Oliver Kieselbach 2900b35256 feat(agent): provisioning-package (PPKG) detector + analyze rules (V2) ...

V2 PPKG scanner that runs once at DeviceSetup-phase start and reports raw facts
only — .ppkg file presence, Provisioning\Packages registry metadata,
Recovery\Customizations residue, and best-effort per-package content indicators.
PPKGs can come from legitimate bulk enrollment or be a pre/in-enrollment
manipulation vector; intent is judged by backend analyze-rules, not the agent.

- ProvisioningPackageCollector + ProvisioningPackageHost, wired as a kernel host
  in DefaultComponentFactory (one-shot at DeviceSetup start, not at agent start).
- Events: provisioning_package_scan (aggregate) + provisioning_package_detected
  (one scalar event per artifact so analyze rules can match per package).
- Analyze rules ANALYZE-SEC-005/006 incl. a per-tenant allow-list template.
- Event-type catalogs kept in sync (Constants.EventTypes, MCP resource-catalog,
  rule-builder eventTypes).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-07 12:06:08 +02:00

..

analyze

feat(agent): provisioning-package (PPKG) detector + analyze rules (V2)

2026-06-07 12:06:08 +02:00

dist

feat(agent): provisioning-package (PPKG) detector + analyze rules (V2)

2026-06-07 12:06:08 +02:00

gather

fix community gather cert rule

2026-03-17 22:43:17 +01:00

ime-log-patterns

fix(agent/v2,rules): two-stage health-script emission to close short-session timing gap

2026-05-12 00:58:21 +02:00

schema

fix(agent/v2,rules): two-stage health-script emission to close short-session timing gap

2026-05-12 00:58:21 +02:00

scripts

added centralized guardrails for easier maintenance, added some more gather rules

2026-03-17 17:17:08 +01:00

guardrails.json

chore(rules,agent): allowlist RealmJoin registry prefixes + bump build counters (Phase E)

2026-05-21 18:39:02 +02:00