Oliver Kieselbach 2e736f40ad feat(backend,shared): Intune Enrollment Validation admits enrolled devices without pre-registration (D-282) ...

The certificate's Intune managedDevice id is looked up in the tenant's Intune. With the tenant
switch ValidateIntuneDeviceBinding on, that lookup is the last accepting link of the validator
chain: an enrolled device that is not being retired, wiped or deleted is admitted as
ValidatorType.IntuneEnrollment. A 404 for a certificate younger than 60 minutes is
NotFoundRecentEnrollment (503, never cached); a missing grant is 503 with 120 s.

For devices another validator admitted, the lookup only observes: in the background, never
admitting or rejecting, and only when the app token carries
DeviceManagementManagedDevices.Read.All, so a tenant without the add-on costs no Graph call.
Outcomes ride on the request row (CertDeviceBinding, role, serial match, owner and enrollment
type).

TenantConfiguration.HasAnyDeviceValidation() is the single gate precondition; the feature flags
expose it as deviceValidationEnabled (replaces validateAutopilotDevice).

The agent parses ValidatorType strictly: release the agent before this backend.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-09-25 11:57:26 +02:00

..

Backup

fix(backend): typed bodies and error envelope for backup, session-restore and delegation wrappers

2026-09-21 22:19:38 +02:00

Config

feat(backend,shared): Intune Enrollment Validation admits enrolled devices without pre-registration (D-282)

2026-09-25 11:57:26 +02:00

Deletion

Typed API contract: every success response is a wire DTO, generated end-to-end into TypeScript (#136)

2026-08-31 02:30:39 +02:00

Diagnostics

feat(backend,mcp): typed API contract COMPLETED — every remaining top-level success body is a manifest-exported wire DTO, and the guard now catches the bypass shapes that let them escape. The 08-31 migration's ratchet only saw inline WriteAsJsonAsync(new {...}); four bypass classes had kept ~20 endpoint families untyped: (A) Shared classes without IApiResponse — GeographicMetricsResponse, FleetHealthMetrics, ImePatternHealthResponse, SlaMetricsResponse, PlatformUsageMetrics now implement it (wire byte-identical, interface is empty); (B) Functions-local named response families moved verbatim to Shared — PlatformAgentMetricsResponse/SessionAgentMetric/DeliveryLatencyMetrics/CrashRateMetrics/CrashExceptionSummary, AgentEfficiencyMetricsResponse family (CloneAsCacheHit relocated into the service; init→set for netstandard2.0), OffboardResponse; (C) anonymous/object builders converted to DTOs with old-vs-new wire-parity facts (TypedContractCompletionWireParityTests, 14 facts incl. every vanishing-key case): rule-stats x2 (RuleStatsResponse; uniqueRules is global-only via an optional slot at its exact wire position), verdict-calibration (builder renamed VerdictCalibrationResponseBuilder, PathRow/TrendWindow to Shared), metrics/app (MetricsMath), apps list/analytics/sessions x6 routes (AppsAnalyticsHelper; legacy + paged list share ONE DTO via optional paging keys), ime-versions lean projection (ImeVersionHistoryLeanEntry [WireContract]; bare-array envelope stays, typed as IReadOnlyList<object>), device-journeys + time-attribution fleet envelopes, feature-flags, diagnostics/paths, session restore, cascade-delete Enqueued arm (error arms stay anonymous by design), feedback eligibility/list; (D) Serialize+WriteString path — ListBackupsResponse under the backup surface's own serializer options; AppInsightsQuery's Serialize is an outgoing REQUEST body (not response debt, baselined as such). TypedResponseGuardTests gains three ratchets with mutation-proven red/green: WriteAsJsonAsync(<variable assigned an anonymous object>) (empty baseline), JsonSerializer.Serialize(new{ (error-tolerant; 1 documented request-body entry), and object/Task<object>-returning Build*/Compute*/*Payload/*Response methods (1 documented union entry); the local-WriteJson-wrapper class is closed structurally (generic T : IApiResponse — an interface-typed parameter would serialize zero properties, the generic keeps the concrete type). Manifest regenerated 208→298 exported types; MCP adopts the new types (get_rule_stats typed with the trend-drop as explicit output shaping, get_platform_metrics drops its hand-declared mirror for PlatformAgentMetricsResponse, verdict-calibration-shape derives its rows via extends Omit<generated wire row> so backend renames go tsc-red). Six backend shape-test files switched from default-options serialization to the production wire options via TestWire (ApiJsonOptions; the old default-options runs only matched while payloads were anonymous with lowercase members), and three assertions that pinned null-VALUED keys now pin key ABSENCE — production always omitted them (WhenWritingNull); the parity facts prove the wire itself is unchanged. Deliberately still untyped: auth/me, CheckMcpAccess dictionary, TenantAdmins/GlobalAdmins entity-row arrays and the object-slot payloads (RuleDryRun, HealthCheck, TenantConfigFieldSchema, ...) — the documented read-model follow-up. Suites: Backend 5323, DecisionCore 577, Agent 2805, SummaryDialog 44, MCP 617, Web tsc 0 + vitest 957, generator idempotent.

2026-08-31 04:32:51 +02:00

Enrollment

feat(security): session-owner binding stage 1 (shadow) + dormant agent session rotation

2026-08-29 21:32:24 +02:00

Graph

feat(backend,shared): Intune Enrollment Validation admits enrolled devices without pre-registration (D-282)

2026-09-25 11:57:26 +02:00

Metrics

fix(sla): alert and dashboard judge one rolling 30-day window; an empty period is no data; a lasting breach repeats only on new enrollments

2026-09-21 15:08:16 +02:00

Notifications

Agent Host changes for agents/whats-new-notification-settings (#153)

2026-09-08 20:51:20 +02:00

Offboarding

feat(backend): finalize + arm the offboarding farewell email

2026-08-03 10:20:27 +02:00

Rules

fix(backend): rule catalogs — a GitHub reseed newer than the deployed build closes the embedded self-seed (RuleCatalogStamp), the IME self-seed sunsets retired patterns, and IME pattern health reads the global partition instead of the embedded catalog (D-249)

2026-09-11 12:09:18 +02:00

Vulnerability

feat(vuln): FIRST EPSS as fourth source, act/attend/track priority, CVSS vector; never cache a refused NVD answer

2026-08-29 11:07:31 +02:00

WhatsNew

Agent Host changes for agents/whats-new-notification-settings (#153)

2026-09-08 20:51:20 +02:00

AdminApiModels.cs

fix(backend): typed bodies and error envelope for backup, session-restore and delegation wrappers

2026-09-21 22:19:38 +02:00

AnalyzeOnEnrollmentEndEnvelope.cs

chore: private submodule docs/ becomes internal/ (knowledge + decisions + work files + private instructions)

2026-09-04 02:19:00 +02:00

AnnotationApiModels.cs

shared+backend: IApiRequest marker, one RequestBody reader, every request body a Shared wire type (D-207)

2026-09-06 11:42:03 +02:00

BootstrapApiModels.cs

shared+backend: IApiRequest marker, one RequestBody reader, every request body a Shared wire type (D-207)

2026-09-06 11:42:03 +02:00

CommonApiModels.cs

shared+backend: IApiRequest marker, one RequestBody reader, every request body a Shared wire type (D-207)

2026-09-06 11:42:03 +02:00

ConfigApiModels.cs

feat(backend,web,mcp): the MCP quota follows the delegating tenant — every request is checked and counted on the caller's home tenant, a managed tenant is never charged or blocked by its manager's reads, and every delegation slot bought beyond the edition's included ones grows both the account and the organization windows by operator-editable per-slot values (D-250)

2026-09-11 16:46:27 +02:00

DecisionTransitionRecord.cs

backend: remove the V2 index tables and their dual-write pipeline (D-196)

2026-09-05 04:27:48 +02:00

DelegationApiModels.cs

fix(backend): managed tenants see operator-provisioned access as "Platform support"

2026-09-22 09:52:00 +02:00

DiagnosticsApiModels.cs

shared+backend: IApiRequest marker, one RequestBody reader, every request body a Shared wire type (D-207)

2026-09-06 11:42:03 +02:00

ErrorCodeEntry.cs

refactor: move the error-code generator from scripts/ to tools/ (D-225)

2026-09-08 20:35:51 +02:00

EventTypeIndexEntry.cs

perf(raw-events): budgeted, resumable cross-session scan; tenant from index rows; MCP pageSize override + timeout retry

2026-09-01 22:35:46 +02:00

FeedbackApiModels.cs

shared+backend: IApiRequest marker, one RequestBody reader, every request body a Shared wire type (D-207)

2026-09-06 11:42:03 +02:00

FleetHealthModels.cs

web+backend: dashboard search gets field qualifiers (model=, manufacturer=), AND-ed terms and exclusions, parsed identically on both sides; Fleet Health model rows link with that search (D-217)

2026-09-06 21:54:10 +02:00

GeographicApiModels.cs

feat(backend,mcp): typed API contract COMPLETED — every remaining top-level success body is a manifest-exported wire DTO, and the guard now catches the bypass shapes that let them escape. The 08-31 migration's ratchet only saw inline WriteAsJsonAsync(new {...}); four bypass classes had kept ~20 endpoint families untyped: (A) Shared classes without IApiResponse — GeographicMetricsResponse, FleetHealthMetrics, ImePatternHealthResponse, SlaMetricsResponse, PlatformUsageMetrics now implement it (wire byte-identical, interface is empty); (B) Functions-local named response families moved verbatim to Shared — PlatformAgentMetricsResponse/SessionAgentMetric/DeliveryLatencyMetrics/CrashRateMetrics/CrashExceptionSummary, AgentEfficiencyMetricsResponse family (CloneAsCacheHit relocated into the service; init→set for netstandard2.0), OffboardResponse; (C) anonymous/object builders converted to DTOs with old-vs-new wire-parity facts (TypedContractCompletionWireParityTests, 14 facts incl. every vanishing-key case): rule-stats x2 (RuleStatsResponse; uniqueRules is global-only via an optional slot at its exact wire position), verdict-calibration (builder renamed VerdictCalibrationResponseBuilder, PathRow/TrendWindow to Shared), metrics/app (MetricsMath), apps list/analytics/sessions x6 routes (AppsAnalyticsHelper; legacy + paged list share ONE DTO via optional paging keys), ime-versions lean projection (ImeVersionHistoryLeanEntry [WireContract]; bare-array envelope stays, typed as IReadOnlyList<object>), device-journeys + time-attribution fleet envelopes, feature-flags, diagnostics/paths, session restore, cascade-delete Enqueued arm (error arms stay anonymous by design), feedback eligibility/list; (D) Serialize+WriteString path — ListBackupsResponse under the backup surface's own serializer options; AppInsightsQuery's Serialize is an outgoing REQUEST body (not response debt, baselined as such). TypedResponseGuardTests gains three ratchets with mutation-proven red/green: WriteAsJsonAsync(<variable assigned an anonymous object>) (empty baseline), JsonSerializer.Serialize(new{ (error-tolerant; 1 documented request-body entry), and object/Task<object>-returning Build*/Compute*/*Payload/*Response methods (1 documented union entry); the local-WriteJson-wrapper class is closed structurally (generic T : IApiResponse — an interface-typed parameter would serialize zero properties, the generic keeps the concrete type). Manifest regenerated 208→298 exported types; MCP adopts the new types (get_rule_stats typed with the trend-drop as explicit output shaping, get_platform_metrics drops its hand-declared mirror for PlatformAgentMetricsResponse, verdict-calibration-shape derives its rows via extends Omit<generated wire row> so backend renames go tsc-red). Six backend shape-test files switched from default-options serialization to the production wire options via TestWire (ApiJsonOptions; the old default-options runs only matched while payloads were anonymous with lowercase members), and three assertions that pinned null-VALUED keys now pin key ABSENCE — production always omitted them (WhenWritingNull); the parity facts prove the wire itself is unchanged. Deliberately still untyped: auth/me, CheckMcpAccess dictionary, TenantAdmins/GlobalAdmins entity-row arrays and the object-slot payloads (RuleDryRun, HealthCheck, TenantConfigFieldSchema, ...) — the documented read-model follow-up. Suites: Backend 5323, DecisionCore 577, Agent 2805, SummaryDialog 44, MCP 617, Web tsc 0 + vitest 957, generator idempotent.

2026-08-31 04:32:51 +02:00

GraphApiModels.cs

shared+backend: IApiRequest marker, one RequestBody reader, every request body a Shared wire type (D-207)

2026-09-06 11:42:03 +02:00

ImeMsiArchiveEnvelope.cs

backend: auto-archive IME installer on first sighting of a new version

2026-08-18 00:20:53 +02:00

ImePatternHealthModels.cs

fix(backend): rule catalogs — a GitHub reseed newer than the deployed build closes the embedded self-seed (RuleCatalogStamp), the IME self-seed sunsets retired patterns, and IME pattern health reads the global partition instead of the embedded catalog (D-249)

2026-09-11 12:09:18 +02:00

InfrastructureApiModels.cs

feat(mcp): tenant-bound registrations for self-hosted MCP clients (D-280)

2026-09-24 14:10:13 +02:00

McpClientRegistrationApiModels.cs

feat(mcp): tenant-bound registrations for self-hosted MCP clients (D-280)

2026-09-24 14:10:13 +02:00

MetricsApiModels.cs

feat(backend,web,mcp): the MCP quota follows the delegating tenant — every request is checked and counted on the caller's home tenant, a managed tenant is never charged or blocked by its manager's reads, and every delegation slot bought beyond the edition's included ones grows both the account and the organization windows by operator-editable per-slot values (D-250)

2026-09-11 16:46:27 +02:00

NotificationsApiModels.cs

feat(backend,mcp,web): typisierung follow-up — the deliberately-untyped remainder is typed end-to-end, and the raw table entities leave the wire (#137)

2026-08-31 15:22:16 +02:00

OffboardApiModels.cs

feat(offboarding): operator retry of a Failed tenant offboarding from Tenant Management

2026-09-18 10:30:06 +00:00

ProgressApiModels.cs

Typed API contract: every success response is a wire DTO, generated end-to-end into TypeScript (#136)

2026-08-31 02:30:39 +02:00

RawApiModels.cs

shared+backend: IApiRequest marker, one RequestBody reader, every request body a Shared wire type (D-207)

2026-09-06 11:42:03 +02:00

ReportApiModels.cs

shared+backend: IApiRequest marker, one RequestBody reader, every request body a Shared wire type (D-207)

2026-09-06 11:42:03 +02:00

RulesApiModels.cs

shared+backend: IApiRequest marker, one RequestBody reader, every request body a Shared wire type (D-207)

2026-09-06 11:42:03 +02:00

RuleSubmissionApiModels.cs

feat(rules): rule submissions — retention (withdrawn 30d, declined 90d), contact email, pending-first tenant list, operator hard delete (D-236 amended)

2026-09-09 23:27:25 +02:00

ServerAction.cs

feat: Server SessionActions and action signal consolidation on agent side

2026-04-14 23:42:10 +02:00

SessionAnnotation.cs

session annotations: role-separated human verdicts on sessions (flywheel labels)

2026-08-11 13:30:44 +02:00

SessionApiModels.cs

feat(backend,shared): Intune Enrollment Validation admits enrolled devices without pre-registration (D-282)

2026-09-25 11:57:26 +02:00

SessionRestoreApiModels.cs

shared+backend: IApiRequest marker, one RequestBody reader, every request body a Shared wire type (D-207)

2026-09-06 11:42:03 +02:00

SessionSearchFilter.cs

backend: lifecycle completeness nets + session-scope point-read + server-side dashboard search (audit P5/P6)

2026-08-13 19:29:27 +02:00

SessionSkewScan.cs

fix(backend): CMTrace skew tripwire judges only the current ingest era

2026-09-01 13:53:59 +02:00

SignalRecord.cs

feat(backend): M5.a primary tables — Signals + DecisionTransitions repositories

2026-04-21 09:19:08 +02:00

SlaBreachType.cs

feat(sla): persistent SlaTenantStatus row replaces in-memory throttle, fixes 2h breach-notification spam

2026-05-11 18:47:58 +02:00

SlaTenantStatus.cs

feat(sla): persistent SlaTenantStatus row replaces in-memory throttle, fixes 2h breach-notification spam

2026-05-11 18:47:58 +02:00

TelemetryItemDto.cs

agent+backend: one telemetry wire class, 422 poison for rejected items, agent responses in the typed regime (D-200/D-201)

2026-09-05 23:10:25 +02:00

TelemetryItemKind.cs

agent+backend: one telemetry wire class, 422 poison for rejected items, agent responses in the typed regime (D-200/D-201)

2026-09-05 23:10:25 +02:00

UserPresenceEntry.cs

feat(backend+web): GA "Active Users" live presence dashboard + UserActivity retention

2026-06-23 19:44:30 +02:00

UserWhatsNewSeen.cs

Agent Host changes for agents/improve-changelog-promotion-ui (#152)

2026-09-08 14:57:11 +02:00

VerdictPaths.cs

chore: private submodule docs/ becomes internal/ (knowledge + decisions + work files + private instructions)

2026-09-04 02:19:00 +02:00

VulnerabilityApiModels.cs

backend+web: vulnerability summary carries a priority breakdown (act/attend/track); the exposure panel shows Act and Attend tiles and every severity or priority chip filters the top-CVE list (D-218)

2026-09-06 22:30:36 +02:00

VulnerabilityCorrelateEnvelope.cs

feat(vuln): queue-driven correlation + WhiteGlove Part-1 inventory trigger

2026-04-30 15:25:28 +02:00