fix(agent): network-link gate before initial config fetch + post-registration recovery

Root cause (edu.kosh audit 2026-08-24, session ba828038): on boot-time relaunches
the agent starts before the Wi-Fi link is up. The Phase 4 config fetch had no
network gate (98f8114d only guarded Phase 6 registration), burned its 10/30/60s
retry budget into a dead link and stranded the whole session on built-in defaults
(ConfigVersion=0) — up to ~50% of that tenant's sessions, with no self-heal short
of a manual rotate_config action. Not a version regression: rates varied wildly
per day within the same agent build; the failed requests never reached the backend.

Two complementary layers:
- RemoteConfigService gates the initial fetch on the shared NetworkLinkWait poll
  (60s cap — longer than registration's 15s because the fetch runs first), so the
  retry budget starts on a live link. rotate_config stays ungated (latency-bound).
- Phase 6.5: after registration proves the backend reachable, TryRecoverConfigAsync
  refetches once and AgentRuntimeConfig.TryRecoverAfterRegistration re-applies the
  live config (same merge/integrity pipeline as Phase 4). LastFetch* keeps the
  original failure record; remote_config_fetch_failed reports it with a recovered
  flag at Info severity, agent_started flags remoteConfigRecovered.

Deliberately not re-run in recovery: kill-signal check (telemetry-channel control
signals cover post-registration kills) and endpoint migration (next start).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Configuration/BuiltInConfigCatalogTests.cs

@@ -1,62 +0,0 @@
-using System.Linq;
-using AutopilotMonitor.Agent.V2.Core.Configuration;
-using Xunit;
-
-namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
-{
-    /// <summary>
-    /// Pins the compiled-in fallback rule catalogs (<see cref="BuiltInConfigCatalog"/>):
-    /// the agent embeds the SAME CI-combined rules/dist artifacts the backend serves, so a
-    /// no-config/no-cache session still runs full IME tracking. These tests guard the
-    /// embedding + deserialization end-to-end — a broken LogicalName, a moved resource or a
-    /// shape change in the combined JSON must fail HERE, not silently strip the fallback
-    /// back down to zero patterns in the field.
-    /// </summary>
-    public class BuiltInConfigCatalogTests
-    {
-        [Fact]
-        public void ImeLogPatterns_LoadFromEmbeddedCatalog_EnabledOnly()
-        {
-            var patterns = BuiltInConfigCatalog.GetEnabledImeLogPatterns(logger: null);
-
-            Assert.NotEmpty(patterns);
-            Assert.All(patterns, p =>
-            {
-                Assert.True(p.Enabled);
-                Assert.False(string.IsNullOrWhiteSpace(p.PatternId));
-                Assert.False(string.IsNullOrWhiteSpace(p.Pattern));
-                Assert.False(string.IsNullOrWhiteSpace(p.Action));
-                Assert.False(string.IsNullOrWhiteSpace(p.Category));
-            });
-            Assert.Equal(patterns.Count, patterns.Select(p => p.PatternId).Distinct().Count());
-        }
-
-        [Fact]
-        public void ImeLogPatterns_CarryCoreTrackingActions()
-        {
-            // The app-tracking backbone: without these two actions the ImeLogTracker cannot
-            // attribute installs to apps or follow ESP phases. Their presence proves the
-            // deserialization actually populated the action field (a shape drift in the
-            // combined JSON would otherwise still pass the structural checks above).
-            var actions = BuiltInConfigCatalog.GetEnabledImeLogPatterns(logger: null)
-                .Select(p => p.Action).ToHashSet();
-
-            Assert.Contains("setCurrentApp", actions);
-            Assert.Contains("espPhaseDetected", actions);
-        }
-
-        [Fact]
-        public void GatherRules_LoadFromEmbeddedCatalog_EnabledOnly()
-        {
-            // The built-in gather-rule catalog ships mostly disabled rules — only the
-            // default-enabled ones may reach the fallback config.
-            var rules = BuiltInConfigCatalog.GetEnabledGatherRules(logger: null);
-
-            Assert.All(rules, r =>
-            {
-                Assert.True(r.Enabled);
-                Assert.False(string.IsNullOrWhiteSpace(r.RuleId));
-            });
-        }
-    }
-}

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Configuration/RemoteConfigServiceRetryTests.cs

@@ -114,22 +114,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
             Assert.Equal(1, svc.LastFetchAttempts);
         }
 
-        [Fact]
-        public async Task FetchConfig_DefaultsFallback_CarriesBuiltInCatalogs()
-        {
-            // A no-config/no-cache session must still get the compiled-in rule catalogs —
-            // an empty ImeLogPatterns list kills the entire IME tracking pipeline (the
-            // pre-catalog behaviour this pins against regressing to).
-            var svc = NewService(BackendBehaviour.AlwaysTransientFailure);
-
-            var result = await svc.FetchConfigAsync(retryOnTransientErrors: true);
-
-            Assert.Equal(0, result.ConfigVersion);
-            Assert.NotEmpty(result.ImeLogPatterns);
-            Assert.All(result.ImeLogPatterns, p => Assert.True(p.Enabled));
-            Assert.All(result.GatherRules, r => Assert.True(r.Enabled));
-        }
-
         [Fact]
         public async Task FetchConfig_EmptyResponse_TreatedAsTransient()
         {
@@ -144,7 +128,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Configuration
             Assert.Equal(4, svc.LastFetchAttempts);
         }
 
-        // ── Network-link gate (tenant aebdce78 audit 2026-08-24) ────────────
+        // ── Network-link gate (edu.kosh audit 2026-08-24) ───────────────────
 
         [Fact]
         public async Task FetchConfig_InitialFetch_WaitsForNetworkLink()

src/Agent/AutopilotMonitor.Agent.V2.Core.Tests/Program/LifecycleEmittersRemoteConfigTests.cs

@@ -182,7 +182,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Program
             Assert.Equal("FromCache", data["outcome"]);
         }
 
-        // ── Post-registration recovery (Phase 6.5, tenant aebdce78 audit 2026-08-24) ─
+        // ── Post-registration recovery (Phase 6.5, edu.kosh audit 2026-08-24) ─
 
         [Fact]
         public void EmitFetchFailedIfAny_AfterRecovery_MarksRecoveredAndDemotesToInfo()

src/Agent/AutopilotMonitor.Agent.V2.Core/AutopilotMonitor.Agent.V2.Core.csproj

@@ -52,11 +52,6 @@
          carries the V2 assembly namespace so GatherRuleGuards locates it under
          "AutopilotMonitor.Agent.V2.Core.Resources.guardrails.json". -->
     <EmbeddedResource Include="..\..\..\rules\guardrails.json" LogicalName="AutopilotMonitor.Agent.V2.Core.Resources.guardrails.json" />
-    <!-- Built-in fallback rule catalogs (BuiltInConfigCatalog): the SAME CI-combined
-         rules/dist artifacts the backend embeds and serves. Snapshotted per agent build so
-         the no-config/no-cache fallback still runs full IME tracking instead of nothing. -->
-    <EmbeddedResource Include="..\..\..\rules\dist\ime-log-patterns.json" LogicalName="AutopilotMonitor.Agent.V2.Core.Resources.ime-log-patterns.json" />
-    <EmbeddedResource Include="..\..\..\rules\dist\gather-rules.json" LogicalName="AutopilotMonitor.Agent.V2.Core.Resources.gather-rules.json" />
   </ItemGroup>
 
   <ItemGroup>

src/Agent/AutopilotMonitor.Agent.V2.Core/Configuration/BuiltInConfigCatalog.cs

@@ -1,74 +0,0 @@
-using System;
-using System.Collections.Generic;
-using System.IO;
-using System.Linq;
-using AutopilotMonitor.Agent.V2.Core.Logging;
-using AutopilotMonitor.Shared.Models;
-using Newtonsoft.Json;
-
-namespace AutopilotMonitor.Agent.V2.Core.Configuration
-{
-    /// <summary>
-    /// Compiled-in fallback copies of the global rule catalogs, embedded from the same
-    /// CI-generated <c>rules/dist</c> artifacts the backend seeds and serves — single
-    /// source by construction: each agent release snapshots the catalog state of its own
-    /// build, so the offline fallback can never drift further than the running agent
-    /// version itself (no manually maintained default to forget).
-    /// <para>
-    /// Consumed only by <see cref="RemoteConfigService"/>'s built-in default config,
-    /// i.e. when a session has NO live config and NO cache. Before this existed, that
-    /// path shipped an empty <c>ImeLogPatterns</c> list, which left the entire IME
-    /// tracking pipeline (app installs, platform/remediation scripts, health-script
-    /// compliance, IME ESP-phase signals) dead for the whole session — the core of
-    /// enrollment monitoring. A live fetch (startup, post-registration recovery or
-    /// rotate_config) always wins over this catalog.
-    /// </para>
-    /// Fail-soft: any load/parse error returns an empty list (the pre-catalog behaviour).
-    /// </summary>
-    internal static class BuiltInConfigCatalog
-    {
-        /// <summary>Enabled built-in IME log patterns from the embedded catalog.</summary>
-        public static List<ImeLogPattern> GetEnabledImeLogPatterns(AgentLogger logger)
-            => LoadEnabled<ImeLogPattern>("ime-log-patterns.json", p => p.Enabled, logger);
-
-        /// <summary>Enabled built-in gather rules from the embedded catalog.</summary>
-        public static List<GatherRule> GetEnabledGatherRules(AgentLogger logger)
-            => LoadEnabled<GatherRule>("gather-rules.json", r => r.Enabled, logger);
-
-        private static List<T> LoadEnabled<T>(string name, Func<T, bool> isEnabled, AgentLogger logger)
-        {
-            try
-            {
-                var assembly = typeof(BuiltInConfigCatalog).Assembly;
-                using (var stream = assembly.GetManifestResourceStream(
-                    "AutopilotMonitor.Agent.V2.Core.Resources." + name))
-                {
-                    if (stream == null)
-                    {
-                        logger?.Warning($"Built-in config catalog resource '{name}' not found — fallback runs without it.");
-                        return new List<T>();
-                    }
-
-                    using (var reader = new StreamReader(stream))
-                    {
-                        var wrapper = JsonConvert.DeserializeObject<RulesFile<T>>(reader.ReadToEnd());
-                        var all = wrapper?.Rules ?? new List<T>();
-                        return all.Where(isEnabled).ToList();
-                    }
-                }
-            }
-            catch (Exception ex)
-            {
-                logger?.Warning($"Built-in config catalog '{name}' failed to load ({ex.Message}) — fallback runs without it.");
-                return new List<T>();
-            }
-        }
-
-        /// <summary>Shape of the CI-combined catalog files: <c>{ "rules": [...] }</c>.</summary>
-        private sealed class RulesFile<T>
-        {
-            [JsonProperty("rules")]
-            public List<T> Rules { get; set; }
-        }
-    }
-}

src/Agent/AutopilotMonitor.Agent.V2.Core/Configuration/RemoteConfigService.cs

@@ -46,7 +46,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
         /// Upper bound for the pre-fetch network-link wait on the initial startup fetch.
         /// Deliberately longer than the registration gate's 15s: the fetch runs FIRST after a
         /// boot-time relaunch, when Wi-Fi may still be associating (802.1X, OOBE), and a fetch
-        /// burned into a dead link strands the whole session on built-in defaults — tenant aebdce78
+        /// burned into a dead link strands the whole session on built-in defaults — edu.kosh
         /// audit 2026-08-24: ~50% of sessions lost their tenant config exactly this way.
         /// </summary>
         internal static readonly TimeSpan InitialFetchNetworkLinkWaitMax = TimeSpan.FromSeconds(60);
@@ -231,12 +231,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
                 return cached;
             }
 
-            // Fall back to built-in defaults (collector/analyzer defaults from the shared
-            // model initializers + the compiled-in rule catalogs).
+            // Fall back to defaults
+            _logger.Info("No cached config available, using defaults (all optional collectors disabled)");
             var defaults = CreateDefaultConfig();
-            _logger.Info($"No cached config available, using built-in defaults (ConfigVersion=0, " +
-                         $"{defaults.ImeLogPatterns?.Count ?? 0} built-in IME patterns, " +
-                         $"{defaults.GatherRules?.Count ?? 0} built-in gather rules)");
             SetConfig(defaults);
             LastFetchOutcome = RemoteConfigFetchOutcome.UsedDefaults;
             return defaults;
@@ -396,11 +393,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
 
         private AgentConfigResponse CreateDefaultConfig()
         {
-            // Everything not set here falls to the shared AgentConfigResponse property
-            // initializers — the same values the backend uses as its `??` fallbacks, so the
-            // scalar knobs cannot drift. The rule catalogs are the one thing initializers
-            // cannot supply: without them the whole IME tracking pipeline is dead, so they
-            // come from the compiled-in snapshot of the served catalogs (BuiltInConfigCatalog).
             return new AgentConfigResponse
             {
                 ConfigVersion = 0,
@@ -412,8 +404,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Configuration
                 EnableGatherRuleDebugLog = false,
                 EnableEspContinueAnywayObservation = false,
                 Collectors = CollectorConfiguration.CreateDefault(),
-                GatherRules = BuiltInConfigCatalog.GetEnabledGatherRules(_logger),
-                ImeLogPatterns = BuiltInConfigCatalog.GetEnabledImeLogPatterns(_logger)
+                GatherRules = new System.Collections.Generic.List<GatherRule>(),
+                ImeLogPatterns = new System.Collections.Generic.List<ImeLogPattern>()
             };
         }
 

src/Agent/AutopilotMonitor.Agent.V2/Runtime/AgentRuntimeConfig.cs

@@ -76,7 +76,7 @@ namespace AutopilotMonitor.Agent.V2.Runtime
 
         /// <summary>
         /// Phase 6.5 — config self-heal. When the Phase 4 fetch ran before the network link was
-        /// up (agent relaunched at boot, Wi-Fi still associating — tenant aebdce78 audit 2026-08-24:
+        /// up (agent relaunched at boot, Wi-Fi still associating — edu.kosh audit 2026-08-24:
         /// ~50% of sessions ran on ConfigVersion=0 exactly this way), a successful session
         /// registration has just proven the backend reachable. Retry the fetch once and apply
         /// the live tenant config instead of stranding the whole session on cache/defaults.