Oliver Kieselbach e2e12055bf Show the NTP clock skew in the right direction ...

The agent's ntp_time_check reports offsetSeconds = NTP time - device time,
so a positive value means the device clock is BEHIND. The session card
said "ahead of UTC" for it (a device 10 h behind showed as 10 h ahead),
and ANALYZE-DEV-007 named its two signals the wrong way round.

- SessionInfoCard: the direction comes from deviceClockDirection
  (sessionInfoLogic.ts, pinned by a test with both signs).
- ANALYZE-DEV-007 1.1.1: offsetSeconds > 120 is clock_behind, < -120 is
  clock_ahead. Conditions, thresholds and text are unchanged.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-05 22:58:46 +02:00

..

.gitattributes

chore: unignore rules/dist/ and add initial combined rule files

2026-02-28 13:24:15 +01:00

analyze-rules.json

Show the NTP clock skew in the right direction

2026-10-05 22:58:46 +02:00

cpe-community-mappings.json

feat: enhanced software inventory and vulnerability report

2026-03-20 19:01:16 +01:00

cpe-mapping-seed.json

new seed file

2026-04-07 09:47:59 +02:00

gather-rules.json

agent+rules: Hybrid Join user affinity from the IME user token; IME backlog eras anchored by the bootstrap record

2026-09-04 21:12:56 +02:00

ime-log-patterns.json

Public texts no longer name a customer domain or IME decompiles

2026-10-01 22:00:52 +02:00