Files
Oliver Kieselbach e5cb3c4f5e Rules: every analyze rule carries a presentation block (D-356)
All 54 shipped analyze rules get role, summary, subject and key facts as
{{signal.key}} templates, each with a minor version bump so the self-seed
picks them up. Values were checked against stored findings, the rows that
receive the block at read time.

- ENRL-001 repeats the outcome only: the 0x87D1041C paragraph and the
  placeholder note are gone, labels read "ESP step that failed" / "ESP
  error code", remediation is "Find the cause". This changes its alert text.
- ENRL-002 says the sweep "closed" the session (it can end Incomplete).
- ID-002 and ID-004 gain evidence-only conditions (unexpected account
  names; IME token failure count and codes); firing and confidence are
  unchanged.
- Resolution: facts sharing a label are alternatives, an exact repeat of
  label and value is left out (new shared fixture case, web module and
  its generated MCP copy).
- Ratchet: every built-in presentation passes the save validator, uses
  qualified tokens only, and each token names a condition of the rule and
  a key its source records (RuleTemplateInterpolator.TokenRegex internal).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-13 23:36:21 +02:00

111 lines
6.2 KiB
JSON

{
"cases": [
{
"name": "summary, subject and facts resolve from qualified tokens",
"presentation": {
"role": "cause",
"summary": "{{install_retry_loop.appName}} was started {{install_retry_loop.count}} times",
"subject": { "kind": "app", "key": "{{install_retry_loop.groupKey}}", "name": "{{install_retry_loop.appName}}" },
"facts": [
{ "label": "Install starts", "value": "{{install_retry_loop.count}}", "format": "number" },
{ "label": "Threshold", "value": "{{install_retry_loop.threshold}}" }
]
},
"matchedConditions": {
"install_retry_loop": { "eventId": "evt-3", "groupKey": "00000000-0000-4000-8000-000000000002", "appName": "Contoso VPN", "count": 4, "threshold": 3 }
},
"explanation": "The same app was started 3 or more times.",
"expected": {
"role": "cause",
"summary": "Contoso VPN was started 4 times",
"subject": { "kind": "app", "key": "00000000-0000-4000-8000-000000000002", "name": "Contoso VPN" },
"facts": [
{ "label": "Install starts", "value": "4", "format": "number" },
{ "label": "Threshold", "value": "3", "format": "text" }
]
}
},
{
"name": "a fact whose token was not recorded is left out, the order of the rest is kept",
"presentation": {
"role": "outcome",
"facts": [
{ "label": "Reason", "value": "{{reason}}", "format": "code" },
{ "label": "ESP step", "value": "{{esp_failure_subcategory.value}}" },
{ "label": "HRESULT", "value": "{{esp_failure_errorcode.value}}", "format": "errorCode" }
]
},
"matchedConditions": {
"enrollment_failed_reason": { "eventType": "enrollment_failed", "field": "reason", "value": "esp_terminal_failure" },
"esp_failure_errorcode": { "eventType": "esp_failure_settle_started", "field": "errorCode", "value": "0x80d03805" }
},
"explanation": "The Autopilot enrollment has explicitly failed.",
"expected": {
"role": "outcome",
"summary": "The Autopilot enrollment has explicitly failed.",
"subject": null,
"facts": [
{ "label": "Reason", "value": "esp_terminal_failure", "format": "code" },
{ "label": "HRESULT", "value": "0x80d03805", "format": "errorCode" }
]
}
},
{
"name": "an empty value counts as not recorded",
"presentation": { "role": "cause", "facts": [ { "label": "Reason", "value": "{{reason}}" }, { "label": "Note", "value": " {{note.value}} " } ] },
"matchedConditions": { "sig": { "field": "reason", "value": null }, "note": { "field": "other", "value": "" } },
"explanation": "",
"expected": { "role": "cause", "summary": null, "subject": null, "facts": [] }
},
{
"name": "summary falls back to the explanation's first sentence without markdown",
"presentation": { "role": "cause", "summary": "{{missing.count}} starts" },
"matchedConditions": { "failed_app": { "field": "appName", "value": "Contoso VPN" } },
"explanation": "App **{{appName}}** failed with `0x1`. The installer reported success.\n\nMore text.",
"expected": { "role": "cause", "summary": "App Contoso VPN failed with 0x1.", "subject": null, "facts": [] }
},
{
"name": "summary fallback skips a first sentence whose token was not recorded",
"presentation": { "role": "advisory" },
"matchedConditions": {},
"explanation": "- **Failure reason:** {{reason}}\n- next item",
"expected": { "role": "advisory", "summary": null, "subject": null, "facts": [] }
},
{
"name": "a subject whose key was not recorded is no subject; a missing name shows the key",
"presentation": { "role": "cause", "summary": "x", "subject": { "kind": "app", "key": "{{failed.appId}}" } },
"matchedConditions": { "failed": { "appId": "00000000-0000-4000-8000-000000000004" } },
"explanation": "",
"expected": { "role": "cause", "summary": "x", "subject": { "kind": "app", "key": "00000000-0000-4000-8000-000000000004", "name": "00000000-0000-4000-8000-000000000004" }, "facts": [] }
},
{
"name": "an unresolved subject key drops the subject",
"presentation": { "role": "cause", "summary": "x", "subject": { "kind": "app", "key": "{{failed.appId}}", "name": "{{failed.appName}}" } },
"matchedConditions": { "failed": { "appName": "Contoso VPN" } },
"explanation": "",
"expected": { "role": "cause", "summary": "x", "subject": null, "facts": [] }
},
{
"name": "an unknown fact format reads as text, a fact without a label is skipped",
"presentation": { "role": "context", "summary": "x", "facts": [ { "label": "Minutes", "value": "{{s.offsetMinutes}}", "format": "weird" }, { "label": "", "value": "{{s.direction}}" } ] },
"matchedConditions": { "s": { "offsetMinutes": 30.5, "direction": "behind" } },
"explanation": "",
"expected": { "role": "context", "summary": "x", "subject": null, "facts": [ { "label": "Minutes", "value": "30.5", "format": "text" } ] }
},
{
"name": "facts sharing a label are alternatives: a repeated label and value is left out, a different value stays",
"presentation": { "role": "cause", "summary": "x", "facts": [ { "label": "ESP error", "value": "{{on_failure.value}}", "format": "errorCode" }, { "label": "ESP error", "value": "{{on_advisory.value}}", "format": "errorCode" }, { "label": "Exit code", "value": "{{first.value}}" }, { "label": "Exit code", "value": "{{second.value}}" } ] },
"matchedConditions": { "on_failure": { "field": "errorCode", "value": "0x80180014" }, "on_advisory": { "field": "errorCode", "value": "0x80180014" }, "first": { "value": 1603 }, "second": { "value": 1618 } },
"explanation": "",
"expected": { "role": "cause", "summary": "x", "subject": null, "facts": [ { "label": "ESP error", "value": "0x80180014", "format": "errorCode" }, { "label": "Exit code", "value": "1603", "format": "text" }, { "label": "Exit code", "value": "1618", "format": "text" } ] }
},
{
"name": "no presentation resolves to nothing",
"presentation": null,
"matchedConditions": { "sig": { "field": "reason", "value": "x" } },
"explanation": "Text.",
"expected": null
}
]
}