mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 04:32:32 +00:00
Oliver Kieselbach
5055db2de1
Two analyze rules born from the pilatus-aircraft diagnosis (2026-08-27): - ANALYZE-APP-017 "App Install Blocked by Another Installer (0x80070652)": fires on app_install_failed with hresultFromWin32 -2147023278 (ERROR_INSTALL_ALREADY_RUNNING); confidence boosts for MSI exit code 1618 and for an ESP failure settling with the same code. The 08-26 burst failed 16 sessions deterministically at ~21 min (IME's fixed msiexec-busy retry budget) right after a preceding installer left the Windows Installer mutex held - previously only generic "Enrollment Failed" fired, naming no cause. - ANALYZE-NET-001 "Diagnostics Upload Blocked by Web Security Gateway": fires on diagnostics_upload_failed answered by an HTML block page carrying a recognizable security-product marker (McAfee/Skyhigh, Zscaler, Netskope, ...). OnFailure diagnostics are lost exactly on the sessions that need them; plain HTML errors without a vendor marker (stale/stopped endpoint) stay excluded on purpose. Both validated via MCP validate_rule (0 errors) and dry-run with test_analyze_rule: fire on the burst session (confidence 100 / 90), silent on a timeout-shaped failure and on a succeeded session that carried unrelated app_install_failed events. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>