mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 20:53:06 +00:00
Oliver Kieselbach
c91d8d4501
IME never writes its "Completed user session" line when the user has no assigned Win32 apps - its zero-app branch returns before that statement (ApplicationPoller.cs:713-721, identical in 1.80/1.83/1.97/1.104). So ImeUserSessionCompletedUtc stayed null, every arm of ShouldTransitionToAwaitingHello was unsatisfiable, and the 30-min advisory_completion backstop resolved healthy enrollments as esp_exit_without_completion_evidence. One tenant: 10 of 30 sessions in a week, all false positives - DAD-validated desktop, Hello provisioned, RealmJoin still installing. Every Succeeded session there carries ime_user_session_completed; not one of the failed ones does. IME-USER-SESSION-ZERO-APPS reads the line IME does write there and routes it through the same OnUserSessionCompleted callback. That is IME's own verdict rather than a weakened gate: the zero-app branch locks the ESP in with an empty application list, and the sibling emit site returns ProvisioningComplete right after logging it. Guarded to the AccountSetup phase so it cannot burn the adapter fire-once flag on a pre-sign-in timestamp, and replayed on the phase transition when the observation predates the phase marker. AreUserEspAppsSettled accepts an empty app list only with that explicit observation, never on emptiness alone. Second, independent defect: advisory_completion (30 min) overran the RealmJoin completion gate, which deliberately holds the session and carries its own bounded resolution (60 min from detection, activity-extended, 4 h cap). One session installed 25 RealmJoin packages inside the window, the last 2 min before the failure, while completion_waiting still read "waiting on: realmjoin_resolution". The handler now re-arms while that gate is closed and its own deadline is still armed; convergence comes from the gate itself, which always ends with an Outcome set. ime_user_session_completed gains an evidence field (zero_user_apps_enumerated / user_session_completed) - no new event type, so the Constants -> resource-catalog -> shared-manifests triple stays untouched. The pattern ships via the config API and reaches existing agents, where an unknown action is a single Debug line; the behaviour needs the agent release. Build 0 warnings. DecisionCore 558/558, V2.Core 2530/2530, Backend 4634/4634, MCP event-types-drift 6/6. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
105 lines
3.6 KiB
JSON
105 lines
3.6 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://raw.githubusercontent.com/OliverKieselbach/Autopilot-Monitor/main/rules/schema/ime-log-pattern.schema.json",
|
|
"title": "Autopilot Monitor IME Log Pattern",
|
|
"description": "Defines a regex pattern for Intune Management Extension (IME) log parsing during Autopilot enrollment.",
|
|
"oneOf": [
|
|
{ "$ref": "#/$defs/imeLogPattern" },
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"$schema": { "type": "string" },
|
|
"rules": {
|
|
"type": "array",
|
|
"items": { "$ref": "#/$defs/imeLogPattern" }
|
|
}
|
|
},
|
|
"required": ["rules"],
|
|
"additionalProperties": false
|
|
}
|
|
],
|
|
"$defs": {
|
|
"imeLogPattern": {
|
|
"type": "object",
|
|
"properties": {
|
|
"$schema": {
|
|
"type": "string",
|
|
"description": "JSON Schema reference for editor IntelliSense."
|
|
},
|
|
"patternId": {
|
|
"type": "string",
|
|
"description": "Unique pattern identifier (e.g., \"IME-ESP-PHASE\")."
|
|
},
|
|
"category": {
|
|
"type": "string",
|
|
"description": "Pattern category controlling when the pattern is active.",
|
|
"enum": ["always", "currentPhase", "otherPhases"]
|
|
},
|
|
"pattern": {
|
|
"type": "string",
|
|
"description": "Regex pattern string to match against IME log message content. Supports named capture groups. Uses {GUID} as placeholder for the standard GUID capture pattern."
|
|
},
|
|
"action": {
|
|
"type": "string",
|
|
"description": "Action to perform when the pattern matches. Must match an action handler in the agent's ImeLogTracker.",
|
|
"enum": [
|
|
"setCurrentApp",
|
|
"updateStateInstalled",
|
|
"updateStateDownloading",
|
|
"updateStateInstalling",
|
|
"updateStateSkipped",
|
|
"updateStateError",
|
|
"updateStatePostponed",
|
|
"espPhaseDetected",
|
|
"imeStarted",
|
|
"policiesDiscovered",
|
|
"ignoreCompletedApp",
|
|
"imeAgentVersion",
|
|
"espTrackStatus",
|
|
"updateName",
|
|
"updateWin32AppState",
|
|
"cancelStuckAndSetCurrent",
|
|
"imeSessionChange",
|
|
"imeImpersonation",
|
|
"imeTokenFailure",
|
|
"enrollmentCompleted",
|
|
"userSessionZeroApps",
|
|
"updateDoTelemetry",
|
|
"scriptStarted",
|
|
"scriptContext",
|
|
"scriptExitCode",
|
|
"scriptOutput",
|
|
"scriptCompleted",
|
|
"resetPlatformScriptContext",
|
|
"healthScriptResult",
|
|
"healthScriptDetectionResult",
|
|
"captureExitCode",
|
|
"captureHResult",
|
|
"captureAppVersion",
|
|
"captureAppTypeWinGet",
|
|
"captureAppTypeMsi",
|
|
"captureAttemptNumber",
|
|
"captureDetectionResult"
|
|
]
|
|
},
|
|
"parameters": {
|
|
"type": "object",
|
|
"description": "Optional extra parameters for the action handler (all values are strings).",
|
|
"additionalProperties": { "type": "string" }
|
|
},
|
|
"description": {
|
|
"type": "string",
|
|
"description": "Human-readable description of what this pattern detects and why."
|
|
},
|
|
"enabled": {
|
|
"type": "boolean",
|
|
"description": "Whether this pattern is enabled. Set to false to add a pattern without activating it immediately.",
|
|
"default": true
|
|
}
|
|
},
|
|
"required": ["patternId", "category", "pattern", "action"],
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
}
|