding earns its keep on file size
-  alone, not on boot time.
-- **Raising the container to 0.5 vCPU was not justified by cold start.** The stated
-  reason was the embedding model load; prebaked, that is 173 ms and runs in the
-  background, where only the first *search* could ever wait on it. The extra vCPU may
-  still help concurrent requests, but the cold-start argument does not survive
-  measurement.
-- **The only real lever is `minReplicas: 1`**, which removes activation entirely at
-  roughly 7× the monthly free consumption grant. Shrinking the image would shave the
-  mount, but that is a fraction of platform time, not the bulk of it.
-
-# Cross-repo coupling
-
-**Editing the documentation does not update a running MCP server.** The corpus is
-baked into the image, so only re-running the *Deploy MCP Server* workflow picks
-up doc changes.
-
-That coupling is made checkable rather than memorable: the build passes the docs
-checkout SHA as `--build-arg DOCS_COMMIT`, and `/health` reports
-`docs: { commit, chunks, sections }`. Comparing that commit against
-`git rev-parse HEAD` in `autopilotmonitor-docs` answers "is the deployed
-documentation stale?" directly.
-
-Automatic redeploy on a docs push was considered and rejected: it would need a
-PAT secret in the docs repo and would turn every typo fix into a container
-deployment.
-
-# Examples
-
-Retrieval measured against the real bundle (323 chunks, all-MiniLM-L6-v2):
-
-```
-"where is my data stored"            → 0.566  troubleshooting/faq.md :: General › Where is my data stored?
-"how do I deploy the agent with Intune" → 0.819  troubleshooting/faq.md :: Setup & Agent › How do I deploy the agent?
-"which roles exist and what can they do" → 0.500  trust/security-faq.md :: Identity and Access › What roles exist?
-"how do I set up Teams notifications"    → 0.592  reference/settings.md  :: Tenant › Notifications
-"what firewall URLs do I need to allow"  → 0.374  reference/network-endpoints.md :: (intro)
-```
-
-The 0.25 `minScore` default is tuned to that observed band — short keyword
-queries on all-MiniLM score low, and a relevant-but-marginal hit lands around
-0.34.
-
-# Citations
-
-* `/src/McpServer/autopilot-monitor-mcp/src/docs-corpus.ts` — loader, frontmatter
-  parser, chunker
-* `/src/McpServer/autopilot-monitor-mcp/src/tools/search.ts` — `search_docs`
-  registration
-* `/src/McpServer/autopilot-monitor-mcp/src/precomputed-index.ts` — `docs`
-  section and its validation asymmetry
-* `/src/McpServer/autopilot-monitor-mcp/Dockerfile` — `mcp-docs/` copy,
-  `DOCS_COMMIT`
-* `/.github/workflows/deploy-mcp.yml` — docs checkout and SHA capture
-* `/src/McpServer/autopilot-monitor-mcp/scripts/eval-docs-search.ts` — retrieval
-  evaluation harness; run it before changing anything about ranking
-* [MCP OAuth Flow](../mcp-oauth-flow.md) — the other MCP concept document

docs/rules/gather-rule-guardrails.md

@@ -1,81 +0,0 @@
----
-type: Concept
-title: Gather Rule Guardrails
-description: >-
-  How gather-rule collectors are fenced in — the allowlists in rules/guardrails.json,
-  the hard blocks that survive unrestricted mode, and why every collector must call a
-  guard rather than trusting rule.Target.
-resource: src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather
-tags: [gather-rules, security, guardrails, agent]
-timestamp: 2026-07-22
----
-
-# Concept
-
-A gather rule is authored by a **tenant administrator** through `POST /api/rules/gather` and executed by the agent as **SYSTEM** on an enrolling device. The backend does not validate `collectorType`, `target`, or `parameters` at all — it only enforces scope/emit-mode fields, a 1 MB body cap, and that the rule lands in the caller's own tenant partition. Everything that decides *what a rule may reach* is therefore enforced **on the agent**, in `GatherRuleGuards`.
-
-This is the security boundary. The portal's `ValidationIndicator` is a convenience: it does not block submit, and the API is reachable directly.
-
-# Schema
-
-Allowlists come from `rules/guardrails.json`, embedded into the agent assembly as
-`AutopilotMonitor.Agent.V2.Core.Resources.guardrails.json` (see the `EmbeddedResource`
-item in `AutopilotMonitor.Agent.V2.Core.csproj`) and regenerated into the portal's
-`utils/guardrails.generated.ts` by `node rules/scripts/combine.js`.
-
-| Guard | Source list | Match rule |
-| --- | --- | --- |
-| `IsRegistryPathAllowed` | `registryPrefixes` | prefix, boundary `\` or end |
-| `IsFilePathAllowed` | `filePrefixes` | `Path.GetFullPath` first, then prefix + boundary |
-| `IsWmiQueryAllowed` | `wmiQueryPrefixes` | prefix, boundary whitespace or end |
-| `IsCommandAllowed` | `allowedCommands` | **exact** match, trimmed — never prefix |
-| `IsEventLogChannelAllowed` | `eventLogChannels` | prefix, boundary `/` or end |
-
-**Hard blocks live in code, not in the JSON**, so a parse error cannot lift them — on a
-parse failure the allowlists fall back to empty and everything is blocked (fail-closed),
-but the hard blocks must hold regardless of configuration:
-
-* `BlockedUsersPrefix` (`C:\Users`) and `AdditionalHardBlockedPathPrefixes`
-  (`C:\Windows\System32\config`) — exception only for `%LOGGED_ON_USER_PROFILE%`
-  under `AppData\Local` / `AppData\Roaming`.
-* `HardBlockedCommandPatterns` — download, user/group creation, boot config,
-  persistence, destructive operations; plus `MaxCommandLength`.
-* `HardBlockedEventLogChannels` — `Security` (audit trail of user behaviour) and the
-  PowerShell channels (script-block logging routinely contains secrets in clear text).
-
-`rules/guardrails.json` mirrors the blocked lists (`blockedFilePrefixes`,
-`blockedEventLogChannels`) **for display only**. Enforcement is the C# constant.
-
-# Examples
-
-Every collector must call its guard and return `context.EmitSecurityWarning(...)` on
-refusal — that emits the `security_warning` event that makes a block visible in the
-timeline instead of failing silently.
-
-```csharp
-// FileCollector / JsonCollector / XmlCollector
-if (!GatherRuleGuards.IsFilePathAllowed(filePath, context.UnrestrictedMode, userProfilePath))
-    return context.EmitSecurityWarning(rule, "file", filePath);
-```
-
-Two collectors were added to this contract on 2026-07-22 after shipping without it:
-
-* **`LogParserCollector`** read any path in `rule.Target`, bypassing even the `C:\Users`
-  hard block. It cannot guard `rule.Target` directly — a wildcard filename makes
-  `Path.GetFullPath` throw — so it guards **the directory** when the filename contains
-  `*`/`?`, and re-guards **each resolved path** after wildcard expansion (a junction can
-  surface a file the directory check did not cover).
-* **`EventLogCollector`** read any channel, including `Security`.
-
-`ImeLogPathOverride` comes only from the local `--ime-log-path` CLI flag, never from
-remote config. The operator using it is already a local admin, so it relaxes the
-allowlist exactly the way unrestricted mode does — hard blocks still apply.
-
-# Citations
-
-* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/GatherRuleGuards.cs`
-* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/GatherRuleContext.cs` — `EmitSecurityWarning`
-* `src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Monitoring/Gather/GatherRuleCollectorGuardTests.cs`
-* `src/Backend/AutopilotMonitor.Functions/Functions/Rules/GatherRulesFunction.cs` — what the backend does *not* validate
-* `rules/guardrails.json`, `rules/scripts/combine.js`
-* Customer-facing counterpart: `autopilotmonitor-docs/rules/gather-rules.md` (§ Security guardrails)

docs/rules/gather-rule-phase-scoping.md

@@ -1,136 +0,0 @@
----
-type: Concept
-title: Gather Rule Phase Scoping, One-Shot Triggers & Emit-on-Change
-description: How gather rules are restricted to enrollment phases (activePhases / activeFromPhase), collect once at a phase boundary (phase_change / phase_exit), and how emitMode "on_change" suppresses repeated identical results.
-resource: /src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/GatherRuleExecutor.cs
-tags:
-  - agent
-  - backend
-  - gather-rules
-  - config
-timestamp: 2026-07-20T00:00:00+02:00
----
-
-# Problem
-
-Interval gather rules (e.g. a registry poll every 60 s) ran during **all** enrollment phases
-and emitted an event on **every** tick — including `exists=false` events while the target key
-did not exist yet. A rule needed only from Account Setup onwards produced hundreds of
-identical noise events per session and wasted collector runs.
-
-# Schema
-
-Three opt-in fields on `GatherRule` (Shared model, `rules/schema/gather-rule.schema.json`,
-delivered to the agent via `GET agent/config`; ConfigVersion 34). Absent fields = legacy
-behavior — full back-compat.
-
-| Field | Type | Semantics |
-|---|---|---|
-| `activePhases` | `string[]` \| null | Rule runs only while the current phase is in the list. Null/empty = unrestricted. |
-| `activeFromPhase` | `string` \| null | Sticky latch: activates when the phase first reaches the threshold, then stays active for the rest of the session — including through `Failed`. Null = unrestricted. |
-| `emitMode` | `"always"` \| `"on_change"` \| null | `on_change`: poll on the trigger cadence, emit only when the collected result changes. Null/`always` = emit every collection (legacy). |
-
-Canonical phase tokens are the `EnrollmentPhase` enum **names** `Start`(0) …`Complete`(7).
-Backend validation (`GatherRulesFunction.ValidateScopeAndEmitMode`) rejects `Unknown`/`Failed`,
-numeric tokens, unknown emit modes, and both scope fields set at once (400). The agent
-defensively prefers `activePhases` if both arrive anyway.
-
-# One-shot collection at phase boundaries
-
-Scoping answers "while *may* this rule run". The trigger answers "when does it fire". For
-one-shot collection the two phase triggers are the bookends of a phase:
-
-| Trigger | Fires |
-|---|---|
-| `phase_change` | Once when `triggerPhase` is **entered** (dedup key `{ruleId}\|{phase}`). |
-| `phase_exit` | Once when `triggerPhase` is **left** (dedup key `exit:{ruleId}\|{phase}`). |
-
-Empty `triggerPhase` means every transition. Both keys live in the same
-`_phaseRulesExecuted` set; the `exit:` prefix keeps the two key spaces disjoint, so an
-enter-rule and an exit-rule on the same phase never cannibalise each other's slot.
-
-`phase_exit` semantics that are easy to get wrong:
-
-* It is evaluated **before** `_currentPhase` advances, so both the `triggerPhase` match and
-  the phase-scope gate see the phase being **left**. A rule scoped to `DeviceSetup` therefore
-  still fires on its own exit, even though the phase being entered is outside that scope.
-* A transition into `Failed` **does** fire the exit rules of the failing phase — capturing
-  state at the failure boundary is the point.
-* Exit of `Unknown` never fires (nothing was entered yet), and a repeated identical phase
-  signal is not a transition.
-* An exit rule on `Complete` only fires if something transitions *away* from Complete. For
-  "at the end of enrollment", use `phase_change` on `Complete` or `on_event` with
-  `enrollment_complete`.
-* Old agents do not know the trigger value and simply never fire the rule (silent no-op) —
-  which is why `phase_exit` needs no ConfigVersion bump: no new field is transported.
-
-# Scope semantics (agent, `GatherRuleExecutor`)
-
-* Scope applies to **all trigger types**:
-  * `interval` — timers keep running; an out-of-scope tick is a free early-return (no
-    start/stop lifecycle races on phase transitions).
-  * `startup` — a scoped startup rule not yet in scope at `UpdateRules` is **deferred**: it
-    runs exactly once from `OnPhaseChanged` when its scope activates (same
-    `_startupRulesExecuted` dedup; it is not part of the `WaitForStartupRules` latch).
-  * `phase_change` — evaluated against the **new** phase; the scope gate runs before the
-    per-(rule, phase) dedup so an out-of-scope pass does not consume the execution slot.
-  * `on_event` — gated by the current phase.
-* **Before the first phase signal** of a session (`_currentPhase == Unknown`) scoped rules are
-  inactive. Sessions that never produce phase signals never run them (documented behavior).
-* **From-phase latch**: activates when `phase != Unknown && phase != Failed && (int)phase >=
-  (int)fromPhase`. `Failed=99` would ordinal-satisfy every threshold, hence the explicit
-  exclusion — but once latched, a rule stays active through `Failed`. A config refresh that
-  delivers a from-phase rule after its threshold passed latches it immediately.
-* `--run-gather-rules` (diagnostic CLI) sets `IgnorePhaseScope = true` — no phase context
-  exists there, scoped rules execute unconditionally (log line marks the bypass).
-
-# Emit-on-change semantics
-
-* The collector result dict is canonically hashed (keys ordinal-sorted at every nesting
-  level, invariant value formatting, SHA-256) **before** `ruleId`/`ruleTitle` injection.
-* First in-scope non-empty result always emits — on an absent registry key that first
-  `exists=false` event *is* the visible "we're polling now" indicator.
-* Unchanged results increment a per-rule suppression counter; the next emitted event carries
-  `suppressedPolls` + `suppressedSinceUtc` in its `Data` so the gap is observable.
-* Composition with `emitOnlyIfExists=true` (collector-level): a miss returns an empty dict —
-  no emit AND no hash update. Result: zero noise while absent, one event on appearance, then
-  only on change.
-* State is in-memory and survives `UpdateRules` config refreshes; an agent restart causes at
-  most one re-emit per rule (acceptable under the per-enrollment lifecycle).
-* Volatile collectors (eventlog timestamps, logparser positions) degrade `on_change` to
-  `always` — every poll hashes differently. The option stays visible for them since some
-  outputs are stable; this is documented, not hidden.
-
-# Portal & delivery
-
-* Create form defaults new rules to `emitMode: "on_change"`; existing rules load as
-  `always`. The scope UI is a three-way mode (always / during phases / from phase) backed by
-  a canonical `GATHER_PHASES` list — the same list replaced the free-text `triggerPhase`
-  input, whose placeholder used to suggest invalid tokens.
-* **Controls are shown only where they change behavior** (`supportsPhaseScope` /
-  `supportsEmitMode` in `types.ts`). Offering all three "when" controls unconditionally
-  produced meaningless combinations — a scope on a `phase_change` rule naming a concrete
-  phase can only ever suppress the single firing, and `on_change` has no second result to
-  compare against. Hidden controls are nulled by `buildScopeFields` so state from an earlier
-  trigger choice cannot leak into the payload, and `validateScopeSelection` rejects a scope
-  mode that was selected but left unfilled (which previously serialised to null and silently
-  ran the rule everywhere while the form still read "From a phase onwards").
-  Startup is the deliberate exception: a scope there defers the one-shot rather than
-  suppressing it, so the scope control stays while emit mode is hidden.
-* The custom-rule toggle PUT (`{enabled, isBuiltIn, isCommunity}`) previously full-replaced
-  the stored rule and wiped Title/Target/Trigger — `GatherRuleService.UpdateRuleAsync` now
-  merges toggle-style partials (empty Title/CollectorType/Target) into the existing row and
-  preserves `CreatedAt` on full edits. This fix is a prerequisite: without it every toggle
-  would silently clear the new fields.
-* Old agents (Newtonsoft) ignore unknown config properties: scoped rules run everywhere,
-  `emitMode` is ignored — graceful degradation until the fleet rolls forward.
-* `ContentEquivalent` treats null and empty `activePhases` as equal, so pre-existing DB rows
-  (absent columns → null) never diff against seeds — no reseed churn.
-
-# Citations
-
-* `src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Telemetry/Gather/GatherRuleExecutor.cs` — scope gates, latch, canonical hash
-* `src/Backend/AutopilotMonitor.Functions/Functions/Rules/GatherRulesFunction.cs` — `ValidateScopeAndEmitMode`
-* `src/Backend/AutopilotMonitor.Functions/Services/GatherRuleService.cs` — partial-PUT merge, `ContentEquivalent`
-* `src/Shared/AutopilotMonitor.Shared/Models/Rules/GatherRule.cs` — field contracts
-* Tests: `GatherRuleExecutorPhaseScopeTests`, `GatherRuleExecutorEmitModeTests` (agent); `GatherRuleUpdatePartialMergeTests`, `GatherRuleScopeFieldsTests` (backend)

docs/url-registry.md

@@ -1,85 +0,0 @@
----
-type: Concept
-title: URL Registry — One Place per Component, Guard-Enforced
-description: Every well-known own or Microsoft host lives in exactly one registry file per component (Constants.cs, utils/config.ts, src/config.ts); guard tests fail the build on any literal outside them. Includes the agent-download host migration to the download alias.
-resource: /src/Shared/AutopilotMonitor.Shared/Constants.cs
-tags:
-  - architecture
-  - urls
-  - ci
-  - convention
-timestamp: 2026-07-23T00:00:00+02:00
----
-
-# URL Registry
-
-Every well-known base URL — own hosts (portal, www, docs, download alias, MCP,
-API, both blob accounts) and Microsoft hosts (Graph, Entra login) — is defined
-in exactly one registry file per component. Code references the constant; the
-literal appears nowhere else.
-
-| Component | Registry | Guard test |
-|---|---|---|
-| C# (Shared/Backend/Agent) | `AutopilotMonitor.Shared.Constants` (`*BaseUrl`) | `HardcodedUrlGuardTests` |
-| Web | `utils/config.ts` (`DOCS_URL`, `SITE_URL`, `PORTAL_URL`, `ENTRA_LOGIN_URL`, `API_URL_PROD`, `BLOB_URL_PROD`, `AGENT_DOWNLOAD_HOSTNAMES`) | `utils/__tests__/hardcodedUrls.guard.test.ts` |
-| MCP | `src/config.ts` (`API_BASE_URL`, `ENTRA_LOGIN_BASE_URL`, `DOCS_BASE_URL`) | `src/__tests__/hardcoded-urls.guard.test.ts` |
-
-Derived registries build on these instead of repeating hosts:
-`lib/hostRouting.ts` computes `PUBLIC_HOST`/`PORTAL_HOST`/`APEX_HOST` from the
-URL constants, and `middleware.ts` imports from it.
-
-# Schema
-
-The guards scan non-test source for the enforced host list and fail with
-file:line on any occurrence outside the registry. Comment lines are ignored
-(docs may cite URLs). Test files are excluded on purpose: a literal in a test
-is an independent oracle — `ValidateBootstrapCodeResponseShapeTests` spells the
-full agent download URL out so a registry change must be acknowledged in two
-places, backend and portal allow-list, consciously.
-
-Why enforced rather than agreed: the registry existed before (both
-`Constants.AgentBlobBaseUrl` and the MCP `config.ts` header document earlier
-drift), yet the EU cutover still missed two literal copies of the blob host —
-`LatestVersionsService` and `ValidateBootstrapCodeFunction` kept reading the
-legacy account, silently kept alive only by the fail-soft legacy mirror in
-`build-agent.yml`. A convention that is not checked decays; these guards make
-the next stray literal a red build instead of a production surprise.
-
-# Agent-download host migration (2026-07-23)
-
-The two legacy readers above plus the agent's `SelfUpdater` now use
-`Constants.AgentDownloadBaseUrl` (`download.autopilotmonitor.com/agent`, Front
-Door in front of the current blob origin — verified serving `version.json`,
-`version-v2.json` and both ZIPs before the switch). The portal's
-`bootstrapValidation.ts` allow-lists BOTH the alias and the legacy blob host
-(`AGENT_DOWNLOAD_HOSTNAMES`) because bootstrap scripts already deployed in
-customer Intune tenants still carry legacy URLs.
-
-Deploy-order constraint: the web allow-list must be live BEFORE (or with) the
-backend that serves alias URLs — an old portal build rejects the alias host and
-the bootstrap flow dies client-side. Remove the legacy hostname from the
-allow-list only after the legacy account is torn down.
-
-**Front Door caching is a correctness hazard here, not a staleness nuisance.**
-The first release after the migration exposed it: the alias kept serving the
-previous `version.json` (`X-Cache: TCP_REMOTE_HIT`) while the origin was already
-updated — and because manifest and ZIP are independent cache entries, a stale
-manifest paired with a fresh ZIP fails the bootstrap's SHA-256 check. Two
-defenses, both in place since 2026-07-23: route caching on `/agent/*` is
-DISABLED, and every blob upload (CI `Send-Blob`, local `build.ps1`, the
-`versions/*.json` manifests) stamps `Cache-Control: no-cache` — all these blobs
-rotate in place, even the per-line ZIP. If caching is ever re-enabled, the
-headers keep the mismatch class impossible.
-
-Deliberately still on the legacy account: the `HealthCheckService` /
-`MaintenanceService` legacy-keepalive probes and the fail-soft mirror in
-`build-agent.yml` — they exist precisely to keep already-deployed customer
-bootstrap scripts working until the customer migration completes.
-
-# Citations
-
-- `src/Shared/AutopilotMonitor.Shared/Constants.cs` — C# registry
-- `src/Web/autopilot-monitor-web/utils/config.ts` — web registry
-- `src/McpServer/autopilot-monitor-mcp/src/config.ts` — MCP registry
-- `src/Backend/AutopilotMonitor.Functions.Tests/HardcodedUrlGuardTests.cs`
-- [Version Contract](versioning.md) — the release pipeline this migration protects

docs/versioning.md

@@ -1,108 +0,0 @@
----
-type: Concept
-title: Version Contract — Agent, Backend, MCP
-description: One version shape for all three shipping components, the ETag-CAS counter blob that mints build numbers, and the published manifests that make "what is deployed" checkable from outside.
-resource: /.github/scripts/Request-BuildNumber.ps1
-tags:
-  - build
-  - ci
-  - release
-  - versioning
-timestamp: 2026-07-22T00:00:00+02:00
----
-
-# Version Contract
-
-Three components ship from this repository — the agent, the Functions backend and the
-MCP server. They share one version shape, one way of minting build numbers, and one
-manifest format, so that a version string means the same thing whoever emits it.
-
-```
-version   = <major>.<minor>.<build>    major.minor curated by hand, build minted per build
-commit    = 7-char short SHA of this repo
-buildUtc  = ISO-8601 build moment
-```
-
-| Component | major.minor from | Counter blob | Reported by |
-|---|---|---|---|
-| Agent V2 | `VersionPrefix` in `AutopilotMonitor.Agent.V2.csproj` | `agent/buildcounter-v2.txt` | `agent/version.json` |
-| Backend | `VersionPrefix` in `AutopilotMonitor.Functions.csproj` | `versions/backend.txt` | `GET /api/health` |
-| MCP | `version` in `package.json` | `versions/mcp.txt` | `GET /health`, MCP handshake |
-
-# Schema
-
-## Build numbers — reserve before build, ETag-CAS
-
-`.github/scripts/Request-BuildNumber.ps1` is the only implementation; the CI
-workflows and the local `build.ps1` all call it.
-
-1. Anonymous `GET` on the counter blob → value `N` and `ETag`. The blob holds the
-   **last used** number as plain text and is public-read; only the write needs the
-   container SAS.
-2. `PUT N+1` with `If-Match: <etag>`. The quoted ETag form is required — PowerShell
-   strips the quotes on read, and an unquoted `If-Match` is rejected client-side.
-3. `412 Precondition Failed` → a concurrent build reserved first → re-read and retry
-   (5 attempts, linear backoff).
-4. Build with the reserved number.
-
-Reserving *before* the build is what makes concurrent minting impossible. **A failed
-build burns a number** — deliberate: uniqueness matters, density does not.
-
-Why a counter and not the published manifest: manifests are written on publish, not on
-build. The agent writes `version.json` only for stable releases, so deriving the next
-number from it would hand two consecutive dev builds the same number and let the second
-overwrite the first's artifact. A state-free scheme such as `git rev-list --count HEAD`
-fails for the same reason — two builds of one commit collide.
-
-**Seeding** (once per component): `PUT <last used number>` with `If-None-Match: *`, so
-an existing counter can never be clobbered. Agent V2 was seeded with `1356` on
-2026-07-17; `versions/backend.txt` with `999` and `versions/mcp.txt` with `299` on
-2026-07-22.
-
-## Local builds
-
-No counter is reached, the build number stays `0`, and the commit is empty or
-`unknown`. A `1.5.0` with no commit hash on `/api/health` is therefore a developer
-machine, not a release — the fallback is the signal, not a defect. The agent is the
-exception: `build.ps1` produces uploadable artifacts and reserves a real number unless
-`-SkipUpload` is passed.
-
-## Manifests
-
-`versions/backend.json` and `versions/mcp.json` (public-read) record what is deployed:
-
-```json
-{ "component": "backend", "version": "1.5.1000", "commit": "abc1234",
-  "buildUtc": "…", "deployedUtc": "…", "runId": "…" }
-```
-
-The MCP manifest adds `docsCommit`, because for that component "which build" and "which
-documentation" are separate questions.
-
-Each is written **last and only after the deploy workflow has polled the component's
-health endpoint until it reports that exact version and commit**. A green deploy step
-alone means the package was accepted, not that it is being served. Consequently a
-manifest that disagrees with the live endpoint means the running instance drifted after
-the fact (rollback, stale revision) rather than a half-finished pipeline.
-
-The agent keeps its own manifest at `agent/version.json` — the bootstrap derives that
-URL from the download URL and verifies the ZIP against its `sha256`, so it cannot move.
-It carries the same `commit` and `buildUtc` fields; `sha256` and `bootstrapVersion`
-remain, being the customer-facing integrity contract.
-
-# Consequences
-
-- Bumping `major.minor` is a human decision, made in the component's own file
-  (`VersionPrefix`, or `version` in `package.json`). Nothing bumps it automatically.
-- A new component joins by seeding a counter blob and calling the same script; no new
-  mechanism.
-- The counter blobs and manifests live in the `versions` container on
-  `autopilotmonitoreu` (writes via `AZURE_BLOB_VERSIONS_SAS_TOKEN`). The agent's
-  counter stays in the `agent` container next to the artifacts it numbers.
-
-# Citations
-
-- `.github/scripts/Request-BuildNumber.ps1` — the CAS protocol
-- `.github/workflows/deploy-backend.yml`, `deploy-mcp.yml` — reserve, verify, publish
-- `.github/workflows/build-agent.yml`, `scripts/Deployment/build.ps1` — agent line
-- [Build Counter Blob](agent/build-counter-blob.md) — agent-specific consequences

docs/web/portal-navigation-prefetch.md

@@ -1,88 +0,0 @@
----
-type: Concept
-title: Portal Navigation Prefetch & the SWA Runtime Bottleneck
-description: Why every navigation Link in the portal sets prefetch={false} — the App Router's viewport prefetch fires one RSC request per visible link against an HTTP/1.1 Static Web Apps runtime, and its latency tail starves the connection pool that serves the document and the route chunks.
-resource: src/Web/autopilot-monitor-web/components/GlobalSidebar.tsx
-tags:
-  - web
-  - performance
-  - nextjs
-  - static-web-apps
-  - observability
-timestamp: 2026-07-27T18:00:00+02:00
----
-
-# Context
-
-The portal is a Next.js 15 App Router application hosted on Azure Static Web Apps. Every page under
-the authenticated shell is a client component behind `ProtectedRoute` that fetches its own data from
-the Function App (`autopilotmonitor-api-eu`) after mount. The RSC payload a route returns on
-navigation therefore carries no page data — only the shell.
-
-`GlobalSidebar` and `Navbar` render the full navigation on every page. With the App Router's default
-prefetch behaviour, each visible `<Link>` triggers a background `GET /<route>?_rsc=<hash>` as soon as
-it enters the viewport.
-
-# Mechanism
-
-Three properties combine into a portal-wide freeze:
-
-1. **Fan-out.** The navigation is fully rendered on each page load, so a single navigation issues one
-   RSC request per visible link — measured at ~10,400 requests over 14 days.
-2. **Shared origin over HTTP/1.1.** `portal.autopilotmonitor.com` serves the document, the JS route
-   chunks *and* the RSC payloads, and it negotiates HTTP/1.1 — not HTTP/2. Browsers cap concurrent
-   connections per origin at six.
-3. **A heavy latency tail on the SSR runtime.** RSC responses are prerendered and edge-cached
-   (`x-nextjs-cache: HIT`, `s-maxage=31536000`), so the median is fast. On a cache miss or cold start
-   the Static Web Apps managed runtime queues them.
-
-When the tail hits, the in-flight prefetches hold all six connections. The document request and the
-route chunks of the page the user actually wants then have no socket available, and the tab shows a
-loading spinner or a blank page until the queue drains. Nothing fails — the requests eventually
-return `200`, which is why the failure leaves no error trace anywhere.
-
-# Evidence
-
-Incident of 2026-07-27, 17:25–17:29 CEST. Browser-side dependencies during the freeze:
-
-| Request | Duration | Status |
-| --- | --- | --- |
-| `/admin/presence?_rsc=…` | 151,461 ms | 200 |
-| `/gather-rules?_rsc=…` | 52,283 ms | 200 |
-| `/progress?_rsc=…` | 37,878 ms | 200 |
-| `/analyze-rules?_rsc=…` | 37,559 ms | 200 |
-| `/audit?_rsc=…` | 37,539 ms | 200 |
-| Backend API, same window | 1,600–2,200 ms | 200 |
-
-The three ~37.5 s responses complete within 340 ms of each other — a queue draining, not independent
-slow requests. The corresponding `browserTimings` row for `/geographic-performance` reports
-`networkDuration` = 16 ms against `processingDuration` = 225,095 ms: the network delivered the
-document immediately and the browser then waited nearly four minutes for the `load` event.
-
-Fourteen-day distribution of RSC prefetches: n = 10,428, p50 = 91 ms, p95 = 896 ms, max = 234,230 ms,
-38 over 10 s, 21 over 30 s.
-
-# Diagnosing this class of problem
-
-The backend Application Insights resource is the wrong place to look — a freeze appears there as an
-*absence* of requests, never as an error. Browser telemetry lives in a **separate** Application
-Insights resource addressed by `AUTOPILOT_MONITOR_WEB_APPINSIGHTS_ID`, which the MCP
-`query_backend_logs` tool does not reach. Query it through
-`.claude/commands/scripts/query-appinsights.sh` with that ID exported, and read `dependencies`
-(client-side fetches, including RSC prefetches) and `browserTimings` (the network/processing split of
-a document load).
-
-# Contract
-
-Navigation `<Link>` elements in `GlobalSidebar` and `Navbar` set `prefetch={false}`. The prefetched
-RSC payload buys nothing for these routes, so the only remaining cost of a click is the route's JS
-chunk, which the browser caches after first use.
-
-Do not remove the prop to "speed up navigation" without first re-measuring the tail in the web
-Application Insights resource — the prefetch is cheap only while the runtime is warm.
-
-# Citations
-
-* `src/Web/autopilot-monitor-web/components/GlobalSidebar.tsx` — nav link rendering, rationale comment
-* `src/Web/autopilot-monitor-web/components/Navbar.tsx` — top-bar and notification links
-* [SWA and Oryx node pinning](../architecture.md) — hosting model for the web app

infra/mcp-server.bicep

@@ -1,268 +0,0 @@
-// Autopilot-Monitor MCP Server — Azure Container App Infrastructure
-//
-// Reconciled against the live deployment on 2026-07-21 (rg-autopilotmonitor-prd-gwc,
-// Germany West Central). The template had drifted behind two changes made directly
-// in Azure: the EU cutover (registry/API renamed) and the ACR hardening (admin user
-// disabled, image pull moved to the app's system-assigned identity).
-//
-// !! BEFORE RE-DEPLOYING THIS TEMPLATE, READ THIS !!
-// The live app carries an ingress custom-domain binding for mcp.autopilotmonitor.com
-// (SNI-enabled, with a managed certificate). Custom domains are NOT modelled below,
-// because the certificate is bound out-of-band. A full template deployment would
-// therefore REMOVE that binding and take the public MCP endpoint offline.
-// For routine changes (CPU/memory, env vars, image) prefer the surgical CLI form:
-//   az containerapp update -n autopilotmonitor-mcp -g rg-autopilotmonitor-prd-gwc --cpu 0.5 --memory 1.0Gi
-// Treat this file as the documented desired state and as a rebuild-from-scratch
-// recipe — not as a routinely-applied deployment.
-//
-// On a FROM-SCRATCH deploy the AcrPull assignment below is created only after the
-// Container App exists (it needs the app's principalId), so the very first revision
-// can fail to pull its image. Re-run the deployment, or restart the revision, once
-// the role assignment has propagated. This does not affect updates to a live app.
-//
-// Deploy (two-stage; required to set the OAuth public URL safely):
-//   1. First deploy without mcpPublicUrl:
-//      az deployment group create \
-//        --resource-group <rg-name> \
-//        --template-file infra/mcp-server.bicep \
-//        --parameters apiUrl=https://autopilotmonitor-api.azurewebsites.net \
-//                     entraClientSecret=<secret-value>
-//      This emits `containerAppUrl` as an output (e.g. https://autopilotmonitor-mcp.<env-suffix>.<region>.azurecontainerapps.io).
-//
-//   2. Re-deploy with that URL pinned, so the OAuth proxy never trusts caller-
-//      supplied X-Forwarded-Host / Host headers when building issuer / WWW-
-//      Authenticate / redirect_uri metadata:
-//        --parameters mcpPublicUrl=<containerAppUrl from step 1>
-//
-//   When mcpPublicUrl is set, the MCP server uses it verbatim and ignores any
-//   forwarded-headers from the request. Without it, the server logs a startup
-//   warning and falls back to header-derived URLs (acceptable for local dev,
-//   not for production).
-
-@description('Azure region for all resources')
-param location string = resourceGroup().location
-
-@description('Name of the Container App')
-param containerAppName string = 'autopilotmonitor-mcp'
-
-@description('Name of the Container App Environment')
-param environmentName string = 'autopilotmonitor-env'
-
-@description('Name of the Log Analytics Workspace (dedicated for Container Apps)')
-param logAnalyticsName string = 'autopilotmonitor-container-logs'
-
-@description('Name of the Azure Container Registry')
-param acrName string = 'autopilotmonitoreuacr'
-
-@description('Backend API URL')
-param apiUrl string = 'https://autopilotmonitor-api-eu.azurewebsites.net'
-
-@description('Container image tag')
-param imageTag string = 'latest'
-
-@description('Entra ID app registration client_id used for the OAuth proxy. Public value (appears in JWT aud claim); not a secret.')
-param entraClientId string = '1a400946-62c1-4ab4-aa37-f730ac89704d'
-
-@secure()
-@description('Entra ID client secret for OAuth token exchange')
-param entraClientSecret string = ''
-
-@description('Comma-separated allowlist of redirect_uri hosts for the OAuth proxy. Loopback is always allowed. Empty = built-in default (Anthropic, OpenAI, Google).')
-param mcpAllowedRedirectHosts string = ''
-
-@description('Public URL of the MCP server, used verbatim for OAuth issuer / WWW-Authenticate / redirect metadata. REQUIRED in production: the container refuses to boot without it (host-spoofing defense — see config.ts). Set on the second deploy with the value of the containerAppUrl output from the first deploy. The stage-1 deploy is safe because minReplicas=0 means no container runs until this is pinned. Empty falls back to X-Forwarded-Host headers only outside production (NODE_ENV != production).')
-param mcpPublicUrl string = ''
-
-@secure()
-// NOTE: avoid characters outside cp1252 here (this one used to say a Unicode
-// >=). `az bicep build --stdout` writes through the Windows console codec and
-// dies with a UnicodeEncodeError on anything it cannot map. Em dashes are fine.
-@description('Base64-encoded HMAC key (>=32 bytes after decode) for signing the OAuth proxy state. Naming and format match the backend\'s PaginationTokenSigningKey for consistency. Empty = generate per-instance random key on startup (acceptable for single-replica deployments since state has 10 min lifetime). Generate with PowerShell: [Convert]::ToBase64String([Security.Cryptography.RandomNumberGenerator]::GetBytes(32))')
-param oAuthStateSigningKey string = ''
-
-@description('Enable structured tool-call logging to stderr (queryable via Container App Logs)')
-param toolLoggingEnabled bool = false
-
-// --- Azure Container Registry ---
-
-// Admin user is DISABLED: a registry-wide username/password pair is a static,
-// non-rotating credential that would also have to live in a Container App secret.
-// The app pulls with its system-assigned identity + AcrPull instead (see below).
-resource acr 'Microsoft.ContainerRegistry/registries@2023-07-01' = {
-  name: acrName
-  location: location
-  sku: {
-    name: 'Basic'
-  }
-  properties: {
-    adminUserEnabled: false
-  }
-}
-
-// AcrPull for the Container App's system-assigned identity — this is what replaces
-// the admin credentials. Without it the app cannot pull its own image.
-//
-// NOTE: this assignment exists on the live registry but could not be enumerated
-// during reconciliation (the CLI session lacks Microsoft.Authorization read), so it
-// is reproduced here from the documented pattern rather than read back from Azure.
-// Verify with:
-//   az role assignment list --scope <acr-id> --assignee <containerApp principalId>
-var acrPullRoleId = '7f951dda-4ed3-4680-a7ca-43fe172d538d'
-
-resource acrPull 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
-  scope: acr
-  name: guid(acr.id, containerAppName, acrPullRoleId)
-  properties: {
-    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', acrPullRoleId)
-    principalId: containerApp.identity.principalId
-    principalType: 'ServicePrincipal'
-  }
-}
-
-// --- Log Analytics Workspace (required by Container App Environment) ---
-
-resource logAnalytics 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
-  name: logAnalyticsName
-  location: location
-  properties: {
-    sku: {
-      name: 'PerGB2018'
-    }
-    retentionInDays: 30
-  }
-}
-
-// --- Container App Environment ---
-
-resource environment 'Microsoft.App/managedEnvironments@2024-03-01' = {
-  name: environmentName
-  location: location
-  properties: {
-    appLogsConfiguration: {
-      destination: 'log-analytics'
-      logAnalyticsConfiguration: {
-        customerId: logAnalytics.properties.customerId
-        sharedKey: logAnalytics.listKeys().primarySharedKey
-      }
-    }
-  }
-}
-
-// --- Container App ---
-
-resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
-  name: containerAppName
-  location: location
-  // System-assigned identity: the credential the app uses to pull from the ACR
-  // (see the AcrPull assignment above). Replaces the former admin-user secret.
-  identity: {
-    type: 'SystemAssigned'
-  }
-  properties: {
-    managedEnvironmentId: environment.id
-    configuration: {
-      ingress: {
-        external: true
-        targetPort: 8080
-        transport: 'auto'
-        allowInsecure: false
-      }
-      // 'system' = pull with the app's system-assigned identity. No username, no
-      // password secret — nothing to rotate and nothing to leak from the app config.
-      registries: [
-        {
-          server: acr.properties.loginServer
-          identity: 'system'
-        }
-      ]
-      secrets: [
-        {
-          name: 'entra-client-secret'
-          value: entraClientSecret
-        }
-        {
-          name: 'oauth-state-signing-key'
-          value: oAuthStateSigningKey
-        }
-      ]
-      activeRevisionsMode: 'Single'
-    }
-    template: {
-      containers: [
-        {
-          name: 'mcp-server'
-          image: '${acr.properties.loginServer}/${containerAppName}:${imageTag}'
-          // 0.5 vCPU, but NOT for the reason originally given. It was raised from
-          // 0.25 to shorten the scale-to-zero cold start, on the assumption that
-          // loading the ONNX embedding model dominated it. Measurement disproved
-          // that: the app boots in 504 ms in production (see the [boot] marks in
-          // the container log and docs/mcp/docs-corpus.md), of which the prebaked
-          // embedder is 173 ms in the background. Of a 31 s cold start, ~98% is
-          // Container Apps activation — pod scheduling, image mount, container
-          // start — which no CPU setting touches.
-          //
-          // It stays at 0.5 because it plausibly helps CONCURRENT requests
-          // (maxReplicas is 1, so one replica serves up to 10 in-flight calls) and
-          // because at scale-to-zero the container bills only while active, making
-          // the difference negligible. If cold start ever needs to actually go
-          // away, the only lever is minReplicas: 1. Container Apps accepts fixed
-          // CPU/memory pairs, so memory moves with the CPU.
-          resources: {
-            cpu: json('0.5')
-            memory: '1.0Gi'
-          }
-          env: [
-            { name: 'AUTOPILOT_API_URL', value: apiUrl }
-            { name: 'PORT', value: '8080' }
-            { name: 'AUTOPILOT_ENTRA_CLIENT_ID', value: entraClientId }
-            { name: 'AUTOPILOT_ENTRA_CLIENT_SECRET', secretRef: 'entra-client-secret' }
-            { name: 'MCP_ALLOWED_REDIRECT_HOSTS', value: mcpAllowedRedirectHosts }
-            { name: 'MCP_PUBLIC_URL', value: mcpPublicUrl }
-            { name: 'OAuthStateSigningKey', secretRef: 'oauth-state-signing-key' }
-            { name: 'MCP_TOOL_LOGGING', value: toolLoggingEnabled ? 'true' : 'false' }
-          ]
-          probes: [
-            {
-              type: 'Liveness'
-              httpGet: {
-                path: '/health'
-                port: 8080
-              }
-              periodSeconds: 30
-              initialDelaySeconds: 10
-            }
-            {
-              type: 'Readiness'
-              httpGet: {
-                path: '/health'
-                port: 8080
-              }
-              periodSeconds: 10
-              initialDelaySeconds: 5
-            }
-          ]
-        }
-      ]
-      scale: {
-        minReplicas: 0
-        maxReplicas: 1
-        rules: [
-          {
-            name: 'http-scaler'
-            http: {
-              metadata: {
-                concurrentRequests: '10'
-              }
-            }
-          }
-        ]
-      }
-    }
-  }
-}
-
-// --- Outputs ---
-
-output containerAppUrl string = 'https://${containerApp.properties.configuration.ingress.fqdn}'
-output mcpEndpoint string = 'https://${containerApp.properties.configuration.ingress.fqdn}/mcp'
-output acrLoginServer string = acr.properties.loginServer

rules/analyze/ANALYZE-APP-001.json

@@ -5,8 +5,12 @@
   "description": "Detects when a Win32 app detection script fails or returns unexpected results.",
   "severity": "warning",
   "category": "apps",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed"
+  ],
   "baseConfidence": 60,
   "conditions": [
     {
@@ -34,5 +38,9 @@
       ]
     }
   ],
-  "tags": ["apps", "detection", "win32"]
+  "tags": [
+    "apps",
+    "detection",
+    "win32"
+  ]
 }

rules/analyze/ANALYZE-APP-002.json

@@ -5,8 +5,13 @@
   "description": "Detects app installation failures with specific exit codes or HRESULT error codes and suggests fixes.",
   "severity": "high",
   "category": "apps",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed",
+    "on_event:app_install_failed"
+  ],
   "baseConfidence": 80,
   "conditions": [
     {
@@ -36,5 +41,9 @@
       ]
     }
   ],
-  "tags": ["apps", "msi", "error-code"]
+  "tags": [
+    "apps",
+    "msi",
+    "error-code"
+  ]
 }

rules/analyze/ANALYZE-APP-003.json

@@ -6,6 +6,10 @@
   "severity": "high",
   "category": "apps",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed"
+  ],
   "baseConfidence": 70,
   "conditions": [
     {
@@ -29,5 +33,9 @@
       ]
     }
   ],
-  "tags": ["apps", "dependency"]
+  "tags": [
+    "apps",
+    "dependency"
+  ],
+  "version": "1.1.0"
 }

rules/analyze/ANALYZE-APP-004.json

@@ -5,8 +5,13 @@
   "description": "Detects when disk space is critically low during enrollment, which can cause app installation failures. Confidence increases when app installations actually failed while disk space was low.",
   "severity": "critical",
   "category": "apps",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed",
+    "on_event:app_install_failed"
+  ],
   "baseConfidence": 75,
   "conditions": [
     {
@@ -36,8 +41,16 @@
     }
   ],
   "confidenceFactors": [
-    { "signal": "app_failed", "condition": "exists", "weight": 15 },
-    { "signal": "enrollment_failed", "condition": "exists", "weight": 10 }
+    {
+      "signal": "app_failed",
+      "condition": "exists",
+      "weight": 15
+    },
+    {
+      "signal": "enrollment_failed",
+      "condition": "exists",
+      "weight": 10
+    }
   ],
   "explanation": "Performance monitoring shows disk free space dropped below 5 GB during enrollment. This can cause app installation failures, especially for large Win32 apps.\n\nIf app installations failed in the same session while free space was low, treat storage exhaustion as the likely contributing cause — the confidence score of this finding is raised accordingly. Verify the individual app failures for their concrete error codes before concluding storage was the only cause.",
   "remediation": [
@@ -58,5 +71,9 @@
       ]
     }
   ],
-  "tags": ["apps", "disk-space", "critical"]
+  "tags": [
+    "apps",
+    "disk-space",
+    "critical"
+  ]
 }

rules/analyze/ANALYZE-APP-005.json

@@ -6,6 +6,10 @@
   "severity": "high",
   "category": "apps",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed"
+  ],
   "baseConfidence": 70,
   "conditions": [
     {
@@ -29,5 +33,10 @@
       ]
     }
   ],
-  "tags": ["apps", "download", "timeout"]
+  "tags": [
+    "apps",
+    "download",
+    "timeout"
+  ],
+  "version": "1.1.0"
 }

rules/analyze/ANALYZE-APP-006.json

@@ -5,8 +5,12 @@
   "description": "Detects when the same app installation is attempted 3 or more times during one enrollment — a retry loop caused by unhonored reboot requests, repeated failures, or detection mismatches.",
   "severity": "high",
   "category": "apps",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed"
+  ],
   "baseConfidence": 70,
   "conditions": [
     {
@@ -31,5 +35,10 @@
       ]
     }
   ],
-  "tags": ["apps", "reboot", "retry", "loop"]
+  "tags": [
+    "apps",
+    "reboot",
+    "retry",
+    "loop"
+  ]
 }

rules/analyze/ANALYZE-APP-007.json

@@ -5,7 +5,13 @@
   "description": "Detects when the app tracking summary reports multiple failed app installations.",
   "severity": "high",
   "category": "apps",
+  "version": "1.2.0",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed",
+    "on_event:app_install_failed"
+  ],
   "baseConfidence": 75,
   "conditions": [
     {
@@ -16,10 +22,22 @@
       "operator": "gte",
       "value": "2",
       "required": true
+    },
+    {
+      "signal": "enrollment_failed",
+      "source": "event_type",
+      "eventType": "enrollment_failed",
+      "operator": "exists",
+      "value": "",
+      "required": false
     }
   ],
   "confidenceFactors": [
-    { "signal": "enrollment_failed", "condition": "exists", "weight": 15 }
+    {
+      "signal": "enrollment_failed",
+      "condition": "exists",
+      "weight": 15
+    }
   ],
   "explanation": "The app tracking summary reports 2 or more failed app installations during enrollment. This suggests a systemic issue rather than an isolated app failure.",
   "remediation": [
@@ -32,5 +50,9 @@
       ]
     }
   ],
-  "tags": ["apps", "summary", "multiple-failures"]
+  "tags": [
+    "apps",
+    "summary",
+    "multiple-failures"
+  ]
 }

rules/analyze/ANALYZE-APP-008.json

@@ -6,6 +6,10 @@
   "severity": "warning",
   "category": "apps",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed"
+  ],
   "baseConfidence": 70,
   "conditions": [
     {
@@ -28,5 +32,11 @@
       ]
     }
   ],
-  "tags": ["apps", "performance", "slow-install", "warning"]
+  "tags": [
+    "apps",
+    "performance",
+    "slow-install",
+    "warning"
+  ],
+  "version": "1.1.0"
 }

rules/analyze/ANALYZE-APP-012.json

@@ -6,6 +6,10 @@
   "severity": "warning",
   "category": "apps",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed"
+  ],
   "trigger": "correlation",
   "baseConfidence": 80,
   "conditions": [
@@ -34,7 +38,17 @@
     }
   ],
   "relatedDocs": [
-    { "title": "Win32 app return codes in Intune", "url": "https://learn.microsoft.com/en-us/mem/intune/apps/apps-win32-app-management#step-4-return-codes" }
+    {
+      "title": "Win32 app return codes in Intune",
+      "url": "https://learn.microsoft.com/en-us/mem/intune/apps/apps-win32-app-management#step-4-return-codes"
+    }
   ],
-  "tags": ["apps", "enforcement", "exit-code", "unmapped", "resolved"]
+  "tags": [
+    "apps",
+    "enforcement",
+    "exit-code",
+    "unmapped",
+    "resolved"
+  ],
+  "version": "1.1.0"
 }

rules/analyze/ANALYZE-APP-013.json

@@ -5,8 +5,12 @@
   "description": "Detects when the Enrollment Status Page failed because Intune could not verify an app was installed (HRESULT 0x87D1041C). The installer ran but the detection rule did not match afterwards.",
   "severity": "critical",
   "category": "apps",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed"
+  ],
   "baseConfidence": 90,
   "preconditions": [
     {
@@ -69,8 +73,20 @@
     }
   ],
   "relatedDocs": [
-    { "title": "Microsoft Learn: Troubleshoot Windows Autopilot ESP error codes", "url": "https://learn.microsoft.com/en-us/autopilot/troubleshoot-tsg" },
-    { "title": "Win32 app detection rules in Intune", "url": "https://learn.microsoft.com/en-us/mem/intune/apps/apps-win32-add#step-4-detection-rules" }
+    {
+      "title": "Microsoft Learn: Troubleshoot Windows Autopilot ESP error codes",
+      "url": "https://learn.microsoft.com/en-us/autopilot/troubleshoot-tsg"
+    },
+    {
+      "title": "Win32 app detection rules in Intune",
+      "url": "https://learn.microsoft.com/en-us/mem/intune/apps/apps-win32-add#step-4-detection-rules"
+    }
   ],
-  "tags": ["apps", "detection", "esp", "0x87d1041c", "intune"]
+  "tags": [
+    "apps",
+    "detection",
+    "esp",
+    "0x87d1041c",
+    "intune"
+  ]
 }

rules/analyze/ANALYZE-APP-014.json

@@ -5,8 +5,12 @@
   "description": "Detects when the Enrollment Status Page failed on the Apps subcategory and the agent's AppX deployment log scan identified a suspected MSIX/Store package. Store/MSIX apps install outside the Win32 pipeline, so the regular per-app tracking sees nothing — this correlation names the likely culprit.",
   "severity": "warning",
   "category": "apps",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed"
+  ],
   "baseConfidence": 75,
   "preconditions": [
     {
@@ -35,6 +39,51 @@
       "operator": "regex",
       "value": "^0x80073[cd]",
       "required": false
+    },
+    {
+      "signal": "appx_esp_category",
+      "source": "event_data",
+      "eventType": "esp_appx_failure_analysis",
+      "dataField": "espCategory",
+      "operator": "exists",
+      "value": "",
+      "required": false
+    },
+    {
+      "signal": "appx_esp_errorcode",
+      "source": "event_data",
+      "eventType": "esp_appx_failure_analysis",
+      "dataField": "espErrorCode",
+      "operator": "exists",
+      "value": "",
+      "required": false
+    },
+    {
+      "signal": "appx_top_candidate_package",
+      "source": "event_data",
+      "eventType": "esp_appx_failure_analysis",
+      "dataField": "topCandidatePackage",
+      "operator": "exists",
+      "value": "",
+      "required": false
+    },
+    {
+      "signal": "appx_candidate_count",
+      "source": "event_data",
+      "eventType": "esp_appx_failure_analysis",
+      "dataField": "candidateCount",
+      "operator": "exists",
+      "value": "",
+      "required": false
+    },
+    {
+      "signal": "appx_scan_confidence",
+      "source": "event_data",
+      "eventType": "esp_appx_failure_analysis",
+      "dataField": "confidence",
+      "operator": "exists",
+      "value": "",
+      "required": false
     }
   ],
   "explanation": "The ESP **{{espCategory}}/Apps** subcategory failed with HRESULT **{{espErrorCode}}** — an error from the AppX/MSIX deployment stack, i.e. a **Microsoft Store / MSIX app**, not a Win32 app. These apps install via the EnterpriseModernAppManagement CSP and never appear in the IME Win32 sidecar logs, which is why all tracked Win32/WinGet apps in this session can look green while ESP still reports an Apps failure.\n\nThe agent scanned the AppXDeploymentServer event log during the failure settle window and identified **{{topCandidatePackageName}}** (package `{{topCandidatePackage}}`) as the most likely culprit — its deployment error matches the ESP failure code ({{candidateCount}} candidate(s) total, confidence: {{confidence}}).\n\n**This is a correlation-based assessment, not a confirmed root cause** — validate against the AppXDeploymentServer/Operational event log on the device or in the diagnostics archive before acting.",
@@ -65,8 +114,21 @@
     }
   ],
   "relatedDocs": [
-    { "title": "Microsoft Learn: Troubleshoot Windows Autopilot ESP error codes", "url": "https://learn.microsoft.com/en-us/autopilot/troubleshoot-tsg" },
-    { "title": "Add Microsoft Store apps to Intune", "url": "https://learn.microsoft.com/en-us/mem/intune/apps/store-apps-microsoft" }
+    {
+      "title": "Microsoft Learn: Troubleshoot Windows Autopilot ESP error codes",
+      "url": "https://learn.microsoft.com/en-us/autopilot/troubleshoot-tsg"
+    },
+    {
+      "title": "Add Microsoft Store apps to Intune",
+      "url": "https://learn.microsoft.com/en-us/mem/intune/apps/store-apps-microsoft"
+    }
   ],
-  "tags": ["apps", "appx", "msix", "store", "esp", "0x80073cf9"]
+  "tags": [
+    "apps",
+    "appx",
+    "msix",
+    "store",
+    "esp",
+    "0x80073cf9"
+  ]
 }

rules/analyze/ANALYZE-APP-015.json

@@ -0,0 +1,80 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-APP-015",
+  "title": "Required App Never Settled — ESP Completion Deferred",
+  "description": "The IME reported its user-session completion line, but at least one required app stayed pending — without ever failing or even starting to install — so the agent kept deferring the enrollment completion signal. Typically an assignment/requirement problem (requirement rules never met, dependency never satisfied, or the app needs a context that is not available during ESP, e.g. a VPN client waiting for user sign-in to a portal).",
+  "severity": "high",
+  "category": "apps",
+  "version": "1.0.0",
+  "author": "Autopilot Monitor",
+  "enabled": true,
+  "trigger": "correlation",
+  "baseConfidence": 60,
+  "confidenceThreshold": 55,
+  "preconditions": [
+    {
+      "source": "event_data",
+      "eventType": "enrollment_complete",
+      "operator": "not_exists",
+      "description": "Suppress when the pending app eventually settled and the enrollment completed — a transient deferral is normal."
+    },
+    {
+      "source": "event_data",
+      "eventType": "enrollment_failed",
+      "operator": "not_exists",
+      "description": "Suppress when the session failed explicitly — the app/ESP failure rules already cover that path; this rule targets the never-finishing case."
+    }
+  ],
+  "conditions": [
+    {
+      "signal": "completion_deferred",
+      "source": "event_type",
+      "eventType": "agent_trace",
+      "dataField": "message",
+      "operator": "contains",
+      "value": "completion signal deferred",
+      "required": true
+    },
+    {
+      "signal": "apps_pending",
+      "source": "event_data",
+      "eventType": "app_tracking_summary",
+      "dataField": "pending",
+      "operator": "gte",
+      "value": "1",
+      "required": true
+    },
+    {
+      "signal": "pending_app_names",
+      "source": "event_data",
+      "eventType": "app_tracking_summary",
+      "dataField": "pendingNames",
+      "operator": "exists",
+      "value": "",
+      "required": false
+    }
+  ],
+  "confidenceFactors": [
+    { "signal": "pending_app_names", "condition": "exists", "weight": 5 }
+  ],
+  "explanation": "The Intune Management Extension wrote its user-session completion line, but the agent observed `{{pending}}` required app(s) still pending (`{{pendingNames}}`) and therefore **deferred the enrollment completion signal** — repeatedly, if this happened across several logons or reboots.\n\nA pending app that never transitions to downloading/installing and never fails is almost always an **assignment or requirement problem**, not an install error:\n\n- requirement rules that are never met on this device (OS/architecture/registry/script checks),\n- an unsatisfied dependency or supersedence chain,\n- an app targeted as *required* for the user ESP that needs something unavailable during provisioning (e.g. a VPN client whose portal sign-in only happens after first logon),\n- user-targeted apps on a device where the user identity never fully registered (see the hybrid user-affinity rule if it also fired).",
+  "remediation": [
+    {
+      "title": "Identify and unblock the pending app",
+      "steps": [
+        "Check the app names listed in this finding's evidence (pendingNames) — these are the apps the ESP is waiting for.",
+        "In Intune, review the app's requirement rules and dependencies; test them on the device (IntuneManagementExtension.log logs each requirement evaluation).",
+        "Decide whether the app really must block the ESP: removing it from the ESP's 'blocking apps' list (or making it not-required during enrollment) unblocks completion immediately.",
+        "If the app is user-targeted on a hybrid-joined device, verify the user's Entra affinity first — without a signed-in Entra user, user-targeted policy never applies."
+      ]
+    }
+  ],
+  "relatedDocs": [
+    {
+      "title": "Microsoft Learn: Enrollment Status Page — blocking apps",
+      "url": "https://learn.microsoft.com/en-us/intune/intune-service/enrollment/windows-enrollment-status"
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": ["apps", "esp", "completion", "assignment", "pending"]
+}

rules/analyze/ANALYZE-APP-016.json

@@ -0,0 +1,113 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-APP-016",
+  "title": "Required Apps Never Started — ESP Apps Gate Starved",
+  "description": "One or more required user-ESP apps never started installing while the ESP AccountSetup apps gate waited on them — the agent observed the ESP page exit with those apps still in a non-terminal, never-started state. Unlike ANALYZE-APP-015 (which reports that completion was DEFERRED because of a pending app, and stays silent once the session reaches a terminal verdict) this rule reports the delivery gap itself and fires regardless of the final outcome: an enrollment that Windows called done while required apps never ran is a successful enrollment with missing software, and the operator must see it.",
+  "severity": "warning",
+  "category": "apps",
+  "version": "1.0.0",
+  "author": "Autopilot Monitor",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed",
+    "on_event:session_stalled"
+  ],
+  "trigger": "single",
+  "baseConfidence": 75,
+  "confidenceThreshold": 70,
+  "conditions": [
+    {
+      "signal": "starved_apps_present",
+      "source": "event_count",
+      "eventType": "app_install_starved",
+      "operator": "count_gte",
+      "value": "1",
+      "required": true
+    },
+    {
+      "signal": "many_starved_apps",
+      "source": "event_count",
+      "eventType": "app_install_starved",
+      "operator": "count_gte",
+      "value": "5",
+      "required": false
+    },
+    {
+      "signal": "appName",
+      "source": "event_type",
+      "eventType": "app_install_starved",
+      "dataField": "appName",
+      "operator": "exists",
+      "value": "",
+      "required": false
+    },
+    {
+      "signal": "state",
+      "source": "event_type",
+      "eventType": "app_install_starved",
+      "dataField": "state",
+      "operator": "exists",
+      "value": "",
+      "required": false
+    }
+  ],
+  "confidenceFactors": [
+    {
+      "signal": "many_starved_apps",
+      "condition": "exists",
+      "weight": 15
+    },
+    {
+      "signal": "appName",
+      "condition": "exists",
+      "weight": 10
+    }
+  ],
+  "explanation": "At least one **required** app assigned to the user ESP never started installing. The Intune Management Extension never moved it out of its initial state (`{{state}}`) — it did not download, did not install, and did not fail — while the ESP AccountSetup apps gate was waiting on it. First app observed: `{{appName}}`.\n\nEvery starved app has its own `app_install_starved` timeline event carrying `appId`, `appName` and `state` — open the timeline and filter on that event type for the complete list.\n\nThis is a **delivery** problem, not an install error, and it is invisible in the Intune console: the app simply never appears. Typical causes:\n\n- far more required apps targeted at the ESP than the gate can service in the available window,\n- requirement rules that are never met on this device (OS / architecture / registry / script checks),\n- an unsatisfied dependency or supersedence chain,\n- an app that needs a context unavailable during provisioning (e.g. a VPN client waiting on a portal sign-in),\n- a mid-ESP reboot that cut the gate short — check whether the mid-ESP reboot advisory also fired for this session.\n\nNote that this finding is independent of the session verdict. A session can be marked **Succeeded** and still be missing every app listed here.",
+  "remediation": [
+    {
+      "title": "Shrink the ESP blocking set",
+      "steps": [
+        "Open the Enrollment Status Page profile and review the blocking app list — every required app there must finish before the user reaches the desktop.",
+        "Move apps that do not have to be present at first logon from *required* to *available*, or remove them from the ESP's blocking apps selection.",
+        "Prefer a small, deliberately chosen blocking set (security agent, VPN, management tooling) over the full application catalogue."
+      ]
+    },
+    {
+      "title": "Unblock the individual apps",
+      "steps": [
+        "Collect the app names from the `app_install_starved` timeline events in this session.",
+        "For each app, review its requirement rules and dependencies in Intune — IntuneManagementExtension.log records every requirement evaluation.",
+        "Verify the assignment actually targets the signed-in user (user-targeted apps need an established Entra user affinity; check the hybrid user-affinity finding if it also fired).",
+        "Re-run an enrollment and confirm the apps now reach a terminal state before the ESP exits."
+      ]
+    },
+    {
+      "title": "Rule out a truncated gate",
+      "steps": [
+        "Check whether a mid-ESP reboot was observed for this session — a forced restart during AccountSetup cuts the apps gate short and can starve everything still queued.",
+        "If so, reassign the reboot-forcing device policies to user groups so the restart lands after AccountSetup."
+      ]
+    }
+  ],
+  "relatedDocs": [
+    {
+      "title": "Microsoft Learn: Enrollment Status Page — blocking apps",
+      "url": "https://learn.microsoft.com/en-us/intune/intune-service/enrollment/windows-enrollment-status"
+    },
+    {
+      "title": "Microsoft Learn: Win32 app requirement rules",
+      "url": "https://learn.microsoft.com/en-us/intune/intune-service/apps/apps-win32-add"
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "apps",
+    "esp",
+    "starvation",
+    "assignment",
+    "blocking",
+    "delivery-gap"
+  ]
+}

rules/analyze/ANALYZE-APP-017.json

@@ -0,0 +1,92 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-APP-017",
+  "title": "App Install Blocked by Another Installer (0x80070652)",
+  "description": "Detects Win32 app installs that failed because the Windows Installer was busy with another installation (HRESULT 0x80070652 / MSI exit code 1618, ERROR_INSTALL_ALREADY_RUNNING). The IME retries on a fixed budget (~15-17 minutes across several attempts) and then reports the app as failed; when the app is ESP-blocking, the Device Setup Apps subcategory terminates with it.",
+  "severity": "high",
+  "category": "apps",
+  "version": "1.0.0",
+  "author": "Autopilot Monitor",
+  "enabled": true,
+  "baseConfidence": 70,
+  "conditions": [
+    {
+      "signal": "mutex_blocked_install",
+      "source": "event_type",
+      "eventType": "app_install_failed",
+      "dataField": "hresultFromWin32",
+      "operator": "equals",
+      "value": "-2147023278",
+      "required": true
+    },
+    {
+      "signal": "installer_exit_1618",
+      "source": "event_data",
+      "eventType": "app_install_failed",
+      "dataField": "exitCode",
+      "operator": "equals",
+      "value": "1618",
+      "required": false
+    },
+    {
+      "signal": "esp_failed_with_mutex_code",
+      "source": "event_data",
+      "eventType": "esp_failure_settle_started",
+      "dataField": "errorCode",
+      "operator": "equals",
+      "value": "0x80070652",
+      "required": false
+    }
+  ],
+  "confidenceFactors": [
+    {
+      "signal": "installer_exit_1618",
+      "condition": "exists",
+      "weight": 10
+    },
+    {
+      "signal": "esp_failed_with_mutex_code",
+      "condition": "exists",
+      "weight": 20
+    }
+  ],
+  "confidenceThreshold": 65,
+  "explanation": "App **{{appName}}** failed to install because the Windows Installer service was already busy with another installation — HRESULT **0x80070652** / MSI exit code **1618** (`ERROR_INSTALL_ALREADY_RUNNING`). Only one Windows Installer transaction can run at a time; the Intune Management Extension retried on its fixed budget (typically ~15-17 minutes across several attempts) and then reported the app as failed. If this app is required in the Enrollment Status Page, the Device Setup Apps subcategory fails with it and the enrollment terminates.\n\nThis failure is **deterministic per attempt**: as long as the competing installer keeps winning the race, a plain re-enrollment fails again at roughly the same minute mark — retrying without fixing the collision only churns devices.\n\nCommon sources of the competing installation:\n\n- The **preceding Win32 app in the install order**: its installer exits 0 (so IME moves on) but leaves a child `msiexec` transaction or post-install MSI work running. Security agents and proxy clients that chain multiple MSIs are frequent offenders.\n- **OEM factory software** installing on first boot (factory-image provisioning packages, vendor updaters) — typical on brand-new hardware batches.\n- **Microsoft 365 Apps (C2R), driver updaters or Windows servicing** running installations in parallel outside IME's control.",
+  "remediation": [
+    {
+      "title": "Identify the competing installer",
+      "steps": [
+        "In this session's timeline, note which app finished installing immediately before {{appName}} started — its installer is the prime suspect for holding the Windows Installer mutex",
+        "On a reproduction device, when the failure window is active, check for running installers: Get-Process msiexec | Select-Object Id,StartTime and the in-progress marker key HKLM\\SOFTWARE\\Microsoft\\Windows\\Installer\\InProgress",
+        "Check the Application event log for MsiInstaller events around the failure timestamp to see which product held the transaction",
+        "On factory-fresh hardware, also look for OEM first-boot installers (vendor updater services, factory provisioning packages) that run outside Intune"
+      ]
+    },
+    {
+      "title": "Serialize the install chain",
+      "steps": [
+        "Add an Intune Win32 dependency so {{appName}} depends on the app whose installer causes the collision — IME then orders them explicitly instead of racing",
+        "Alternatively, wrap the offending predecessor so its install script waits until msiexec has fully finished (poll the InProgress registry key or the _MSIExecute mutex with a bounded timeout) before exiting",
+        "If the app does not have to gate the ESP, remove it from the blocking-app list so a transient 1618 no longer terminates the enrollment; Intune retries it after the desktop"
+      ]
+    }
+  ],
+  "relatedDocs": [
+    {
+      "title": "Microsoft Learn: MsiExec.exe error messages (1618 = another installation is in progress)",
+      "url": "https://learn.microsoft.com/en-us/windows/win32/msi/error-codes"
+    },
+    {
+      "title": "Microsoft Learn: Troubleshoot Win32 app installations in Intune",
+      "url": "https://learn.microsoft.com/en-us/troubleshoot/mem/intune/app-management/troubleshoot-win32-app-install"
+    }
+  ],
+  "tags": [
+    "apps",
+    "msiexec",
+    "mutex",
+    "0x80070652",
+    "1618",
+    "esp"
+  ]
+}

rules/analyze/ANALYZE-CORR-003.json

@@ -5,8 +5,13 @@
   "description": "Correlates an active proxy configuration with app content download failures (Delivery Optimization timeout or download error), suggesting the proxy is blocking or throttling Intune content delivery.",
   "severity": "high",
   "category": "apps",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed",
+    "on_event:app_install_failed"
+  ],
   "trigger": "correlation",
   "baseConfidence": 60,
   "conditions": [
@@ -30,8 +35,16 @@
     }
   ],
   "confidenceFactors": [
-    { "signal": "app_install_failed", "condition": "count >= 2", "weight": 15 },
-    { "signal": "enrollment_failed", "condition": "count >= 1", "weight": 10 }
+    {
+      "signal": "app_install_failed",
+      "condition": "count >= 2",
+      "weight": 15
+    },
+    {
+      "signal": "enrollment_failed",
+      "condition": "count >= 1",
+      "weight": 10
+    }
   ],
   "confidenceThreshold": 50,
   "explanation": "A proxy (explicit or PAC-based) is configured on this device and app content downloads failed (Delivery Optimization timeout or download content error). Proxies can block or throttle downloads from *.delivery.mp.microsoft.com and other Intune CDN endpoints.\n\nThis is a common root cause when app downloads fail consistently on proxy-connected corporate networks. Note this rule only fires when the failure is download-related — generic app install errors behind a proxy do not trigger it.",
@@ -54,5 +67,12 @@
       ]
     }
   ],
-  "tags": ["correlation", "apps", "proxy", "network", "download", "root-cause"]
+  "tags": [
+    "correlation",
+    "apps",
+    "proxy",
+    "network",
+    "download",
+    "root-cause"
+  ]
 }

rules/analyze/ANALYZE-DEV-002.json

@@ -5,8 +5,12 @@
   "description": "Detects when memory usage stays above 90% across at least 3 performance snapshots during enrollment, indicating sustained memory pressure that can cause app installation failures or system instability.",
   "severity": "warning",
   "category": "device",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed"
+  ],
   "baseConfidence": 55,
   "conditions": [
     {
@@ -38,8 +42,16 @@
     }
   ],
   "confidenceFactors": [
-    { "signal": "app_failed", "condition": "exists", "weight": 20 },
-    { "signal": "enrollment_failed", "condition": "exists", "weight": 15 }
+    {
+      "signal": "app_failed",
+      "condition": "exists",
+      "weight": 20
+    },
+    {
+      "signal": "enrollment_failed",
+      "condition": "exists",
+      "weight": 15
+    }
   ],
   "explanation": "Memory usage exceeded 90% in at least 3 performance snapshots during this enrollment — sustained pressure, not a single transient spike. Persistent high memory usage can cause app installation failures, system slowdowns, and ESP timeouts, especially on devices with 8 GB RAM installing several apps concurrently.",
   "remediation": [
@@ -53,5 +65,9 @@
       ]
     }
   ],
-  "tags": ["device", "memory", "performance"]
+  "tags": [
+    "device",
+    "memory",
+    "performance"
+  ]
 }

rules/analyze/ANALYZE-DEV-003.json

@@ -5,8 +5,12 @@
   "description": "Detects devices enrolling with an OS build that has reached end of support: Windows 11 22H2 (build 22621) or older, which includes every Windows 10 build. Maintenance note: raise the build cutoff to 22631 after Windows 11 23H2 reaches end of support on 2026-11-10.",
   "severity": "warning",
   "category": "device",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed"
+  ],
   "baseConfidence": 90,
   "conditions": [
     {
@@ -52,5 +56,11 @@
       "url": "https://learn.microsoft.com/en-us/lifecycle/products/windows-11-home-and-pro"
     }
   ],
-  "tags": ["device", "os-version", "end-of-support", "windows-11", "windows-10"]
+  "tags": [
+    "device",
+    "os-version",
+    "end-of-support",
+    "windows-11",
+    "windows-10"
+  ]
 }

rules/analyze/ANALYZE-DEV-004.json

@@ -5,8 +5,13 @@
   "description": "Detects a Windows quality/cumulative update that FAILED to install during the OOBE / ESP enrollment window (WindowsUpdateClient EventID 20). A cumulative update failing mid-OOBE is a known cause of enrollment errors and is otherwise invisible in the Intune console.",
   "severity": "high",
   "category": "device",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed",
+    "on_event:windows_update_failed"
+  ],
   "trigger": "single",
   "baseConfidence": 70,
   "confidenceThreshold": 60,
@@ -65,8 +70,16 @@
     }
   ],
   "confidenceFactors": [
-    { "signal": "enrollment_failed", "condition": "exists", "weight": 20 },
-    { "signal": "reboot_pending", "condition": "exists", "weight": 10 }
+    {
+      "signal": "enrollment_failed",
+      "condition": "exists",
+      "weight": 20
+    },
+    {
+      "signal": "reboot_pending",
+      "condition": "exists",
+      "weight": 10
+    }
   ],
   "explanation": "A Windows Update failed to install during enrollment: **{{updateTitle}}** (error {{hresult}} {{hresultSymbol}}). Windows can install quality/cumulative updates during OOBE (the \"Getting updates\" screen and the ESP \"Install Windows quality updates during OOBE\" option). When one of these fails mid-enrollment it can leave the device in an inconsistent state, force an unexpected reboot, or block the Enrollment Status Page — a failure mode that is otherwise only discoverable by deep manual digging on the device.",
   "remediation": [
@@ -87,5 +100,10 @@
     }
   ],
   "markSessionAsFailedDefault": false,
-  "tags": ["device", "windows-update", "oobe", "servicing"]
+  "tags": [
+    "device",
+    "windows-update",
+    "oobe",
+    "servicing"
+  ]
 }

rules/analyze/ANALYZE-DEV-005.json

@@ -5,8 +5,12 @@
   "description": "Informational: a Windows quality/cumulative update installed during the OOBE / ESP enrollment window (WindowsUpdateClient EventID 19). Surfaces updates applied mid-enrollment — useful context when correlating enrollment duration, reboots, or later issues with a specific KB.",
   "severity": "info",
   "category": "device",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed"
+  ],
   "trigger": "single",
   "baseConfidence": 60,
   "confidenceThreshold": 50,
@@ -39,7 +43,11 @@
     }
   ],
   "confidenceFactors": [
-    { "signal": "reboot_pending", "condition": "exists", "weight": 15 }
+    {
+      "signal": "reboot_pending",
+      "condition": "exists",
+      "weight": 15
+    }
   ],
   "explanation": "One or more Windows updates installed during enrollment (e.g. **{{updateTitle}}**). This is normal when Windows Update runs during OOBE, but it extends enrollment time and can trigger a reboot mid-ESP. Track it when correlating enrollment duration or reboot count with a specific cumulative update, or when a device behaves differently after a particular KB landed during provisioning.",
   "remediation": [
@@ -53,5 +61,9 @@
     }
   ],
   "markSessionAsFailedDefault": false,
-  "tags": ["device", "windows-update", "oobe"]
+  "tags": [
+    "device",
+    "windows-update",
+    "oobe"
+  ]
 }

rules/analyze/ANALYZE-DEV-006.json

@@ -5,8 +5,12 @@
   "description": "Informational: the OS build (CurrentBuild.UBR) changed across a reboot during enrollment — an update was installed, regardless of which servicing path delivered it. Deterministic corroboration that works even when the Windows Update event channel shows nothing (registry comparison across restart cannot be lost to timing or logging-path differences).",
   "severity": "info",
   "category": "device",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed"
+  ],
   "trigger": "single",
   "baseConfidence": 70,
   "confidenceThreshold": 50,
@@ -47,7 +51,11 @@
     }
   ],
   "confidenceFactors": [
-    { "signal": "wu_channel_blind", "condition": "exists", "weight": 10 }
+    {
+      "signal": "wu_channel_blind",
+      "condition": "exists",
+      "weight": 10
+    }
   ],
   "explanation": "The OS build changed from **{{previousBuild}}** to **{{currentBuild}}** across a reboot during enrollment — a Windows update was installed mid-provisioning. This is normal when quality updates run during OOBE, but it adds a reboot and extends enrollment time. If a windows_update_channel_census event is also present, the update installed via a servicing path the Windows Update watcher does not capture yet — its EventID histogram tells which IDs to enable.",
   "remediation": [
@@ -61,5 +69,10 @@
     }
   ],
   "markSessionAsFailedDefault": false,
-  "tags": ["device", "windows-update", "oobe", "reboot"]
+  "tags": [
+    "device",
+    "windows-update",
+    "oobe",
+    "reboot"
+  ]
 }

rules/analyze/ANALYZE-DEV-007.json

@@ -2,12 +2,16 @@
   "$schema": "../schema/analyze-rule.schema.json",
   "ruleId": "ANALYZE-DEV-007",
   "title": "System Clock Skew — TPM Attestation and ESP Timeout Risk",
-  "description": "The device's real-time clock deviates from NTP by more than two minutes. Microsoft documents that a clock off by several minutes causes TPM attestation errors (self-deploying/pre-provisioning) and ESP timeouts. Knowledge source: docs/agent/autopilot-ztd-diagnostics.md.",
+  "description": "The device's real-time clock deviates from NTP by more than two minutes. Microsoft documents that a clock off by several minutes causes TPM attestation errors (self-deploying/pre-provisioning) and ESP timeouts.",
   "severity": "warning",
   "category": "device",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "author": "Autopilot Monitor",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed"
+  ],
   "trigger": "single",
   "baseConfidence": 55,
   "confidenceThreshold": 50,
@@ -55,5 +59,12 @@
     }
   ],
   "markSessionAsFailedDefault": false,
-  "tags": ["device", "ntp", "clock-skew", "tpm", "esp", "known-issue"]
+  "tags": [
+    "device",
+    "ntp",
+    "clock-skew",
+    "tpm",
+    "esp",
+    "known-issue"
+  ]
 }

rules/analyze/ANALYZE-DEV-008.json

@@ -0,0 +1,69 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-DEV-008",
+  "title": "Device Clock Wrong During Enrollment — Jump or Sustained Offset",
+  "description": "The device's clock changed by five or more minutes mid-session (clock jump) or ran five or more minutes off server time for the whole session (sustained offset), measured against the server receive frame of every uploaded event. Complements ANALYZE-DEV-007, which is a one-shot NTP check at agent startup and misses devices where NTP was unreachable or the clock changed later. IME-log-derived events are excluded from the measurement.",
+  "severity": "warning",
+  "category": "device",
+  "version": "1.0.0",
+  "author": "Autopilot Monitor",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed"
+  ],
+  "trigger": "single",
+  "baseConfidence": 60,
+  "confidenceThreshold": 50,
+  "conditions": [
+    {
+      "signal": "clock_jump",
+      "source": "clock_skew",
+      "skewMetric": "clock_jump",
+      "operator": "gte",
+      "value": "300",
+      "required": false
+    },
+    {
+      "signal": "sustained_offset",
+      "source": "clock_skew",
+      "skewMetric": "sustained_offset",
+      "operator": "gte",
+      "value": "300",
+      "required": false
+    }
+  ],
+  "confidenceFactors": [],
+  "explanation": "This device's {{skewSummary}} (five-minute threshold). A clock that is off by five or more minutes breaks time-sensitive enrollment mechanisms: Kerberos tolerates at most 5 minutes of skew (Hybrid Join), Entra ID token validation allows about 5 minutes on token lifetimes, and freshly issued SCEP/PKCS certificates can be rejected as \"not yet valid\" when the clock is more than ~10 minutes behind the CA.\n\nUnlike ANALYZE-DEV-007 (a one-shot NTP comparison at agent startup), this finding is measured across the whole session against the server's receive time — it also catches devices where the NTP check could not run (UDP 123 blocked) or where the clock changed after startup (time sync correcting a wrong RTC, Windows auto-timezone, manual change).",
+  "remediation": [
+    {
+      "title": "Fix the device clock and time source",
+      "steps": [
+        "Check the BIOS/RTC clock and the CMOS battery if the wrong time recurs on the same hardware.",
+        "At OOBE, run 'w32tm /resync /force' (Shift+F10 command prompt) to sync with time.windows.com.",
+        "Ensure UDP port 123 to time.windows.com is open in the deployment network.",
+        "Review 'Set time automatically' and 'Set time zone automatically' behavior on the deployment image — automatic timezone changes mid-enrollment show up as clock jumps."
+      ]
+    }
+  ],
+  "relatedDocs": [
+    {
+      "title": "Microsoft Learn: Windows Autopilot known issues — device provisioning can fail (clock skew)",
+      "url": "https://learn.microsoft.com/en-us/autopilot/known-issues"
+    },
+    {
+      "title": "Microsoft Learn: Windows Autopilot requirements — Networking (NTP)",
+      "url": "https://learn.microsoft.com/en-us/autopilot/requirements?tabs=networking"
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "device",
+    "clock-skew",
+    "clock-jump",
+    "time-sync",
+    "kerberos",
+    "certificates",
+    "known-issue"
+  ]
+}

rules/analyze/ANALYZE-DEV-009.json

@@ -0,0 +1,48 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-DEV-009",
+  "title": "Battery Critically Low During Enrollment",
+  "description": "Detects that the device's battery dropped to 15% or less while enrolling on battery power (power_state_change threshold event from the agent's live power watcher). A device dying mid-enrollment leaves a half-provisioned state that typically needs a full reset; this rule surfaces the risk while there is still time to plug the device in. Uses a single required condition on the agent-stamped thresholdPercent field (the data field 'transition' on the event is unrelated to this rule's 'trigger' property).",
+  "severity": "high",
+  "category": "device",
+  "version": "1.0.0",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed",
+    "on_event:power_state_change"
+  ],
+  "trigger": "single",
+  "baseConfidence": 90,
+  "confidenceThreshold": 60,
+  "conditions": [
+    {
+      "signal": "battery_threshold_15",
+      "source": "event_data",
+      "eventType": "power_state_change",
+      "dataField": "thresholdPercent",
+      "operator": "equals",
+      "value": "15",
+      "required": true
+    }
+  ],
+  "explanation": "The device's battery fell below **{{thresholdPercent}}%** while the enrollment was running on battery power. If the battery drains completely mid-enrollment, the device is left in a half-provisioned state — apps, policies, or the user profile may be incomplete, and in most cases the device has to be reset and re-enrolled. The agent detected the threshold crossing live via a Windows power-status notification; the exact percentage at that moment is recorded on the matched power_state_change event in the session timeline.",
+  "remediation": [
+    {
+      "title": "Secure power for the running enrollment",
+      "steps": [
+        "Connect the device to AC power immediately — the enrollment continues normally once power is stable.",
+        "If the device shut down before completing, check whether the session reached the desktop; if not, reset the device (Autopilot reset or reimage) and re-enroll it plugged in.",
+        "For technician/White Glove flows, make AC power part of the bench checklist — pre-provisioning on battery is the most common source of this alert.",
+        "If this fires across many devices of one model, review that model's battery health (the hardware_spec event carries design vs. full-charge capacity)."
+      ]
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "device",
+    "power",
+    "battery",
+    "environment"
+  ]
+}

rules/analyze/ANALYZE-DEV-010.json

@@ -0,0 +1,48 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-DEV-010",
+  "title": "Enrollment Switched From AC to Battery Power",
+  "description": "Detects that the device lost AC power and switched to battery while the enrollment was running (power_state_change event with transition ac_to_battery from the agent's live power watcher). Uses a single required condition so the match is pinned to one event instance; the event payload carries the battery percentage at the moment of the switch. The agent debounces power flapping (5s) so a brief unplug/replug does not produce this event.",
+  "severity": "warning",
+  "category": "device",
+  "version": "1.0.0",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed",
+    "on_event:power_state_change"
+  ],
+  "trigger": "single",
+  "baseConfidence": 85,
+  "confidenceThreshold": 60,
+  "conditions": [
+    {
+      "signal": "switched_to_battery",
+      "source": "event_data",
+      "eventType": "power_state_change",
+      "dataField": "transition",
+      "operator": "equals",
+      "value": "ac_to_battery",
+      "required": true
+    }
+  ],
+  "explanation": "The device switched from AC to battery power mid-enrollment. Enrollments are power-hungry — app downloads, Windows Update and disk encryption drain a battery quickly, and Windows may also throttle CPU and network on battery, slowing the enrollment down. The battery percentage at the moment of the switch is recorded on the matched power_state_change event in the session timeline; if the device stayed on battery, look there for subsequent threshold events (50/30/15%) — a later battery_to_ac event means power was restored.",
+  "remediation": [
+    {
+      "title": "Restore AC power",
+      "steps": [
+        "Reconnect the device to AC power; the enrollment continues normally.",
+        "Check the session timeline for a subsequent battery_to_ac event (power restored) or threshold_crossed events (battery draining) to judge urgency.",
+        "If this alert is frequent in a deployment area, check docking stations/USB-C hubs for loose power delivery — a flapping dock is a common cause.",
+        "Make 'plugged in during setup' part of the end-user/technician enrollment instructions."
+      ]
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "device",
+    "power",
+    "battery",
+    "environment"
+  ]
+}

rules/analyze/ANALYZE-DEV-012.json

@@ -0,0 +1,49 @@
+{
+  "$schema": "../schema/analyze-rule.schema.json",
+  "ruleId": "ANALYZE-DEV-012",
+  "title": "Device Entered Standby During Enrollment",
+  "description": "Detects that the device completed a sleep, hibernate or Modern Standby episode of at least 5 minutes while the enrollment was running (system_sleep_episode event from the agent's system timeline watcher, recorded retroactively at wake from the Windows event log — pre-agent episodes are backfilled). Uses a single required condition on the episode's durationSeconds so the match is pinned to one event instance and the interpolated duration is the matched value. Short Modern Standby screen-off scenarios (under 60 s of real sleep) never emit the event, and this rule adds a 5-minute floor so brief lid-close moments do not fire it.",
+  "severity": "info",
+  "category": "device",
+  "version": "1.0.0",
+  "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed",
+    "on_event:system_sleep_episode"
+  ],
+  "trigger": "single",
+  "baseConfidence": 90,
+  "confidenceThreshold": 60,
+  "conditions": [
+    {
+      "signal": "slept_during_enrollment",
+      "source": "event_data",
+      "eventType": "system_sleep_episode",
+      "dataField": "durationSeconds",
+      "operator": "gte",
+      "value": "300",
+      "required": true
+    }
+  ],
+  "explanation": "The device was asleep for {{durationSeconds}} seconds during the enrollment window. Nothing progresses while the device sleeps — downloads pause, the IME stops processing and the ESP simply waits — so the wall-clock enrollment duration includes this pause and can look much slower than the enrollment actually was. The matched system_sleep_episode event in the session timeline carries the exact enter/exit times, the episode kind (sleep, hibernate or Modern Standby) and, for Modern Standby, whether the device was on AC power. A long unexplained gap in the timeline right before that event is this pause, not missing telemetry.",
+  "remediation": [
+    {
+      "title": "Keep the device awake during enrollment",
+      "steps": [
+        "Check the matched system_sleep_episode event in the timeline for the episode bounds and kind — the enrollment duration minus the episode duration is the real active time.",
+        "If the device slept on battery, connect AC power during setup; Windows sleeps far more aggressively on battery.",
+        "Instruct users/technicians to keep the lid open and the device powered until the enrollment finishes.",
+        "For recurring cases, review the power plan applied during OOBE/ESP (e.g. via provisioning or Intune policy) — consider disabling sleep on AC for the enrollment window."
+      ]
+    }
+  ],
+  "markSessionAsFailedDefault": false,
+  "tags": [
+    "device",
+    "power",
+    "standby",
+    "sleep",
+    "environment"
+  ]
+}

rules/analyze/ANALYZE-ENRL-002.json

@@ -5,7 +5,7 @@
   "description": "Detects when the enrollment session was force-failed by the server-side inactivity timeout (no agent telemetry for the configured SessionTimeoutHours window) without ever completing or explicitly failing.",
   "severity": "high",
   "category": "enrollment",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "enabled": true,
   "baseConfidence": 80,
   "preconditions": [
@@ -30,9 +30,35 @@
       "operator": "exists",
       "value": "",
       "required": true
+    },
+    {
+      "signal": "timeoutHours",
+      "source": "event_data",
+      "eventType": "session_timeout",
+      "dataField": "timeoutHours",
+      "operator": "exists",
+      "value": "",
+      "required": false
+    },
+    {
+      "signal": "desktop_was_reached",
+      "source": "event_type",
+      "eventType": "desktop_arrived",
+      "operator": "exists",
+      "value": "",
+      "required": false
+    },
+    {
+      "signal": "all_tracked_apps_completed",
+      "source": "event_data",
+      "eventType": "app_tracking_summary",
+      "dataField": "isAllCompleted",
+      "operator": "equals",
+      "value": "true",
+      "required": false
     }
   ],
-  "explanation": "The enrollment session was force-failed by the server-side maintenance sweep after `{{timeoutHours}}` hour(s) of agent inactivity — the device stopped sending telemetry and never reported completion or an explicit failure.\n\nThis usually means the agent process died or the device went offline mid-enrollment (power off, network loss, bluescreen, reimage) rather than a clean enrollment failure. Because there is no terminal `enrollment_failed` event, the more specific app/ESP rules cannot pinpoint a cause — the evidence simply stops at the last event before the gap.",
+  "explanation": "The enrollment session was force-failed by the server-side maintenance sweep after `{{timeoutHours}}` hour(s) of agent inactivity — the device stopped sending telemetry and never reported completion or an explicit failure.\n\nThis usually means the agent process died or the device went offline mid-enrollment (power off, network loss, bluescreen, reimage) rather than a clean enrollment failure. Because there is no terminal `enrollment_failed` event, the more specific app/ESP rules cannot pinpoint a cause — the evidence simply stops at the last event before the gap.\n\n**If the evidence shows the user desktop was reached and all tracked apps completed**, the device most likely got all its content but the ESP never signaled completion — on hybrid-joined devices the usual culprit is the user session never establishing Entra affinity (Account Setup re-running on every logon). Check whether the hybrid user-affinity finding also fired for this session.",
   "remediation": [
     {
       "title": "Investigate the silent session",
@@ -43,6 +69,13 @@
         "If the device is reachable, collect the agent + IME logs and re-run enrollment, correlating with the timeout timestamp",
         "If many sessions time out in the same window, check for a tenant-wide network/connectivity issue or an Intune service incident"
       ]
+    },
+    {
+      "title": "Desktop reached and apps done, but no completion",
+      "steps": [
+        "Sign in as the affected user and run dsregcmd /status — 'SSO State: AzureAdPrt' must be YES; NO means the user never registered with Entra and the Account Setup ESP will loop",
+        "Verify Entra Connect syncs both the computer object (userCertificate) and the signing-in user, and that the user's UPN suffix is a verified Entra domain"
+      ]
     }
   ],
   "tags": ["enrollment", "timeout", "stalled"]

rules/analyze/ANALYZE-ENRL-003.json

@@ -2,12 +2,17 @@
   "$schema": "../schema/analyze-rule.schema.json",
   "ruleId": "ANALYZE-ENRL-003",
   "title": "TPM Attestation Failure — Known Error Code",
-  "description": "A TPM-attestation-related error code documented in the Microsoft Autopilot known-issues list was observed (0x800705B4, 0x801C03EA, 0x81039001, 0x81039023, 0x81039024, 0x80070490). These block self-deploying and pre-provisioning deployments during 'Securing your hardware'. Observability: attestation precedes MDM enrollment, so in the normal deployment model (agent installed via IME after enrollment) these codes are rarely visible — the rule primarily serves bootstrap-token deployments. See docs/agent/autopilot-ztd-diagnostics.md (Observability section).",
+  "description": "A TPM-attestation-related error code documented in the Microsoft Autopilot known-issues list was observed (0x800705B4, 0x801C03EA, 0x81039001, 0x81039023, 0x81039024, 0x80070490). These block self-deploying and pre-provisioning deployments during 'Securing your hardware'. Observability: attestation precedes MDM enrollment, so in the normal deployment model (agent installed via IME after enrollment) these codes are rarely visible — the rule primarily serves bootstrap-token deployments.",
   "severity": "high",
   "category": "enrollment",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "author": "Autopilot Monitor",
   "enabled": true,
+  "evaluateOn": [
+    "enrollment_end",
+    "whiteglove_sealed",
+    "on_event:modern_deployment_error"
+  ],
   "trigger": "single",
   "baseConfidence": 60,
   "confidenceThreshold": 55,
@@ -75,5 +80,12 @@
     }
   ],
   "markSessionAsFailedDefault": false,
-  "tags": ["enrollment", "tpm", "attestation", "self-deploying", "pre-provisioning", "known-issue"]
+  "tags": [
+    "enrollment",
+    "tpm",
+    "attestation",
+    "self-deploying",
+    "pre-provisioning",
+    "known-issue"
+  ]
 }