Oliver Kieselbach 7a3516e570 feat(observability): IME pattern-drift loop — nothing the log tracker skips or stops matching stays silent: the agent keeps cumulative tracker health counters and a per-pattern match histogram (restart-safe in ImeTrackerState), reports ime_* keys in agent_metrics_snapshot (files tailed, backlog bytes, lines read, matches, oversized/timeouts/budget breaks/held tails/unanchored), raises a one-shot immediate-upload ime_tracker_degraded Warning on the first pass that skipped work, and emits ime_pattern_hits at termination (every enabled pattern, zeros included, IME version); the backend folds the histogram into the permanent per-IME-version ImePatternStats table (built-in IDs only, plausible version only, one partition read + one transactional batch) and evaluates drift without a hard-coded list — baseline = the version with the most reporting sessions (≥100), expected = ≥80 % hit rate there, drift = an expected pattern matched in none of ≥25 sessions on a newer version — raising ImePatternDriftSuspected once per version×pattern (ETag-stamped, dual-registered in the web ops-event list with a new guard test); GET metrics/ime-pattern-health (GlobalReadOrAdmin) + Global Admin → Metrics → IME Pattern Health matrix (drift/silent/low/few cells, open alerts, retired patterns) + session-page "IME Tracker" rows (latest snapshot by max sequence) + MCP get_ime_pattern_health (GA/Reader) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-30 15:12:38 +02:00

..

admin-identity-binding.md

fix(security): McpUsers whitelist rows are honoured only for the identity the UPN is bound to (AdminIdentityBindings tid+oid) — grant, UsagePlan override and Disabled kill-switch no longer follow a same-UPN token from another tenant or a recycled account; POST global/mcp-users binds first (resolver, 422 HomeTenantUnresolved, 409 conflict) and the settings UI shows the home-tenant picker on 422; unbound legacy rows are inert

2026-08-30 12:13:03 +02:00

app-install-duration-attempt.md

feat: app install durations measure the status-defining attempt

2026-08-21 13:40:47 +02:00

app-version-regression-radar.md

insights: app-version duration regression radar + per-version duration stats

2026-08-13 13:39:03 +02:00

business-timestamps.md

fix(backend): business timestamps survive storage migrations (OccurredUtc + RowKey decode)

2026-07-20 11:29:53 +02:00

client-cert-tenant-binding.md

fix(security): drop client-writable certificate header; bootstrap routes token-only, fail-closed

2026-08-29 20:04:04 +02:00

cloudpc-device-validation.md

distress: carry the W365 Cloud PC marker into Devices Not Registered

2026-08-07 10:52:35 +00:00

device-journeys.md

perf(maintenance): one projected 35d Sessions scan shared by all rolling sweeps

2026-08-23 12:19:41 +02:00

ime-msi-archive.md

fix(security): ImeVersionHistory no longer takes a device-reported IME version as a platform fact — RecordImeVersionAsync rejects strings outside MSI ProductVersion bounds (no row/ops event/archive job), a session counts once (UpdateSessionImeAgentVersionAsync returns whether the version changed), a second tenant's sighting stamps CorroboratedAt, and the MemberRead view lists only fleet-confirmed versions (Archived, corroborated, or pre-2026-08-31) while Global scope still sees every row

2026-08-30 11:38:27 +02:00

ime-pattern-health.md

feat(observability): IME pattern-drift loop — nothing the log tracker skips or stops matching stays silent: the agent keeps cumulative tracker health counters and a per-pattern match histogram (restart-safe in ImeTrackerState), reports ime_* keys in agent_metrics_snapshot (files tailed, backlog bytes, lines read, matches, oversized/timeouts/budget breaks/held tails/unanchored), raises a one-shot immediate-upload ime_tracker_degraded Warning on the first pass that skipped work, and emits ime_pattern_hits at termination (every enabled pattern, zeros included, IME version); the backend folds the histogram into the permanent per-IME-version ImePatternStats table (built-in IDs only, plausible version only, one partition read + one transactional batch) and evaluates drift without a hard-coded list — baseline = the version with the most reporting sessions (≥100), expected = ≥80 % hit rate there, drift = an expected pattern matched in none of ≥25 sessions on a newer version — raising ImePatternDriftSuspected once per version×pattern (ETag-stamped, dual-registered in the web ops-event list with a new guard test); GET metrics/ime-pattern-health (GlobalReadOrAdmin) + Global Admin → Metrics → IME Pattern Health matrix (drift/silent/low/few cells, open alerts, retired patterns) + session-page "IME Tracker" rows (latest snapshot by max sequence) + MCP get_ime_pattern_health (GA/Reader)

2026-08-30 15:12:38 +02:00

lifecycle-manifests-and-session-scope.md

backend: lifecycle completeness nets + session-scope point-read + server-side dashboard search (audit P5/P6)

2026-08-13 19:29:27 +02:00

oobe-bootstrap-go-flow.md

fix code review findings

2026-07-29 10:30:47 +02:00

plan-downgrade-retention-grace.md

feat(backend): 30-day retention grace period on Pro downgrade

2026-08-22 21:00:53 +02:00

rule-regression-radar.md

feat(insights): F3 regression radar - Wilson-gated rule hit-rate drift detection (PR6)

2026-07-27 09:10:52 +02:00

send-time-frame-separation.md

feat: P14 - per-upload-batch send time separates spool delay from clock offset

2026-08-21 00:44:29 +02:00

server-actions-on-demand-diagnostics.md

docs(okf): ServerActions & on-demand diagnostics concept doc

2026-07-24 18:15:23 +02:00

session-annotations.md

annotations: tenant switcher on the overview page + GA-lane guard on the global list

2026-08-13 09:27:31 +02:00

session-owner-binding.md

feat(security): session-owner binding stage 1 (shadow) + dormant agent session rotation

2026-08-29 21:32:24 +02:00

silent-session-classification.md

feat(classification,calibration): rule 5a completed-assumed, max-lifetime grace skip, drift-radar floors

2026-08-27 18:10:19 +02:00

table-schema-sentinel.md

feat(telemetry): startup duration metrics for backend and MCP

2026-08-23 16:04:31 +02:00

telemetry-ingest-shaping.md

infra(telemetry): DCR also drops host-emitted successful SignalR dependencies

2026-08-23 19:15:41 +02:00

tenant-activation-welcome-mail.md

fix(security): PUT preview/notification-email requires a member role once the tenant has members; roleless writes only in the signup window

2026-08-29 23:57:35 +02:00

time-attribution.md

perf(maintenance): one projected 35d Sessions scan shared by all rolling sweeps

2026-08-23 12:19:41 +02:00

verdict-calibration.md

feat(classification,calibration): rule 5a completed-assumed, max-lifetime grace skip, drift-radar floors

2026-08-27 18:10:19 +02:00

vulnerability-correlation-sources.md

feat(vuln): manual "Refresh NVD Cache" and "Sync EPSS" with their own last-sync lines

2026-08-29 11:57:55 +02:00