Oliver Kieselbach 1ebc2675b1 gather-rules: WQL property projections, portal enable-gating, author from JWT ...

- WMI guard accepts SELECT <property-list> FROM <class> for any class already
  allowed via SELECT * (strict data subset); same algorithm in agent, portal
  validator, and MCP validate_rule (incl. trim fix); guardrails.json unchanged
- Portal refuses to enable custom rules with not-allowed targets: create lands
  disabled, invalid edit force-disables, "Blocked on devices" badge, GitHub-issue
  hint for allowlist requests; agent stays the enforcement boundary
- Rule Author is stamped from the creator's token (display name > UPN) at create
  and preserved through every update, incl. cross-tenant GA edits
- bumpVersion keeps the segment count ("1.0.0" -> "1.1.0")

Customer feedback: SELECT BatteryStatus FROM Win32_Battery + on_change was
impossible because SELECT * re-emits on every charge-percent fluctuation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-10 13:41:14 +02:00

..

gather-rule-guardrails.md

gather-rules: WQL property projections, portal enable-gating, author from JWT

2026-08-10 13:41:14 +02:00

gather-rule-phase-scoping.md

fix(agent): gather phase/event triggers follow the engine-reduced timeline

2026-08-04 14:44:35 +02:00

rule-authoring-surface.md

Logparser pattern testing with the agent's exact .NET engine (test_log_pattern) (#125)

2026-08-05 22:48:10 +02:00