Oliver Kieselbach 5055db2de1 feat(rules): detect installer-mutex app failures (0x80070652) and SWG-blocked diagnostics uploads ...

Two analyze rules born from the pilatus-aircraft diagnosis (2026-08-27):

- ANALYZE-APP-017 "App Install Blocked by Another Installer (0x80070652)":
  fires on app_install_failed with hresultFromWin32 -2147023278
  (ERROR_INSTALL_ALREADY_RUNNING); confidence boosts for MSI exit code
  1618 and for an ESP failure settling with the same code. The 08-26
  burst failed 16 sessions deterministically at ~21 min (IME's fixed
  msiexec-busy retry budget) right after a preceding installer left the
  Windows Installer mutex held - previously only generic
  "Enrollment Failed" fired, naming no cause.
- ANALYZE-NET-001 "Diagnostics Upload Blocked by Web Security Gateway":
  fires on diagnostics_upload_failed answered by an HTML block page
  carrying a recognizable security-product marker (McAfee/Skyhigh,
  Zscaler, Netskope, ...). OnFailure diagnostics are lost exactly on the
  sessions that need them; plain HTML errors without a vendor marker
  (stale/stopped endpoint) stay excluded on purpose.

Both validated via MCP validate_rule (0 errors) and dry-run with
test_analyze_rule: fire on the burst session (confidence 100 / 90),
silent on a timeout-shaped failure and on a succeeded session that
carried unrelated app_install_failed events.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-27 19:40:17 +02:00

..

ANALYZE-APP-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-002.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-004.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-007.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-008.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-010.json

feat: externalize rules to GitHub + API consolidation + preview mode

2026-02-28 13:12:09 +01:00

ANALYZE-APP-012.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-013.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-014.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-015.json

rules: hybrid user-affinity + never-settled-app detection, dsregcmd on_event snapshot, evidence interpolation fixes

2026-08-14 13:39:16 +02:00

ANALYZE-APP-016.json

fix(agent): recover ESP completion after a forced mid-ESP reboot

2026-08-19 17:00:59 +02:00

ANALYZE-APP-017.json

feat(rules): detect installer-mutex app failures (0x80070652) and SWG-blocked diagnostics uploads

2026-08-27 19:40:17 +02:00

ANALYZE-CORR-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-001.json

feat(rules): built-in analyze-rule hygiene pass ahead of public docs catalog

2026-07-06 12:32:32 +02:00

ANALYZE-DEV-002.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-004.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-007.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-008.json

feat(backend): P6 split - CMTrace skew tripwire + customer clock_skew rule

2026-08-20 22:30:10 +02:00

ANALYZE-DEV-009.json

feat(agent): live power-state watcher + battery analyze rules DEV-009/010

2026-08-21 15:24:41 +02:00

ANALYZE-DEV-010.json

feat(agent): live power-state watcher + battery analyze rules DEV-009/010

2026-08-21 15:24:41 +02:00

ANALYZE-DEV-012.json

feat(agent): system timeline watcher — clock steps + sleep episodes as ground truth

2026-08-21 19:41:56 +02:00

ANALYZE-ENRL-001.json

feat(rules): built-in analyze-rule hygiene pass ahead of public docs catalog

2026-07-06 12:32:32 +02:00

ANALYZE-ENRL-002.json

rules+backend+mcp: rule-verify sweep fixes (dead factor, {{token}} evidence, stats cap, list stringify)

2026-08-14 16:50:29 +02:00

ANALYZE-ENRL-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ENRL-004.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ENRL-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ESP-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ESP-002.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ESP-004.json

feat(rules): built-in analyze-rule hygiene pass ahead of public docs catalog

2026-07-06 12:32:32 +02:00

ANALYZE-ESP-005.json

fix(agent): recover ESP completion after a forced mid-ESP reboot

2026-08-19 17:00:59 +02:00

ANALYZE-ESP-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ID-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ID-002.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ID-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ID-004.json

ANALYZE-ID-004 v1.2.0: pre-logon VPN + Hello-as-symptom self-service guidance

2026-08-17 13:36:10 +02:00

ANALYZE-NET-001.json

feat(rules): detect installer-mutex app failures (0x80070652) and SWG-blocked diagnostics uploads

2026-08-27 19:40:17 +02:00

ANALYZE-OFFICE-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-004.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-007.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-008.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00