From 81cb896d8d3c15d507f6a5aba24737eadcb539c3 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 12 Oct 2026 15:00:22 +0000 Subject: [PATCH 1/4] docs: policy baseline plan (GPO, Intune, Linux) and visualization prompts Adds plan policy-baseline-integration-v1 (D-PBL-0..7) for the console's "Richtlinienverwaltung" panel. It keeps configured, assigned and observed apart (GPO has no central observed state), keeps every encoder read-only, and reads the GPO-to-CSP mapping as published data. Nothing past D-PBL-0 until the operator picks the setting key, the home crate and the Linux source. Adds visualization-prompts-v1: three image-model prompts that show only what has shipped, each backed by a PR, with #1496..#1501 and this plan drawn as research. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg --- .claude/board/INTEGRATION_PLANS.md | 7 + .claude/board/STATUS_BOARD.md | 15 ++ .claude/knowledge/visualization-prompts-v1.md | 74 +++++++++ .../plans/policy-baseline-integration-v1.md | 157 ++++++++++++++++++ 4 files changed, 253 insertions(+) create mode 100644 .claude/knowledge/visualization-prompts-v1.md create mode 100644 .claude/plans/policy-baseline-integration-v1.md diff --git a/.claude/board/INTEGRATION_PLANS.md b/.claude/board/INTEGRATION_PLANS.md index dc0e46c60..bde53bfba 100644 --- a/.claude/board/INTEGRATION_PLANS.md +++ b/.claude/board/INTEGRATION_PLANS.md @@ -15,6 +15,13 @@ - First probes: merge-on-read vs in-place revision (D-HL-2) and a per-delta evidential base as the independence test (D-HL-3), both beside the D-RPF-P5 harness. - Validation is a parallel run against pinned OpenNARS, scored with `jc::reliability` (D-HL-4). +## 2026-10-12 — policy-baseline-integration-v1 — GPO, Intune and Linux baselines in one view → `.claude/plans/policy-baseline-integration-v1.md` + +**Status:** PROPOSAL (D-PBL-0..7). Nothing past D-PBL-0 until the operator picks the canonical setting key, the home crate and the Linux source. + +- Keeps three questions apart: configured (policy object), assigned (links, filters, group assignments), observed (per-device state). GPO has no central observed state, so a GPO column never shows drift. +- Read-only encoders in `ogar-ad` / `ogar-az`; the GPO↔CSP mapping is read as published data; assignment resolves over the dir-sim directory. + ## 2026-10-11 (4) — sql-polyfill-r2il-v1 — SQL() as a polyfill of R2IL procedures over mask-risc → `.claude/plans/sql-polyfill-r2il-v1.md` **Status:** PROPOSAL (D-SQLP-0..8). W1–W3 authorized; nothing from W4 on until the D-SQLP-3 benchmark clears its pre-registered threshold. diff --git a/.claude/board/STATUS_BOARD.md b/.claude/board/STATUS_BOARD.md index fafd9d391..57b64ae80 100644 --- a/.claude/board/STATUS_BOARD.md +++ b/.claude/board/STATUS_BOARD.md @@ -35,6 +35,21 @@ Plan: `.claude/plans/ce64-hypothesis-layers-v1.md`. Plateau: `.claude/knowledge/ | **D-HL-9** | Hydration budget split sweep | Queued | agreement not flat in k | | **D-HL-10** | NAL inference ISA: `ogar-nal` loco vocabulary + mask-risc dialect (a vocabulary on the existing IR, ledger R18); detailed as D-NALP | Queued (design; after D-HL-4) | per-op parity with the CE64 register method of the same name; agreement with OpenNARS within D-HL-4's tolerance; no second IR | +## D-PBL — policy baselines across GPO, Intune and Linux (2026-10-12) + +Plan: `.claude/plans/policy-baseline-integration-v1.md`. + +| D-id | Deliverable | Status | Gate | +|---|---|---|---| +| **D-PBL-0** | Operator decisions (setting key, home, Linux source); mint policy concepts in `ogar-vocab` | Queued (decision) | decisions recorded in the plan | +| **D-PBL-1** | Intune read: configuration policies, settings, assignments, devices from recorded Graph JSON | Queued | raw round trip; exclusions kept (disable run red) | +| **D-PBL-2** | GPO read: `groupPolicyContainer`, `gPLink`, `gPOptions`; `Registry.pol`, `GptTmpl.inf` parsers | Queued | parse equals an independent reader; disabled links kept and flagged | +| **D-PBL-3** | Setting identity from the published GPO↔CSP mapping as data | Queued | join only through a mapping row (disable run red) | +| **D-PBL-4** | Assignment resolution over dir-sim (precedence, enforced, block inheritance, exclusions) | Queued | precedence fixtures; nested member carries its chain | +| **D-PBL-5** | Observed state: Intune per-device status; GPO "not centrally observable" | Queued | no drift count on a GPO-only setting | +| **D-PBL-6** | Console projection; empty where no source | Queued | each cell names its source | +| **D-PBL-7** | Linux source | Parked (D-PBL-0) | — | + ## D-NAL — NAL-1..9 × 34 recipes against OpenNARS and ONA (2026-10-11) Audit: `.claude/knowledge/nal-recipe-audit/README.md`. Entry: diff --git a/.claude/knowledge/visualization-prompts-v1.md b/.claude/knowledge/visualization-prompts-v1.md new file mode 100644 index 000000000..694c47539 --- /dev/null +++ b/.claude/knowledge/visualization-prompts-v1.md @@ -0,0 +1,74 @@ +# Visualization prompts — where the stack is strongest (2026-10-12) + +READ BY: anyone asking an image model (GPT image, etc.) for a picture of the +current state; refresh this file before reusing it after a large merge. + +Rule for every prompt below: an image model draws whatever it is told is +there. So each prompt names only what has shipped, and marks research as +research. The evidence column is for the human; do not paste it into the +prompt. + +## What has shipped (evidence) + +| capability | evidence | +|---|---| +| Directory simulation with version history: AD (LDIF) and Entra (Graph JSON) observed read-only, one history, undo as a new version | dir-sim; image/restore/revert #1473; Lance log D-DSP-2 #1485 | +| Group membership with the chain kept (direct vs nested vs via which group), transitive members | #1458; Graph groups + `transitiveMemberOf` observed (HubSPO wishlist 19) | +| Address claim vs delivery kept apart; a mail-enabled group grants delivery, not send-as | dir-sim delivery work; Stalwart fix (task #41) | +| LDIF export and a read-only LDAP server over a simulated version | #1469, #1453 | +| One authorization rule shared by Spear, MedCare, a2ui and OGAR: only the signed-in subject holds roles; delegated login read from the token's `act` chain | `rbac_plug::SubjectRoles` + `with_act_claim` #1491; OGAR #356; Spear #25 | +| Group → role grants in a versioned policy, unread ≠ empty | `GroupRoles::from_policy` #1486 | +| Mail server and mail hub on that directory: Stalwart resolves recipients via dir-sim; Spear scopes mailbox access by owner | Stalwart dir-sim backend; Spear IAM | + +Research / proposal only (draw dashed, labelled "Forschung"): CE64 +hypothesis layers and NAL polyfill (#1496, plans only), PLN/Shannon attention +(#1497), Hyperon/MeTTa projection (#1498), NARS evidence/fission (#1499), +Rubicon volition (#1500), class-method hot-plug (#1501), policy baselines +GPO/Intune (plan `policy-baseline-integration-v1`). + +## Prompt 1 — one-page capability map + +> A clean, modern one-page capability map in German, light background, +> flat vector style, for an IT decision-maker. Title: "LanceGraph — was heute +> läuft". Center: a column labelled "Verzeichnis-Simulation (nur lesend)" +> with four stacked tiles: "Active Directory (LDIF)", "Entra ID (Graph)", +> "Versionsverlauf mit Rückgängig", "LDAP-Server (nur lesend)". To the right, +> a tile "Eine Berechtigungsregel für alle Anwendungen" with three small app +> icons labelled "Spear (Mail-Hub)", "MedCare", "a2ui", and a small badge +> "angemeldete Person hält Rollen; Vertretung aus Token-Kette". Below it a +> tile "Mailserver Stalwart: Zustellung aus dem Verzeichnis" with a note +> "Verteiler = Zustellung, keine Berechtigung". At the bottom, a separate +> dashed area labelled "Forschung, noch nicht gebaut" with small grey tiles: +> "Hypothesen-Schichten", "Aufmerksamkeit (PLN/Shannon)", +> "Hyperon/MeTTa", "Willensbildung (Rubikon)", "Klassen-Methoden-Hotplug", +> "Richtlinien GPO/Intune". Solid colour only for built items; grey and +> dashed for research. No numbers, no percentages, no logos of real vendors +> other than plain text names. + +## Prompt 2 — the strongest screen: access path with history + +> A Windows-style admin application screenshot, German UI, title bar +> "LanceGraph — Verzeichnis-Simulation". Left: a directory tree with +> "contoso.local [AD]" and "contoso.onmicrosoft.com [Entra ID]", both marked +> "nur lesend". Center: a user "Anna Müller" with a table "Mitglied von" +> whose column "Art" shows "direkt", "verschachtelt über GG_Vertrieb". A +> separate, visually distinct section below it titled "Mail-Zustellung (keine +> Berechtigung)" lists "vertrieb@ — Verteiler". Right: a panel "Zugriffspfade" +> drawing Anna → GG_Vertrieb → GG_CRM_Users → "Rolle: CRM-Leser (Richtlinie +> v3)". Top of the window: a timeline bar "Versionen" with version markers, +> one labelled "Simulation: Abteilungswechsel", and a button +> "Rückgängig als neue Version". Status bar: "Simulation — es wird nichts an +> AD oder Entra geschrieben · Änderungen als Antrag exportieren". No column +> called "zuletzt genutzt", no device policies. + +## Prompt 3 — architecture, one rule in many apps + +> A minimalist architecture diagram, German labels, white background, thin +> lines. Left: two sources "AD (LDIF)" and "Entra ID (Graph)" with arrows +> labelled "nur lesen" into a box "Verzeichnis-Simulation (versioniert)". +> From it, an arrow labelled "Mitgliedschaft mit Kette" into a box +> "Berechtigungsregel: nur die angemeldete Person hält Rollen". A small token +> icon labelled "Anmelde-Token mit Vertretungskette (act)" feeds the same box. +> From the rule box, three arrows to "Spear", "MedCare", "a2ui", and one arrow +> to "Stalwart Mailserver" labelled "Zustellung". No arrow points back into +> AD or Entra. diff --git a/.claude/plans/policy-baseline-integration-v1.md b/.claude/plans/policy-baseline-integration-v1.md new file mode 100644 index 000000000..b6e63fdf5 --- /dev/null +++ b/.claude/plans/policy-baseline-integration-v1.md @@ -0,0 +1,157 @@ +# Policy baselines across GPO, Intune and Linux — v1 + +**Status:** PROPOSAL (2026-10-12), D-PBL-0..7. Nothing is authorized past +D-PBL-0 until the operator makes the three decisions it names. +Origin: the "Richtlinienverwaltung" panel of the identity console mockup +(2026-10-12), which shows one setting per row with a value and a status per +target (GPO, Intune, Linux). Nothing in OGAR or lance-graph reads policy +today (`grep -i 'intune|gplink|grouppolicy'` over OGAR, lance-graph and Spear +returns nothing), so the panel shows data that does not exist yet. + +## Overview + +The panel's premise: Intune can be shown in GPO terms, so that an +administrator who knows Group Policy sees each Intune setting under the +name they already know, and GPO, Intune and Linux line up in one row. Part +of this is real. Intune's "Administrative Templates" are ADMX-backed, and +Microsoft's Group Policy analytics maps GPO settings onto MDM CSPs, so a +documented mapping exists for some settings. For many it does not. And a +"value per target" hides three questions that must not be merged: + +| question | GPO answer | Intune answer | +|---|---|---| +| **configured** — what does the policy object say? | `groupPolicyContainer` + SYSVOL files | configuration policy + its settings | +| **assigned** — who is it aimed at? | `gPLink` on OUs/domain/sites, link flags, security filtering, WMI filter | group assignments and exclusions | +| **observed** — what does a device actually have? | not observable centrally; per-machine RSoP only | per-device status reports | + +This is the same separation the directory work uses (address claim ≠ +provisioning conflict ≠ delivery resolution; unread ≠ explicitly empty). +The panel's "Abweichung auf 3 Geräten" is an *observed* fact and can only +exist in the Intune column. A GPO column can state *configured* and +*assigned*, never "compliant". + +## Constraints carried over + +- **Read-only.** Nothing writes to AD, SYSVOL, Graph or Intune. The console's + "Bearbeiten" is a change to a simulated version, exported as a proposal. +- **Encoders hold raw records** (the `ogar-ad` / `ogar-az` pattern): no + derived "effective" value is stored in an observation. +- **No HTTP in the encoders.** Recorded Graph JSON and LDIF/SYSVOL files are + the inputs; fetching is a separate example or tool, like `az_ingest.rs`. +- **Data, not literals.** The GPO↔CSP mapping is read from its published + source, never re-typed into a Rust table. +- **Concepts are minted in `ogar-vocab`** through the hot-plug path; no + local classid. +- **Unread is not empty.** A source that was not read yields "nicht gelesen", + never "kein Wert" and never "konform". + +## Checklist + +- [ ] **D-PBL-0** Decisions (operator): canonical setting key; home crate; + Linux source. Mint the policy concepts in `ogar-vocab`. +- [ ] **D-PBL-1** Intune read: encode configuration policies, their settings + and assignments from recorded Graph JSON into raw records. +- [ ] **D-PBL-2** GPO read: `groupPolicyContainer`, `gPLink`, `gPOptions` from + LDIF; `Registry.pol` and `GptTmpl.inf` from SYSVOL files. +- [ ] **D-PBL-3** Setting identity: load the published GPO↔CSP mapping as data; + unmapped settings stay visible in their source's own terms. +- [ ] **D-PBL-4** Assignment resolution over the directory simulation. +- [ ] **D-PBL-5** Observed state: Intune per-device status; GPO marked + "not centrally observable" unless RSoP exports are supplied. +- [ ] **D-PBL-6** Console projection: the panel reads D-PBL-1..5, empty where + no source exists. +- [ ] **D-PBL-7** Linux (PARKED until D-PBL-0 names a source). + +## D-PBL-0 — decisions needed + +1. **Canonical setting key.** Options: (a) the CSP path (Intune-native, covers + settings with no GPO equivalent); (b) the ADMX `class/category/policy` + name (GPO-native, matches the mockup's wording); (c) both, with the key + being whichever source the setting came from and the mapping as an edge. + Recommendation: (c). A forced single key turns every unmapped setting into + a guess. +2. **Home.** Options: (a) extend `lance-graph-dir-sim` (policies live beside + the directory they target, one version history); (b) a sibling + `lance-graph-policy-sim` that reads a dir-sim `View` for assignment. + Recommendation: (b). Policy history changes on a different cadence from + the directory, and dir-sim's observation schema should not grow a second + family. +3. **Linux source.** No directory holds Linux configuration. Candidates: an + inventory export from a configuration-management tool, or an agent. + Recommendation: park until a customer names the tool they run. + +Concepts to mint (names indicative, the vocabulary owner decides): +`policy_setting`, `policy_object`, `policy_assignment`, `baseline`. + +## D-PBL-1 — Intune read + +Encoder in `ogar-az` (new module, same shape as `group.rs`): input is +recorded Graph JSON for configuration policies and their settings, the +ADMX-backed administrative-template policies, and the assignments of each. +Device objects are needed for device-group assignment; `ogar-az` encodes +users and groups only today, so devices are part of this deliverable. + +Endpoint names and API versions (several are beta-only) are to be verified +against current Graph documentation when the encoder is written; this plan +does not pin them. + +**Gate:** a recorded tenant export round-trips into records whose raw values +equal the JSON; an assignment with an exclusion group keeps the exclusion as +its own record (disable run: drop exclusions → test red). + +## D-PBL-2 — GPO read + +`ogar-ad` already parses LDIF. Add `groupPolicyContainer` attributes +(`gPCFileSysPath`, `versionNumber`, `flags`, extension GUID lists), and on +OUs/domain `gPLink` (with its per-link disabled/enforced flags) and +`gPOptions` (block inheritance). New pure parsers for SYSVOL: `Registry.pol` +(binary) and `GptTmpl.inf` (INI). Security filtering needs the GPC's +security descriptor; if that attribute is not exported, record "filtering +not read", never "applies to all". + +**Gate:** a fixture `Registry.pol` parses to the same key/value set as an +independent reader; a link marked disabled is kept and flagged, not dropped. + +## D-PBL-3 — setting identity + +Load the mapping from its published form (the ADMX-backed CSP definitions +and Group Policy analytics output) as data. A mapping row records its +source and whether it is exact or partial. Settings without a mapping are +shown under their native key with "keine Entsprechung". + +**Gate:** a setting present in both sources joins only through a mapping +row; removing the row splits it into two rows (disable run red). + +## D-PBL-4 — assignment resolution + +GPO: OU subtree (dir-sim `subtree`), link order and precedence (local, site, +domain, OU), enforced links and block inheritance, then security filtering. +Intune: transitive group members via dir-sim, minus exclusions. When a +setting is configured by both GPO and Intune on one device, report the +conflict and the device's declared precedence setting if read; do not pick +a winner without it. + +**Gate:** precedence fixtures with enforced + blocked links reproduce the +documented order; a member reached only through a nested group carries the +chain. + +## D-PBL-5 — observed state + +Intune per-device setting status from its reports. GPO: "nicht zentral +beobachtbar" unless RSoP exports are ingested per machine. The console's +drift count is computed only from observed records. + +**Gate:** a GPO-only setting can never display a drift count; a device with +no status report displays "nicht gemeldet", not "konform". + +## D-PBL-6 — console projection + +The panel reads D-PBL-1..5. Each cell names its source. Columns with no +reader (Linux before D-PBL-7) render empty with the reason. + +## Open points + +- Whether Microsoft's mapping data can be fetched and stored without a + separate operator decision (not discussed here). +- Settings expressed only as scripts or custom OMA-URI: kept raw, never + interpreted. From c78e36a15705dbf65ce107d2e49172ce96a77113 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 12 Oct 2026 15:08:59 +0000 Subject: [PATCH 2/4] docs: tighten visualization prompt 2 after the first render Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg --- .claude/knowledge/visualization-prompts-v1.md | 29 ++++++++++++------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/.claude/knowledge/visualization-prompts-v1.md b/.claude/knowledge/visualization-prompts-v1.md index 694c47539..1957ff876 100644 --- a/.claude/knowledge/visualization-prompts-v1.md +++ b/.claude/knowledge/visualization-prompts-v1.md @@ -50,16 +50,25 @@ GPO/Intune (plan `policy-baseline-integration-v1`). > A Windows-style admin application screenshot, German UI, title bar > "LanceGraph — Verzeichnis-Simulation". Left: a directory tree with > "contoso.local [AD]" and "contoso.onmicrosoft.com [Entra ID]", both marked -> "nur lesend". Center: a user "Anna Müller" with a table "Mitglied von" -> whose column "Art" shows "direkt", "verschachtelt über GG_Vertrieb". A -> separate, visually distinct section below it titled "Mail-Zustellung (keine -> Berechtigung)" lists "vertrieb@ — Verteiler". Right: a panel "Zugriffspfade" -> drawing Anna → GG_Vertrieb → GG_CRM_Users → "Rolle: CRM-Leser (Richtlinie -> v3)". Top of the window: a timeline bar "Versionen" with version markers, -> one labelled "Simulation: Abteilungswechsel", and a button -> "Rückgängig als neue Version". Status bar: "Simulation — es wird nichts an -> AD oder Entra geschrieben · Änderungen als Antrag exportieren". No column -> called "zuletzt genutzt", no device policies. +> "nur lesend"; under Entra ID show only "Benutzer" and "Gruppen". Center: a +> user "Anna Müller" with fields "Objekt-GUID" (a GUID) and, separately, +> "Ort (DN)"; a field "Cloud-Identität: verknüpft über Sync-Anker". A table +> "Mitglied von" lists only security groups, with column "Art" showing +> "direkt" or "verschachtelt über GG_Vertrieb". Below it, a separate box +> titled "Verteiler: Zustellung, keine Rechte" listing "vertrieb@". Right: a +> panel "Zugriffspfade" drawing Anna → GG_Vertrieb → GG_CRM_Users → +> "Rolle: CRM-Leser (Richtlinie v3)". Top: a version timeline of observed +> versions as solid dots; from one of them a dashed side branch labelled +> "Simulation: Abteilungswechsel" leaves the main line. No planned or future +> versions. A button "Rückgängig als neue Version". Status bar: "Simulation — +> es wird nichts an AD oder Entra geschrieben · Änderungen als Antrag +> exportieren". No column called "zuletzt genutzt", no device policies. + +Known misreadings from the first render (2026-10-12): "keine Berechtigung" +was drawn as "you may not view this"; the distribution group was listed among +memberships; the simulation was drawn on the observed timeline next to a +"geplant" version; the DN was labelled as the object id; Entra roles and +applications appeared although nothing reads them. ## Prompt 3 — architecture, one rule in many apps From 806e6cc97c7d3c5b8caea8fe505c36da524894a1 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 12 Oct 2026 15:09:53 +0000 Subject: [PATCH 3/4] docs: answer review on the policy plan and the prompts Plan: devices need a dir-sim population before device-targeted assignment resolves; Intune assignment filters, GPO site links and WMI filters are captured raw and resolve to an explicit unknown until evaluated. Prompts: a membership path is drawn as planned (dir-sim returns flattened transitive sets); Stalwart's dir-sim backend is not yet selectable in config. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg --- .claude/knowledge/visualization-prompts-v1.md | 16 ++++++----- .../plans/policy-baseline-integration-v1.md | 27 +++++++++++++++---- 2 files changed, 31 insertions(+), 12 deletions(-) diff --git a/.claude/knowledge/visualization-prompts-v1.md b/.claude/knowledge/visualization-prompts-v1.md index 1957ff876..b5b2932b6 100644 --- a/.claude/knowledge/visualization-prompts-v1.md +++ b/.claude/knowledge/visualization-prompts-v1.md @@ -13,8 +13,8 @@ prompt. | capability | evidence | |---|---| | Directory simulation with version history: AD (LDIF) and Entra (Graph JSON) observed read-only, one history, undo as a new version | dir-sim; image/restore/revert #1473; Lance log D-DSP-2 #1485 | -| Group membership with the chain kept (direct vs nested vs via which group), transitive members | #1458; Graph groups + `transitiveMemberOf` observed (HubSPO wishlist 19) | -| Address claim vs delivery kept apart; a mail-enabled group grants delivery, not send-as | dir-sim delivery work; Stalwart fix (task #41) | +| Group membership, direct and transitive (flattened: the intermediate groups are not returned, so a drawn path Anna → GG_Vertrieb → GG_CRM_Users is research) | #1458; Graph groups + `transitiveMemberOf` observed (HubSPO wishlist 19) | +| Address claim vs delivery kept apart; in Stalwart a distribution list grants delivery only, and security-group membership is not send-as | dir-sim delivery work; Stalwart #13, #14 (`groups_of` = SID chain only). The dir-sim backend is a build feature, not yet selectable in Stalwart config | | LDIF export and a read-only LDAP server over a simulated version | #1469, #1453 | | One authorization rule shared by Spear, MedCare, a2ui and OGAR: only the signed-in subject holds roles; delegated login read from the token's `act` chain | `rbac_plug::SubjectRoles` + `with_act_claim` #1491; OGAR #356; Spear #25 | | Group → role grants in a versioned policy, unread ≠ empty | `GroupRoles::from_policy` #1486 | @@ -37,7 +37,8 @@ GPO/Intune (plan `policy-baseline-integration-v1`). > icons labelled "Spear (Mail-Hub)", "MedCare", "a2ui", and a small badge > "angemeldete Person hält Rollen; Vertretung aus Token-Kette". Below it a > tile "Mailserver Stalwart: Zustellung aus dem Verzeichnis" with a note -> "Verteiler = Zustellung, keine Berechtigung". At the bottom, a separate +> "Verteiler = Zustellung, keine Berechtigung" and a small grey badge +> "noch nicht per Konfiguration wählbar". At the bottom, a separate > dashed area labelled "Forschung, noch nicht gebaut" with small grey tiles: > "Hypothesen-Schichten", "Aufmerksamkeit (PLN/Shannon)", > "Hyperon/MeTTa", "Willensbildung (Rubikon)", "Klassen-Methoden-Hotplug", @@ -54,10 +55,11 @@ GPO/Intune (plan `policy-baseline-integration-v1`). > user "Anna Müller" with fields "Objekt-GUID" (a GUID) and, separately, > "Ort (DN)"; a field "Cloud-Identität: verknüpft über Sync-Anker". A table > "Mitglied von" lists only security groups, with column "Art" showing -> "direkt" or "verschachtelt über GG_Vertrieb". Below it, a separate box +> "direkt" or "verschachtelt" (never "über" a named group). Below it, a separate box > titled "Verteiler: Zustellung, keine Rechte" listing "vertrieb@". Right: a -> panel "Zugriffspfade" drawing Anna → GG_Vertrieb → GG_CRM_Users → -> "Rolle: CRM-Leser (Richtlinie v3)". Top: a version timeline of observed +> panel "Zugriffspfade" whose path Anna → GG_Vertrieb → GG_CRM_Users → +> "Rolle: CRM-Leser (Richtlinie v3)" is drawn dashed in grey with the caption +> "Pfad-Erklärung: geplant". Top: a version timeline of observed > versions as solid dots; from one of them a dashed side branch labelled > "Simulation: Abteilungswechsel" leaves the main line. No planned or future > versions. A button "Rückgängig als neue Version". Status bar: "Simulation — @@ -75,7 +77,7 @@ applications appeared although nothing reads them. > A minimalist architecture diagram, German labels, white background, thin > lines. Left: two sources "AD (LDIF)" and "Entra ID (Graph)" with arrows > labelled "nur lesen" into a box "Verzeichnis-Simulation (versioniert)". -> From it, an arrow labelled "Mitgliedschaft mit Kette" into a box +> From it, an arrow labelled "Mitgliedschaft (direkt und transitiv)" into a box > "Berechtigungsregel: nur die angemeldete Person hält Rollen". A small token > icon labelled "Anmelde-Token mit Vertretungskette (act)" feeds the same box. > From the rule box, three arrows to "Spear", "MedCare", "a2ui", and one arrow diff --git a/.claude/plans/policy-baseline-integration-v1.md b/.claude/plans/policy-baseline-integration-v1.md index b6e63fdf5..3dec77eb7 100644 --- a/.claude/plans/policy-baseline-integration-v1.md +++ b/.claude/plans/policy-baseline-integration-v1.md @@ -88,8 +88,17 @@ Concepts to mint (names indicative, the vocabulary owner decides): Encoder in `ogar-az` (new module, same shape as `group.rs`): input is recorded Graph JSON for configuration policies and their settings, the ADMX-backed administrative-template policies, and the assignments of each. -Device objects are needed for device-group assignment; `ogar-az` encodes -users and groups only today, so devices are part of this deliverable. +Device objects are needed for device-group assignment. `ogar-az` encodes +users and groups only, and dir-sim's `observe::from_graph` skips every other +object kind, with `members_transitive` returning users only. So devices need +a population and a device-group membership path in dir-sim too; until they +exist, a device-targeted assignment resolves to "unbekannt", never to +"nicht zugewiesen". + +Assignment targets can carry an assignment filter (filter id and +include/exclude type). The filter is captured raw with its definition; D-PBL-4 +evaluates it against device properties or reports the assignment as +unresolved. Endpoint names and API versions (several are beta-only) are to be verified against current Graph documentation when the encoder is written; this plan @@ -104,7 +113,10 @@ its own record (disable run: drop exclusions → test red). `ogar-ad` already parses LDIF. Add `groupPolicyContainer` attributes (`gPCFileSysPath`, `versionNumber`, `flags`, extension GUID lists), and on OUs/domain `gPLink` (with its per-link disabled/enforced flags) and -`gPOptions` (block inheritance). New pure parsers for SYSVOL: `Registry.pol` +`gPOptions` (block inheritance), and `gPLink` on site objects in the +configuration partition, with the subnet/site objects needed to place a +computer in a site. The GPC's `gPCWQLFilter` and the referenced WMI filter +object are captured raw. New pure parsers for SYSVOL: `Registry.pol` (binary) and `GptTmpl.inf` (INI). Security filtering needs the GPC's security descriptor; if that attribute is not exported, record "filtering not read", never "applies to all". @@ -126,14 +138,19 @@ row; removing the row splits it into two rows (disable run red). GPO: OU subtree (dir-sim `subtree`), link order and precedence (local, site, domain, OU), enforced links and block inheritance, then security filtering. +Site links apply only when the computer's site is known; otherwise the +site-scoped part is "unbekannt". A WMI filter is evaluated only against +device inventory that answers its query; without it the GPO's assignment is +"abhängig von WMI-Filter", never "zugewiesen". Intune: transitive group members via dir-sim, minus exclusions. When a setting is configured by both GPO and Intune on one device, report the conflict and the device's declared precedence setting if read; do not pick a winner without it. **Gate:** precedence fixtures with enforced + blocked links reproduce the -documented order; a member reached only through a nested group carries the -chain. +documented order; a device-targeted assignment with no device population, a +filtered assignment without device properties, and a WMI-filtered GPO each +resolve to an explicit unknown state (disable runs red). ## D-PBL-5 — observed state From 6a7b2709ff62e8c2629ae4d98c863348f06c03b3 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 12 Oct 2026 15:11:30 +0000 Subject: [PATCH 4/4] docs: prompt 4, before/after of a simulated change Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01G22yT6htkcdyXsihxxXdrg --- .claude/knowledge/visualization-prompts-v1.md | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/.claude/knowledge/visualization-prompts-v1.md b/.claude/knowledge/visualization-prompts-v1.md index b5b2932b6..f43ec7db6 100644 --- a/.claude/knowledge/visualization-prompts-v1.md +++ b/.claude/knowledge/visualization-prompts-v1.md @@ -72,6 +72,35 @@ memberships; the simulation was drawn on the observed timeline next to a "geplant" version; the DN was labelled as the object id; Entra roles and applications appeared although nothing reads them. +## Prompt 4 — before/after of a simulated change (the strongest view) + +What backs it: two versions of one history (the observed one and a simulated +one), each read as a `View`; group changes are the set difference of +`groups_transitive` on both views; mail effects come from the mail chain +(`members_transitive_through` mail-enabled); role effects from the versioned +group-role policy. What does not back it: the intermediate groups of a path, +usage dates, recommendations. + +> A Windows-style admin application screenshot, German UI, title +> "LanceGraph — Verzeichnis-Simulation". Top: a timeline of observed +> versions as solid dots; from the last one a dashed branch labelled +> "Simulation: Abteilungswechsel Vertrieb → Marketing". No planned versions. +> Center: user "Anna Müller", field "Abteilung" showing "Vertrieb" struck +> through and "Marketing". A tab "Vorschau Änderungen" with a table +> "Auswirkungen der Simulation" and columns "Änderung", "Gruppe", "Art", +> "Folge". Rows: red "entfernt GG_Vertrieb (direkt, gesetzt)", red "entfernt +> GG_CRM_Users (verschachtelt, abgeleitet)", green "hinzugefügt GG_Marketing +> (direkt, gesetzt)", green "hinzugefügt GG_CMS_Editors (verschachtelt, +> abgeleitet)", grey "unverändert GG_Standort_Berlin". Each row says whether +> the simulation set it or it follows from nesting. Below, a separate box +> "Zustellung (keine Rechte)" with one row "vertrieb@ — erhält keine Mails +> mehr". Right: two columns "Vorher" and "Nachher", each listing roles only: +> "CRM-Leser (Richtlinie v3)" struck through on the left, "CMS-Redakteur +> (Richtlinie v3)" on the right; no group chains between them. Status bar: +> "Simulation — es wird nichts an AD oder Entra geschrieben · 2 entfernt · +> 2 hinzugefügt · Änderungen als Antrag exportieren". No "zuletzt genutzt", +> no "Entfernen empfohlen", no Entra roles or applications in the tree. + ## Prompt 3 — architecture, one rule in many apps > A minimalist architecture diagram, German labels, white background, thin