fix(rules,engine,agent): ESP-004 gates on the esp_apps_timeout verdict; not_exists absence gate; Shell-Core failure inherits settle detail (D-234, D-235)

ANALYZE-ESP-004 fired on every ESP terminal failure of a Continue-anyway profile and rendered the configured FirstSync limit as elapsed time — the mayHaveContinuedAnyway flag only says the profile has the button. The rule now requires the agent's own verdict (app_install_failed with failureType=esp_apps_timeout), names that app via a same-event filter, reads failedSubcategory from esp_failure_settle_started and words the limit as a limit. Verified with test_analyze_rule: cb7036a6 fires, 683f1eff (0x80070652 after 19 min) stays silent. Rule engine: not_exists with a dataField on event_type/event_data conditions matches when no event of the type carries a non-empty value — including an absent type — instead of being dead behind the fieldValue null short-circuit. Schema and MCP authoring guide say so. Agent: a Shell-Core 62407 failure that lands inside the provisioning tracker's 30-s settle window (a third of all ESP terminal failures) now inherits the pending errorCode / failedSubcategory / category / likelyCulpritApps, so enrollment_failed, Sessions.FailureReason and the termination-time app classification see the HRESULT the registry had already named. failureType stays the Shell-Core value. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
fix(web): omit the two default field values from the browser catalog (D-233)
2026-10-25 13:10:13 +00:00 · 2026-09-09 17:20:24 +02:00 · 2026-09-09 15:26:29 +02:00 · 2026-09-09 14:59:56 +02:00 · 2026-09-09 14:55:30 +02:00 · 2026-09-09 14:55:22 +02:00
59 changed files with 1661 additions and 254 deletions
@@ -55,6 +55,10 @@ updates:
      - dependency-name: '*'
        update-types: ['version-update:semver-major']

+  # Every action is referenced by commit SHA with the version in a trailing comment;
+  # action-pins.yml fails any workflow change that reintroduces a mutable tag. Dependabot
+  # is what keeps those pins current: it rewrites the SHA and the comment together, so the
+  # pins are reviewed in a PR instead of drifting silently or being bumped by hand.
  - package-ecosystem: github-actions
    directory: /
    schedule:
@@ -0,0 +1,70 @@
+name: Action Pin Gate
+
+# Every third-party action must be referenced by a full commit SHA, never by a tag.
+# Tags are mutable: whoever controls an action repository can repoint v4 at new code,
+# and that code runs inside jobs that hold the code-signing identity, the storage
+# credentials and a token that can push to main. A SHA is the only reference an
+# upstream owner cannot change under us.
+#
+# Lives in its own workflow rather than in ci.yml: CI deliberately ignores changes to
+# the other workflow files, so a guard placed there would stay silent for exactly the
+# commits it needs to inspect.
+#
+# Like CI, this reports rather than blocks: main is deliberately unprotected, so a red
+# run is a signal to act on, not a merge barrier. Making it binding means adding
+# 'Verify action pins' as a required status check -- a branch-protection decision, not
+# something this file can assert.
+#
+# The pins are not maintained by hand — .github/dependabot.yml opens a monthly grouped
+# PR that rewrites both the SHA and the trailing version comment. The comment is
+# therefore required too: it is what makes a pinned line reviewable.
+
+on:
+  push:
+    branches: [main]
+    paths: ['.github/workflows/**']
+  pull_request:
+    branches: [main]
+    paths: ['.github/workflows/**']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  verify-pins:
+    name: Verify action pins
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Every third-party action is pinned to a SHA
+        run: |
+          set -uo pipefail
+          failed=0
+          while IFS=: read -r file line ref; do
+            # Reusable workflows from this repository move with the commit that calls
+            # them, so there is nothing to pin.
+            case "$ref" in ./*) continue ;; esac
+
+            if [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]+#[[:space:]]*[^[:space:]] ]]; then
+              printf 'ok  %s:%s  %s\n' "$file" "$line" "$ref"
+              continue
+            fi
+
+            if [[ "$ref" =~ ^[^@]+@[0-9a-f]{40}[[:space:]]*$ ]]; then
+              echo "::error file=$file,line=$line::Pinned but the version comment is missing: '$ref'. Write 'owner/action@<sha> # vN' so the line stays reviewable."
+            else
+              echo "::error file=$file,line=$line::Action '$ref' is not pinned to a commit SHA. Tags are mutable -- resolve it with: gh api repos/<owner>/<action>/git/ref/tags/<tag>"
+            fi
+            failed=1
+          # -H is load-bearing: with a single matching file grep omits the name, the
+          # fields shift by one and every diagnostic points at nothing.
+          done < <(grep -nHE '^[[:space:]]*(-[[:space:]]+)?uses:' .github/workflows/*.yml \
+                   | sed -E 's/^([^:]+):([0-9]+):[[:space:]]*(-[[:space:]]+)?uses:[[:space:]]*/\1:\2:/')
+
+          if [ "$failed" -ne 0 ]; then
+            echo "::error::Unpinned action references found -- fix them before this reaches main."
+            exit 1
+          fi
+          echo "All action references are pinned to commit SHAs."
@@ -18,7 +18,7 @@ jobs:
    name: Bootstrap guard tests (PS 5.1)
    runs-on: windows-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Install Pester 5+
        shell: powershell
@@ -72,7 +72,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      # Every released build is signed; a missing variable stops the run before a build
      # number is burnt.
@@ -122,7 +122,7 @@ jobs:

      # SDK 10 = single build toolchain (parity with local build.ps1 / global.json).
      - name: Setup .NET
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
        with:
          dotnet-version: '10.0.x'

@@ -462,7 +462,7 @@ jobs:
      # Skipped on runs that publish nothing -- no log entry for bytes nobody receives.
      - name: Attest build provenance
        if: inputs.upload_blob || inputs.create_release
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
        with:
          subject-path: |
            ${{ steps.artifact.outputs.versioned_zip_release }}
@@ -470,13 +470,13 @@ jobs:
            staging/agent/AutopilotMonitor.SummaryDialog.exe

      - name: Upload build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: AutopilotMonitor-Agent-v${{ steps.version.outputs.version }}
          path: ${{ steps.artifact.outputs.versioned_zip_release }}

      - name: Upload version metadata
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: version-metadata
          path: ${{ env.MANIFEST_NAME }}
@@ -40,7 +40,7 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      # The loader executes as SYSTEM on every enrolling device — a parse error or
      # non-ASCII mojibake (PS 5.1 codepage roulette) must fail the build, not the fleet.
@@ -111,8 +111,11 @@ jobs:
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

+      # Exact version, not a "5.*" range: wix writes the bytes of the MSI that customers
+      # install, so a compromised or simply broken point release must not flow into a build
+      # unnoticed. Bumping is a reviewed commit.
      - name: Install WiX toolset
-        run: dotnet tool install --global wix --version "5.*"
+        run: dotnet tool install --global wix --version 5.0.2

      # Version pinned; roll-forward because the tool targets an older runtime than the SDK.
      - name: Install AzureSignTool
@@ -235,12 +238,12 @@ jobs:
      # gh attestation verify AutopilotMonitor-Bootstrap.msi --repo okieselbach/AutopilotMonitor
      - name: Attest build provenance (MSI)
        if: inputs.upload_blob
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
        with:
          subject-path: ${{ env.STABLE_MSI }}

      - name: Upload build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: AutopilotMonitor-Bootstrap-v${{ steps.version.outputs.version }}
          path: ${{ env.STABLE_MSI }}
@@ -35,6 +35,7 @@ on:
      # Every other workflow: nothing here builds or tests anything CI covers. paths-ignore
      # cannot negate, so they are listed one by one; ci.yml itself stays out of the list
      # so a change to CI runs CI. A new workflow file is opt-in — add it here too.
+      - '.github/workflows/action-pins.yml'
      - '.github/workflows/bootstrap-script-gates.yml'
      - '.github/workflows/build-agent.yml'
      - '.github/workflows/build-msi.yml'
@@ -67,6 +68,7 @@ on:
      # Every other workflow: nothing here builds or tests anything CI covers. paths-ignore
      # cannot negate, so they are listed one by one; ci.yml itself stays out of the list
      # so a change to CI runs CI. A new workflow file is opt-in — add it here too.
+      - '.github/workflows/action-pins.yml'
      - '.github/workflows/bootstrap-script-gates.yml'
      - '.github/workflows/build-agent.yml'
      - '.github/workflows/build-msi.yml'
@@ -94,9 +96,9 @@ jobs:
    # windows-latest is required: the agent test projects target net48.
    runs-on: windows-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: actions/setup-dotnet@v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
        with:
          dotnet-version: '10.0.x'

@@ -125,9 +127,9 @@ jobs:
      run:
        working-directory: src/Web/autopilot-monitor-web
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: '22'
          cache: npm
@@ -159,9 +161,9 @@ jobs:
      run:
        working-directory: src/McpServer/autopilot-monitor-mcp
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: '22'
          cache: npm
@@ -179,7 +181,7 @@ jobs:
      # (run 31252869254). Persist the model across runs instead; HF_CACHE_DIR
      # is honored by vector-search-provider.ts.
      - name: Cache embedding model
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
        with:
          path: ${{ github.workspace }}/.hf-cache
          key: hf-model-Xenova-all-MiniLM-L6-v2
@@ -193,9 +195,9 @@ jobs:
    name: Generated guardrails match rules/guardrails.json
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: '22'

@@ -214,9 +216,9 @@ jobs:
    name: Generated wire types match shared-manifests.json
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: '22'

@@ -102,15 +102,15 @@ jobs:
            build-mode: none

    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: actions/setup-dotnet@v6
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
        if: matrix.language == 'csharp'
        with:
          dotnet-version: '10.0.x'

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.9
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
@@ -121,6 +121,6 @@ jobs:
        run: dotnet build AutopilotMonitor.sln --configuration Release

      - name: Analyze
-        uses: github/codeql-action/analyze@v4.37.9
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
        with:
          category: /language:${{ matrix.language }}
@@ -24,14 +24,17 @@ jobs:
    permissions:
      contents: write
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: '22'

+      # Exact versions and no lifecycle scripts: this job holds contents:write and pushes to
+      # main, so an install-time script from a hijacked package would run with a token that
+      # can rewrite the repository. ajv is pure JS and needs no install hooks.
      - name: Install ajv-cli
-        run: npm install -g ajv-cli ajv-formats
+        run: npm install -g --ignore-scripts ajv-cli@5.0.0 ajv-formats@3.0.1

      - name: Validate Gather Rules
        run: |
@@ -19,7 +19,7 @@ jobs:
    name: Build and Deploy Backend

    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Login to Azure (OIDC)
        uses: azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3
@@ -29,7 +29,7 @@ jobs:
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Setup .NET 10
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
        with:
          dotnet-version: '10.0.x'

@@ -26,7 +26,7 @@ jobs:
    name: Build and Deploy MCP Server

    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      # The published customer documentation lives in its own PUBLIC repo and is
      # baked into the image as the search_docs corpus (see the Dockerfile). No
@@ -36,7 +36,7 @@ jobs:
      # re-run actually rolls a new revision). /health reports the SHA captured
      # below so that staleness is checkable.
      - name: Check out documentation bundle
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          repository: autopilotmonitor/autopilotmonitor-docs
          path: mcp-docs
@@ -35,7 +35,7 @@ jobs:
    runs-on: ubuntu-latest
    name: Build and Deploy Job
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          lfs: false
          fetch-depth: 0  # Full history needed for git-based sitemap lastmod dates
@@ -56,7 +56,7 @@ jobs:
      # workflow runs again (push under src/Web/** or a manual dispatch); versions/web.json
      # records which docs commit is live.
      - name: Check out documentation bundle
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          repository: autopilotmonitor/autopilotmonitor-docs
          path: whats-new-docs
@@ -66,7 +66,7 @@ jobs:
        id: docs
        run: echo "sha=$(git -C whats-new-docs rev-parse HEAD)" >> "$GITHUB_OUTPUT"

-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
        with:
          node-version: '22'
          cache: npm
@@ -114,12 +114,12 @@ jobs:
      # commit, workflow file) in a public transparency log.
      # Verify: gh attestation verify portal-<sha>.tar.gz --repo okieselbach/AutopilotMonitor
      - name: Attest build provenance (portal export)
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
        with:
          subject-path: ${{ steps.package.outputs.archive }}

      - name: Upload build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: portal-${{ github.sha }}
          path: ${{ steps.package.outputs.archive }}
@@ -54,7 +54,7 @@ jobs:
    needs: gates
    runs-on: windows-latest
    steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - name: Check code-signing configuration
        shell: pwsh
@@ -127,7 +127,7 @@ jobs:
      # when someone wants to look at the file.
      - name: Upload signed scripts
        if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: signed-scripts
          path: ${{ runner.temp }}/signed-scripts
@@ -1,11 +1,11 @@
 {
  "$schema": "../schema/analyze-rule.schema.json",
  "ruleId": "ANALYZE-ESP-004",
-  "title": "ESP Timeout with 'Continue Anyway' (Soft Failure)",
-  "description": "Detects an ESP terminal failure on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device.",
+  "title": "ESP Gave Up on a Blocking App with 'Continue Anyway' (Soft Failure)",
+  "description": "Detects an ESP terminal failure where the ESP gave up while a blocking app was still installing (the agent's own esp_apps_timeout verdict — no per-app HRESULT was reported) on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device. An ESP failure that carries a specific error code (a failed installer, a detection mismatch) is a different case and stays with the rule that explains that code.",
  "severity": "warning",
  "category": "esp",
-  "version": "1.0.1",
+  "version": "1.1.0",
  "enabled": true,
  "baseConfidence": 80,
  "conditions": [
@@ -26,6 +26,27 @@
      "value": "true",
      "required": true
    },
+    {
+      "signal": "esp_gave_up_on_app",
+      "source": "event_type",
+      "eventType": "app_install_failed",
+      "dataField": "failureType",
+      "operator": "equals",
+      "value": "esp_apps_timeout",
+      "required": true
+    },
+    {
+      "signal": "appName",
+      "source": "event_data",
+      "eventType": "app_install_failed",
+      "dataField": "appName",
+      "operator": "exists",
+      "value": "",
+      "filterField": "failureType",
+      "filterOperator": "equals",
+      "filterValue": "esp_apps_timeout",
+      "required": false
+    },
    {
      "signal": "espSyncFailureTimeoutMinutes",
      "source": "event_type",
@@ -38,34 +59,25 @@
    {
      "signal": "failedSubcategory",
      "source": "event_type",
-      "eventType": "enrollment_failed",
+      "eventType": "esp_failure_settle_started",
      "dataField": "failedSubcategory",
      "operator": "exists",
      "value": "",
      "required": false
-    },
-    {
-      "signal": "appName",
-      "source": "event_type",
-      "eventType": "app_install_failed",
-      "dataField": "appName",
-      "operator": "exists",
-      "value": "",
-      "required": false
    }
  ],
  "confidenceFactors": [
-    { "signal": "appName", "condition": "exists", "weight": 10 }
+    { "signal": "failedSubcategory", "condition": "exists", "weight": 10 }
  ],
-  "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page reached its configured terminal timeout (`{{espSyncFailureTimeoutMinutes}} min`) before all blocking items finished. The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while at least one blocking item (`{{failedSubcategory}}` subcategory / app `{{appName}}`) did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP timeout wall, not at broken devices. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session (e.g. a certificate-only failure has no failed app).",
+  "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page gave up while the blocking app **{{appName}}** was still installing — the agent recorded no per-app error code, only that the app never finished inside the ESP window (the profile's configured limit is `{{espSyncFailureTimeoutMinutes}} min`; the ESP may have stopped earlier than that). The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while the `{{failedSubcategory}}` subcategory did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP limit, not at broken devices. This rule deliberately stays silent when the failed app reported a specific error code — a failed installer or a detection mismatch is explained by the rule for that code, and 'Continue anyway' does not make it a timing problem. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session.",
  "remediation": [
    {
      "title": "Relieve ESP pressure so enrollments finish inside the window",
      "steps": [
-        "Identify the slow blocking app (`{{appName}}`) and either remove it from the ESP 'block device use until these required apps are installed' list, or raise the ESP installation timeout (currently {{espSyncFailureTimeoutMinutes}} min).",
-        "If the app legitimately needs longer than the ESP allows, make it non-blocking and let it install after the desktop arrives.",
-        "Verify the app's detection rule matches after install — an app that installs but fails detection times out the ESP on every device (see ANALYZE-APP-013).",
-        "If a subcategory such as Certificates is reported under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
+        "Look at how long `{{appName}}` takes on a device that completes: if it legitimately needs longer than the ESP allows, make it non-blocking (remove it from 'block device use until these required apps are installed') and let it install after the desktop arrives.",
+        "If the app must stay blocking, raise the ESP setting 'Show error when installation takes longer than' (configured at {{espSyncFailureTimeoutMinutes}} min) — a limit, not a target; it only helps when the app reliably finishes within the new value.",
+        "Check the app's dependencies and install order: a blocking app waiting on a large dependency download (Delivery Optimization, proxy throughput) is the usual reason it never finishes in time.",
+        "If the ESP reported a non-Apps subcategory under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
      ]
    }
  ],
@@ -2496,11 +2496,11 @@
    },
    {
      "ruleId": "ANALYZE-ESP-004",
-      "title": "ESP Timeout with 'Continue Anyway' (Soft Failure)",
-      "description": "Detects an ESP terminal failure on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device.",
+      "title": "ESP Gave Up on a Blocking App with 'Continue Anyway' (Soft Failure)",
+      "description": "Detects an ESP terminal failure where the ESP gave up while a blocking app was still installing (the agent's own esp_apps_timeout verdict — no per-app HRESULT was reported) on a profile that allows 'Continue anyway'. The enrollment is reported as failed, but the user most likely dismissed the error screen and reached the desktop — a soft failure rather than an unusable device. An ESP failure that carries a specific error code (a failed installer, a detection mismatch) is a different case and stays with the rule that explains that code.",
      "severity": "warning",
      "category": "esp",
-      "version": "1.0.1",
+      "version": "1.1.0",
      "enabled": true,
      "baseConfidence": 80,
      "conditions": [
@@ -2521,6 +2521,27 @@
          "value": "true",
          "required": true
        },
+        {
+          "signal": "esp_gave_up_on_app",
+          "source": "event_type",
+          "eventType": "app_install_failed",
+          "dataField": "failureType",
+          "operator": "equals",
+          "value": "esp_apps_timeout",
+          "required": true
+        },
+        {
+          "signal": "appName",
+          "source": "event_data",
+          "eventType": "app_install_failed",
+          "dataField": "appName",
+          "operator": "exists",
+          "value": "",
+          "filterField": "failureType",
+          "filterOperator": "equals",
+          "filterValue": "esp_apps_timeout",
+          "required": false
+        },
        {
          "signal": "espSyncFailureTimeoutMinutes",
          "source": "event_type",
@@ -2533,38 +2554,29 @@
        {
          "signal": "failedSubcategory",
          "source": "event_type",
-          "eventType": "enrollment_failed",
+          "eventType": "esp_failure_settle_started",
          "dataField": "failedSubcategory",
          "operator": "exists",
          "value": "",
          "required": false
-        },
-        {
-          "signal": "appName",
-          "source": "event_type",
-          "eventType": "app_install_failed",
-          "dataField": "appName",
-          "operator": "exists",
-          "value": "",
-          "required": false
        }
      ],
      "confidenceFactors": [
        {
-          "signal": "appName",
+          "signal": "failedSubcategory",
          "condition": "exists",
          "weight": 10
        }
      ],
-      "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page reached its configured terminal timeout (`{{espSyncFailureTimeoutMinutes}} min`) before all blocking items finished. The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while at least one blocking item (`{{failedSubcategory}}` subcategory / app `{{appName}}`) did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP timeout wall, not at broken devices. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session (e.g. a certificate-only failure has no failed app).",
+      "explanation": "This enrollment was reported as **failed** because the Enrollment Status Page gave up while the blocking app **{{appName}}** was still installing — the agent recorded no per-app error code, only that the app never finished inside the ESP window (the profile's configured limit is `{{espSyncFailureTimeoutMinutes}} min`; the ESP may have stopped earlier than that). The ESP profile, however, allows **'Continue anyway'** — so the user most likely dismissed the error screen and reached the desktop with a working, though not fully provisioned, device.\n\nThe agent only observes the ESP terminal failure on the device side; it cannot see what the user did after the failure screen. Treat this as a **soft failure**: the device may well be in productive use, while the `{{failedSubcategory}}` subcategory did not complete inside the ESP window.\n\nA cluster of these across a tenant almost always points at one slow blocking app holding the whole fleet at the ESP limit, not at broken devices. This rule deliberately stays silent when the failed app reported a specific error code — a failed installer or a detection mismatch is explained by the rule for that code, and 'Continue anyway' does not make it a timing problem. Any field still shown as a literal `{{…}}` placeholder was simply not recorded for this session.",
      "remediation": [
        {
          "title": "Relieve ESP pressure so enrollments finish inside the window",
          "steps": [
-            "Identify the slow blocking app (`{{appName}}`) and either remove it from the ESP 'block device use until these required apps are installed' list, or raise the ESP installation timeout (currently {{espSyncFailureTimeoutMinutes}} min).",
-            "If the app legitimately needs longer than the ESP allows, make it non-blocking and let it install after the desktop arrives.",
-            "Verify the app's detection rule matches after install — an app that installs but fails detection times out the ESP on every device (see ANALYZE-APP-013).",
-            "If a subcategory such as Certificates is reported under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
+            "Look at how long `{{appName}}` takes on a device that completes: if it legitimately needs longer than the ESP allows, make it non-blocking (remove it from 'block device use until these required apps are installed') and let it install after the desktop arrives.",
+            "If the app must stay blocking, raise the ESP setting 'Show error when installation takes longer than' (configured at {{espSyncFailureTimeoutMinutes}} min) — a limit, not a target; it only helps when the app reliably finishes within the new value.",
+            "Check the app's dependencies and install order: a blocking app waiting on a large dependency download (Delivery Optimization, proxy throughput) is the usual reason it never finishes in time.",
+            "If the ESP reported a non-Apps subcategory under '{{failedSubcategory}}', confirm the certificate/connector actually delivers — 'Continue anyway' hides a missing certificate, it does not fix it."
          ]
        }
      ],
@@ -94,7 +94,11 @@
    "C:\\Windows\\Panther",
    "C:\\Windows\\SetupDiag",
    "C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
-    "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log"
+    "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log",
+    "C:\\ProgramData\\RealmJoin\\choco\\logs"
+  ],
+  "userProfileFilePrefixes": [
+    "AppData\\Local\\RealmJoin"
  ],
  "wmiQueryPrefixes": [
    "SELECT * FROM Win32_OperatingSystem",
@@ -190,7 +190,7 @@
        },
        "operator": {
          "type": "string",
-          "description": "Comparison operator.",
+          "description": "Comparison operator. exists/not_exists with a dataField test whether ANY event of the type carries a non-empty value at that field: not_exists matches when no event does — including when the event type is absent altogether — so a rule can gate on a missing field (e.g. an ESP failure without an HRESULT). Without a dataField they test only the presence of the event type.",
          "enum": ["equals", "not_equals", "contains", "not_contains", "regex", "not_regex", "gt", "lt", "gte", "lte", "exists", "not_exists", "count_gte", "count_per_group_gte", "in", "not_in"]
        },
        "value": {
@@ -8,6 +8,16 @@
    "$schema": { "type": "string" },
    "registryPrefixes": { "$ref": "#/$defs/categorizedList" },
    "filePrefixes": { "$ref": "#/$defs/stringList" },
+    "userProfileFilePrefixes": {
+      "description": "Folders under the signed-in user's profile that file collectors and diagnostics paths may read, RELATIVE to the profile root (e.g. \"AppData\\\\Local\\\\Vendor\"). Resolved against %LOGGED_ON_USER_PROFILE% at match time. Entries outside AppData\\Local / AppData\\Roaming are dropped at load: the C:\\Users hard block never admits them, so this list can only ever narrow what the block's exception already permits.",
+      "type": "array",
+      "items": {
+        "allOf": [
+          { "$ref": "#/$defs/safeString" },
+          { "pattern": "^AppData\\\\(Local|Roaming)(\\\\|$)" }
+        ]
+      }
+    },
    "wmiQueryPrefixes": { "$ref": "#/$defs/stringList" },
    "eventLogChannels": { "$ref": "#/$defs/categorizedList" },
    "blockedEventLogChannels": { "$ref": "#/$defs/stringList" },
@@ -208,6 +208,14 @@ export const ALLOWED_FILE_PREFIXES: readonly string[] = [
 ${flatArray(guardrails.filePrefixes)}
 ];

+// Folders under the signed-in user's profile, RELATIVE to the profile root. The agent
+// resolves %LOGGED_ON_USER_PROFILE% at runtime; the portal validates against a placeholder
+// profile. These cannot live in ALLOWED_FILE_PREFIXES — that list is matched literally
+// against the already-expanded path, where the user name is unknown at authoring time.
+export const USER_PROFILE_FILE_PREFIXES: readonly string[] = [
+${flatArray(guardrails.userProfileFilePrefixes ?? [])}
+];
+
 export const ALLOWED_WMI_QUERY_PREFIXES: readonly string[] = [
 ${flatArray(guardrails.wmiQueryPrefixes)}
 ];
@@ -14,6 +14,22 @@
 BeforeAll {
    . (Join-Path $PSScriptRoot 'Install-AutopilotMonitor.ps1')

+    function New-FakeSignature {
+        param([string]$Status, [string]$Subject)
+        $cert = if ($Subject) {
+            [pscustomobject]@{ Subject = $Subject; Thumbprint = '0123456789ABCDEF' }
+        } else { $null }
+        return [pscustomobject]@{ Status = $Status; SignerCertificate = $cert }
+    }
+
+    function New-FakePayload {
+        param([string[]]$Files)
+        $dir = Join-Path $TestDrive ([guid]::NewGuid().ToString())
+        New-Item -ItemType Directory -Path $dir -Force | Out-Null
+        foreach ($f in $Files) { Set-Content -Path (Join-Path $dir $f) -Value 'x' }
+        return $dir
+    }
+
    function New-FakeProfile {
        param([string]$Name, [double]$AgeMinutes)
        $p = Join-Path $TestDrive $Name
@@ -305,3 +321,93 @@ Describe 'logging purity' {
        Get-Content $LogFile -Raw | Should -Match 'SKIP: Agent was previously deployed'
    }
 }
+
+Describe 'Get-UnverifiedAgentBinaries' {
+    # The publisher gate on the extracted payload. What matters is the DECISION: which
+    # payload is accepted, which is refused, and which files are looked at at all.
+    BeforeEach {
+        Mock Write-Log { }
+        $script:ours = 'CN=glueckkanja AG, O=glueckkanja AG, C=DE'
+    }
+
+    It 'accepts a payload where every binary of ours is validly signed by us' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe', 'AutopilotMonitor.Shared.dll')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject $script:ours }
+        Get-UnverifiedAgentBinaries -Path $dir | Should -BeNullOrEmpty
+    }
+
+    It 'checks the binaries we author and leaves third-party assemblies alone' {
+        $dir = New-FakePayload -Files @(
+            'AutopilotMonitor.Agent.exe',
+            'AutopilotMonitor.Agent.exe.config',
+            'AutopilotMonitor.Shared.dll',
+            'Newtonsoft.Json.dll',
+            'System.Management.Automation.dll'
+        )
+        $script:checked = @()
+        Mock Get-AuthenticodeSignature {
+            $script:checked += (Split-Path $FilePath -Leaf)
+            New-FakeSignature -Status 'Valid' -Subject $script:ours
+        }
+
+        Get-UnverifiedAgentBinaries -Path $dir | Should -BeNullOrEmpty
+        $script:checked | Should -Be @('AutopilotMonitor.Agent.exe', 'AutopilotMonitor.Shared.dll')
+    }
+
+    It 'refuses an unsigned agent executable' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'NotSigned' -Subject $null }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses a tampered binary (hash mismatch)' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'HashMismatch' -Subject $script:ours }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses a signature whose chain does not validate' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'UnknownError' -Subject $script:ours }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses a validly signed binary from a different publisher' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject 'CN=Somebody Else, O=Somebody Else Ltd, C=US' }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses the whole payload when a single DLL of ours is swapped' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe', 'AutopilotMonitor.Shared.dll')
+        Mock Get-AuthenticodeSignature {
+            if ((Split-Path $FilePath -Leaf) -eq 'AutopilotMonitor.Shared.dll') {
+                New-FakeSignature -Status 'Valid' -Subject 'CN=Somebody Else, O=Somebody Else Ltd, C=US'
+            } else {
+                New-FakeSignature -Status 'Valid' -Subject $script:ours
+            }
+        }
+        $rejected = Get-UnverifiedAgentBinaries -Path $dir
+        $rejected.Count | Should -Be 1
+        $rejected[0] | Should -BeLike 'AutopilotMonitor.Shared.dll*'
+    }
+
+    It 'refuses when the signature check itself throws' {
+        $dir = New-FakePayload -Files @('AutopilotMonitor.Agent.exe')
+        Mock Get-AuthenticodeSignature { throw 'access denied' }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+
+    It 'refuses an empty payload instead of passing it' {
+        $dir = New-FakePayload -Files @('Newtonsoft.Json.dll')
+        Mock Get-AuthenticodeSignature { New-FakeSignature -Status 'Valid' -Subject $script:ours }
+        (Get-UnverifiedAgentBinaries -Path $dir).Count | Should -Be 1
+    }
+}
+
+Describe 'publisher pin' {
+    It 'pins the expected publisher by subject, not by thumbprint' {
+        $ExpectedPublisher | Should -Be '*O=glueckkanja AG*'
+        $ExpectedPublisher | Should -Not -Match '^[0-9A-Fa-f]{40}$'
+    }
+}
@@ -12,8 +12,9 @@
      2. Downloads the monitoring agent ZIP from Azure Blob Storage
      3. Verifies integrity via SHA-256 hash from the version manifest (mandatory)
      4. Extracts the agent into %ProgramData%\AutopilotMonitor\Agent
-      5. Runs the agent in --install mode (registers Scheduled Task, spawns the runtime)
-      6. Verifies the runtime process actually launched
+      5. Verifies the Authenticode signature and publisher of every binary we author
+      6. Runs the agent in --install mode (registers Scheduled Task, spawns the runtime)
+      7. Verifies the runtime process actually launched
    Agent self-destructs when enrollment completes.

    Relax flow (guards 2+3): a real user profile (or a real LastLoggedOnUser)
@@ -76,6 +77,11 @@
      PowerShell 5.1 (IME) reads scripts without BOM as ANSI, corrupting multi-byte chars.

 .CHANGELOG
+    2026-09-08  v2.5  Publisher gate: every AutopilotMonitor binary in the extracted
+                      payload must carry a valid Authenticode signature from the
+                      expected publisher before --install runs. The SHA-256 manifest
+                      check stays and is unchanged; it proves the bytes, the signature
+                      proves the author.
    2026-08-08  v2.3  Windows 365 Cloud PC support: a positively identified Cloud PC
                      (Windows365 registry key AND CloudManagedDesktopExtension
                      service) now triggers the guard 2+3 relax alongside OOBE
@@ -128,7 +134,12 @@ param(
 )

 # Script version (bump on meaningful changes; see .CHANGELOG above)
-$ScriptVersion = "2.4"
+$ScriptVersion = "2.5"
+
+# The publisher every binary we author must carry. A -like pattern on the subject, NOT a
+# thumbprint: certificates are renewed, deployed copies of this script are not. Same value
+# the loader pins for this script.
+$ExpectedPublisher = "*O=glueckkanja AG*"

 # Configuration - Everything in ProgramData for easy cleanup
 $AgentBasePath = "$env:ProgramData\AutopilotMonitor"
@@ -329,6 +340,56 @@ function Get-BootstrapDecision {
    return [pscustomobject]@{ Install = $true; ReasonCode = $null; RelaxActive = $relax.Active }
 }

+# Returns the list of reasons why the extracted payload is not ours; an empty result means
+# every binary we author carries a valid Authenticode signature from the expected publisher.
+# Third-party assemblies keep their own publisher's signature and are not checked here.
+# Any error is a rejection: an unreadable signature is an unverified binary.
+function Get-UnverifiedAgentBinaries {
+    param([string]$Path)
+
+    $rejected = @()
+    $ourBinaries = @(
+        Get-ChildItem -Path $Path -Filter 'AutopilotMonitor.*' -File -ErrorAction SilentlyContinue |
+            Where-Object { $_.Extension -in @('.exe', '.dll') }
+    )
+
+    # An empty set is a rejection, not a pass: it means the extraction produced nothing we
+    # recognise, and the alternative would be a gate that silently approves an empty folder.
+    # The comma keeps a single rejection an ARRAY: PowerShell unrolls a one-element result to
+    # a bare string, and the caller reads .Count and indexes into it.
+    if ($ourBinaries.Count -eq 0) {
+        return , @("no AutopilotMonitor binaries found in $Path")
+    }
+
+    foreach ($binary in $ourBinaries) {
+        try {
+            $sig = Get-AuthenticodeSignature -FilePath $binary.FullName -ErrorAction Stop
+        }
+        catch {
+            $rejected += "$($binary.Name): signature check failed to run ($($_.Exception.Message))"
+            continue
+        }
+
+        if ($null -eq $sig) {
+            $rejected += "$($binary.Name): signature check returned nothing"
+            continue
+        }
+
+        $subject = if ($sig.SignerCertificate) { $sig.SignerCertificate.Subject } else { '<unsigned>' }
+
+        if ($sig.Status -ne 'Valid') {
+            $rejected += "$($binary.Name): signature status $($sig.Status)"
+            continue
+        }
+        if ($subject -notlike $ExpectedPublisher) {
+            $rejected += "$($binary.Name): unexpected publisher $subject"
+            continue
+        }
+    }
+
+    return , $rejected
+}
+
 # Main bootstrap flow. Only invoked when the script is run directly (see entry guard
 # at the bottom); never on dot-source.
 function Invoke-Bootstrap {
@@ -445,6 +506,20 @@ function Invoke-Bootstrap {
            }
        }

+        # Publisher gate. The SHA-256 above proves the ZIP is the one the manifest names, but
+        # that manifest lives in the same container as the ZIP and cannot outlive a compromise
+        # of the download host. The expected publisher travels inside THIS script, which the
+        # loader verified before running it, so the chain from the file an administrator
+        # assigns to the process that starts here stays publisher-anchored end to end.
+        # Fail-closed, exactly like the hash check: running unverified code as SYSTEM is the
+        # risk being removed.
+        Write-Log "Verifying Authenticode signatures of the agent binaries..."
+        $unverified = Get-UnverifiedAgentBinaries -Path $AgentBinPath
+        if ($unverified.Count -gt 0) {
+            throw "Authenticode verification FAILED ($($unverified -join '; ')). Refusing to run an agent that is not signed by the expected publisher."
+        }
+        Write-Log "Authenticode verification passed (publisher pin: $ExpectedPublisher)"
+
        Write-Log "Calling agent install mode (--install)..."
        & $agentExePath --install
        $installExitCode = $LASTEXITCODE
@@ -0,0 +1,132 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.SignalAdapters;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using AutopilotMonitor.DecisionCore.Signals;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring
+{
+    /// <summary>
+    /// Session 683f1eff — a Shell-Core 62407 failure (<c>WhiteGlove_Failed</c>) arrived four
+    /// seconds into the provisioning tracker's 30-s settle window and terminalised the session
+    /// with nothing but its failure type: the HRESULT (0x80070652) and the failed subcategory
+    /// (Apps) the registry had already named never reached the terminal event, the backend
+    /// FailureReason or the termination-time app classification. The coordinator now inherits
+    /// the pending settle detail onto the Shell-Core args and records the terminal-failure
+    /// snapshot from it.
+    /// </summary>
+    public sealed class EspAndHelloTrackerShellCoreFailureInheritanceTests
+    {
+        private static readonly DateTime Fixed = new DateTime(2026, 9, 8, 18, 11, 6, DateTimeKind.Utc);
+
+        private sealed class Fixture : IDisposable
+        {
+            public TempDirectory Tmp { get; } = new TempDirectory();
+            public AgentLogger Logger { get; }
+            public FakeSignalIngressSink Ingress { get; } = new FakeSignalIngressSink();
+            public FakeSignalIngressSink TrackerPostSink { get; } = new FakeSignalIngressSink();
+            public VirtualClock Clock { get; } = new VirtualClock(Fixed);
+            public List<EspFailureDetectedEventArgs> Forwarded { get; } = new List<EspFailureDetectedEventArgs>();
+
+            public Fixture() { Logger = new AgentLogger(Tmp.Path, AgentLogLevel.Debug); }
+
+            public EspAndHelloTracker BuildCoordinator(Func<EspFailureDetectedEventArgs?> pendingProbe)
+            {
+                var coordinator = new EspAndHelloTracker(
+                    sessionId: "S1",
+                    tenantId: "T1",
+                    post: new InformationalEventPost(TrackerPostSink, Clock),
+                    logger: Logger,
+                    skipConfigProbe: () => ((bool?)false, (bool?)false),
+                    accountSetupActivityProbe: () => false,
+                    pendingEspFailureProbe: pendingProbe);
+                coordinator.EspFailureDetected += (_, args) => Forwarded.Add(args);
+                return coordinator;
+            }
+
+            public FakeSignalIngressSink.PostedSignal TerminalSignal() =>
+                Assert.Single(Ingress.Posted, p => p.Kind == DecisionSignalKind.EspTerminalFailure);
+
+            public void Dispose() { Tmp.Dispose(); }
+        }
+
+        private static EspFailureDetectedEventArgs PendingAppsFailure() => new EspFailureDetectedEventArgs(
+            failureType: "Provisioning_DeviceSetup_Apps_Failed",
+            errorCode: "0x80070652",
+            failedSubcategory: "Apps",
+            category: "DeviceSetup",
+            likelyCulpritApps: new[] { "ESP Finalizer US" });
+
+        [Fact]
+        public void ShellCore_failure_inside_the_settle_window_inherits_the_registry_detail()
+        {
+            using var f = new Fixture();
+            using var coordinator = f.BuildCoordinator(PendingAppsFailure);
+            using var adapter = new EspAndHelloTrackerAdapter(coordinator, f.Ingress, f.Clock);
+
+            coordinator.TriggerShellCoreEspFailureForTest("WhiteGlove_Failed");
+
+            var args = Assert.Single(f.Forwarded);
+            Assert.Equal("WhiteGlove_Failed", args.FailureType);   // the signal that terminalised
+            Assert.Equal("0x80070652", args.ErrorCode);
+            Assert.Equal("Apps", args.FailedSubcategory);
+            Assert.Equal("DeviceSetup", args.Category);
+            Assert.Equal(new[] { "ESP Finalizer US" }, args.LikelyCulpritApps);
+
+            // Wire-through: the EspTerminalFailure signal payload carries the detail the
+            // DecisionEngine copies onto enrollment_failed.
+            var signal = f.TerminalSignal();
+            Assert.Equal("WhiteGlove_Failed", signal.Payload!["failureType"]);
+            Assert.Equal("0x80070652", signal.Payload["errorCode"]);
+            Assert.Equal("Apps", signal.Payload["failedSubcategory"]);
+            Assert.Equal("DeviceSetup", signal.Payload["category"]);
+            Assert.Equal("ESP Finalizer US", signal.Payload["likelyCulpritApps"]);
+
+            // Termination-time classification reads the same context.
+            Assert.NotNull(coordinator.LastEspTerminalFailure);
+            Assert.Equal("0x80070652", coordinator.LastEspTerminalFailure.ErrorCode);
+            Assert.True(coordinator.LastEspTerminalFailure.IsAppsSubcategory);
+        }
+
+        [Fact]
+        public void ShellCore_failure_without_a_pending_window_stays_bare()
+        {
+            using var f = new Fixture();
+            using var coordinator = f.BuildCoordinator(() => null);
+            using var adapter = new EspAndHelloTrackerAdapter(coordinator, f.Ingress, f.Clock);
+
+            coordinator.TriggerShellCoreEspFailureForTest("ESPProgress_Timeout");
+
+            var args = Assert.Single(f.Forwarded);
+            Assert.Equal("ESPProgress_Timeout", args.FailureType);
+            Assert.Null(args.ErrorCode);
+            Assert.Null(args.FailedSubcategory);
+            Assert.Null(args.Category);
+            Assert.Empty(args.LikelyCulpritApps);
+            Assert.Null(coordinator.LastEspTerminalFailure);
+
+            var signal = f.TerminalSignal();
+            Assert.False(signal.Payload!.ContainsKey("errorCode"));
+            Assert.False(signal.Payload.ContainsKey("failedSubcategory"));
+        }
+
+        [Fact]
+        public void A_throwing_probe_degrades_to_the_bare_failure()
+        {
+            using var f = new Fixture();
+            using var coordinator = f.BuildCoordinator(() => throw new InvalidOperationException("probe"));
+
+            coordinator.TriggerShellCoreEspFailureForTest("WhiteGlove_Failed");
+
+            var args = Assert.Single(f.Forwarded);
+            Assert.Equal("WhiteGlove_Failed", args.FailureType);
+            Assert.Null(args.ErrorCode);
+        }
+    }
+}
@@ -456,5 +456,124 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Gather

            SingleSecurityWarning();
        }
+
+        // -------------------------------------------------------------------
+        // %LOGGED_ON_USER_PROFILE% exception (userProfilePath overload)
+        //
+        // The token lifts the C:\Users hard block for AppData\Local and
+        // AppData\Roaming — and nothing more. The allowlist still decides,
+        // which is what the cases below pin down: the exception is a gate the
+        // allowlist has to open, never an allowance of its own.
+        // -------------------------------------------------------------------
+
+        private const string TestProfile = @"C:\Users\TestUser";
+
+        [Fact]
+        public void UserProfile_AppDataPath_WithoutAllowlistEntry_IsStillBlocked()
+        {
+            // The lifted hard block alone admits nothing: without a matching
+            // userProfileFilePrefixes entry the path falls through to the
+            // allowlist and is refused there.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_OutsideAppData_IsBlockedByTheHardBlock()
+        {
+            foreach (var target in new[] { @"\Desktop\secret.txt", @"\Documents\notes.txt", @"\ntuser.dat" })
+            {
+                Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                    TestProfile + target, unrestrictedMode: false, userProfilePath: TestProfile));
+            }
+        }
+
+        [Fact]
+        public void UserProfile_NullProfile_KeepsTheUsersHardBlock()
+        {
+            // No interactive user detected — the exception cannot apply and the
+            // path stays under the plain C:\Users block.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\TestUser\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: false, userProfilePath: null));
+        }
+
+        [Fact]
+        public void UserProfile_TraversalOutOfAppData_IsBlocked()
+        {
+            // Spelling Documents as a traversal out of AppData must not survive
+            // Path.GetFullPath normalisation.
+            const string traversal = @"C:\Users\TestUser\AppData\Local\..\..\Documents\secret.txt";
+
+            Assert.Equal(@"C:\Users\TestUser\Documents\secret.txt", Path.GetFullPath(traversal));
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                traversal, unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_ForeignProfile_IsBlockedEvenUnderAppData()
+        {
+            // The exception is scoped to the DETECTED profile — a rule must not
+            // reach a second user's AppData by spelling the path out.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\OtherUser\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_AllowlistedVendorFolder_IsAllowed()
+        {
+            // AppData\Local\RealmJoin is on userProfileFilePrefixes: the file itself, a
+            // subfolder below it, and the folder itself all pass.
+            foreach (var target in new[] { @"\tray.log", @"\Logs\rj.log", "" })
+            {
+                Assert.True(GatherRuleGuards.IsFilePathAllowed(
+                    TestProfile + @"\AppData\Local\RealmJoin" + target,
+                    unrestrictedMode: false, userProfilePath: TestProfile),
+                    $"expected allowed: ...\\RealmJoin{target}");
+            }
+        }
+
+        [Fact]
+        public void UserProfile_SiblingOfAnAllowlistedVendorFolder_IsBlocked()
+        {
+            // Segment-bounded: "RealmJoin" must not admit "RealmJoinSomethingElse".
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\AppData\Local\RealmJoinSomethingElse\tray.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_AllowlistedVendorFolder_InAForeignProfile_IsBlocked()
+        {
+            // The allowlist is anchored to the DETECTED profile, not to C:\Users\*.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\OtherUser\AppData\Local\RealmJoin\tray.log",
+                unrestrictedMode: false, userProfilePath: TestProfile));
+        }
+
+        [Fact]
+        public void UserProfile_AllowlistedVendorFolder_WithoutADetectedUser_IsBlocked()
+        {
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                @"C:\Users\TestUser\AppData\Local\RealmJoin\tray.log",
+                unrestrictedMode: false, userProfilePath: null));
+        }
+
+        [Fact]
+        public void UserProfile_AppDataPath_IsAllowedInUnrestrictedMode()
+        {
+            // Where the exception does bite today: unrestricted mode returns
+            // before the allowlist, so the lifted hard block is the whole story.
+            Assert.True(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\AppData\Local\UnlistedVendor\app.log",
+                unrestrictedMode: true, userProfilePath: TestProfile));
+
+            // ...but only under AppData — Documents stays blocked even there.
+            Assert.False(GatherRuleGuards.IsFilePathAllowed(
+                TestProfile + @"\Documents\secret.txt",
+                unrestrictedMode: true, userProfilePath: TestProfile));
+        }
    }
 }
@@ -0,0 +1,92 @@
+using System;
+using AutopilotMonitor.Agent.V2.Core.Logging;
+using AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals;
+using AutopilotMonitor.Agent.V2.Core.Orchestration;
+using AutopilotMonitor.Agent.V2.Core.Tests.Harness;
+using AutopilotMonitor.Agent.V2.Core.Tests.Orchestration;
+using Xunit;
+
+namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.SystemSignals
+{
+    /// <summary>
+    /// <see cref="ProvisioningStatusTracker.TryGetPendingFailureArgs"/> exposes the registry
+    /// failure detail while its settle window is open and nothing once the window has fired —
+    /// the coordinator reads it when a Shell-Core failure terminalises first (session 683f1eff).
+    /// </summary>
+    public sealed class ProvisioningStatusTrackerPendingFailureTests
+    {
+        private static readonly DateTime Fixed = new DateTime(2026, 9, 8, 18, 11, 2, DateTimeKind.Utc);
+
+        private const string InProgressJson = @"{
+            ""categorySucceeded"": null,
+            ""AppsSubcategory"": {""subcategoryState"":""inProgress"",""subcategoryStatusText"":""Apps (Working)""}
+        }";
+        private const string AppsFailedJson = @"{
+            ""categorySucceeded"": null,
+            ""AppsSubcategory"": {""subcategoryState"":""failed"",""subcategoryStatusText"":""Apps (0x80070652)""}
+        }";
+
+        private sealed class Fixture : IDisposable
+        {
+            public TempDirectory Tmp { get; } = new TempDirectory();
+            public ProvisioningStatusTracker Tracker { get; }
+
+            public Fixture()
+            {
+                var post = new InformationalEventPost(new FakeSignalIngressSink(), new VirtualClock(Fixed));
+                var logger = new AgentLogger(Tmp.Path, AgentLogLevel.Info);
+                Tracker = new ProvisioningStatusTracker(
+                    sessionId: "S1",
+                    tenantId: "T1",
+                    post: post,
+                    logger: logger,
+                    appxScanner: new FakeAppxDeploymentFailureScanner(),
+                    backgroundDispatcher: action => action());
+            }
+
+            public void Dispose()
+            {
+                Tracker.Dispose();
+                Tmp.Dispose();
+            }
+        }
+
+        [Fact]
+        public void Nothing_pending_before_any_failure()
+        {
+            using var f = new Fixture();
+            Assert.Null(f.Tracker.TryGetPendingFailureArgs());
+
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", InProgressJson);
+            Assert.Null(f.Tracker.TryGetPendingFailureArgs());
+        }
+
+        [Fact]
+        public void Armed_settle_window_exposes_the_registry_detail()
+        {
+            using var f = new Fixture();
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", InProgressJson);
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", AppsFailedJson);
+
+            var pending = f.Tracker.TryGetPendingFailureArgs();
+
+            Assert.NotNull(pending);
+            Assert.Equal("Provisioning_DeviceSetup_Apps_Failed", pending!.FailureType);
+            Assert.Equal("0x80070652", pending.ErrorCode);
+            Assert.Equal("Apps", pending.FailedSubcategory);
+            Assert.Equal("DeviceSetup", pending.Category);
+        }
+
+        [Fact]
+        public void Expired_settle_window_leaves_nothing_pending()
+        {
+            using var f = new Fixture();
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", InProgressJson);
+            f.Tracker.ProcessCategoryStatusForTest("DeviceSetupCategory.Status", AppsFailedJson);
+
+            f.Tracker.TriggerSettleTimerForTest("DeviceSetupCategory.Status");
+
+            Assert.Null(f.Tracker.TryGetPendingFailureArgs());
+        }
+    }
+}
@@ -56,6 +56,31 @@ namespace AutopilotMonitor.Agent.V2.Core.Tests.Monitoring.Telemetry.Gather
                LoadEmbeddedGuardrails()["maxCommandLength"]!.Value<int>());
        }

+        [Fact]
+        public void User_profile_prefixes_are_all_accepted_by_the_loader()
+        {
+            // The loader drops entries outside AppData\Local / AppData\Roaming (the hard block
+            // would never release them anyway). A dropped entry is invisible at runtime — it
+            // just never matches — so a typo in the JSON must fail here instead.
+            var json = LoadEmbeddedGuardrails()["userProfileFilePrefixes"]?.ToObject<string[]>()
+                       ?? new string[0];
+
+            Assert.Equal(
+                json.Select(p => p.Trim().TrimEnd('\\')).OrderBy(p => p),
+                GatherRuleGuards.AllowedUserProfileFilePrefixes.OrderBy(p => p));
+        }
+
+        [Fact]
+        public void User_profile_prefixes_stay_under_the_hard_blocks_exception()
+        {
+            Assert.All(
+                GatherRuleGuards.AllowedUserProfileFilePrefixes,
+                prefix => Assert.Contains(
+                    GatherRuleGuards.AllowedUserProfileSubdirs,
+                    subdir => prefix.StartsWith(subdir, System.StringComparison.OrdinalIgnoreCase) &&
+                              (prefix.Length == subdir.Length || prefix[subdir.Length] == '\\')));
+        }
+
        [Fact]
        public void Blocked_event_log_channels_match_code_constants()
        {
@@ -44,6 +44,9 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        private readonly Func<bool> _userEspAppsSettledProbe;
        private readonly Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> _starvedUserEspAppsProbe;
        private readonly Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> _packageStatesProbe;
+        // Session 683f1eff: registry failure detail still sitting in an open settle window,
+        // consulted when a Shell-Core failure terminalises first (see OnShellCoreEspFailureDetected).
+        private readonly Func<EspFailureDetectedEventArgs> _pendingEspFailureProbe;

        // Session caa6cf50 gate-starvation fix (2026-06-11) — fire-once guard for the
        // user-ESP-apps-settled AccountSetup synthesis (see MaybeSynthesizeAccountSetupComplete).
@@ -174,8 +177,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        /// late "Installing-→-Error" promotion can classify the failure correctly
        /// AND refuse to promote when the failure originated outside the Apps
        /// subcategory (a non-Apps HRESULT does not describe per-app outcome).
-        /// Null when no HRESULT-carrying ESP failure has fired (or all observed
-        /// failures came from ShellCoreTracker, which has no HRESULT surface).
+        /// Null when no registry-derived failure detail has been observed — neither from
+        /// a settle window that expired nor from one a Shell-Core failure inherited.
        /// </summary>
        public Termination.EspTerminalFailureSnapshot LastEspTerminalFailure { get; private set; }

@@ -243,7 +246,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            Func<bool> accountSetupActivityProbe = null,
            Func<bool> userEspAppsSettledProbe = null,
            Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> starvedUserEspAppsProbe = null,
-            Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> packageStatesProbe = null)
+            Func<System.Collections.Generic.IReadOnlyList<Ime.AppPackageState>> packageStatesProbe = null,
+            Func<EspFailureDetectedEventArgs> pendingEspFailureProbe = null)
        {
            _sessionId = sessionId ?? throw new ArgumentNullException(nameof(sessionId));
            _tenantId = tenantId ?? throw new ArgumentNullException(nameof(tenantId));
@@ -277,6 +281,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            // provisioning tracker name not-completed apps on an Apps-subcategory failure.
            _packageStatesProbe = packageStatesProbe
                ?? (() => Array.Empty<Ime.AppPackageState>());
+            // Test seam: defaults to the provisioning tracker's open settle window (null when
+            // none is armed or the tracker is not running, e.g. Device Preparation).
+            _pendingEspFailureProbe = pendingEspFailureProbe
+                ?? (() => _provisioningTracker?.TryGetPendingFailureArgs());
        }

        /// <summary>
@@ -658,6 +666,11 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        internal void TriggerEspExitedForTest(DateTime occurredAtUtc) =>
            OnEspExited(this, new EspExitedEventArgs(occurredAtUtc));

+        // Test seam for a Shell-Core 62407 failure — drives the coordinator forwarder including
+        // the pending-settle inheritance, without a real ShellCoreTracker.
+        internal void TriggerShellCoreEspFailureForTest(string failureType) =>
+            OnShellCoreEspFailureDetected(this, failureType);
+
        // Test seam for HelloWizardStarted — same contract as TriggerEspExitedForTest.
        internal void TriggerHelloWizardStartedForTest(DateTime occurredAtUtc) =>
            OnHelloWizardStarted(this, new HelloWizardStartedEventArgs(occurredAtUtc));
@@ -673,33 +686,56 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        // Forwarder for ShellCoreTracker (event-log-derived ESP failures, e.g. Shell-Core 62407
        // failure descriptions). Source-event timestamp is mirrored so the adapter can stamp the
        // DecisionSignal with the historical instant on backfill. ShellCoreTracker has no HRESULT
-        // surface, so only FailureType is set on the args.
+        // surface; the registry detail is inherited from an open settle window (see below).
        private void OnShellCoreEspFailureDetected(object sender, string failureType)
        {
            LastEventOccurredAtUtc = (sender as ShellCoreTracker)?.LastEventOccurredAtUtc;
            try
            {
-                EspFailureDetected?.Invoke(this, new EspFailureDetectedEventArgs(failureType));
+                EspFailureDetected?.Invoke(this, BuildShellCoreFailureArgs(failureType));
            }
            catch (Exception ex) { _logger.Error($"Error forwarding ShellCore EspFailureDetected for '{failureType}'", ex); }
            finally { LastEventOccurredAtUtc = null; }
        }

-        // Forwarder for ProvisioningStatusTracker (registry-derived ESP failures). Args carry the
-        // full failure detail (FailureType, ErrorCode, FailedSubcategory, Category) extracted
-        // from the failed subcategory's statusText. Provisioning has no source-event timestamp
-        // surfaced today, so the adapter falls back to clock.
-        private void OnProvisioningEspFailureDetected(object sender, EspFailureDetectedEventArgs args)
+        // Session 683f1eff: the Shell-Core 62407 failure usually lands INSIDE the provisioning
+        // tracker's 30-s settle window — after the registry named the failed subcategory and its
+        // HRESULT, before the settle timer would have forwarded them. The engine terminalises on
+        // the first EspTerminalFailure and the agent stops seconds later, so whatever this signal
+        // carries is all the terminal event, the backend FailureReason and the termination-time
+        // app classification ever see (a third of all ESP terminal failures took this path). The
+        // pending detail is inherited here; FailureType stays the Shell-Core value because that
+        // is the signal that actually terminalised.
+        private EspFailureDetectedEventArgs BuildShellCoreFailureArgs(string failureType)
+        {
+            EspFailureDetectedEventArgs pending = null;
+            try { pending = _pendingEspFailureProbe(); }
+            catch (Exception ex) { _logger.Warning($"EspAndHelloTracker: pending ESP failure probe threw: {ex.Message}"); }
+
+            if (pending == null)
+                return new EspFailureDetectedEventArgs(failureType);
+
+            RecordTerminalFailureSnapshot(pending);
+            _logger.Info(
+                $"EspAndHelloTracker: Shell-Core failure '{failureType}' inherits the pending provisioning failure detail " +
+                $"(category={pending.Category ?? "n/a"}, failedSubcategory={pending.FailedSubcategory ?? "n/a"}, " +
+                $"errorCode={pending.ErrorCode ?? "n/a"})");
+            return new EspFailureDetectedEventArgs(
+                failureType,
+                errorCode: pending.ErrorCode,
+                failedSubcategory: pending.FailedSubcategory,
+                category: pending.Category,
+                likelyCulpritApps: pending.LikelyCulpritApps);
+        }
+
+        // Session 080edee9 follow-up + Codex review (P2/P3) — snapshot the full failure context
+        // (HRESULT + failedSubcategory + category) so EnrollmentTerminationHandler can read it on
+        // the terminal-failure pathway. Only update when the args carry at least one of the three
+        // fields, so a bare Shell-Core failure cannot wipe out the registry snapshot. Deliberately
+        // NOT gated on ErrorCode alone — a non-Apps subcategory failure without HRESULT is still
+        // useful for downstream "should we promote?" gating.
+        private void RecordTerminalFailureSnapshot(EspFailureDetectedEventArgs args)
        {
-            LastEventOccurredAtUtc = null;
-            // Session 080edee9 follow-up + Codex review (P2/P3) — snapshot the full
-            // failure context (HRESULT + failedSubcategory + category) before
-            // forwarding so EnrollmentTerminationHandler can read it on the terminal-
-            // failure pathway. Only update when the args carry at least one of the
-            // three fields, so a later ShellCore-derived failure (which has none of
-            // them) cannot wipe out the registry snapshot. We deliberately do NOT
-            // gate on ErrorCode alone — a non-Apps subcategory failure without
-            // HRESULT is still useful for downstream "should we promote?" gating.
            if (!string.IsNullOrEmpty(args?.ErrorCode)
                || !string.IsNullOrEmpty(args?.FailedSubcategory)
                || !string.IsNullOrEmpty(args?.Category))
@@ -709,6 +745,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
                    failedSubcategory: args.FailedSubcategory,
                    category: args.Category);
            }
+        }
+
+        // Forwarder for ProvisioningStatusTracker (registry-derived ESP failures). Args carry the
+        // full failure detail (FailureType, ErrorCode, FailedSubcategory, Category) extracted
+        // from the failed subcategory's statusText. Provisioning has no source-event timestamp
+        // surfaced today, so the adapter falls back to clock.
+        private void OnProvisioningEspFailureDetected(object sender, EspFailureDetectedEventArgs args)
+        {
+            LastEventOccurredAtUtc = null;
+            RecordTerminalFailureSnapshot(args);
            try
            {
                EspFailureDetected?.Invoke(this, args);
@@ -80,6 +80,14 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
            "AccountSetupCategory.Status"
        };

+        // Order in which TryGetPendingFailureArgs resolves concurrently armed settle windows.
+        private static readonly string[] PendingFailurePreference =
+        {
+            "DeviceSetupCategory.Status",
+            "AccountSetupCategory.Status",
+            "DevicePreparationCategory.Status"
+        };
+
        private readonly AgentLogger _logger;
        private readonly string _sessionId;
        private readonly string _tenantId;
@@ -1711,6 +1719,29 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Enrollment.SystemSignals
        internal void TriggerSettleTimerForTest(string categoryName)
            => OnProvisioningFailureSettleExpired(categoryName);

+        /// <summary>
+        /// The registry-derived failure detail of a settle window that is still open (armed,
+        /// not yet expired or retracted) — null when none is pending. Read by the coordinator
+        /// when a Shell-Core 62407 failure arrives inside the window, so the terminal signal
+        /// inherits HRESULT / failed subcategory / category instead of racing them away
+        /// (session 683f1eff). Windows fail one category at a time, but should two be armed
+        /// the device-phase category wins: it is the one the ESP page reports.
+        /// </summary>
+        internal EspFailureDetectedEventArgs TryGetPendingFailureArgs()
+        {
+            lock (_stateLock)
+            {
+                if (_provisioningFailureSettleArgs == null || _provisioningFailureSettleArgs.Count == 0)
+                    return null;
+                foreach (var category in PendingFailurePreference)
+                {
+                    if (_provisioningFailureSettleArgs.TryGetValue(category, out var args) && args != null)
+                        return args;
+                }
+                return null;
+            }
+        }
+
        private bool HasCategorySucceededChanged(string categoryName, bool? newValue)
        {
            if (!_lastCategorySucceeded.TryGetValue(categoryName, out var oldValue))
@@ -70,12 +70,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
            @"C:\Windows\System32\config",  // SAM, SECURITY, SYSTEM hives
        };

-        // Allowed subdirectories under a user profile (used with %LOGGED_ON_USER_PROFILE% token)
-        private static readonly string[] AllowedUserProfileSubdirs = new[]
-        {
-            @"AppData\Local",
-            @"AppData\Roaming",
-        };
+        // The allowed user-profile subdirectories and the vendor allowlist under them live in
+        // GatherRuleGuards, which owns the embedded guardrails.json — one copy for both guards.

        /// <summary>
        /// Returns true if the given path is allowed for diagnostics collection.
@@ -135,7 +131,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
                    (normalizedDir.Length == BlockedUsersPrefix.Length ||
                     normalizedDir[BlockedUsersPrefix.Length] == Path.DirectorySeparatorChar))
                {
-                    if (!IsUserProfileSubpathAllowed(normalizedDir, userProfilePath))
+                    if (!GatherRuleGuards.IsUserProfileSubpathAllowed(normalizedDir, userProfilePath))
                        return false;
                }

@@ -169,7 +165,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
                    }
                }

-                return false;
+                // Vendor folders under the signed-in user's profile — same allowlist the file
+                // collectors use, since it answers the same question: which folders below a
+                // profile carry enrollment-relevant logs rather than the user's own data.
+                return GatherRuleGuards.IsUserProfilePathOnAllowlist(normalizedDir, userProfilePath);
            }
            catch
            {
@@ -178,38 +177,6 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
            }
        }

-        /// <summary>
-        /// Returns true if the normalized path falls under one of the allowed subdirectories
-        /// of the detected user profile (AppData\Local, AppData\Roaming).
-        /// Only applies when %LOGGED_ON_USER_PROFILE% was used to resolve the path.
-        /// </summary>
-        internal static bool IsUserProfileSubpathAllowed(string normalizedPath, string userProfilePath)
-        {
-            if (string.IsNullOrEmpty(userProfilePath))
-                return false;
-
-            try
-            {
-                var normalizedProfile = Path.GetFullPath(userProfilePath);
-                foreach (var subdir in AllowedUserProfileSubdirs)
-                {
-                    var allowedPrefix = Path.GetFullPath(Path.Combine(normalizedProfile, subdir));
-                    if (normalizedPath.StartsWith(allowedPrefix, StringComparison.OrdinalIgnoreCase) &&
-                        (normalizedPath.Length == allowedPrefix.Length ||
-                         normalizedPath[allowedPrefix.Length] == Path.DirectorySeparatorChar))
-                    {
-                        return true;
-                    }
-                }
-            }
-            catch
-            {
-                // Path normalization failure — deny
-            }
-
-            return false;
-        }
-
        /// <summary>
        /// Checks whether any component of the path (directories or file) is a symlink,
        /// junction, or other reparse point. Returns true if a reparse point is detected.
@@ -32,6 +32,16 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
        // -----------------------------------------------------------------------
        public static readonly IReadOnlyList<string> AllowedRegistryPrefixes;
        public static readonly IReadOnlyList<string> AllowedFilePrefixes;
+
+        /// <summary>
+        /// Folders under the signed-in user's profile that file collectors and
+        /// admin-configured diagnostics paths may read, RELATIVE to the profile root
+        /// (e.g. <c>AppData\Local\Vendor</c>). Resolved against the path
+        /// %LOGGED_ON_USER_PROFILE% produced, at match time — the profile name is not
+        /// known when the list is authored, which is why these entries cannot live in
+        /// <see cref="AllowedFilePrefixes"/> (matched literally against the expanded path).
+        /// </summary>
+        public static readonly IReadOnlyList<string> AllowedUserProfileFilePrefixes;
        public static readonly IReadOnlyList<string> AllowedWmiQueryPrefixes;
        public static readonly IReadOnlyCollection<string> AllowedCommands;
        public static readonly IReadOnlyList<string> AllowedEventLogChannels;
@@ -63,8 +73,10 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
            Path.GetFullPath(@"C:\Windows\System32\config"),  // SAM, SECURITY, SYSTEM hives
        };

-        // Allowed subdirectories under a user profile (used with %LOGGED_ON_USER_PROFILE% token)
-        private static readonly string[] AllowedUserProfileSubdirs = new[]
+        // The only subdirectories of a user profile the C:\Users hard block will ever
+        // release (used with %LOGGED_ON_USER_PROFILE%). Single copy for both guards —
+        // DiagnosticsPathGuards delegates here.
+        internal static readonly string[] AllowedUserProfileSubdirs = new[]
        {
            @"AppData\Local",
            @"AppData\Roaming",
@@ -118,6 +130,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather

                    AllowedRegistryPrefixes = FlattenCategorized(obj, "registryPrefixes", "prefixes");
                    AllowedFilePrefixes = obj["filePrefixes"]?.ToObject<List<string>>() ?? new List<string>();
+                    AllowedUserProfileFilePrefixes = LoadUserProfilePrefixes(obj);
                    AllowedWmiQueryPrefixes = obj["wmiQueryPrefixes"]?.ToObject<List<string>>() ?? new List<string>();

                    var commands = FlattenCategorized(obj, "allowedCommands", "commands");
@@ -136,6 +149,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather

            AllowedRegistryPrefixes = new List<string>();
            AllowedFilePrefixes = new List<string>();
+            AllowedUserProfileFilePrefixes = new List<string>();
            AllowedWmiQueryPrefixes = new List<string>();
            AllowedCommands = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
            AllowedEventLogChannels = new List<string>();
@@ -143,6 +157,43 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
            ResidualWmiPrefixes = new List<string>();
        }

+        /// <summary>
+        /// Reads <c>userProfileFilePrefixes</c> and drops every entry that is rooted, carries a
+        /// traversal, or does not sit under one of <see cref="AllowedUserProfileSubdirs"/>.
+        /// The C:\Users hard block releases nothing outside AppData, so such an entry could only
+        /// ever be dead text — dropping it at load keeps the list honest instead of silently
+        /// ineffective, and no configuration can widen the hard block's exception.
+        /// </summary>
+        private static List<string> LoadUserProfilePrefixes(JObject obj)
+        {
+            var raw = obj["userProfileFilePrefixes"]?.ToObject<List<string>>() ?? new List<string>();
+            var result = new List<string>();
+
+            foreach (var entry in raw)
+            {
+                if (string.IsNullOrWhiteSpace(entry))
+                    continue;
+
+                var trimmed = entry.Trim().TrimEnd('\\');
+                if (Path.IsPathRooted(trimmed))
+                    continue;
+                if (trimmed.IndexOf("..", StringComparison.Ordinal) >= 0)
+                    continue;
+
+                foreach (var subdir in AllowedUserProfileSubdirs)
+                {
+                    if (trimmed.StartsWith(subdir, StringComparison.OrdinalIgnoreCase) &&
+                        (trimmed.Length == subdir.Length || trimmed[subdir.Length] == '\\'))
+                    {
+                        result.Add(trimmed);
+                        break;
+                    }
+                }
+            }
+
+            return result;
+        }
+
        private static void DeriveWmiClassAllowlist(
            IReadOnlyList<string> entries,
            out HashSet<string> classes,
@@ -265,12 +316,13 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather

            // C:\Users block always applies (even in unrestricted mode)
            // Exception: paths under <userProfilePath>\AppData\Local or AppData\Roaming
-            // are allowed when the %LOGGED_ON_USER_PROFILE% token was used.
+            // are allowed when the %LOGGED_ON_USER_PROFILE% token was used. The exception
+            // only LIFTS the block — in restricted mode the allowlist below still decides.
            if (normalizedPath.StartsWith(BlockedUsersPrefix, StringComparison.OrdinalIgnoreCase) &&
                (normalizedPath.Length == BlockedUsersPrefix.Length ||
                 normalizedPath[BlockedUsersPrefix.Length] == Path.DirectorySeparatorChar))
            {
-                if (!DiagnosticsPathGuards.IsUserProfileSubpathAllowed(normalizedPath, userProfilePath))
+                if (!IsUserProfileSubpathAllowed(normalizedPath, userProfilePath))
                    return false;
            }

@@ -288,9 +340,61 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Telemetry.Gather
            if (unrestrictedMode)
                return true;

-            return AllowedFilePrefixes.Any(prefix =>
+            if (AllowedFilePrefixes.Any(prefix =>
                normalizedPath.StartsWith(prefix, StringComparison.OrdinalIgnoreCase) &&
-                (normalizedPath.Length == prefix.Length || normalizedPath[prefix.Length] == '\\'));
+                (normalizedPath.Length == prefix.Length || normalizedPath[prefix.Length] == '\\')))
+            {
+                return true;
+            }
+
+            // Vendor folders under the signed-in user's profile. Only reachable when the rule
+            // spelled %LOGGED_ON_USER_PROFILE% and the resolver found an interactive user —
+            // a null profile denies, so a machine with nobody signed in cannot widen anything.
+            return IsUserProfilePathOnAllowlist(normalizedPath, userProfilePath);
+        }
+
+        /// <summary>
+        /// True when the normalized path sits under one of <see cref="AllowedUserProfileSubdirs"/>
+        /// of the detected user profile. This is the C:\Users hard block's only exception; it
+        /// releases the block and nothing else. A null profile denies.
+        /// </summary>
+        internal static bool IsUserProfileSubpathAllowed(string normalizedPath, string userProfilePath)
+            => AllowedUserProfileSubdirs.Any(subdir =>
+                   MatchesProfileRelativePrefix(normalizedPath, userProfilePath, subdir));
+
+        /// <summary>
+        /// True when the normalized path is admitted by an entry of
+        /// <see cref="AllowedUserProfileFilePrefixes"/> under the detected user profile.
+        /// </summary>
+        internal static bool IsUserProfilePathOnAllowlist(string normalizedPath, string userProfilePath)
+            => AllowedUserProfileFilePrefixes.Any(prefix =>
+                   MatchesProfileRelativePrefix(normalizedPath, userProfilePath, prefix));
+
+        /// <summary>
+        /// Segment-bounded match of <paramref name="normalizedPath"/> against
+        /// &lt;profile&gt;\&lt;relativePrefix&gt;. Both sides go through Path.GetFullPath, so a
+        /// traversal spelled into either one cannot slip past the boundary check.
+        /// </summary>
+        private static bool MatchesProfileRelativePrefix(
+            string normalizedPath, string userProfilePath, string relativePrefix)
+        {
+            if (string.IsNullOrEmpty(normalizedPath) || string.IsNullOrEmpty(userProfilePath))
+                return false;
+
+            try
+            {
+                var allowedPrefix = Path.GetFullPath(
+                    Path.Combine(Path.GetFullPath(userProfilePath), relativePrefix));
+
+                return normalizedPath.StartsWith(allowedPrefix, StringComparison.OrdinalIgnoreCase) &&
+                       (normalizedPath.Length == allowedPrefix.Length ||
+                        normalizedPath[allowedPrefix.Length] == Path.DirectorySeparatorChar);
+            }
+            catch
+            {
+                // Path normalization failure — deny.
+                return false;
+            }
        }

        /// <summary>
@@ -10,7 +10,7 @@ using Microsoft.Extensions.Logging.Abstractions;
 namespace AutopilotMonitor.Functions.Tests;

 /// <summary>
-/// Tests for <see cref="LatestVersionsService"/> — the 12h-cached reader for the
+/// Tests for <see cref="LatestVersionsService"/> — the short-TTL reader for the
 /// public <c>version.json</c> blob. Verifies cache hit/miss, forceRefresh bypass,
 /// and failure fallback without hammering the blob on every call.
 /// </summary>
@@ -140,6 +140,28 @@ public class LatestVersionsServiceTests
        Assert.Equal(1, handler.CallCount);
    }

+    [Fact]
+    public async Task GetAsync_HttpFailure_AfterSuccess_ServesLastKnownGood()
+    {
+        var (svc, handler, _) = Create();
+
+        await svc.GetAsync(forceRefresh: false, CancellationToken.None);
+        handler.Responder = _ => new HttpResponseMessage(HttpStatusCode.InternalServerError);
+
+        // The refresh fails, but the version line must not blank out: the last good
+        // value stands until the blob answers again.
+        var afterFailure = await svc.GetAsync(forceRefresh: true, CancellationToken.None);
+
+        Assert.NotNull(afterFailure);
+        Assert.Equal("1.0.706", afterFailure!.AgentVersion);
+        Assert.True(afterFailure.FromCache);
+
+        // ...and it is what the short failure cache serves to the next callers, too.
+        var next = await svc.GetAsync(forceRefresh: false, CancellationToken.None);
+        Assert.Equal("1.0.706", next!.AgentVersion);
+        Assert.Equal(2, handler.CallCount);
+    }
+
    [Fact]
    public async Task GetAsync_MalformedJson_ReturnsNull()
    {
@@ -7,19 +7,21 @@ using Moq;
 namespace AutopilotMonitor.Functions.Tests;

 /// <summary>
-/// Pins ANALYZE-ESP-004 ("ESP Timeout with 'Continue Anyway' — Soft Failure").
+/// Pins ANALYZE-ESP-004 ("ESP Gave Up on a Blocking App with 'Continue Anyway' — Soft Failure").
 ///
 /// Background (tenant c9787ba2, session cb7036a6): a slow blocking app (Encompass
 /// Hybrid Installer) does not finish inside the 30-min Device-ESP window, so the ESP
 /// fails terminally in DeviceSetup. The profile allows "Continue anyway", so the user
 /// most likely dismissed the failure screen and reached the desktop — but the agent
-/// only ever sees the terminal failure and the session is recorded as Failed. The
-/// DecisionEngine already stamps the enrollment_failed event with
-/// <c>mayHaveContinuedAnyway=true</c>; this rule turns that into a customer-visible
-/// "soft failure" advisory with the root-cause remediation.
+/// only ever sees the terminal failure and the session is recorded as Failed.
 ///
-/// The rule keys ONLY on <c>mayHaveContinuedAnyway==true</c> (set exclusively on the
-/// ESP terminal-failure path), so an ordinary hard failure must not trip it.
+/// The rule needs THREE facts: the terminal enrollment_failed, the DecisionEngine's
+/// <c>mayHaveContinuedAnyway=true</c> stamp (profile allows the button), and the agent's own
+/// timeout verdict — an app_install_failed promoted with <c>failureType=esp_apps_timeout</c>
+/// (ESP gave up while the app was still installing, no per-app HRESULT). Session 683f1eff:
+/// an ESP failure with a real HRESULT (0x80070652, installer collision) on a Continue-anyway
+/// profile fired the rule and rendered the configured 90-min limit as if it had elapsed —
+/// the continue-anyway flag alone proves nothing about timing.
 /// </summary>
 public class RuleEngineEspSoftFailureTests
 {
@@ -37,8 +39,9 @@ public class RuleEngineEspSoftFailureTests

        var events = new List<EnrollmentEvent>
        {
+            SettleStartedEvent(errorCode: null),
            EnrollmentFailedEvent(mayHaveContinuedAnyway: "true"),
-            AppInstallFailed(),
+            AppInstallFailed(failureType: "esp_apps_timeout"),
        };

        var outcome = await RunAsync(rule, events);
@@ -47,13 +50,15 @@ public class RuleEngineEspSoftFailureTests
        Assert.Equal("ANALYZE-ESP-004", result.RuleId);
        Assert.Equal("warning", result.Severity);

-        // Required gate matched on the continue-anyway flag.
+        // Required gates: the continue-anyway flag AND the agent's timeout verdict.
        var gate = AsDict(result.MatchedConditions["may_have_continued"]);
        Assert.Equal("true", AsString(gate["value"]));
+        var verdict = AsDict(result.MatchedConditions["esp_gave_up_on_app"]);
+        Assert.Equal("esp_apps_timeout", AsString(verdict["value"]));

-        // Interpolation material for the explanation / remediation templates is present:
-        // {{espSyncFailureTimeoutMinutes}}, {{failedSubcategory}} (from enrollment_failed)
-        // and {{appName}} (from app_install_failed).
+        // Interpolation material: {{espSyncFailureTimeoutMinutes}} (enrollment_failed),
+        // {{failedSubcategory}} (esp_failure_settle_started — the terminal event drops it when
+        // the Shell-Core failure wins the race) and {{appName}} (the promoted app).
        var timeout = AsDict(result.MatchedConditions["espSyncFailureTimeoutMinutes"]);
        Assert.Equal("30", AsString(timeout["value"]));

@@ -65,6 +70,48 @@ public class RuleEngineEspSoftFailureTests
        Assert.Equal(FailedAppName, AsString(failedApp["value"]));
    }

+    [Fact]
+    public async Task ANALYZE_ESP_004_stays_silent_on_a_hard_failure_with_continue_anyway()
+    {
+        // Session 683f1eff: continue-anyway profile, but the ESP failed on a real installer
+        // error (0x80070652 / MSI 1618) after 19 minutes. The failed app carries no
+        // esp_apps_timeout verdict — the rule must not turn an installer collision into
+        // "the ESP reached its 90-min timeout".
+        var rule = BuiltInAnalyzeRules.GetAll().First(r => r.RuleId == "ANALYZE-ESP-004");
+
+        var events = new List<EnrollmentEvent>
+        {
+            SettleStartedEvent(errorCode: "0x80070652"),
+            EnrollmentFailedEvent(mayHaveContinuedAnyway: "true"),
+            AppInstallFailed(failureType: null, exitCodeClass: "Retry"),
+        };
+
+        var outcome = await RunAsync(rule, events);
+        Assert.Empty(outcome.Results);
+    }
+
+    [Fact]
+    public async Task ANALYZE_ESP_004_names_the_timed_out_app_not_another_failed_one()
+    {
+        // Two failed apps: one hard installer failure earlier in the run, one promoted
+        // esp_apps_timeout at the terminal. {{appName}} must be the timed-out app.
+        var rule = BuiltInAnalyzeRules.GetAll().First(r => r.RuleId == "ANALYZE-ESP-004");
+
+        var events = new List<EnrollmentEvent>
+        {
+            AppInstallFailed(failureType: null, exitCodeClass: "Failed", appName: "Contoso Agent", sequence: 100),
+            SettleStartedEvent(errorCode: null),
+            EnrollmentFailedEvent(mayHaveContinuedAnyway: "true"),
+            AppInstallFailed(failureType: "esp_apps_timeout"),
+        };
+
+        var outcome = await RunAsync(rule, events);
+
+        var result = Assert.Single(outcome.Results);
+        var failedApp = AsDict(result.MatchedConditions["appName"]);
+        Assert.Equal(FailedAppName, AsString(failedApp["value"]));
+    }
+
    [Fact]
    public async Task ANALYZE_ESP_004_does_not_fire_when_continue_anyway_is_false()
    {
@@ -75,7 +122,7 @@ public class RuleEngineEspSoftFailureTests
        var events = new List<EnrollmentEvent>
        {
            EnrollmentFailedEvent(mayHaveContinuedAnyway: "false"),
-            AppInstallFailed(),
+            AppInstallFailed(failureType: "esp_apps_timeout"),
        };

        var outcome = await RunAsync(rule, events);
@@ -92,7 +139,7 @@ public class RuleEngineEspSoftFailureTests
        var events = new List<EnrollmentEvent>
        {
            EnrollmentFailedEvent(mayHaveContinuedAnyway: null),
-            AppInstallFailed(),
+            AppInstallFailed(failureType: "esp_apps_timeout"),
        };

        var outcome = await RunAsync(rule, events);
@@ -132,23 +179,61 @@ public class RuleEngineEspSoftFailureTests
        return data;
    }

-    private static EnrollmentEvent AppInstallFailed() => new()
+    private static EnrollmentEvent SettleStartedEvent(string? errorCode)
    {
-        EventId = Guid.NewGuid().ToString(),
-        TenantId = TenantId,
-        SessionId = SessionId,
-        EventType = "app_install_failed",
-        Timestamp = DateTime.UtcNow,
-        Sequence = 220,
-        Data = new Dictionary<string, object>
+        var data = new Dictionary<string, object>
        {
-            ["appName"] = FailedAppName,
+            ["category"] = "DeviceSetup",
+            ["failedSubcategory"] = "Certificates",
+            ["failureType"] = "Provisioning_DeviceSetup_Certificates_Failed",
+            ["settleSeconds"] = 30,
+            ["reason"] = "wait_for_late_ime_signals",
+        };
+        if (errorCode != null)
+            data["errorCode"] = errorCode;
+        return new EnrollmentEvent
+        {
+            EventId = Guid.NewGuid().ToString(),
+            TenantId = TenantId,
+            SessionId = SessionId,
+            EventType = "esp_failure_settle_started",
+            Timestamp = DateTime.UtcNow,
+            Sequence = 212,
+            Data = data,
+        };
+    }
+
+    private static EnrollmentEvent AppInstallFailed(
+        string? failureType,
+        string? exitCodeClass = null,
+        string appName = FailedAppName,
+        int sequence = 220)
+    {
+        var data = new Dictionary<string, object>
+        {
+            ["appName"] = appName,
            ["state"] = "Error",
            ["targeted"] = "Device",
-            ["failureType"] = "esp_apps_timeout",
-            ["errorDetail"] = "Install status unconfirmed — ESP gave up while this app was still installing.",
+        };
+        if (failureType != null)
+        {
+            data["failureType"] = failureType;
+            data["confidence"] = "presumed";
+            data["errorDetail"] = "Install status unconfirmed — ESP gave up while this app was still installing.";
        }
-    };
+        if (exitCodeClass != null)
+            data["exitCodeClass"] = exitCodeClass;
+        return new EnrollmentEvent
+        {
+            EventId = Guid.NewGuid().ToString(),
+            TenantId = TenantId,
+            SessionId = SessionId,
+            EventType = "app_install_failed",
+            Timestamp = DateTime.UtcNow,
+            Sequence = sequence,
+            Data = data,
+        };
+    }

    private static Dictionary<string, object> AsDict(object o)
    {
@@ -7,12 +7,17 @@ using Moq;
 namespace AutopilotMonitor.Functions.Tests;

 /// <summary>
-/// Pins the absence gate on <c>event_type</c> conditions: <c>not_exists</c> without a
-/// <c>dataField</c> matches when no event of that type occurs in the session and is disproved by
-/// a single such event. Before this branch an absent type always evaluated false, so a required
-/// "must not have happened" condition could never be expressed (ANALYZE-ID-004 v2 relies on it).
-/// The dataField variant keeps its historical meaning (some event of the type has an empty field)
-/// and is not touched here.
+/// Pins the absence gates on conditions.
+///
+/// Without a <c>dataField</c>, <c>not_exists</c> matches when no event of that type occurs in
+/// the session and is disproved by a single such event (ANALYZE-ID-004 v2 relies on it).
+///
+/// With a <c>dataField</c>, <c>not_exists</c> matches when no event of the type carries a
+/// non-empty value at that field — including when the type is absent — and is disproved by a
+/// single non-empty value; on <c>event_data</c> the same-event filter narrows the inspected set
+/// first. Before this the per-event loop's null short-circuit rejected a missing field before
+/// the operator ever ran, so "the ESP failure carried no HRESULT" (session 683f1eff) could not be
+/// expressed at all, while the precondition gate already had the absence semantics.
 /// </summary>
 public class RuleEngineEventTypeNotExistsTests
 {
@@ -24,7 +29,7 @@ public class RuleEngineEventTypeNotExistsTests
    {
        var events = new List<EnrollmentEvent> { Event("marker_seen", 1) };

-        var outcome = await RunAsync(Rule(), events);
+        var outcome = await RunAsync(TypeAbsenceRule(), events);

        var result = Assert.Single(outcome.Results);
        var evidence = Assert.IsType<Dictionary<string, object>>(result.MatchedConditions["disproof_absent"]);
@@ -37,12 +42,111 @@ public class RuleEngineEventTypeNotExistsTests
    {
        var events = new List<EnrollmentEvent> { Event("marker_seen", 1), Event("disproof", 2) };

-        var outcome = await RunAsync(Rule(), events);
+        var outcome = await RunAsync(TypeAbsenceRule(), events);

        Assert.Empty(outcome.Results);
    }

-    private static AnalyzeRule Rule() => new()
+    [Fact]
+    public async Task Field_not_exists_matches_when_no_event_carries_the_field()
+    {
+        // The event type is present, the field is not — the shape of an ESP failure without an
+        // HRESULT (esp_failure_settle_started without errorCode).
+        var events = new List<EnrollmentEvent> { Event("marker_seen", 1), Event("disproof", 2) };
+
+        var outcome = await RunAsync(FieldAbsenceRule("event_type"), events);
+
+        var result = Assert.Single(outcome.Results);
+        var evidence = Assert.IsType<Dictionary<string, object>>(result.MatchedConditions["code_absent"]);
+        Assert.Equal("disproof", evidence["eventType"]);
+        Assert.Equal("errorCode", evidence["field"]);
+        Assert.Equal(1, evidence["count"]);
+    }
+
+    [Fact]
+    public async Task Field_not_exists_matches_when_the_event_type_is_absent()
+    {
+        var events = new List<EnrollmentEvent> { Event("marker_seen", 1) };
+
+        var outcome = await RunAsync(FieldAbsenceRule("event_type"), events);
+
+        var result = Assert.Single(outcome.Results);
+        var evidence = Assert.IsType<Dictionary<string, object>>(result.MatchedConditions["code_absent"]);
+        Assert.Equal(0, evidence["count"]);
+    }
+
+    [Theory]
+    [InlineData("event_type")]
+    [InlineData("event_data")]
+    public async Task A_non_empty_value_on_any_event_vetoes_a_required_field_not_exists(string source)
+    {
+        var events = new List<EnrollmentEvent>
+        {
+            Event("marker_seen", 1),
+            Event("disproof", 2),
+            Event("disproof", 3, ("errorCode", "0x80070652")),
+        };
+
+        var outcome = await RunAsync(FieldAbsenceRule(source), events);
+
+        Assert.Empty(outcome.Results);
+    }
+
+    [Fact]
+    public async Task An_empty_string_does_not_count_as_a_carried_value()
+    {
+        var events = new List<EnrollmentEvent> { Event("marker_seen", 1), Event("disproof", 2, ("errorCode", "")) };
+
+        var outcome = await RunAsync(FieldAbsenceRule("event_type"), events);
+
+        Assert.Single(outcome.Results);
+    }
+
+    [Fact]
+    public async Task Event_data_field_not_exists_inspects_only_the_filtered_events()
+    {
+        // The carrier of the field is filtered out (kind=a); among kind=b events nobody carries it.
+        var events = new List<EnrollmentEvent>
+        {
+            Event("marker_seen", 1),
+            Event("disproof", 2, ("kind", "a"), ("errorCode", "0x80070652")),
+            Event("disproof", 3, ("kind", "b")),
+        };
+
+        var matched = await RunAsync(FieldAbsenceRule("event_data", filterKind: "b"), events);
+        var result = Assert.Single(matched.Results);
+        var evidence = Assert.IsType<Dictionary<string, object>>(result.MatchedConditions["code_absent"]);
+        Assert.Equal(1, evidence["count"]);
+
+        var vetoed = await RunAsync(FieldAbsenceRule("event_data", filterKind: "a"), events);
+        Assert.Empty(vetoed.Results);
+    }
+
+    private static AnalyzeRule TypeAbsenceRule() => Rule(
+        new RuleCondition { Signal = "disproof_absent", Source = "event_type", EventType = "disproof", Operator = "not_exists", Value = "", Required = true });
+
+    private static AnalyzeRule FieldAbsenceRule(string source, string? filterKind = null)
+    {
+        var absence = new RuleCondition
+        {
+            Signal = "code_absent",
+            Source = source,
+            EventType = "disproof",
+            DataField = "errorCode",
+            Operator = "not_exists",
+            Value = "",
+            Required = true,
+        };
+        if (filterKind != null)
+        {
+            absence.FilterField = "kind";
+            absence.FilterOperator = "equals";
+            absence.FilterValue = filterKind;
+        }
+        return Rule(absence);
+    }
+
+    private static AnalyzeRule Rule(RuleCondition absence) => new()
    {
        // Custom-namespace rule: a built-in ID outside the live catalog is hidden by the
        // sunset filter in AnalyzeRuleService (IsBuiltIn defaults to true).
@@ -58,11 +162,11 @@ public class RuleEngineEventTypeNotExistsTests
        Conditions = new List<RuleCondition>
        {
            new() { Signal = "marker", Source = "event_type", EventType = "marker_seen", Operator = "exists", Value = "", Required = true },
-            new() { Signal = "disproof_absent", Source = "event_type", EventType = "disproof", Operator = "not_exists", Value = "", Required = true },
+            absence,
        },
    };

-    private static EnrollmentEvent Event(string eventType, int sequence) => new()
+    private static EnrollmentEvent Event(string eventType, int sequence, params (string key, string value)[] data) => new()
    {
        EventId = Guid.NewGuid().ToString(),
        TenantId = TenantId,
@@ -70,7 +174,7 @@ public class RuleEngineEventTypeNotExistsTests
        EventType = eventType,
        Timestamp = DateTime.UtcNow.AddMinutes(sequence),
        Sequence = sequence,
-        Data = new Dictionary<string, object>(),
+        Data = data.ToDictionary(d => d.key, d => (object)d.value),
    };

    private static async Task<AnalysisOutcome> RunAsync(AnalyzeRule rule, List<EnrollmentEvent> events)
@@ -13,7 +13,7 @@ namespace AutopilotMonitor.Functions.Functions.Config
 {
    /// <summary>
    /// Returns the latest published agent + bootstrap script versions.
-    /// Cached in-memory for 12h; supports <c>?refresh=true</c> to bypass the cache.
+    /// Cached in-memory for a few minutes; supports <c>?refresh=true</c> to bypass the cache.
    /// Authenticated users only (read-only metadata).
    /// </summary>
    public class GetLatestVersionsFunction
@@ -44,15 +44,18 @@ namespace AutopilotMonitor.Functions.Functions.Config

                var response = req.CreateResponse(HttpStatusCode.OK);

-                // Force-refresh responses MUST NOT be browser-cached.
-                // Normal cached responses may be stored for up to 1h (aligns with 12h backend cache).
+                // Force-refresh responses MUST NOT be browser-cached. Normal responses are
+                // held for a minute only: the portal announces this number as "Latest agent
+                // version" right after a release, and a browser cache measured in hours would
+                // keep showing the previous release long after the backend refreshed. The
+                // payload is a few dozen bytes, so revalidating often is free.
                if (forceRefresh)
                {
                    response.Headers.Add("Cache-Control", "no-store");
                }
                else
                {
-                    response.Headers.Add("Cache-Control", "public, max-age=3600");
+                    response.Headers.Add("Cache-Control", "public, max-age=60");
                }

                await response.WriteAsJsonAsync(new GetLatestVersionsResponse
@@ -11,8 +11,14 @@ namespace AutopilotMonitor.Functions.Services
 {
    /// <summary>
    /// Exposes the latest published agent/bootstrap versions as read from the
-    /// public <c>version.json</c> blob. Caches the result in memory for 12h
-    /// (short TTL on transient failures). Admin endpoint can force-refresh.
+    /// public <c>version.json</c> blob. The TTL is deliberately short: this number is
+    /// what the portal announces right after a release ("Latest agent version" in the
+    /// What's new panel), so a long cache shows the previous release for hours — and
+    /// because the cache is per Function instance, different instances would announce
+    /// different versions at the same time. The origin is a 200-byte no-cache blob
+    /// behind the download alias, so refetching it every few minutes costs nothing.
+    /// On a fetch failure the last known good value is kept rather than blanking the
+    /// display. Admin endpoint can force-refresh.
    /// </summary>
    public interface ILatestVersionsService
    {
@@ -33,13 +39,19 @@ namespace AutopilotMonitor.Functions.Services
        // it could silently serve a stale version while the release pipeline is green.
        public const string VersionJsonUrl = Constants.AgentDownloadBaseUrl + "/" + Constants.AgentVersionFileName;
        private const string CacheKey = "latest-versions";
-        private static readonly TimeSpan CacheDuration = TimeSpan.FromHours(12);
-        private static readonly TimeSpan FailureCacheDuration = TimeSpan.FromMinutes(5);
+        private static readonly TimeSpan CacheDuration = TimeSpan.FromMinutes(5);
+        private static readonly TimeSpan FailureCacheDuration = TimeSpan.FromMinutes(1);

        private readonly IHttpClientFactory _httpClientFactory;
        private readonly IMemoryCache _cache;
        private readonly ILogger<LatestVersionsService> _logger;

+        /// <summary>
+        /// Survives cache expiry: served when the blob read fails so a transient hiccup
+        /// hides the version line for at most one request instead of a full failure TTL.
+        /// </summary>
+        private volatile LatestVersions? _lastGood;
+
        public LatestVersionsService(
            IHttpClientFactory httpClientFactory,
            IMemoryCache cache,
@@ -85,15 +97,22 @@ namespace AutopilotMonitor.Functions.Services
                    FromCache: false);

                _cache.Set(CacheKey, result, CacheDuration);
+                _lastGood = result;
                _logger.LogInformation("LatestVersions refreshed: agent={AgentVersion}, bootstrap={BootstrapVersion}", version, bootstrapVersion);
                return result;
            }
            catch (Exception ex)
            {
-                _logger.LogWarning(ex, "Failed to fetch {Url}; caching null for {Minutes}m", VersionJsonUrl, FailureCacheDuration.TotalMinutes);
-                // Cache failure briefly to avoid hammering blob on repeated calls
-                _cache.Set(CacheKey, (LatestVersions?)null, FailureCacheDuration);
-                return null;
+                var lastGood = _lastGood;
+                _logger.LogWarning(
+                    ex,
+                    "Failed to fetch {Url}; serving {Fallback} for {Minutes}m",
+                    VersionJsonUrl,
+                    lastGood == null ? "nothing" : $"the value fetched at {lastGood.FetchedAtUtc:O}",
+                    FailureCacheDuration.TotalMinutes);
+                // Cache the outcome briefly to avoid hammering the blob on repeated calls.
+                _cache.Set(CacheKey, lastGood, FailureCacheDuration);
+                return lastGood == null ? null : lastGood with { FromCache = true };
            }
        }
    }
@@ -127,6 +127,18 @@ namespace AutopilotMonitor.Functions.Services
                });
            }

+            // Field-absence gate: not_exists WITH a dataField matches when no event of the type
+            // carries a non-empty value at that field — including when the type is absent — the
+            // same semantics as the precondition gate. Must run before the "no matching events"
+            // veto and the per-event loop below, whose null short-circuit could never express
+            // "the field is missing" (session 683f1eff: "esp_failure_settle_started.errorCode
+            // not_exists" was silently dead).
+            if (!string.IsNullOrEmpty(condition.DataField)
+                && string.Equals(condition.Operator, "not_exists", StringComparison.OrdinalIgnoreCase))
+            {
+                return EvaluateFieldAbsence(condition, matchingEvents);
+            }
+
            if (!matchingEvents.Any())
                return (false, "no matching events");

@@ -206,6 +218,11 @@ namespace AutopilotMonitor.Functions.Services
        {
            var matchingEvents = ApplyValueFilter(condition, events.Where(e => MatchesEventType(e, condition.EventType)).ToList());

+            // Field-absence gate — see EvaluateEventTypeCondition; here it applies to the
+            // filtered event set, so "no event with filterField=x carries dataField" is expressible.
+            if (string.Equals(condition.Operator, "not_exists", StringComparison.OrdinalIgnoreCase))
+                return EvaluateFieldAbsence(condition, matchingEvents);
+
            foreach (var evt in matchingEvents)
            {
                var fieldValue = GetDataFieldValue(evt, condition.DataField);
@@ -227,6 +244,26 @@ namespace AutopilotMonitor.Functions.Services
            return (false, "no matching data");
        }

+        /// <summary>
+        /// <c>not_exists</c> with a dataField: true when none of <paramref name="matchingEvents"/>
+        /// carries a non-empty value at the field (an empty set counts as absent). A single
+        /// non-empty value disproves it. Evidence names the type, the field and how many events
+        /// of the type were inspected, so a finding can say "0 esp_failure_settle_started events
+        /// carried errorCode" rather than pointing at one event.
+        /// </summary>
+        private static (bool matched, object evidence) EvaluateFieldAbsence(RuleCondition condition, List<EnrollmentEvent> matchingEvents)
+        {
+            if (matchingEvents.Any(e => !string.IsNullOrEmpty(GetDataFieldValue(e, condition.DataField))))
+                return (false, "data field present");
+
+            return (true, new Dictionary<string, object>
+            {
+                ["eventType"] = condition.EventType,
+                ["field"] = condition.DataField,
+                ["count"] = matchingEvents.Count
+            });
+        }
+
        /// <summary>
        /// Evidence values feed the finding UI and {{token}} interpolation, both of which
        /// render via ToString() — a raw List would surface as its .NET type name
@@ -113,6 +113,58 @@ describe('gather guardrails (agent matching semantics)', () => {
    expect(errors(validateRuleDraft(bad).findings).some((m) => m.includes('hard-blocked'))).toBe(true);
  });

+  // %LOGGED_ON_USER_PROFILE% releases the C:\Users hard block for AppData\Local and
+  // AppData\Roaming — and only releases it. The allowlist still decides, which is what
+  // the agent does (GatherRuleGuards.IsFilePathAllowed) and what the portal shows.
+  it('accepts a userProfileFilePrefixes folder below %LOGGED_ON_USER_PROFILE%', () => {
+    const ok = validGather();
+    ok.collectorType = 'logparser';
+    ok.target = '%LOGGED_ON_USER_PROFILE%\\AppData\\Local\\RealmJoin\\tray*.log';
+    ok.parameters = { pattern: '(?<msg>SSO)', format: 'text' };
+    expect(errors(validateRuleDraft(ok).findings).some((m) => m.includes('guardrails'))).toBe(false);
+  });
+
+  it('rejects an unlisted vendor folder below %LOGGED_ON_USER_PROFILE%\\AppData', () => {
+    const bad = validGather();
+    bad.collectorType = 'file';
+    bad.target = '%LOGGED_ON_USER_PROFILE%\\AppData\\Local\\SomeApp\\data.json';
+    expect(errors(validateRuleDraft(bad).findings).some((m) => m.includes('not under any allowed file prefix'))).toBe(true);
+  });
+
+  it('rejects %LOGGED_ON_USER_PROFILE% outside AppData as hard-blocked', () => {
+    const bad = validGather();
+    bad.collectorType = 'file';
+    bad.target = '%LOGGED_ON_USER_PROFILE%\\Documents\\secret.txt';
+    expect(errors(validateRuleDraft(bad).findings).some((m) => m.includes('hard-blocked'))).toBe(true);
+  });
+
+  it('rejects a sibling of a userProfileFilePrefixes folder (segment boundary)', () => {
+    const bad = validGather();
+    bad.collectorType = 'file';
+    bad.target = '%LOGGED_ON_USER_PROFILE%\\AppData\\Local\\RealmJoinEvil\\tray.log';
+    expect(validateRuleDraft(bad).valid).toBe(false);
+  });
+
+  // The agent expands environment variables before guarding, so a target spelled with
+  // %ProgramData% must not be reported as blocked — there are live rules doing this.
+  it('accepts an allow-listed path spelled with %ProgramData%', () => {
+    const ok = validGather();
+    ok.collectorType = 'logparser';
+    ok.target = '%ProgramData%\\Microsoft\\IntuneManagementExtension\\Logs\\HPReports\\HP Image Assistant.log';
+    ok.parameters = { pattern: '(?<msg>x)', format: 'text' };
+    expect(errors(validateRuleDraft(ok).findings).some((m) => m.includes('guardrails'))).toBe(false);
+  });
+
+  // diagnosticsPathPrefixes governs admin-configured diagnostics paths, not collectors:
+  // the agent guards logparser against filePrefixes alone.
+  it('rejects a logparser target that only diagnosticsPathPrefixes would allow', () => {
+    const bad = validGather();
+    bad.collectorType = 'logparser';
+    bad.target = 'C:\\Install\\Log\\setup.log';
+    bad.parameters = { pattern: '(?<msg>x)', format: 'text' };
+    expect(errors(validateRuleDraft(bad).findings).some((m) => m.includes('not under any allowed file prefix'))).toBe(true);
+  });
+
  it('rejects the registry-hive store path (System32\\config) as hard-blocked', () => {
    const bad = validGather();
    bad.collectorType = 'file';
@@ -201,8 +201,11 @@ export const RULE_AUTHORING_GUIDE = {
    ],
    operatorNotes:
      'String comparisons are case-insensitive; regex runs case-insensitive with a 1s timeout ' +
-      '(.NET regex syntax); in/not_in take a comma-separated value list. An operator the engine ' +
-      'does not know silently evaluates to FALSE in production — validate_rule catches this.',
+      '(.NET regex syntax); in/not_in take a comma-separated value list. exists/not_exists with a ' +
+      'dataField test whether ANY event of the type carries a non-empty value there — not_exists ' +
+      'matches when none does, also when the event type is absent (e.g. "the ESP failure carried no ' +
+      'errorCode"); without a dataField they test only the presence of the event type. An operator ' +
+      'the engine does not know silently evaluates to FALSE in production — validate_rule catches this.',
    required:
      'required=true conditions are the firing core: ALL of them must match or the rule produces ' +
      'nothing. required=false conditions are optional reinforcers whose evidence feeds ' +
@@ -470,7 +470,7 @@ export const ANALYZE_RULE_SCHEMA: Record<string, unknown> = {
        },
        "operator": {
          "type": "string",
-          "description": "Comparison operator.",
+          "description": "Comparison operator. exists/not_exists with a dataField test whether ANY event of the type carries a non-empty value at that field: not_exists matches when no event does — including when the event type is absent altogether — so a rule can gate on a missing field (e.g. an ESP failure without an HRESULT). Without a dataField they test only the presence of the event type.",
          "enum": [
            "equals",
            "not_equals",
@@ -870,7 +870,11 @@ export const RULE_GUARDRAILS = {
    "C:\\Windows\\Panther",
    "C:\\Windows\\SetupDiag",
    "C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
-    "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log"
+    "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log",
+    "C:\\ProgramData\\RealmJoin\\choco\\logs"
+  ],
+  "userProfileFilePrefixes": [
+    "AppData\\Local\\RealmJoin"
  ],
  "wmiQueryPrefixes": [
    "SELECT * FROM Win32_OperatingSystem",
@@ -103,6 +103,52 @@ function pathPrefixAllowed(target: string, prefixes: readonly string[]): boolean
  });
 }

+// The agent expands environment variables and the custom %LOGGED_ON_USER_PROFILE% token
+// BEFORE it guards a path (FileCollector/LogParserCollector -> UserProfileResolver ->
+// GatherRuleGuards). Judging the raw spelling instead reported targets as blocked that the
+// device happily reads (%ProgramData%\...) and made token targets unjudgeable altogether.
+// The profile name is unknown here, so the token resolves to a placeholder profile — the
+// same device-independent stand-in the portal validator uses.
+const COMMON_ENV_VARS: Record<string, string> = {
+  '%ProgramData%': 'C:\\ProgramData',
+  '%SystemRoot%': 'C:\\Windows',
+  '%windir%': 'C:\\Windows',
+  '%SystemDrive%': 'C:',
+};
+const USER_PROFILE_TOKEN = '%LOGGED_ON_USER_PROFILE%';
+const USER_PROFILE_PLACEHOLDER = 'C:\\Users\\__AGENT_RESOLVED__';
+
+/** The only profile subdirectories the C:\Users hard block ever releases. */
+const ALLOWED_USER_PROFILE_SUBDIRS: readonly string[] = ['AppData\\Local', 'AppData\\Roaming'];
+
+/** Vendor folders below the profile, relative to its root (GatherRuleGuards.AllowedUserProfileFilePrefixes). */
+const USER_PROFILE_FILE_PREFIXES: readonly string[] = RULE_GUARDRAILS.userProfileFilePrefixes ?? [];
+
+function escapeRegExp(literal: string): string {
+  return literal.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+function expandPathTokens(target: string): string {
+  let result = target.replace(
+    new RegExp(escapeRegExp(USER_PROFILE_TOKEN), 'gi'), USER_PROFILE_PLACEHOLDER);
+  for (const [envVar, replacement] of Object.entries(COMMON_ENV_VARS)) {
+    result = result.replace(new RegExp(escapeRegExp(envVar), 'gi'), replacement);
+  }
+  return result;
+}
+
+/** True when the expanded path sits in the part of the profile the hard block releases. */
+function isUnderUserProfileException(expanded: string): boolean {
+  return ALLOWED_USER_PROFILE_SUBDIRS.some(
+    (subdir) => pathPrefixAllowed(expanded, [`${USER_PROFILE_PLACEHOLDER}\\${subdir}`]));
+}
+
+/** True when a userProfileFilePrefixes entry admits the expanded path. */
+function userProfilePrefixAllowed(expanded: string): boolean {
+  return USER_PROFILE_FILE_PREFIXES.some(
+    (prefix) => pathPrefixAllowed(expanded, [`${USER_PROFILE_PLACEHOLDER}\\${prefix}`]));
+}
+
 function stripRegistryHive(target: string): string {
  return target.replace(/^(HKLM|HKEY_LOCAL_MACHINE|HKCU|HKEY_CURRENT_USER)\\/i, '');
 }
@@ -127,19 +173,28 @@ function checkGatherTarget(collectorType: string, target: string): ValidationFin
    case 'json':
    case 'xml':
    case 'logparser': {
-      const blocked = HARD_BLOCKED_PATH_PREFIXES.find((p) => pathPrefixAllowed(target, [p]));
-      if (blocked) {
+      const expanded = expandPathTokens(target);
+
+      // C:\Users is hard-blocked; %LOGGED_ON_USER_PROFILE% releases it for AppData\Local
+      // and AppData\Roaming and nothing else. The release is not an allowance — the
+      // allowlist below still decides, exactly as GatherRuleGuards.IsFilePathAllowed does.
+      const blocked = HARD_BLOCKED_PATH_PREFIXES.find((p) => pathPrefixAllowed(expanded, [p]));
+      if (blocked && !isUnderUserProfileException(expanded)) {
        findings.push({ level: 'error', message: `guardrails: "${target}" is under the hard-blocked path ${blocked} — the agent always refuses this, it cannot be allow-listed.` });
        break;
      }
-      const allowed = collectorType === 'logparser'
-        ? [...RULE_GUARDRAILS.filePrefixes, ...RULE_GUARDRAILS.diagnosticsPathPrefixes]
-        : [...RULE_GUARDRAILS.filePrefixes];
-      // logparser targets may carry a glob suffix (*.log) — prefix matching still applies.
-      if (!pathPrefixAllowed(target, allowed) && !allowed.some((p) => target.toLowerCase().startsWith(p.toLowerCase() + '\\'))) {
+      // The agent guards EVERY file collector — logparser included — against
+      // filePrefixes alone (GatherRuleGuards.IsFilePathAllowed). diagnosticsPathPrefixes
+      // governs admin-configured diagnostics paths, a different surface the collectors
+      // never consult; offering it here reported logparser targets as allowed that the
+      // agent refuses on the device (C:\Install\Log, winevt\Logs, WER, ProgramData\AutopilotMonitor).
+      // logparser targets may carry a glob suffix (*.log) — segment-bounded prefix
+      // matching covers that, the glob sits in the last segment.
+      if (!pathPrefixAllowed(expanded, RULE_GUARDRAILS.filePrefixes) &&
+          !userProfilePrefixAllowed(expanded)) {
        findings.push({
          level: 'error',
-          message: `guardrails: ${collectorType} target "${target}" is not under any allowed file prefix (rule_guardrails → filePrefixes${collectorType === 'logparser' ? ' / diagnosticsPathPrefixes' : ''}).`,
+          message: `guardrails: ${collectorType} target "${target}" is not under any allowed file prefix (rule_guardrails → filePrefixes, or userProfileFilePrefixes below %LOGGED_ON_USER_PROFILE%).`,
        });
      }
      break;
@@ -1486,7 +1486,7 @@ export function registerAdminTools(server: McpServer, ga: boolean, strictGa: boo
    {
      title: 'Query Table',
      description:
-        'Query any Azure Table Storage table directly with OData filters. Global Admin only. ' +
+        'Query any Azure Table Storage table directly with OData filters. Table names come from list_tables — a guessed name is a NotFound, not an empty result. Global Admin only. ' +
        'Use list_tables to see available tables. Useful for inspecting TenantConfiguration, RuleResults, or any raw data ' +
        'where no specialized tool exists. ' +
        'For COUNTING / AGGREGATION queries pass `fields=PartitionKey,RowKey,Status,AgentVersion` (or similar lean subset) ' +
@@ -1673,7 +1673,8 @@ export function registerAdminTools(server: McpServer, ga: boolean, strictGa: boo
        tenantId: TenantGuidSchema.describe('Tenant ID (GUID) whose configuration to change.'),
        fields: z.record(z.string(), z.unknown())
          .describe('Object of fieldName → newValue for ONLY the fields to change (e.g. {"dataRetentionDays": 90}). ' +
-                    'Use get_tenant_config for current values and exact field names.'),
+                    'Field names, JSON types and writability come from get_tenant_config_schema; get_tenant_config ' +
+                    'shows the CURRENT values but not the full field set, so it cannot tell you what is writable.'),
        reason: z.string().min(1)
          .describe('REQUIRED: why this change is being made. Stored with the backup snapshot and the audit log entry.'),
      },
@@ -122,7 +122,7 @@ export function registerRuleTools(server: McpServer, ga: boolean): void {
        (ga ? ' Platform-scope callers can target any tenant\'s session — the tenant is resolved from the session automatically.' : ''),
      inputSchema: {
        sessionId: SessionIdSchema.describe('Session UUID to evaluate the draft against'),
-        rule: z.record(z.string(), z.unknown()).describe('The draft analyze rule JSON object'),
+        rule: z.record(z.string(), z.unknown()).describe('The draft analyze rule JSON object. Condition shapes — including the allowed condition `source` values — come from get_resource(name="rule_schemas"); run validate_rule first if the draft has not been validated yet'),
      },
      annotations: READ_ONLY,
    },
@@ -436,7 +436,7 @@ export function registerSessionTools(server: McpServer, ga: boolean, delegated:
      inputSchema: {
        sessionId: SessionIdSchema.describe('Session UUID'),
        tenantId: z.string().optional().describe(tenantIdDescription(ga, delegated, 'Tenant ID. If omitted, auto-resolved from the session.', 'Tenant ID. If omitted, auto-resolved from the session.')),
-        eventType: z.string().optional().describe('Filter to only events of this type'),
+        eventType: z.string().optional().describe('Filter to only events of this type — valid values come from the event_types catalog (call get_resource(name="event_types")); an invented type is rejected, not an empty result'),
        severity: z.enum(EVENT_SEVERITIES).optional(),
        source: z.string().optional().describe('Filter by event source/app name (e.g. "MicrosoftTeams")'),
        fields: z.string().optional()
@@ -262,8 +262,42 @@
    "0x8018002b": {"description":"Automatic MDM enrollment failed: the user's UPN has an unverified or non-routable domain, or the MDM user scope is set to None","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-enrollment-errors","category":"mdm-enrollment"},
    "0x80190193": {"description":"Forbidden (403)","confidence":"high","source":"winerror.h","category":"com","symbol":"HTTP_E_STATUS_FORBIDDEN"},
    "0x80190194": {"description":"Not found (404)","confidence":"high","source":"winerror.h","category":"com","symbol":"HTTP_E_STATUS_NOT_FOUND"},
+    "0x801c0001": {"description":"ADRS server response isn't in a valid format","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0002": {"description":"Server failed to authenticate the user","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0003": {"description":"User isn't authorized to enroll","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0006": {"description":"Unhandled exception from server","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c000b": {"description":"Redirection is needed and redirected location isn't a well known server","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c000c": {"description":"Discovery failed","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c000e": {"description":"Registration quota reached","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c000f": {"description":"Operation successful, but the device requires a reboot","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0010": {"description":"The AIK certificate isn't valid or trusted","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0011": {"description":"The attestation statement of the transport key is invalid","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0012": {"description":"Discovery request isn't in a valid format","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0013": {"description":"Tenant ID isn't found in the token","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0014": {"description":"User SID isn't found in the token","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0015": {"description":"The device is required to be joined to an Active Directory domain","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0016": {"description":"The federation provider configuration is empty","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0017": {"description":"The federation provider domain is empty","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0018": {"description":"The federation provider client configuration URL is empty","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0019": {"description":"The federation provider client configuration is empty","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c001a": {"description":"The DRS endpoint in the federation provider client configuration is empty","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c001b": {"description":"The device certificate isn't found","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c004d": {"description":"NGC provisioning is unable to find the default WAM account to use to request Microsoft Entra token for provisioning. Unable to enroll a device to use a PIN for login","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join","symbol":"DSREG_NO_DEFAULT_ACCOUNT"},
+    "0x801c03e9": {"description":"Server response message is invalid","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
    "0x801c03ea": {"description":"Registering the device for mobile management failed: the TPM supports 2.0 but has not been upgraded to 2.0, or the device is in two groups with different Autopilot profiles","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-enrollment-errors","category":"entra-join"},
+    "0x801c03eb": {"description":"Server response http status isn't valid","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c03ec": {"description":"Unhandled exception from server","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c03ed": {"description":"Multi-factor authentication is required for a 'ProvisionKey' operation, but wasn't performed. -or- Token wasn't found in the Authorization header. -or- Failed to read one or more objects. -or- The req…","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c03ee": {"description":"Attestation failed","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c03ef": {"description":"The AIK certificate is no longer valid","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c03f0": {"description":"There's no key registered for the user","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c03f1": {"description":"There's no UPN in the token","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c03f2": {"description":"Windows Hello key registration failed","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
    "0x801c03f3": {"description":"Microsoft Entra ID has no device object for the device being deployed (the object was deleted); remove the device from Entra ID, Intune and Autopilot and re-register it","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/autopilot/known-issues","category":"entra-join"},
+    "0x801c044c": {"description":"There's no core window for the current thread","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c044d": {"description":"Authorization token doesn't contain device ID","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c044e": {"description":"Failed to receive user credentials input","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
+    "0x801c0451": {"description":"User token switch account","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation","category":"entra-join"},
    "0x80240001": {"description":"Windows Update Agent was unable to provide the service","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/deployment/update/windows-update-error-reference","category":"windows-update","symbol":"WU_E_NO_SERVICE"},
    "0x80240002": {"description":"The maximum capacity of the service was exceeded","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/deployment/update/windows-update-error-reference","category":"windows-update","symbol":"WU_E_MAX_CAPACITY_REACHED"},
    "0x80240003": {"description":"An ID can't be found","confidence":"high","source":"msdoc:https://learn.microsoft.com/en-us/windows/deployment/update/windows-update-error-reference","category":"windows-update","symbol":"WU_E_UNKNOWN_ID"},
@@ -111,7 +111,7 @@ export default function AboutPage() {
            data — into a central dashboard with intelligent analysis built in.
          </p>
          <p className="text-gray-700 leading-relaxed">
-            Deployed by assigning a bootstrapper script in Intune, the platform requires no infrastructure
+            Deployed by assigning a signed loader script in Intune, the platform requires no infrastructure
            changes and no additional certificates on end user devices. It runs entirely on
            <strong> Azure</strong>, authenticates via <strong>Microsoft Entra ID</strong>, and provides
            multi-tenant support with strict per-tenant data isolation.
@@ -239,7 +239,7 @@ export default function AboutPage() {
                items: [
                  ".NET binary — lightweight, low-overhead monitoring",
                  "Runs via scheduled task (no Windows service — easy, residue-free removal)",
-                  "Deployed via an Intune platform script (PowerShell bootstrapper); for Autopilot Device Preparation additionally as a thin MSI line-of-business app",
+                  "Deployed via a signed Intune platform script (PowerShell loader); for Autopilot Device Preparation additionally as a thin MSI line-of-business app",
                  "Mutual TLS using the existing Intune MDM device certificate",
                  "Self-destruct on enrollment completion (on by default — removes task and files)",
                ],
@@ -679,8 +679,8 @@ export function GatherRuleFormFields({ form, setForm, showRuleId, unrestrictedMo
        <p className="text-xs text-gray-400 mt-1 ml-6">
          Attaches the Windows/MSI/Intune meaning to <code className="px-1 bg-gray-100 rounded">exitCode</code>,{" "}
          <code className="px-1 bg-gray-100 rounded">errorCode</code> and <code className="px-1 bg-gray-100 rounded">hresult</code> fields
-          in this rule&apos;s output, like on built-in events. Leave off when the source uses its own exit codes
-          (HP Image Assistant, Dell Command Update, custom scripts) — the catalog would explain them wrongly.
+          in this rule&apos;s output, like on built-in events. Leave off when the source uses its own exit codes —
+          the catalog would explain them wrongly.
        </p>
      </div>
    </div>
@@ -208,7 +208,7 @@ export default function PrivacyPage() {
            <li><strong>Encryption</strong> — HTTPS with a TLS 1.2 floor in transit, Azure Storage encryption at rest with platform-managed keys</li>
            <li><strong>Managed identity instead of storage keys</strong>, and secret-less OIDC deployment pipelines</li>
            <li><strong>Rate limiting</strong> per device, per portal user, and per MCP user</li>
-            <li><strong>Verifiable agent binaries</strong> — Sigstore build attestation plus a four-stage integrity chain through download, backend cross-check, and runtime self-verification</li>
+            <li><strong>Verifiable agent binaries</strong> — Authenticode-signed scripts and binaries whose publisher is verified on the device before anything runs, Sigstore build attestation, and SHA-256 verification at download, through an independent backend cross-check, and at runtime</li>
            <li><strong>Manifest-first deletion</strong> — what will be deleted is captured, restorably, before anything is removed</li>
          </ul>

@@ -6,6 +6,7 @@ import { usePathname } from "next/navigation";
 import { ModalPortal } from "./ModalPortal";
 import { useAuth } from "@/contexts/AuthContext";
 import { useWhatsNew } from "@/hooks/useWhatsNew";
+import { useLatestVersions } from "@/lib/useLatestVersions";
 import { closeWhatsNew } from "@/lib/whatsNewStore";
 import { formatInlineMarkdown } from "@/lib/formatInlineMarkdown";
 import { isPublicPath } from "@/lib/hostRouting";
@@ -107,6 +108,24 @@ function EntryRow({ entry, isNew }: { entry: WhatsNewEntry; isNew: boolean }) {
  );
 }

+/**
+ * The currently published agent version, quiet under the header line. Rendered only for
+ * signed-in portal users (the endpoint is AuthenticatedUser, and the public site has no
+ * session list to compare against), so the mount itself is the fetch gate. Same plain,
+ * monospaced string as the "Agent Version" column of the session list — that match is the
+ * whole point: the reader sees at a glance whether their fleet runs the latest agent.
+ */
+function LatestAgentVersionLine() {
+  const { getAccessToken } = useAuth();
+  const { latestAgentVersion } = useLatestVersions(getAccessToken);
+  if (!latestAgentVersion) return null;
+  return (
+    <p className="mt-1 text-xs text-[var(--lp-ink-faint)]">
+      Latest agent version <span className="font-mono">{latestAgentVersion}</span>
+    </p>
+  );
+}
+
 function SkeletonRows() {
  return (
    <ul className="animate-pulse" aria-hidden="true">
@@ -140,10 +159,12 @@ export function WhatsNewPanel({ rootClassName }: { rootClassName?: string }) {
  const [seenAtOpen] = useState<WhatsNewSeen>(() => wn.seen);
  const [openedAt] = useState(() => new Date());

-  // Only whoever can actually flip the channel toggle gets the "subscribe" link, and only on
-  // the portal — /settings/tenant/… does not exist on the public host.
+  // The portal shows things the public site cannot: /settings/tenant/… does not exist there,
+  // and the latest-agent line needs a signed-in caller plus a session list to compare against.
+  const onPortal = !isPublicPath(pathname);
+  // Only whoever can actually flip the channel toggle gets the "subscribe" link.
  const canConfigureNotifications =
-    wn.tracksUnseen && (user?.isTenantAdmin === true || user?.isGlobalAdmin === true) && !isPublicPath(pathname);
+    wn.tracksUnseen && (user?.isTenantAdmin === true || user?.isGlobalAdmin === true) && onPortal;

  const channel = wn.panelChannel;
  const entries = wn.entries(channel);
@@ -196,6 +217,7 @@ export function WhatsNewPanel({ rootClassName }: { rootClassName?: string }) {
              <div className="min-w-0 flex-1">
                <h2 id="whats-new-title" className="text-lg font-bold leading-tight text-[var(--lp-ink)]">What&apos;s new</h2>
                <p className="mt-0.5 text-sm text-[var(--lp-ink-soft)]">News and improvements from Autopilot Monitor.</p>
+                {onPortal && wn.tracksUnseen && <LatestAgentVersionLine />}
              </div>
              <button
                ref={closeRef}
@@ -22,8 +22,9 @@ export interface UseLatestVersionsResult {

 /**
 * Fetches latest published agent/bootstrap versions from the backend
- * once per mount. The backend caches the upstream blob for 12h, and
- * the browser Cache-Control allows 1h of HTTP caching, so this is cheap.
+ * once per mount. Backend cache and browser Cache-Control are both minutes,
+ * not hours, so a fresh release shows up almost immediately — the What's new
+ * panel announces this number, and the panel mounts on every open.
 *
 * Silently swallows all errors — on failure, returns nulls so callers
 * can gracefully hide "outdated" badges.
@@ -64,16 +64,26 @@ function validate(rawText) {
  return catalog;
 }

-/** The browser-facing shape: same keys, shortened source, no enforcement states. */
+/**
+ * The browser-facing shape: same keys, shortened source, no enforcement states, and the two
+ * dominant field values omitted.
+ *
+ * `confidence: "high"` holds for 562 of 641 rows and `source: "msdoc"` for about half, so
+ * spelling them out costs ~19 KB of the client bundle to repeat two constants. They are
+ * omitted here and restored on read in `utils/errorCodeMap.ts` — the rendered tooltip is
+ * unchanged. Keep the two defaults in sync with that reader.
+ */
+const DEFAULT_CONFIDENCE = "high";
+const DEFAULT_SOURCE = "msdoc";
+
 function transform(catalog) {
  const entries = {};
  for (const [key, e] of Object.entries(catalog.entries)) {
-    const out = {
-      description: e.description,
-      confidence: e.confidence,
-      source: e.source.startsWith("msdoc:") ? "msdoc" : e.source,
-      category: e.category,
-    };
+    const source = e.source.startsWith("msdoc:") ? "msdoc" : e.source;
+    const out = { description: e.description };
+    if (e.confidence !== DEFAULT_CONFIDENCE) out.confidence = e.confidence;
+    if (source !== DEFAULT_SOURCE) out.source = source;
+    out.category = e.category;
    if (e.symbol) out.symbol = e.symbol;
    if (e.imeRetriesDuringEsp) out.imeRetriesDuringEsp = true;
    entries[key] = out;
@@ -31,11 +31,15 @@ describe("errorCodeMap", () => {
    });

    it("uses only the catalog vocabulary", () => {
-      for (const [key, entry] of Object.entries(catalogFile.entries)) {
+      // Asserted on the RESOLVED entry: the synced file omits confidence "high" and source
+      // "msdoc" to save bundle bytes, and getErrorCodeEntry restores them.
+      for (const key of Object.keys(catalogFile.entries)) {
        expect(key, key).toMatch(/^(0x[0-9a-f]{8}|\d+)$/);
-        expect(ERROR_CODE_CATEGORIES, `${key} category`).toContain(entry.category);
-        expect(["high", "medium", "low"], `${key} confidence`).toContain(entry.confidence);
-        expect(entry.source, `${key} source`).toMatch(/^(msdoc|ime:\d+(\.\d+)+|winerror\.h|rule:[A-Z]+-[A-Z]+-\d{3}|legacy-catalog-v1)$/);
+        const entry = getErrorCodeEntry(key);
+        expect(entry, key).not.toBeNull();
+        expect(ERROR_CODE_CATEGORIES, `${key} category`).toContain(entry!.category);
+        expect(["high", "medium", "low"], `${key} confidence`).toContain(entry!.confidence);
+        expect(entry!.source, `${key} source`).toMatch(/^(msdoc|ime:\d+(\.\d+)+|winerror\.h|rule:[A-Z]+-[A-Z]+-\d{3}|legacy-catalog-v1)$/);
      }
    });
  });
@@ -31,7 +31,9 @@ describe("error-codes sync", () => {
    const out = sync.transform(catalog);
    expect(catalog.enforcementStates).toBeDefined();
    expect("enforcementStates" in out).toBe(false);
-    expect(out.entries["0x80070005"].source).toBe("msdoc");
+    // "msdoc" and "high" are the omitted defaults (restored by utils/errorCodeMap.ts).
+    expect(out.entries["0x80070005"]).not.toHaveProperty("source");
+    expect(out.entries["0x80070005"]).not.toHaveProperty("confidence");
    expect(out.entries["0x87d30000"].source).toMatch(/^ime:/);
    expect(out.entries["1603"].symbol).toBe("ERROR_INSTALL_FAILURE");
  });
@@ -143,12 +143,32 @@ describe("validateFileTarget", () => {
    expect(r.allowed).toBe(false);
  });

-  it("allows %LOGGED_ON_USER_PROFILE% with AppData\\Local in file target", () => {
+  // The token lifts the C:\Users hard block for AppData — it does not admit the path.
+  // An unlisted vendor folder therefore falls through to the allowlist and is refused,
+  // exactly as GatherRuleGuards.IsFilePathAllowed does on the device.
+  it("blocks an unlisted vendor folder under %LOGGED_ON_USER_PROFILE%\\AppData\\Local", () => {
    const r = validateFileTarget(
      "%LOGGED_ON_USER_PROFILE%\\AppData\\Local\\SomeApp\\data.json",
      false,
    );
+    expect(r.allowed).toBe(false);
+  });
+
+  it("allows a userProfileFilePrefixes folder under %LOGGED_ON_USER_PROFILE%", () => {
+    const r = validateFileTarget(
+      "%LOGGED_ON_USER_PROFILE%\\AppData\\Local\\RealmJoin\\tray.log",
+      false,
+    );
    expect(r.allowed).toBe(true);
+    expect(r.reason).toContain("%LOGGED_ON_USER_PROFILE%");
+  });
+
+  it("blocks a sibling of a userProfileFilePrefixes folder (segment-bounded)", () => {
+    const r = validateFileTarget(
+      "%LOGGED_ON_USER_PROFILE%\\AppData\\Local\\RealmJoinSomethingElse\\tray.log",
+      false,
+    );
+    expect(r.allowed).toBe(false);
  });

  it("blocks %LOGGED_ON_USER_PROFILE% with Desktop in file target", () => {
@@ -348,12 +368,14 @@ describe("validateDiagnosticsPath", () => {
    expect(r.reason).toContain("%LOGGED_ON_USER_PROFILE%");
  });

-  it("allows %LOGGED_ON_USER_PROFILE% with AppData\\Roaming subpath", () => {
+  it("blocks an unlisted vendor folder under %LOGGED_ON_USER_PROFILE%\\AppData\\Roaming", () => {
+    // AppData\Roaming is inside the hard block's exception, but the folder is not on
+    // userProfileFilePrefixes — the allowlist still has the last word.
    const r = validateDiagnosticsPath(
      "%LOGGED_ON_USER_PROFILE%\\AppData\\Roaming\\SomeApp\\logs\\*.log",
      false,
    );
-    expect(r.allowed).toBe(true);
+    expect(r.allowed).toBe(false);
  });

  it("blocks %LOGGED_ON_USER_PROFILE% with non-AppData subpath", () => {
@@ -56,9 +56,14 @@ export interface ErrorCodeLookup {
  derivedFromWin32?: number;
 }

+/**
+ * The synced file omits the two dominant field values to keep the client bundle small
+ * (`scripts/sync-error-codes.js`): a missing `confidence` means "high", a missing `source`
+ * means "msdoc". Both are restored below, so every consumer still sees a complete entry.
+ */
 interface CatalogFile {
  schemaVersion: number;
-  entries: Record<string, ErrorCodeEntry>;
+  entries: Record<string, Omit<ErrorCodeEntry, "confidence" | "source"> & Partial<Pick<ErrorCodeEntry, "confidence" | "source">>>;
 }

 const typedCatalog = catalogFile as CatalogFile;
@@ -68,7 +73,10 @@ const typedCatalog = catalogFile as CatalogFile;
 * Keys are normalised lowercase hex strings (e.g. "0x80070005") or decimal strings (e.g. "1603").
 */
 const errorCodeMap: Record<string, ErrorCodeEntry> = Object.fromEntries(
-  Object.entries(typedCatalog.entries).map(([k, v]) => [k.toLowerCase(), v])
+  Object.entries(typedCatalog.entries).map(([k, v]) => [
+    k.toLowerCase(),
+    { ...v, confidence: v.confidence ?? "high", source: v.source ?? "msdoc" },
+  ])
 );

 /** Look up a structured entry for a raw code; null when no mapping is found. */
@@ -9,6 +9,7 @@
 import {
  ALLOWED_REGISTRY_PREFIXES,
  ALLOWED_FILE_PREFIXES,
+  USER_PROFILE_FILE_PREFIXES,
  ALLOWED_WMI_QUERY_PREFIXES,
  ALLOWED_COMMANDS_LIST,
  ALLOWED_DIAGNOSTICS_PATH_PREFIXES,
@@ -198,6 +199,18 @@ function isUserProfileSubpathAllowed(normalizedDir: string): boolean {
  return false;
 }

+/**
+ * Returns the userProfileFilePrefixes entry admitting the path, if any.
+ * Mirrors GatherRuleGuards.IsUserProfilePathOnAllowlist: the entries are relative to
+ * the profile root, so they are matched against the placeholder profile the token
+ * expanded to.
+ */
+function findUserProfilePrefix(normalizedDir: string): string | undefined {
+  return USER_PROFILE_FILE_PREFIXES.find((prefix) =>
+    matchesPrefix(normalizedDir, `${USER_PROFILE_PLACEHOLDER}\\${prefix}`, "\\")
+  );
+}
+
 // ---------------------------------------------------------------------------
 // Validation functions
 // ---------------------------------------------------------------------------
@@ -265,11 +278,14 @@ export function validateFileTarget(
    normalizedDir = normalizePath(expanded);
  }

-  // Hard block: C:\Users always blocked — except allowed subdirs via %LOGGED_ON_USER_PROFILE% token
-  if (matchesPrefix(normalizedDir, BLOCKED_USERS_PREFIX, "\\")) {
-    if (isUserProfileSubpathAllowed(normalizedDir)) {
-      return { allowed: true, reason: "Allowed via %LOGGED_ON_USER_PROFILE% (AppData only)", unrestricted: false };
-    }
+  // Hard block: C:\Users always blocked. The %LOGGED_ON_USER_PROFILE% token LIFTS it for
+  // AppData\Local and AppData\Roaming — it does not admit the path: the allowlist below
+  // still has to match, exactly as GatherRuleGuards.IsFilePathAllowed does. Returning
+  // "allowed" here would show a target as green that the agent refuses on the device.
+  if (
+    matchesPrefix(normalizedDir, BLOCKED_USERS_PREFIX, "\\") &&
+    !isUserProfileSubpathAllowed(normalizedDir)
+  ) {
    return { allowed: false, reason: "C:\\Users is always blocked (privacy protection)", unrestricted: false };
  }

@@ -289,6 +305,15 @@ export function validateFileTarget(
    }
  }

+  const userProfilePrefix = findUserProfilePrefix(normalizedDir);
+  if (userProfilePrefix) {
+    return {
+      allowed: true,
+      reason: `Matches: %LOGGED_ON_USER_PROFILE%\\${userProfilePrefix}`,
+      unrestricted: false,
+    };
+  }
+
  return {
    allowed: false,
    reason: "Not under any allowed file path prefix",
@@ -415,11 +440,14 @@ export function validateDiagnosticsPath(
    normalizedDir = normalizePath(expanded);
  }

-  // Hard block: C:\Users always blocked — except allowed subdirs via %LOGGED_ON_USER_PROFILE% token
-  if (matchesPrefix(normalizedDir, BLOCKED_USERS_PREFIX, "\\")) {
-    if (isUserProfileSubpathAllowed(normalizedDir)) {
-      return { allowed: true, reason: "Allowed via %LOGGED_ON_USER_PROFILE% (AppData only)", unrestricted: false };
-    }
+  // Hard block: C:\Users always blocked. As in validateFileTarget, the
+  // %LOGGED_ON_USER_PROFILE% token only lifts the block for AppData\Local and
+  // AppData\Roaming — DiagnosticsPathGuards.IsDiagnosticsPathAllowed then still
+  // requires an allowlist match below.
+  if (
+    matchesPrefix(normalizedDir, BLOCKED_USERS_PREFIX, "\\") &&
+    !isUserProfileSubpathAllowed(normalizedDir)
+  ) {
    return { allowed: false, reason: "C:\\Users is always blocked (privacy protection)", unrestricted: false };
  }

@@ -439,6 +467,15 @@ export function validateDiagnosticsPath(
    }
  }

+  const userProfilePrefix = findUserProfilePrefix(normalizedDir);
+  if (userProfilePrefix) {
+    return {
+      allowed: true,
+      reason: `Matches: %LOGGED_ON_USER_PROFILE%\\${userProfilePrefix}`,
+      unrestricted: false,
+    };
+  }
+
  return {
    allowed: false,
    reason: "Not under any allowed diagnostics path prefix",
@@ -263,6 +263,15 @@ export const ALLOWED_FILE_PREFIXES: readonly string[] = [
  "C:\\Windows\\SetupDiag",
  "C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
  "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log",
+  "C:\\ProgramData\\RealmJoin\\choco\\logs",
+];
+
+// Folders under the signed-in user's profile, RELATIVE to the profile root. The agent
+// resolves %LOGGED_ON_USER_PROFILE% at runtime; the portal validates against a placeholder
+// profile. These cannot live in ALLOWED_FILE_PREFIXES — that list is matched literally
+// against the already-expanded path, where the user name is unknown at authoring time.
+export const USER_PROFILE_FILE_PREFIXES: readonly string[] = [
+  "AppData\\Local\\RealmJoin",
 ];

 export const ALLOWED_WMI_QUERY_PREFIXES: readonly string[] = [
@@ -45,6 +45,7 @@ duplicates are reported on stderr.
 | windows-update / cbs | [Windows Update common errors](https://learn.microsoft.com/en-us/windows/deployment/update/windows-update-errors) | One table per single-code heading; symbol = text before `;` in the Message cell, description = text after it, else the Description cell. `0x800F…` → `cbs`. |
 | intune-mobile / intune-win32 | [Intune app installation error codes](https://learn.microsoft.com/en-us/troubleshoot/mem/intune/app-management/app-install-error-codes) | iOS/iPadOS and Windows tables (Android skipped); description = the message cell. |
 | mdm-enrollment / autopilot / entra-join | [Windows enrollment errors](https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-enrollment-errors), [Autopilot known issues](https://learn.microsoft.com/en-us/autopilot/known-issues) | Prose pages: one-sentence paraphrase listed in `PROSE_ENTRIES`; the generator asserts the code appears on the page. Codes only our analysis rules name carry `rule:` and `medium`. |
+| entra-join | [Windows Hello errors during PIN creation](https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation) | Both tables parsed (`Hex \| Cause \| Mitigation` and the "unknown mitigation" one); the `Cause` column is the description, `Mitigation` is advice and is not carried. **Only `0x801c*`** — the page also lists NTE crypto codes, a Win32 code the `win32` family owns, and codes with no category here. Runs after `PROSE_ENTRIES` so the Autopilot-specific text for `0x801c03ea` wins. A `SYMBOL: text` cell yields `symbol`. Fails the run below 30 keys, so a reshaped page cannot silently shrink the family. |
 | intune-win32 (`0x87D3xxxx`) | IME `CustomErrorCodes` enum | Member name as symbol, humanised as description, `medium`. Two known sign/digit defects in the enum source are corrected by `IME_ENUM_FIXUPS`; a build that fixes them makes the run fail so the fixup is removed. |
 | delivery-optimization (`0x80D0xxxx`) | IME `DeliveryOptimizationConstants` | Member name as symbol, humanised, `medium`. |
 | legacy | v1 catalog | Entries no primary source covers, `low`. |
@@ -26,6 +26,8 @@
 *   intune-*              MS "Intune app installation error codes" (iOS + Windows tables)
 *   mdm-enrollment/       MS enrollment troubleshooting + Autopilot known-issues pages (prose:
 *   autopilot/entra-join  one-sentence paraphrase, presence-checked against the page)
+ *   entra-join            MS "Windows Hello errors during PIN creation", 0x801Cxxxx only — the
+ *                         DSREG / device-registration family (runs after prose, which wins)
 *   intune-win32          IME CustomErrorCodes enum (0x87D3xxxx), member name paraphrased
 *   delivery-optimization IME DeliveryOptimizationConstants (0x80D0xxxx), member name paraphrased
 *   legacy                v1 entries without a primary source, kept at confidence "low"
@@ -82,6 +84,7 @@ const URL = {
  intuneApps: "https://learn.microsoft.com/en-us/troubleshoot/mem/intune/app-management/app-install-error-codes",
  enrollErrors: "https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-enrollment-errors",
  knownIssues: "https://learn.microsoft.com/en-us/autopilot/known-issues",
+  helloErrors: "https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation",
  winhttp: "https://learn.microsoft.com/en-us/windows/win32/winhttp/error-messages",
  win32: (range) => `https://learn.microsoft.com/en-us/windows/win32/debug/system-error-codes--${range}-`,
 };
@@ -117,6 +120,10 @@ const ENTITIES = { nbsp: " ", amp: "&", lt: "<", gt: ">", quot: '"', "#39": "'",
 /**
 * Cell markup → plain text. Tags are stripped until none remain (a nested "<scr<b>ipt>" cannot
 * survive), and entities are decoded in ONE pass so "&amp;lt;" yields "&lt;", never "<".
+ *
+ * Zero-width and bidi marks are removed before the whitespace collapse: MS Learn tables carry
+ * stray U+200B in hex and description cells, JS `\s` does not match them, and a hex cell that
+ * keeps one fails every `^0x…$` test — the row would then be skipped with no diagnostic.
 */
 const decode = (s) => {
  let text = s.replace(/<br\s*\/?>/gi, " ").replace(/<\/(p|li|div)>/gi, " ");
@@ -127,6 +134,7 @@ const decode = (s) => {
  } while (text !== previous);
  return text
    .replace(/&(nbsp|amp|lt|gt|quot|#39|#x27);/g, (_, name) => ENTITIES[name])
+    .replace(/[-‏‪-‮⁠]/g, "")
    .replace(/\s+/g, " ")
    .trim();
 };
@@ -409,6 +417,45 @@ async function main() {
    queue("prose", e.key, { symbol: e.symbol, description: e.description, confidence: e.confidence ?? "high", source: e.source ?? msdoc(e.page), category: e.category });
  }

+  // entra-join — the Windows Hello PIN error page is the only MS table that documents the
+  // 0x801Cxxxx (DSREG / device-registration) family, which an enrollment meets during hybrid
+  // join and the ESP account-setup phase. Two tables: "Hex | Cause | Mitigation" and, for the
+  // codes without a documented fix, "Hex | Cause". The `Cause` column is the description in
+  // both — `Mitigation` is advice, and the catalog describes codes rather than advising.
+  //
+  // Runs AFTER the prose entries on purpose: 0x801c03ea is on both, and the Autopilot-specific
+  // prose ("TPM supports 2.0 but has not been upgraded") is the more useful of the two here,
+  // so the earlier family has to win. Scope stays at 0x801c*: the same page also lists NTE
+  // crypto codes, a plain Win32 code that the win32 family already owns, and two codes whose
+  // categories do not exist — none of them get invented here.
+  {
+    const ENTRA_MIN_KEYS = 30; // 35 on 2026-09-09; a drop means the page changed shape
+    let entraKeys = 0;
+    for (const table of parseTables(await fetchPage(URL.helloErrors))) {
+      for (const [value, cause] of table.slice(1)) {
+        if (!/^0x[0-9a-f]{8}$/i.test(value)) continue;
+        const key = normalizeHex(value);
+        if (!key.startsWith("0x801c")) continue;
+        // "DSREG_NO_DEFAULT_ACCOUNT: NGC provisioning is unable to …" — the cell leads with the
+        // symbol for the codes that have one.
+        const named = /^([A-Z][A-Z0-9_]{2,}):\s+(.*)$/s.exec(cause);
+        queue("entra-join", key, {
+          symbol: named?.[1],
+          description: named ? named[2] : cause,
+          confidence: "high",
+          source: msdoc(URL.helloErrors),
+          category: "entra-join",
+        });
+        entraKeys += 1;
+      }
+    }
+    // parseTables drops a row whose hex cell does not match; without this the page silently
+    // yielding fewer codes would look like a clean run.
+    if (entraKeys < ENTRA_MIN_KEYS) {
+      throw new Error(`entra-join: only ${entraKeys} 0x801c keys parsed from ${URL.helloErrors} (expected >= ${ENTRA_MIN_KEYS}) — the page shape changed`);
+    }
+  }
+
  // IME CustomErrorCodes (0x87D3xxxx)
  for (const [name, rawValue] of Object.entries(ime.customErrorCodes)) {
    if (name === "Undefined") continue;
Author	SHA1	Message	Date
Oliver Kieselbach	8224c8f1a8	fix(rules,engine,agent): ESP-004 gates on the esp_apps_timeout verdict; not_exists absence gate; Shell-Core failure inherits settle detail (D-234, D-235) ANALYZE-ESP-004 fired on every ESP terminal failure of a Continue-anyway profile and rendered the configured FirstSync limit as elapsed time — the mayHaveContinuedAnyway flag only says the profile has the button. The rule now requires the agent's own verdict (app_install_failed with failureType=esp_apps_timeout), names that app via a same-event filter, reads failedSubcategory from esp_failure_settle_started and words the limit as a limit. Verified with test_analyze_rule: cb7036a6 fires, 683f1eff (0x80070652 after 19 min) stays silent. Rule engine: not_exists with a dataField on event_type/event_data conditions matches when no event of the type carries a non-empty value — including an absent type — instead of being dead behind the fieldValue null short-circuit. Schema and MCP authoring guide say so. Agent: a Shell-Core 62407 failure that lands inside the provisioning tracker's 30-s settle window (a third of all ESP terminal failures) now inherits the pending errorCode / failedSubcategory / category / likelyCulpritApps, so enrollment_failed, Sessions.FailureReason and the termination-time app classification see the HRESULT the registry had already named. failureType stays the Shell-Core value. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-09 17:20:24 +02:00
Oliver Kieselbach	d7f39895f5	fix(web): omit the two default field values from the browser catalog (D-233) The Entra family (D-231) pushed utils/error-codes.json to 123026 bytes against the 120000-byte client-bundle budget, breaking the Web CI job. Raising the cap would have been the wrong repair -- it was set three days ago with the v2 catalog, and a guard that gets widened whenever content grows is not a guard. The bytes were elsewhere: confidence "high" holds for 562 of 641 rows and source "msdoc" for about half, ~19 KB of bundle spent repeating two constants. The sync now omits them and errorCodeMap restores them while building the map, so every consumer still sees a complete entry and errorCodeTooltip renders exactly as before. 123026 -> 102399 bytes, cap unchanged, ~17 KB of headroom left. Dropping the fields outright was rejected: the tooltip renders both, so they are provenance a customer sees. The vocabulary test now asserts on the resolved entry via getErrorCodeEntry rather than the raw file -- a default changed on one side only would otherwise make tooltips lie about provenance silently.	2026-09-09 15:26:29 +02:00
Oliver Kieselbach	790bd35385	small gather rule description change	2026-09-09 14:59:56 +02:00
Oliver Kieselbach	34c9fd42fe	chore: bump internal and .claude/commands gitlinks internal: D-231/D-232, the plan with its review, backlog B-y5d and B-s2y. .claude/commands: the platform-health marker-catalog corrections from the 2026-09-09 health pass (weekday vs weekend ingest baseline, CAS retried scales with load, WhatsNewNotificationSent is not proof of a run).	2026-09-09 14:55:30 +02:00
Oliver Kieselbach	19a336870c	fix(mcp): put the catalog pointer on the parameter, not only the tool (D-232) Seven of 44 tool errors in the 7-day telemetry were invented catalog values, and in every case the tool description already said the right thing while the parameter description was bare or contradicted it. update_tenant_config is the clean proof: its description says "Call get_tenant_config_schema FIRST", but the fields parameter said "Use get_tenant_config for current values and exact field names" -- and over 30 days the model called get_tenant_config 12 times and get_tenant_config_schema once. The text next to the argument wins, and get_tenant_config cannot answer what it was pointed at: it shows only the fields this tenant has set, with no type, writability or nullability. Also: get_session_events.eventType (event_types catalog, matching the pointer search_sessions_by_event.eventType already carries), query_table (list_tables) and test_analyze_rule.rule (rule_schemas, validate_rule first).	2026-09-09 14:55:22 +02:00
Oliver Kieselbach	5ba5942d0b	feat(error-codes): parse the Entra device-registration family (D-231) The catalog held 2 of 607 entries in entra-join, while the 0x801Cxxxx DSREG family is what an enrollment meets during hybrid join and the ESP account-setup phase. The Windows Hello PIN error page is the only MS table that documents it; both of its tables are now parsed, restricted to 0x801c* (607 -> 641 entries). The block runs after PROSE_ENTRIES so the Autopilot-specific text for 0x801c03ea keeps precedence over the generic one. The Mitigation column is not carried -- the catalog describes codes, it does not advise. A "SYMBOL: text" cell yields a symbol (0x801c004d -> DSREG_NO_DEFAULT_ACCOUNT). The run fails below 30 keys, because parseTables drops non-matching rows silently and a reshaped page would otherwise look like a clean run. decode() now strips zero-width and bidi marks: the page carries U+200B in one hex cell and four description cells, JS \s does not match it, and such a hex cell fails every ^0x...$ test. Placed in decode() rather than in the new source so the next parsed page cannot walk into it -- regeneration shows 34 added, 0 changed. 0x801C044F, the zero-hit lookup that started this, is on none of the three MS pages and deliberately stays unknown.	2026-09-09 14:55:11 +02:00
Oliver Kieselbach	aa20d9102c	fix(backend): show the freshly published agent version, not the previous one (D-230) The What's new panel prints "Latest agent version" under the release entries, and the session list draws its outdated badges from the same endpoint — but the value was cached 12h in each Function instance and 1h in the browser, so the panel announced the previous release for up to 13h and two instances could disagree. - LatestVersionsService: TTL 12h -> 5 min; keep the last successful result and serve it when the blob read fails, so the shorter TTL cannot blank the version line on a transient hiccup (failure marker 5 min -> 1 min). - GetLatestVersions: Cache-Control max-age 3600 -> 60. - No refresh callback from build-agent.yml: the cache is per instance, a warm-up request would leave every other instance stale. The origin is a ~200-byte no-cache blob behind the download alias that Front Door does not cache, so a warm instance now reads it at most 12x/h. Backend deploy (workflow_dispatch) pending — B-uq7. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-09 12:26:03 +02:00
Oliver Kieselbach	097be1700b	chore: bump internal gitlink Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-09 12:10:52 +02:00
Oliver Kieselbach	f1457d823d	chore: bump .claude/commands gitlink	2026-09-09 12:02:05 +02:00
Oliver Kieselbach	12e66299e6	feat(rules): allow-list folders under the signed-in user's profile (D-228, D-229) Gather rules and admin-configured diagnostics paths could never reach a folder below a user profile. The %LOGGED_ON_USER_PROFILE% token lifts the C:\Users hard block for AppData\Local and AppData\Roaming, but lifting is not admitting: the path then fell into filePrefixes, which is matched literally against the already-expanded path, and the profile name is not known when that list is authored. The exception only ever worked in unrestricted mode, and no agent test passed a non-null userProfilePath. D-228 introduces userProfileFilePrefixes, holding entries relative to the profile root (AppData\Local\RealmJoin). Both guards resolve them against the detected profile and match segment-bounded; entries that are rooted, contain "..", or sit outside AppData\Local / AppData\Roaming are dropped at load, so configuration can only narrow the hard block's exception, never widen it. The allowlist is anchored to the detected profile, so a rule cannot reach another user's AppData. The AppData subdirectory list existed in both guard classes with the GatherRuleGuards copy unused; it is now one list and DiagnosticsPathGuards delegates. filePrefixes additionally gains C:\ProgramData\RealmJoin\choco\logs. D-229 fixes the pre-flight validators, which must only ever reject what the agent rejects: - the portal returned "allowed" on the lifted hard block without consulting the allowlist, so a rule the agent refuses passed the enable gate and then failed silently on the device with a security_warning; - the MCP validator offered logparser the diagnosticsPathPrefixes list that no collector consults (four paths reported allowed that the agent blocks); - the MCP validator did not expand environment variables at all, reporting %ProgramData% targets as blocked although the device reads them. Measured before changing the portal: no rule in any tenant used the token, so nothing that was working gets disabled. Verified: solution build 0 warnings, agent 2897 tests, web 1257 + tsc + eslint 0, MCP 779, guardrails.json validates against its schema, rules/dist regenerates without drift. The six new agent tests were green against the unchanged guard first, which is what proves the exception was inert. Takes effect on devices only after an agent release: guardrails.json is an EmbeddedResource in the agent assembly. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-09 11:54:36 +02:00
Oliver Kieselbach	e9a01de9da	chore: bump .claude/commands gitlink Event reference in /ux-insights completed and live-verified. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-09 10:06:20 +02:00
Oliver Kieselbach	5f793ea01a	chore: bump .claude/commands gitlink Marker-catalog rows for the What's new panel events and the digest timer. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-09 09:58:50 +02:00
Oliver Kieselbach	e86f7efed3	feat(bootstrap): verify the publisher of the extracted agent binaries before --install (D-227) The SHA-256 check proves the ZIP is the one version.json names, but that manifest lives in the same container as the ZIP: it cannot outlive a compromise of the download host. The expected publisher travels inside this script, which the loader verified before running it, so the chain from the file an administrator assigns to the process that starts is publisher-anchored end to end. Install-AutopilotMonitor.ps1 v2.4 -> v2.5: - Get-UnverifiedAgentBinaries checks every AutopilotMonitor.*.exe/.dll in the extracted payload for status Valid and the same subject pin the loader carries; the gate runs immediately before --install and throws on any rejection, exactly like the hash check. - Third-party assemblies keep their own publisher's signature and are not checked: System.Management.Automation.dll ships unsigned, so a gate over all files would refuse the live payload. - An extracted folder with no binary of ours is a rejection, not a pass. - The SHA-256 manifest check is unchanged and still runs first: it proves the bytes, the signature proves the author. Verified against the live payload 2.0.1454 (all five of our PEs Valid and glueckkanja AG, gate passes); appending one byte to AutopilotMonitor.Shared.dll makes it reject. Pester 55/55. The portal privacy and about pages carried the pre-signing wording and are corrected in the same change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-08 23:11:16 +02:00
Oliver Kieselbach	78bfad0ec6	web: the portal What's new panel names the currently published agent version A quiet third line in the panel header ("Latest agent version 2.0.1452", faint, the number monospaced) reads from the existing config/latest-versions endpoint. The monospaced string is the same one the session list shows in its "Agent Version" column, so a reader can tell at a glance whether their fleet runs the latest agent. Portal and signed-in only: the endpoint is AuthenticatedUser, and the public site has no session list to compare against. The gate sits on the mount of the small component, so the landing page never even issues the request; a missing version renders nothing.	2026-09-08 22:37:29 +02:00
Oliver Kieselbach	f5efadfd07	ci: pin every third-party action to a commit SHA, gated and Dependabot-maintained (D-226) A tag is a mutable pointer owned by the action's publisher. These jobs are not ordinary CI: they hold the code-signing Key Vault token (D-223), the federated storage credentials (D-222), and combine-rules.yml holds a contents:write token that pushes to main. Whoever could repoint v7 would run code with all of that. azure/login and Azure/functions-action were already pinned; the actions/* and github/codeql-action references were not, on the usual argument that GitHub owns them and shares the runner's trust boundary. That argument does not survive the fact that they run in the same jobs as the signing identity. All seven are now pinned by SHA with the version in a trailing comment -- the comment is what keeps the line reviewable, and Dependabot rewrites both together. action-pins.yml is the guard: pins nobody enforces rot, and no review reliably catches one @v4 added to a 200-line workflow. It lives in its own workflow because ci.yml deliberately ignores changes to the other workflow files, so a job placed there would stay silent for exactly the commits it must inspect. Like CI it reports rather than blocks -- main is unprotected; making it binding would mean adding it as a required status check, which is a branch-protection decision. Verified both directions: 49 references pass against the repo, and a fixture with @v7, @main and a bare SHA fails with three annotations while the local reusable workflow refs are skipped. Two floating tool versions closed while here. wix went from the range 5.* to 5.0.2 -- it writes the bytes of the MSI customers install, where AzureSignTool only signs them. ajv was the worse one: unpinned, and npm runs lifecycle scripts at install, so a hijacked release would have executed with the push token before a single rule was validated; now exact versions with --ignore-scripts. Line endings: sed -i rewrote the workflow files as LF. Git normalises on commit, so the content diff is unaffected and indexnow-notify.yml carries no change at all. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-08 22:14:15 +02:00