Oliver Kieselbach 5f3ae2d06b fix(backend): SessionTenantLookup is claimed first-writer-wins at registration — the sessionId→tenantId row that every Global Admin/Reader cross-tenant session resolve trusts was an unconditional last-writer-wins upsert AFTER the session write keyed by the client-supplied sessionId, so any tenant's device (self-service onboarding) that knew a victim session GUID (portal deep links, Teams/Slack notifications, progress-portal URLs) could re-point the mapping at its own tenant and have every no-tenantId GA read and GA write (globaladmin annotation lane, restore fallback) silently served from a forged session; StoreSessionAsync now claims the row create-only BEFORE any Sessions/SessionsIndex write (409 → read owner: same tenant = re-registration, foreign tenant = SessionTenantConflictException → 409 session_owner_mismatch without disclosing the owner + SessionTenantConflict ops event, nothing written, not fail-soft), the legacy self-heal write is Add-only, ResolveSessionScopeAsync(requireGlobalAdmin) corroborates the resolved tenant against its Sessions row (silent, no operator confirmation), and scripts/Migration/Backfill-SessionTenantLookup.ps1 closed the pre-table window (13509 sessions, 8795 rows added, verify dry-run added=0); no tombstone on deletion by design ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-30 20:34:50 +02:00

..

admin-identity-binding.md

fix(security): McpUsers whitelist rows are honoured only for the identity the UPN is bound to (AdminIdentityBindings tid+oid) — grant, UsagePlan override and Disabled kill-switch no longer follow a same-UPN token from another tenant or a recycled account; POST global/mcp-users binds first (resolver, 422 HomeTenantUnresolved, 409 conflict) and the settings UI shows the home-tenant picker on 422; unbound legacy rows are inert

2026-08-30 12:13:03 +02:00

app-install-duration-attempt.md

feat: app install durations measure the status-defining attempt

2026-08-21 13:40:47 +02:00

app-version-regression-radar.md

insights: app-version duration regression radar + per-version duration stats

2026-08-13 13:39:03 +02:00

business-timestamps.md

fix(backend): business timestamps survive storage migrations (OccurredUtc + RowKey decode)

2026-07-20 11:29:53 +02:00

client-cert-tenant-binding.md

fix(security): drop client-writable certificate header; bootstrap routes token-only, fail-closed

2026-08-29 20:04:04 +02:00

cloudpc-device-validation.md

distress: carry the W365 Cloud PC marker into Devices Not Registered

2026-08-07 10:52:35 +00:00

device-journeys.md

perf(maintenance): one projected 35d Sessions scan shared by all rolling sweeps

2026-08-23 12:19:41 +02:00

ime-msi-archive.md

fix(security): ImeVersionHistory no longer takes a device-reported IME version as a platform fact — RecordImeVersionAsync rejects strings outside MSI ProductVersion bounds (no row/ops event/archive job), a session counts once (UpdateSessionImeAgentVersionAsync returns whether the version changed), a second tenant's sighting stamps CorroboratedAt, and the MemberRead view lists only fleet-confirmed versions (Archived, corroborated, or pre-2026-08-31) while Global scope still sees every row

2026-08-30 11:38:27 +02:00

ime-pattern-health.md

fix(agent): IME per-line matching budget counts Regex.Match time only — the wall-clock window also held the match handlers and scheduler stalls, and session 946ccbd6 (Hyper-V guest, 5–10 s process-wide stalls, 1 MB log, no line over 5 KB) broke it twice on genuine lines and silently skipped their remaining patterns; ime_pattern_hits is Debug severity (operator/backend signal, hidden from the default timeline — the IME Tracker card and the ingest fold read it regardless); the session page's IME Tracker card moves to the right column under Hardware

2026-08-30 16:00:28 +02:00

lifecycle-manifests-and-session-scope.md

fix(backend): SessionTenantLookup is claimed first-writer-wins at registration — the sessionId→tenantId row that every Global Admin/Reader cross-tenant session resolve trusts was an unconditional last-writer-wins upsert AFTER the session write keyed by the client-supplied sessionId, so any tenant's device (self-service onboarding) that knew a victim session GUID (portal deep links, Teams/Slack notifications, progress-portal URLs) could re-point the mapping at its own tenant and have every no-tenantId GA read and GA write (globaladmin annotation lane, restore fallback) silently served from a forged session; StoreSessionAsync now claims the row create-only BEFORE any Sessions/SessionsIndex write (409 → read owner: same tenant = re-registration, foreign tenant = SessionTenantConflictException → 409 session_owner_mismatch without disclosing the owner + SessionTenantConflict ops event, nothing written, not fail-soft), the legacy self-heal write is Add-only, ResolveSessionScopeAsync(requireGlobalAdmin) corroborates the resolved tenant against its Sessions row (silent, no operator confirmation), and scripts/Migration/Backfill-SessionTenantLookup.ps1 closed the pre-table window (13509 sessions, 8795 rows added, verify dry-run added=0); no tombstone on deletion by design

2026-08-30 20:34:50 +02:00

oobe-bootstrap-go-flow.md

fix code review findings

2026-07-29 10:30:47 +02:00

plan-downgrade-retention-grace.md

feat(backend): 30-day retention grace period on Pro downgrade

2026-08-22 21:00:53 +02:00

rule-regression-radar.md

feat(insights): F3 regression radar - Wilson-gated rule hit-rate drift detection (PR6)

2026-07-27 09:10:52 +02:00

send-time-frame-separation.md

feat: P14 - per-upload-batch send time separates spool delay from clock offset

2026-08-21 00:44:29 +02:00

server-actions-on-demand-diagnostics.md

docs(okf): ServerActions & on-demand diagnostics concept doc

2026-07-24 18:15:23 +02:00

session-annotations.md

annotations: tenant switcher on the overview page + GA-lane guard on the global list

2026-08-13 09:27:31 +02:00

session-owner-binding.md

feat(security): session-owner binding stage 1 (shadow) + dormant agent session rotation

2026-08-29 21:32:24 +02:00

silent-session-classification.md

feat(classification,calibration): rule 5a completed-assumed, max-lifetime grace skip, drift-radar floors

2026-08-27 18:10:19 +02:00

table-schema-sentinel.md

feat(telemetry): startup duration metrics for backend and MCP

2026-08-23 16:04:31 +02:00

telemetry-ingest-shaping.md

infra(telemetry): DCR also drops host-emitted successful SignalR dependencies

2026-08-23 19:15:41 +02:00

tenant-activation-welcome-mail.md

fix(security): PUT preview/notification-email requires a member role once the tenant has members; roleless writes only in the signup window

2026-08-29 23:57:35 +02:00

time-attribution.md

perf(maintenance): one projected 35d Sessions scan shared by all rolling sweeps

2026-08-23 12:19:41 +02:00

verdict-calibration.md

feat(classification,calibration): rule 5a completed-assumed, max-lifetime grace skip, drift-radar floors

2026-08-27 18:10:19 +02:00

vulnerability-correlation-sources.md

feat(vuln): manual "Refresh NVD Cache" and "Sync EPSS" with their own last-sync lines

2026-08-29 11:57:55 +02:00