deploy-hub.yml builds deploy/hub/Dockerfile on the appserver runner, writes
.env from repo secrets and starts docker-compose.prod.yml (external
PostgreSQL, /data bind-mounted), then polls /health.
ci.yml used runs-on: docker, which no runner has, so jobs never started.
Build/tests and the MSI now run inside the SDK image via deploy/ci/Dockerfile,
because the host-mode runner ignores container: and has no apt-get.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Read-only JSON API (/api/v1/instances, /api/v1/findings) and a
Prometheus endpoint (/metrics) in the web UI, with bearer tokens for
machines (only their SHA-256 is configured; a token only opens the API,
never the pages; sensitive evidence left out unless enabled). A
Grafana dashboard and Prometheus scrape example. A Windows Event Log
notification channel with fixed event ids for SCOM, exempt from the
hourly cap.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E3EExwndy8Z22EK2Qpt6BK
Hub: nightly retention of resolved findings, the submission log and
silent instances; delete-customer erases a customer's data and blocks
its licenses; persistent data protection keys and trusted reverse
proxies. Docker image and compose file with PostgreSQL. The agent
refuses to send the license to a non-https hub. Documentation for the
hub, for data processing (GDPR basis for a data processing agreement)
and the README roadmap for phase 3.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E3EExwndy8Z22EK2Qpt6BK
