Oliver Kieselbach 6657c6b9c0 fix(rules): ANALYZE-OFFICE-001 explains what the detector actually reports ...

office_install_failed is emitted only for an error code in the C2R INSTALL scenario; a window without on-disk proof ends silently. The old text described a StreamingFinished-based failure and attributed the early "done" of the built-in app type to IME, which never sees Office CSP installs. Text only, version 1.1.1.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-11 02:28:12 +02:00

..

ANALYZE-APP-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-002.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-004.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-007.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-008.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-010.json

feat: externalize rules to GitHub + API consolidation + preview mode

2026-02-28 13:12:09 +01:00

ANALYZE-APP-012.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-013.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-APP-014.json

error-code catalog v2: generated from primary sources, symbols and families, MCP lookup_error_code (D-211/D-212)

2026-09-06 16:24:35 +02:00

ANALYZE-APP-015.json

rules: hybrid user-affinity + never-settled-app detection, dsregcmd on_event snapshot, evidence interpolation fixes

2026-08-14 13:39:16 +02:00

ANALYZE-APP-016.json

fix(agent): recover ESP completion after a forced mid-ESP reboot

2026-08-19 17:00:59 +02:00

ANALYZE-APP-017.json

feat(rules): detect installer-mutex app failures (0x80070652) and SWG-blocked diagnostics uploads

2026-08-27 19:40:17 +02:00

ANALYZE-APP-018.json

exit-code class per app + reboot rule: IME-EXITCODE-CLASS, ANALYZE-APP-018, exitCode on every terminal app event (D-214)

2026-09-06 18:08:49 +02:00

ANALYZE-CORR-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-001.json

feat(rules): built-in analyze-rule hygiene pass ahead of public docs catalog

2026-07-06 12:32:32 +02:00

ANALYZE-DEV-002.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-004.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-DEV-007.json

chore: private submodule docs/ becomes internal/ (knowledge + decisions + work files + private instructions)

2026-09-04 02:19:00 +02:00

ANALYZE-DEV-008.json

feat(backend): P6 split - CMTrace skew tripwire + customer clock_skew rule

2026-08-20 22:30:10 +02:00

ANALYZE-DEV-009.json

feat(agent): live power-state watcher + battery analyze rules DEV-009/010

2026-08-21 15:24:41 +02:00

ANALYZE-DEV-010.json

feat(agent): live power-state watcher + battery analyze rules DEV-009/010

2026-08-21 15:24:41 +02:00

ANALYZE-DEV-012.json

fix(agent,rules): AccountSetup activity means observed progress; same-event filter for event_data conditions (q8n)

2026-09-04 13:11:28 +02:00

ANALYZE-ENRL-001.json

feat(rules): built-in analyze-rule hygiene pass ahead of public docs catalog

2026-07-06 12:32:32 +02:00

ANALYZE-ENRL-002.json

rules+backend+mcp: rule-verify sweep fixes (dead factor, {{token}} evidence, stats cap, list stringify)

2026-08-14 16:50:29 +02:00

ANALYZE-ENRL-003.json

chore: private submodule docs/ becomes internal/ (knowledge + decisions + work files + private instructions)

2026-09-04 02:19:00 +02:00

ANALYZE-ENRL-004.json

chore: private submodule docs/ becomes internal/ (knowledge + decisions + work files + private instructions)

2026-09-04 02:19:00 +02:00

ANALYZE-ENRL-005.json

chore: private submodule docs/ becomes internal/ (knowledge + decisions + work files + private instructions)

2026-09-04 02:19:00 +02:00

ANALYZE-ESP-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ESP-002.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ESP-004.json

fix(rules,engine,agent): ESP-004 gates on the esp_apps_timeout verdict; not_exists absence gate; Shell-Core failure inherits settle detail (D-234, D-235)

2026-09-09 17:20:24 +02:00

ANALYZE-ESP-005.json

fix(agent): recover ESP completion after a forced mid-ESP reboot

2026-08-19 17:00:59 +02:00

ANALYZE-ESP-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ID-001.json

feat(rules): community rule submissions — submit custom rules from the portal, review via GA page or MCP, publish by repo commit + reseed (D-236)

2026-09-09 22:53:32 +02:00

ANALYZE-ID-002.json

fix(security): LocalAdminAnalyzer never exempts a logged-in local SAM account from the shutdown scan (CWE-807) and matches built-ins by well-known RID so localized Guest/Administrator are not flagged

2026-08-30 01:42:51 +02:00

ANALYZE-ID-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-ID-004.json

agent+rules: Hybrid Join user affinity from the IME user token; IME backlog eras anchored by the bootstrap record

2026-09-04 21:12:56 +02:00

ANALYZE-NET-001.json

feat(rules): detect installer-mutex app failures (0x80070652) and SWG-blocked diagnostics uploads

2026-08-27 19:40:17 +02:00

ANALYZE-OFFICE-001.json

fix(rules): ANALYZE-OFFICE-001 explains what the detector actually reports

2026-09-11 02:28:12 +02:00

ANALYZE-SEC-001.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-003.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-004.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-005.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-006.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-007.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00

ANALYZE-SEC-008.json

rules: evaluate 30 device-phase built-ins at the WhiteGlove seal, 6 also on_event

2026-08-14 19:29:45 +02:00