mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
8224c8f1a8
ANALYZE-ESP-004 fired on every ESP terminal failure of a Continue-anyway profile and rendered the configured FirstSync limit as elapsed time — the mayHaveContinuedAnyway flag only says the profile has the button. The rule now requires the agent's own verdict (app_install_failed with failureType=esp_apps_timeout), names that app via a same-event filter, reads failedSubcategory from esp_failure_settle_started and words the limit as a limit. Verified with test_analyze_rule: cb7036a6 fires, 683f1eff (0x80070652 after 19 min) stays silent. Rule engine: not_exists with a dataField on event_type/event_data conditions matches when no event of the type carries a non-empty value — including an absent type — instead of being dead behind the fieldValue null short-circuit. Schema and MCP authoring guide say so. Agent: a Shell-Core 62407 failure that lands inside the provisioning tracker's 30-s settle window (a third of all ESP terminal failures) now inherits the pending errorCode / failedSubcategory / category / likelyCulpritApps, so enrollment_failed, Sessions.FailureReason and the termination-time app classification see the HRESULT the registry had already named. failureType stays the Shell-Core value. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>