Intune Windows enrollment: model Autopilot evidence outside ESP

[adamgell]

Parent

Part of #356.

Outcome

Implement cmtraceopen_parser::intune::enrollment::windows::autopilot for Windows Autopilot identity/profile/OOBE evidence that is outside the existing ESP/Device Preparation reducer. ESP remains a sibling and may be correlated through explicit enrollment/session keys; it is not renamed into Autopilot.

Scope boundary

Autopilot covers device registration/identity, profile discovery/download/application, OOBE mode and deployment-profile facts, diagnostics-page/export evidence, and the handoff into enrollment/ESP. ESP continues to own app/profile progress and blocking status after that handoff.

Input contract

Pure parser inputs may include:

• normalized events from Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot and related validated channels;
• exported MDM diagnostics reports, including explicitly identified Autopilot sections/artifacts;
• supplied Autopilot diagnostics-page/export facts;
• optional registry/configuration exports with provenance;
• optional normalized enrollment/ESP session facts from existing reducers;
• capture metadata such as Windows build, Autopilot/diagnostic schema version, timezone, and collection time.

EVTX decoding, registry access, diagnostic export generation, and live OOBE interaction remain native. The pure crate consumes stable normalized inputs.

Detection/framing

• Event records retain channel/provider/event ID/version/activity/correlation ID and original timestamp.
• HTML/XML/JSON/text report sections require an explicit schema detector and version tag.
• Do not extract identifiers from physical fragments or unrelated MDM report text.
• A diagnostics export from an unsupported Windows build remains parseable as raw evidence but cannot use unvalidated terminal semantics.

Output/state contract

Model: device identity/registration evidence, profile candidate/selection, profile retrieval, profile application, OOBE mode, enrollment handoff, ESP/Device Preparation handoff, completed local Autopilot phase, terminal failure, retry/deferred, and insufficient evidence.

Distinguish at minimum:

• no matching profile evidence;
• profile retrieval failure;
• profile application/configuration failure;
• identity/registration mismatch or missing registration evidence;
• network/service symptom without proven cause;
• handoff reached but later ESP evidence missing;
• completed Autopilot phase;
• contradictory sources or unknown schema.

Every finding cites exact event/report evidence and names the next smallest artifact (Autopilot event channel, MDM report, ESP bundle, or identity facts).

Implementation/file boundary

Create pure modules under crates/cmtraceopen-parser/src/intune/enrollment/windows/autopilot/. Reuse platform-neutral event/fact models where possible, but do not make this module depend on Tauri/native types.

Add:

• crates/cmtraceopen-parser/tests/intune_windows_autopilot.rs
• crates/cmtraceopen-parser/tests/fixtures/intune/windows/autopilot/<scenario>/
• a focused native Windows normalization test for EVTX/report adapters.

Required fixture matrix

1. user-driven success through ESP handoff;
2. self-deploying or pre-provisioning sample only after its actual source contract is captured;
3. no profile candidate;
4. profile retrieval failure;
5. profile application failure;
6. identity/registration mismatch;
7. network/service retry without terminal proof;
8. Autopilot completed but ESP bundle absent;
9. matching Autopilot and ESP session;
10. conflicting profile/session identifiers;
11. incomplete event channel;
12. malformed report section;
13. unknown Windows/schema version;
14. invalid/missing timezone;
15. deterministic identity/privacy redaction.

Acceptance criteria

• Autopilot and ESP outputs are distinct, documented sibling contracts.
• Cross-sibling linkage requires explicit enrollment/activity/session identity; time-only joins stay low confidence.
• Pure tests run on every platform; native event/report collection is accepted on Windows.
• Focused test: cargo test --locked -p cmtraceopen-parser --test intune_windows_autopilot.

Non-goals

• No live tenant profile lookup, Graph calls, OOBE automation, or UI.
• No reimplementation of ESP/Device Preparation rules.

References

• Microsoft Windows Autopilot troubleshooting and event-log location
• Microsoft Windows MDM diagnostics collection

Cross-cutting review gates

• Keep cmtraceopen-parser pure Rust and wasm32-unknown-unknown compatible.
• Native filesystem, registry, event-log, unified-log, and platform-command work stays outside the parser crate; pure code consumes supplied serializable facts.
• Preserve artifact provenance, record/channel/provider identity, original timestamp/offset, and exact evidence references.
• Missing, inaccessible, capped, skipped, unsupported, malformed, or unknown-version evidence remains explicit coverage state.
• New public/serialized fields are additive, camelCase, deterministic, and golden-tested.
• Use only synthetic or explicitly sanitized fixtures; default exports redact identity, user, device, tenant, path, token, and arbitrary script/output data.
• Unknown identifiers and time-only proximity cannot create a high-confidence transaction or cause.

Standard verification

cargo test --locked -p cmtraceopen-parser
cargo clippy --locked -p cmtraceopen-parser --all-targets -- -D warnings
cargo check --locked -p cmtraceopen-parser --target wasm32-unknown-unknown
cargo fmt --check --all
git diff --check

Run the focused test named below first. Native adapter acceptance runs on the required operating system.

[adamgell]

Claude batch-2 recovery checkpoint: the previously local-only WIP commit 76aba4b is now preserved on https://github.com/adamgell/cmtraceopen/tree/codex/recovery-intune-362-autopilot (Windows Autopilot evidence outside ESP). This is a preservation branch, not an acceptance claim: I verified the worktree was clean and scanned added content for obvious credential/user-path publication risks, but production semantics and the full prescribed test matrix have not yet received independent review. No PR is opened until that audit is complete; the issue remains open.

[adamgell]

Independent audit completed against preserved Claude batch-2 SHA 76aba4bd45fb9dc87b23033c078ce63f5f82c331.

Status: NO-GO for a feature PR or acceptance. Keep codex/recovery-intune-362-autopilot as donor code and a synthetic fixture corpus only; the issue remains open.

Verification at the exact head:

• focused Autopilot suite: 25/25 passed
• full parser suite: 766 tests passed
• cargo check --locked -p cmtraceopen-parser --target wasm32-unknown-unknown: passed
• cargo clippy --locked -p cmtraceopen-parser --all-targets -- -D warnings: passed
• git diff --check: passed
• cargo fmt --check --all: failed, including new Autopilot files
• CodeRabbit exact-diff review: 9 findings

Audit-only adversarial tests reproduced eight blockers: terminal semantics survive missing build/schema proof; malformed/access-denied records can still drive outcomes; evidence may cite an artifact other than the wrapper that supplied it; time-only linkage is emitted without overlap or usable time provenance; disjoint keys can bind distinct ESP sessions as high-confidence Linked; device GUIDs survive default export messages; redaction token namespaces break equality and bracketed values bypass redaction; and placeholder timezone text upgrades provenance.

Root source review corroborated the key defects: NormalizedWindowsEvent and AutopilotObservation have no event-version field; reduce_esp_linkage returns TimeOnlyCandidate whenever ESP facts have no matching key; the redaction path uses different token kinds for identity, named data, and correlation keys while treating any bracketed colon value as already safe; and source input discards kind/rotation/fragment/capture metadata. There is also no native EVTX/report adapter or native Windows test in the diff.

Fixture state: all 15 required synthetic scenarios exist and the shared fixture/privacy harness passes. Missing acceptance coverage includes native normalization, runtime citation closure, rotation/fragment identity, adversarial redaction, trustworthy profile/time semantics, and live Windows exercise. No live Windows acceptance is claimed.

Repair order: reconstruct on a fresh branch from current main; add event-version and complete source/provenance contracts; gate reduction on supported profile and assessable record state; enforce citation/fragment closure; fix time and multi-session key ambiguity; unify redaction; then add native Windows adapter tests and request CodeRabbit/Copilot review.