Oliver Kieselbach 6c53dc33e7 feat(distress): tenant-visible TpmPssUnsupported devices + one-shot bell ...

TpmPssUnsupported distress reports (TPM cannot RSA-PSS-sign, Schannel drops
the client cert on Win11 25H2+, agent can never authenticate) were operator-
only, yet the remediation is tenant-side: TPM firmware update or device
replacement.

- New GET audit/tpm-pss-unsupported (MemberRead), aggregated per serial,
  mirroring audit/device-not-registered
- Bell notification "tpm_pss_unsupported" (Admin audience) once per
  (tenant, serial); dedup via the existing rejection tracker table with a
  disjoint "tpmpss|{serial}" row-key space; no webhook by design
- Web: TpmIncompatibleDevicesInsights panel in the Hardware Whitelist
  section; renders only when a device is affected (no permanent card)

No agent change, no ConfigVersion bump. Backend tests 3287/3287, tsc clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-24 20:47:06 +02:00

..

Agent

fix(agent): esp_policy_provider_stalled gains sidecar-missing arm (issue #106)

2026-07-24 16:48:50 +02:00

Backend

feat(distress): tenant-visible TpmPssUnsupported devices + one-shot bell

2026-07-24 20:47:06 +02:00

McpServer

chore(ci): unify Node toolchain on 22 across CI + engines pins

2026-07-24 16:15:54 +02:00

Shared

feat(distress): tenant-visible TpmPssUnsupported devices + one-shot bell

2026-07-24 20:47:06 +02:00

Web

feat(distress): tenant-visible TpmPssUnsupported devices + one-shot bell

2026-07-24 20:47:06 +02:00