feat(sccm): complete end-to-end diagnostics epic - #490

Merged

adamgell merged 457 commits into

mainfrom

codex/sccm333-integration-timestamp-gate

Aug 5, 2026

This pull request is big! We're only showing the most recent 250 commits

Commits on Jul 31, 2026

test(sccm): resolve supersedes against catalog inventory
adamgell
committed
a988ac9
fix(sccm): fail closed on malformed validator shapes
adamgell
committed
92a090b
test(sccm): expose cbsLog ConfigMgr sourceVersion gap
adamgell
committed
6a04e9f
fix(sccm): bind cbsLog sourceVersion to null
adamgell
committed
271069f
test(sccm): expose keyless observation phase claim
adamgell
committed
f997505
fix(sccm): null keyless observation phase claims
adamgell
committed
ecf73d9
test(sccm): pin scalar counterpartReadyFacts rejection
adamgell
committed
590608b
test(sccm): expose duplicate and overlapping citations
adamgell
committed
857cee2
fix(sccm): reject overlapping evidence citation ranges
adamgell
committed
f179d31
refactor(sccm): return correlation checks as results
adamgell
committed
5dcc1f5
test(sccm): expose stale metadata on noncapture artifacts
adamgell
committed
0ec6aba
fix(sccm): reject noncapture physical metadata
adamgell
committed
eb78c2c
test(sccm): probe decoded projection privacy leaks
adamgell
committed
9669962
fix(sccm): inspect decoded projection strings fail closed
adamgell
committed
96898b6
fix(sccm): alias helper probe type for clippy
adamgell
committed
6ccb367
fix(sccm): apply rustfmt to the updates contract test
adamgell
committed
a1d34a1
test(sccm): probe unbound fixture refs and ownership
adamgell
committed
0bd7a17
fix(sccm): bind fixture refs to side and upstream state
adamgell
committed
56ebce4
test(sccm): probe neutralized guard input states
adamgell
committed
a604401
fix(sccm): require every guard demonstrated by inputs
adamgell
committed
29872ee
test(sccm): pin opposite-order reorder evidence
adamgell
committed
42f9f32
fix(sccm): encode ordered evidence in reorder fixtures
adamgell
committed
f155064
Merge pull request #374 from adamgell/codex/sccm-329-distribution-point-corpus
adamgell
authored
f995f20
test(sccm): probe reorder manifest and ref divergence
adamgell
committed
affc63f
Merge pull request #379 from adamgell/codex/sccm-331-hierarchy-replication-corpus
adamgell
authored
886b062
Merge pull request #355 from adamgell/codex/sccm-325-inventory-compliance-metering-corpus
adamgell
authored
516b4fa
Merge pull request #377 from adamgell/codex/sccm-330-software-update-point-corpus
adamgell
authored
38a7d1e
fix(sccm): enforce reorder manifests in the validator
adamgell
committed
842965d
test(sccm): probe declarative required outputs
adamgell
committed
fe28190
Merge pull request #396 from adamgell/codex/sccm-335-pure-intake
adamgell
authored
1679045
fix(sccm): make required outputs executable checks
adamgell
committed
8c5aca3
docs(sccm): document bound refs and reorder evidence
adamgell
committed
72c9798
style(sccm): drop redaction check subsumed by guards
adamgell
committed
5ec1f5d
Merge skeleton 16790457 into codex/sccm-333-review-fixes-cd9a-r2
adamgell
committed
f7028ff
Merge pull request #380 from adamgell/codex/sccm-332-provider-admin-service-corpus
adamgell
authored
7655826
docs(sccm): sharpen the #329 pending distinction
adamgell
committed
cc7d2b5
test(sccm): probe sentence-final dotted hostname leaks
adamgell
committed
af1214d
fix(sccm): trim sentence-final periods before host test
adamgell
committed
a9fc487
test(sccm): probe SID-shaped public identifiers
adamgell
committed
e3623c5
fix(sccm): reject SID-shaped public identifiers
adamgell
committed
325b29f
fix(sccm): validate citation ranges before uniqueness walk
adamgell
committed
59a6896
Merge skeleton 7655826f into codex/sccm-328-reconcile-r4
adamgell
committed
7eb024b
test(sccm): bind MP analysis to flipped mpcontrol row
adamgell
committed
ef0f431
fix(sccm): treat mpcontrol as site-server subject evidence
adamgell
committed
4a2d926
test(sccm): probe network-identifier shaped tokens
adamgell
committed
dc87d77
fix(sccm): reject any multi-dot network-shaped token
adamgell
committed
8cd5501
test(sccm): probe non-NT SID authority variants
adamgell
committed
e8b3a00
fix(sccm): reject generic SID-shaped runs on public surfaces
adamgell
committed
89d538b
test(sccm): pin bracket prefixes and aliased observations
adamgell
committed
c7b1e8e
fix(sccm): bound tokens by body edges, disjoint observations
adamgell
committed
495a36a
Merge pull request #385 from adamgell/codex/sccm-333-correlation-contracts
adamgell
authored
2611602
test(sccm): request the rejected record's owning group
adamgell
committed
5862eb5

Commits on Aug 1, 2026

Commits on Aug 2, 2026

fix(sccm): reject overlapping evidence ranges in the spine (#418)
adamgell
authored
d5beb5b
fix(sccm): bound opaque ids and harden finding deserialization (#404)
adamgell
authored
34c3aba
feat(sccm): assess pure client intake coverage (#394)
adamgell
authored
d1bb525
fix(sccm): harden server intake coverage
adamgell
committed
a48c824
fix(sccm): harden server intake contract
adamgell
committed
e608717
fix(sccm): close server intake review gaps
adamgell
committed
d07f461
test(sccm): close server intake oracle gaps
adamgell
committed
813cfb2
fix(sccm): retain safe forward intake provenance
adamgell
committed
0f892a8
fix(sccm): close opaque intake boundaries
adamgell
committed
82cc77c
fix(sccm): decouple future role coverage
adamgell
committed
ceb487e
test(sccm): require early server intake bounds
adamgell
committed
b433d07
fix(sccm): enforce server preflight bounds
adamgell
committed
ad93b11
fix(sccm): align server intake review contracts
adamgell
committed
07ee97c
fix(sccm): keep future source handles production-only
adamgell
committed
8daad4e
fix(sccm): honor declared server payload encoding
adamgell
committed
976ec2a
Merge pull request #434 from adamgell/codex/sccm-335-safety-repair-root
adamgell
authored
0b37e7a
test(sccm): drive site core from server intake
adamgell
committed
c93ef45
fix(sccm): harden client intake and CCM ambiguity
adamgell
committed
55ad437
feat(sccm): analyze site core from server intake
adamgell
committed
b9c2653
docs(sccm): make client intake ceiling authoritative (#319)
adamgell
committed
eb03235
test(sccm): strengthen site core isolation assertions
adamgell
committed
2d40321
fix(sccm): address client intake review findings
adamgell
committed
074b412
test(sccm): expose site core review blockers
adamgell
committed
0771c2c
feat(sccm): preserve client capture gap coverage (#319)
adamgell
committed
3b461a2
Merge pull request #435 from adamgell/codex/sccm-319-client-hardening-clean-port-r1
adamgell
authored
ce774fd
fix(sccm): validate client capture gap boundaries (#319)
adamgell
committed
8dce4f6
fix(sccm): validate client intake decoding (#319)
adamgell
committed
fd52c4c
fix(sccm): close site core evidence contracts
adamgell
committed
c3a7302
test(sccm): reject delimiter-adjacent profile labels
adamgell
committed
bb43422
fix(sccm): close delimiter-separated profile fields
adamgell
committed
ded859a
Merge pull request #436 from adamgell/codex/sccm-319-client-cap-gap-contract-r1
adamgell
authored
26a9a5e
test(sccm): pin native manifest reader contract (#319)
adamgell
committed
8a0a603
test(sccm): expose site core review gaps
adamgell
committed
c9cfc3a
fix(sccm): reject unscoped site core evidence
adamgell
committed
daa7e0b
test(sccm): expose foreign source scope borrowing
adamgell
committed
be8f9f5
fix(sccm): isolate site core request attribution
adamgell
committed
142d3aa
test(sccm): expose undeclared status coverage gap
adamgell
committed
3a52973
fix(sccm): materialize missing status coverage
adamgell
committed
1ea4e23
feat(sccm): read native client manifests (#319)
adamgell
committed
7fdc1c6
test(sccm): expose undeclared component coverage
adamgell
committed
849df5a
fix(sccm): materialize missing component coverage
adamgell
committed
8999216
test(sccm): expose native manifest physical cap gaps
adamgell
committed
8294729
test(sccm): expose malformed peer coverage loss
adamgell
committed
eecdb30
fix(sccm): bind native manifest evidence to verified roots
adamgell
committed
607c732
fix(sccm): retain malformed peer coverage findings
adamgell
committed
3a12cb8
test(sccm): cover Windows handle-bound manifest reads
adamgell
committed
8a92e4c
feat(sccm): bind Windows manifest reads to handles
adamgell
committed
9a030da
test(sccm): expose unconfirmed site-core phase
adamgell
committed
7027287
fix(sccm): mark unconfirmed site-core phase
adamgell
committed
87e2c18
test(sccm): cover Windows native manifest error mapping
adamgell
committed
c3f1c94
fix(sccm): preserve native manifest open errors
adamgell
committed
84079b8
Merge pull request #439 from adamgell/codex/sccm-327-site-core-symmetric-fix-r2
adamgell
authored
94195dc
test(sccm): expose native reader review gaps
adamgell
committed
310e7d3
test(sccm): expose final descriptor flag leak
adamgell
committed
daf3c8c
fix(sccm): bound native manifest evidence admission
adamgell
committed
d14ba3d
test(sccm): pin native manifest nofollow error
adamgell
committed
0eec38e
fix(sccm): remove unused non-native test opener
adamgell
committed
b69d5a1
test(sccm): prove manifest caps precede evidence reads
adamgell
committed
c33bab7
test(sccm): require reusable native projection
adamgell
committed
f6376cf
fix(sccm): reuse validated native projection
adamgell
committed
aad5e04
test(sccm): count native intake projection passes
adamgell
committed
efed80b
test(sccm): prove one native intake projection pass
adamgell
committed
afb06ba
fix(sccm): gate projection counter to Unix tests
adamgell
committed
1458575
fix(sccm/test): open fixture directory with READ_CONTROL|WRITE_DAC for SetSecurityInfo
Copilot
authored
c4e4c9b
test(sccm): prove source caps precede evidence reads
adamgell
committed
7d33618
fix(sccm): import Windows fixture rights from storage
adamgell
committed
bcb4ac5
test(sccm): normalize Windows link fixture ACLs
adamgell
committed
244448b
test(sccm): exercise physical byte overflow guard
adamgell
committed
53c4933
Merge pull request #440 from adamgell/codex/native-manifest-ntstatus-fix-r3
adamgell
authored
4319097
test(sccm): reject cyclic advanced-role supersession (#442)
adamgell
authored
76784c3
fix(sccm): bind Management Point analysis to canonical intake (#443)
adamgell
authored
4684eb4
feat(sccm): add bounded client discovery normalization (#444)
adamgell
authored
c622c9e

Commits on Aug 3, 2026

fix(sccm): preserve bounded discovery coverage correctness (#454)
adamgell
authored
1bba619
fix(sccm): bind server coverage to canonical topology (#455)
adamgell
authored
09aafd4
test(sccm): require sealed client evidence admission
adamgell
committed
1125089
feat(sccm): seal canonical client evidence admission
adamgell
committed
c863233
test(sccm): expose client admission framing and cap gaps
adamgell
committed
345422e
fix(sccm): bound client evidence admission
adamgell
committed
4c660f8
test(sccm): expose aggregate client record cap bypass
adamgell
committed
30f8533
fix(sccm): enforce aggregate client record cap
adamgell
committed
d7bb629
test(sccm): expose client evidence authority gaps
adamgell
committed
dc07cf9
fix(sccm): bind client evidence to intake authority
adamgell
committed
32ee8f6
test(sccm): expose client admission authority gaps
adamgell
committed
2b196e0
fix(sccm): enforce client evidence source authority
adamgell
committed
2d18af8
test(sccm): expose UTF-32 BOM prefix confusion
adamgell
committed
aebe81c
fix(sccm): reject unsupported Unicode BOMs
adamgell
committed
d2bcd12
test(sccm): expose mixed setup coverage authority
adamgell
committed
5e5b8ce
fix(sccm): isolate raw CCM group readiness
adamgell
committed
3d8584c
test(sccm): expose forged policy extraction authority
adamgell
committed
ec38be9
test(sccm): bind extraction to exact artifact evidence
adamgell
committed
8d8af0a
fix(sccm): seal client key extraction authority
adamgell
committed
37309e9
test(sccm): pin unsealed native intake projection
adamgell
committed
a6bdeeb
fix(sccm): keep native intake projection unsealed
adamgell
committed
bb4571c
test(sccm): pin independent admission seal cap
adamgell
committed
7da7d8d
test(sccm): expose admitted authority review gaps
adamgell
committed
d705778
fix(sccm): reserve family trust for admitted profiles
adamgell
committed
0ff8adf
fix(sccm): enforce aggregate CCM record budget
adamgell
committed
7d63f88
refactor(sccm): confine family trust to sealed admission
adamgell
committed
f21ad29
test(ccm): expose observer cleanup after panic
adamgell
committed
b199a53
test(ccm): reset bounded scan observation on unwind
adamgell
committed
f6c458a
fix(sccm): isolate missing encoding admission gaps
adamgell
committed
05f5d5e

Commits on Aug 4, 2026

feat(sccm): add client inventory compliance metering state machines
adamgell
committed
d514b06
feat(sccm): start sealed client updates analyzer
adamgell
committed
3ce89b6
feat(sccm): reduce client update phases
adamgell
committed
8f7bf6a
feat(sccm): complete client updates diagnosis
adamgell
committed
5d3ca68
fix(sccm): harden client updates evidence contract
adamgell
committed
f5de9dc
feat(sccm): analyze client inventory compliance and metering
adamgell
committed
f7d6054
fix(sccm): close client extended analyzer review gaps
adamgell
committed
810c322
test(sccm): freeze full client analyzer outputs
adamgell
committed
b81eff2
test(sccm): pin declared deployment transaction outcomes
adamgell
committed
0479384
feat(sccm): reduce client deployment transactions
adamgell
committed
0715afc
test(sccm): pin deployment coverage, observations, findings
adamgell
committed
37b17a5
feat(sccm): emit deployment coverage, gaps, and findings
adamgell
committed
fe551e9
test(sccm): guard deployment identity, order, and keys
adamgell
committed
bdbf0cc
test(sccm): pin the deployment public projection
adamgell
committed
832bc03
test(sccm): pin the observed deployment extraction profile
adamgell
committed
72ccfdd
feat(sccm): validate families only where records were read
adamgell
committed
c093e04
test(sccm): reproduce four deployment review defects
adamgell
committed
a14ec72
test(sccm): reject electing one of several terminal records
adamgell
committed
8af1e77
fix(sccm): admit only complete records and cite every terminal
adamgell
committed
2fcbe7e
test(sccm): pin the declared profile selection state
adamgell
committed
92a5a8d
feat(sccm): report the deployment profile selection state
adamgell
committed
3c0adbb
test(sccm): pin the repeated content-request citation
adamgell
committed
8374585
fix(sccm): cite the earliest orderable content request
adamgell
committed
11640bd
fix(sccm): elect chain records against the chain
adamgell
committed
51b7195
feat(sccm): analyze client deployment evidence
adamgell
committed
8687417
fix(sccm): fail closed on deployment ambiguity
adamgell
committed
eb1b8ba
fix(sccm): recover ordered deployment outcomes
adamgell
committed
61a4256
fix(sccm): bind update facts to physical sources
adamgell
committed
58ceeb9
fix(sccm): canonicalize client update rotations
adamgell
committed
408f982
feat(sccm): bind DP sources to sealed server intake (#458)
adamgell
committed
2022b02
feat(sccm): define optional WSUS supplemental intake contract (#459)
adamgell
committed
acf645d
feat(sccm): analyze software update point workflow
adamgell
committed
936daac
fix(sccm): harden software update point analysis
adamgell
committed
ca9121c
fix(sccm): poison unusable SUP chronology
adamgell
committed
b1c0905
feat(sccm): analyze distribution point content lifecycle
adamgell
committed
a2f6bb0
fix(sccm): cite decisive DP contradiction evidence
adamgell
committed
adedf2d
feat(sccm): add client policy state analysis
adamgell
committed
346d658
fix(sccm): prioritize policy chronology conflicts
adamgell
committed
a313e66
fix(sccm): confirm only ordered policy successes
adamgell
committed
dcc8e56
test(sccm): reduce admitted unorderable deployments
adamgell
committed
a736ccb
feat(sccm): add production client health correlation
adamgell
committed
8da65cb
fix(sccm): preserve client health chain authority
adamgell
committed
94ca828
fix(sccm): resolve newest client health attempt
adamgell
committed
dfc0026
fix(sccm): reject equal-time health key conflicts
adamgell
committed
8c3a48a
fix(sccm): expose equal-time health tuple conflicts
adamgell
committed
320267e
feat(sccm): analyze sealed task sequence evidence
adamgell
committed
d8a2589
fix(sccm): harden task sequence evidence reduction
adamgell
committed
2c2db83
feat(sccm): analyze hierarchy replication workflows
adamgell
committed
68e3baa
fix(sccm): seal hierarchy replication authority
adamgell
committed
5dca3db
fix(sccm): request omitted hierarchy target evidence
adamgell
committed
b8f247c
fix(sccm): require each hierarchy target source
adamgell
committed
0118a6b
fix(sccm): prioritize missing hierarchy targets
adamgell
committed
ed7aa25
fix(sccm): require usable hierarchy targets
adamgell
committed
a110fed
fix(sccm): close provider admin service review gaps
adamgell
committed
de89679
fix(sccm): harden provider admin review contracts
adamgell
committed
7c95922
feat(sccm): add production evidence correlation
adamgell
committed
76deb04
test(sccm): reconcile integrated source contracts
adamgell
committed
0fb7106
style: apply workspace rustfmt
adamgell
committed
cedda7f
test(sccm): canonicalize health oracle JSON
adamgell
committed
47068b0
fix(sccm): use typed SUP rotation guard
adamgell
committed
ce1d330
test(sccm): canonicalize inventory oracle JSON
adamgell
committed
112bc4b
docs(sccm): plan main integration
adamgell
committed
c7d7085
merge: integrate current main into SCCM diagnostics
adamgell
committed
b71a976
docs(sccm): record inherited fmt baseline
adamgell
committed
5d20d4a
fix(ci): satisfy Rust 1.97 hierarchy lint
adamgell
committed
b11093f
docs(sccm): plan native product path rework
adamgell
committed
27c28c0
feat(sccm): add native diagnostics workspace
adamgell
committed
b2fe563
feat(sccm): add native discovery and bounded capture
adamgell
committed
0c40a97
fix(sccm): register native workspace menu
adamgell
committed
e0591d2
fix(sccm): block capture without detected roles
adamgell
committed
0f8e4d6
fix(sccm): preserve native coverage semantics
adamgell
committed
19da86e
fix(sccm): detect client from CcmExec service
adamgell
committed
6fbf1f0