Oliver Kieselbach 83e15e49de fix(core,backend): every payload-derived string stored into DecisionState is bounded (FactStringBounds, 256) and the reducer-verification replay streams signals — RealmJoinFacts.WithPackageStarted/Completed left PackageId/Version/Scope unbounded and deduped via a linear ordinal compare over up to 200 rows, so a forged 5000-signal stream with ~400 KB near-identical package ids cost minutes of CPU per GET sessions/{id}/reducer-verification while ReducerVerifier held all decoded payloads (~GBs) live; keys are now bounded BEFORE the dedupe scan (forged near-duplicates collapse to one row), Scope normalised to machine/user, and the same bound applied to failed app ids, HelloOutcome, ImeMatchedPatternId, EspAdvisoryFailureCategory and RJ product version/channel incl. WithVersionOverride — never truncating real telemetry (registry key names ≤ 255, GUIDs, enum-like strings); the agent adapter bounds packageId/version at the source; ReducerVerifier replays decode-fold-discard (head-signal check before the journal so stubbed streams stay silent, mid-stream truncation and count-imbalance semantics unchanged, pinned by tests); ISignalRepository.QueryBySessionAsync carries a cumulative PayloadJson budget (SignalQueryLimits, 32 M chars) reflected in the truncated flag of sessions/{id}/signals and reducer-verification; no ingest cap — stored signals stay verbatim ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-30 20:06:51 +02:00

..

autopilot-ztd-diagnostics.md

Cloud-PC-aware autopilot_profile_missing: Info instead of Warning on W365

2026-08-12 16:13:34 +02:00

build-counter-blob.md

feat(versioning): one version contract for agent, backend and MCP

2026-07-22 17:41:03 +02:00

cmtrace-time-resolution.md

fix(security): CmTraceLogParser parses in linear time (first open / last parseable trailer, timeout-backed trailer regex) instead of a greedy .* regex that backtracked quadratically on hostile lines without a timeout; agent multiline buffer gains a 1 MB char cap next to the 100-line cap, both logged at Warning, and the tail of a dropped entry is skipped instead of raw-matched

2026-08-30 00:48:29 +02:00

continue-anyway-observation.md

esp: continue-anyway observation mode — bounded 60-min defang for device-phase failures

2026-08-08 12:28:45 +02:00

decision-engine.md

fix(core,backend): every payload-derived string stored into DecisionState is bounded (FactStringBounds, 256) and the reducer-verification replay streams signals — RealmJoinFacts.WithPackageStarted/Completed left PackageId/Version/Scope unbounded and deduped via a linear ordinal compare over up to 200 rows, so a forged 5000-signal stream with ~400 KB near-identical package ids cost minutes of CPU per GET sessions/{id}/reducer-verification while ReducerVerifier held all decoded payloads (~GBs) live; keys are now bounded BEFORE the dedupe scan (forged near-duplicates collapse to one row), Scope normalised to machine/user, and the same bound applied to failed app ids, HelloOutcome, ImeMatchedPatternId, EspAdvisoryFailureCategory and RJ product version/channel incl. WithVersionOverride — never truncating real telemetry (registry key names ≤ 255, GUIDs, enum-like strings); the agent adapter bounds packageId/version at the source; ReducerVerifier replays decode-fold-discard (head-signal check before the journal so stubbed streams stay silent, mid-stream truncation and count-imbalance semantics unchanged, pinned by tests); ISignalRepository.QueryBySessionAsync carries a cumulative PayloadJson budget (SignalQueryLimits, 32 M chars) reflected in the truncated flag of sessions/{id}/signals and reducer-verification; no ingest cap — stored signals stay verbatim

2026-08-30 20:06:51 +02:00

diagnostics-package.md

fix(security): diagnostics packager reads every file through a handle validated against its pinned source folder; a subdirectory swapped for a junction between enumeration and open is skipped instead of copied

2026-08-30 00:06:50 +02:00

do-group-id-auto-set.md

feat(agent): optional Delivery Optimization GroupId from network fingerprint

2026-08-21 20:09:45 +02:00

endpoint-migration.md

feat(agent,backend,web): config-channel agent endpoint migration (MigrateToApiBaseUrl)

2026-07-18 17:48:48 +02:00

esp-policy-provider-stall.md

fix(agent): esp_policy_provider_stalled gains sidecar-missing arm (issue #106)

2026-07-24 16:48:50 +02:00

gather-rule-debug-log.md

refactor(agent): unified kebab-case log file naming + date-less agent.log

2026-08-18 02:55:06 +02:00

hello-wizard-unskip.md

fix(agent): HelloWizardStarted signal — never complete while the Hello wizard is running (session 772fe502)

2026-07-13 10:16:10 +02:00

ime-log-tracker-matching-budget.md

fix(agent): IME per-line matching budget counts Regex.Match time only — the wall-clock window also held the match handlers and scheduler stalls, and session 946ccbd6 (Hyper-V guest, 5–10 s process-wide stalls, 1 MB log, no line over 5 KB) broke it twice on genuine lines and silently skipped their remaining patterns; ime_pattern_hits is Debug severity (operator/backend signal, hidden from the default timeline — the IME Tracker card and the ingest fold read it regardless); the session page's IME Tracker card moves to the right column under Hardware

2026-08-30 16:00:28 +02:00

ime-process-watcher.md

fix(agent): ImeProcessWatcher verifies process identity before attaching and re-arms discovery after an exit — it attached to the first IntuneManagementExtension name match, so a standard user starting a renamed binary during AccountSetup could forge an ime_process_exited Warning and mute the real signal for the rest of the session (CWE-807), and even a legitimate IME service restart was never watched again; ImeProcessIdentity requires session 0 + image under the IME install root (QueryFullProcessImageName, cross-bitness), prefers the oldest trusted candidate, logs untrusted matches once per PID, and OnImeExited restarts the discovery timer (ReferenceEquals guard against duplicate events)

2026-08-30 17:07:18 +02:00

index.md

fix(agent): complete enrollments with zero user-targeted apps instead of failing them

2026-08-25 12:27:42 +02:00

local-admin-analyzer.md

fix(security): LocalAdminAnalyzer never exempts a logged-in local SAM account from the shutdown scan (CWE-807) and matches built-ins by well-known RID so localized Guest/Administrator are not flagged

2026-08-30 01:42:51 +02:00

logs-and-persistence.md

refactor(agent): unified kebab-case log file naming + date-less agent.log

2026-08-18 02:55:06 +02:00

mdm-reboot-coalescing.md

fix(agent): neutral aggregated 2800 observations; reboot claim gated on observed reboot

2026-07-20 18:41:47 +02:00

overview.md

fix(agent): SignalIngress worker re-entrancy — never block the single consumer on its own post

2026-08-29 22:11:25 +02:00

post-reboot-completion-recovery.md

fix(engine): let the observed user-ESP skip stand in for the exit evidence

2026-08-20 00:40:23 +02:00

power-state-watcher.md

fix(agent): battery-instance fallback for the dead Win32_PowerManagementEvent provider

2026-08-21 15:49:03 +02:00

registry-app-state-pillar.md

Registry second pillar: IME app state from HKLM with log reconciliation

2026-08-18 01:25:54 +02:00

secureboot-ca2023-detection.md

more safe SecureBootCertReader and section plan layout update

2026-07-25 12:48:27 +02:00

system-timeline-watcher.md

feat(agent): system timeline watcher — clock steps + sleep episodes as ground truth

2026-08-21 19:41:56 +02:00

wdp-scenario-gates.md

feat(wdp): scenario gates for Device Preparation + completion backstop

2026-08-18 13:12:09 +02:00

wifi-ssid-location-gate.md

feat(web): explain the blank WiFi signal in the network timeline

2026-08-26 14:06:49 +02:00

zero-user-apps-completion-gate.md

fix(agent): complete enrollments with zero user-targeted apps instead of failing them

2026-08-25 12:27:42 +02:00