Built from the schema files in the SQL Server 2022 container and read as the
least-privilege agent login: detection and discovery, 'ikke målbar' with the
exact GRANT and measuring after it (no customer table readable, no data
changed), the shipped grant/revoke scripts, AX 2012 history by RECID read
once, a locked AX table skipped within seconds, the SQL Scripts run as-is,
repository retention and read-back, and the web pages and API v1.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
A PDF report for management and auditors (PDFsharp/MigraDoc, MIT, with
the Inter font embedded): key figures, a plain-language summary,
compliance controls backed by rules (met, not met, not measured),
instances and the critical and high findings. Downloadable from the
web UI (/rapporter) and mailed monthly by the agent with the PDF
attached, once per month, across daylight saving changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E3EExwndy8Z22EK2Qpt6BK
- ASP.NET Core API POST /api/v1/findings with EF Core (Npgsql, snake_case)
and a generated initial migration
- The hub is the authority on licenses: verifies the signature itself,
rejects invalid (401), community/expired past grace (403), revoked
(403, re-checked under the lock) and over the instance limit (403)
- Full-state reconciliation per instance: new findings inserted, existing
updated, missing ones resolved, rule states upserted; idempotent by
submission id; late older submissions are recorded but not applied
- Serialized per customer with a PostgreSQL advisory lock (found by a
concurrency test: parallel first submissions raced on the license row)
- Size and schema validation; tests on real PostgreSQL, including the full
path agent → queue → hub → PostgreSQL with evidence redaction
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E3EExwndy8Z22EK2Qpt6BK
- Repository reports which findings opened and resolved per evaluation
- Agent notifies on new and resolved findings and on instance
unreachable/recovered transitions, with links to the web UI
- Channels: e-mail (MailKit, HTML-encoded), Microsoft Teams Workflows
webhook (Adaptive Card), generic JSON webhook signed with HMAC-SHA256
- Per-channel minimum severity (outages always sent), one message per
batch, hourly cap per channel; a failing channel never stops monitoring
- Tested with a real SMTP server (Mailpit) and the real agent pipeline
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E3EExwndy8Z22EK2Qpt6BK
- ASP.NET Core Blazor static SSR: overview with KPI tiles, instance page
(findings, CPU/batch/PLE trends, top waits, file latency, blocking,
deadlocks with .xdl download, not-measurable rules, resolved), finding
detail with explanation, evidence, fix script and references
- Light-first design (sidebar, cards, self-hosted Inter, teal accent),
optional dark theme via toggle; strict CSP, no inline styles
- Windows authentication (Negotiate/IIS) with optional group restriction;
refuses to run without authentication outside Development
- Hosting: IIS (in-process ASP.NET Core Module), Windows service with
Kestrel, or systemd; web reads the repository with db_datareader only
- docs/installation.md for repository, permissions, agent and web
- Fix: CPU used by other processes is not derived on Linux (SystemIdle is
unreliable there); deadlocks are not re-reported or stored twice after
an agent restart; Dapper sends datetime2 so time comparisons are exact
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E3EExwndy8Z22EK2Qpt6BK
Each instance runs its due collectors over one hardened connection per
cycle, keeps previous results for deltas, evaluates all rules and stores
findings, rule states and time series. Instances run in parallel with a
limit; a slow or failing instance never delays the others. The
repository is migrated at startup with retry, and maintenance runs hourly.
End-to-end test against SQL Server with the least-privilege login.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E3EExwndy8Z22EK2Qpt6BK
- Versioned, embedded migrations serialized with sp_getapplock so the agent
and web UI can both migrate at startup
- Findings tracked per rule and subject: first seen, last seen, resolved;
a rule that could not run never resolves its findings
- Time series (waits, file I/O, CPU, counters), blocking chains and
deadlock graphs; idempotent inserts (timestamps truncated to match
datetime2(0)), hourly aggregation and batched retention deletes
- Read API for the web UI; integration tests against SQL Server
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E3EExwndy8Z22EK2Qpt6BK
Collectors (SQL Server 2000+, version-specific SQL, least privilege):
server, configuration, trace flags, databases (settings, backups in UTC,
CHECKDB, VLFs, Query Store, files, tempdb), suspect pages, plan cache,
wait stats and file I/O as deltas with restart/clear detection,
performance counters, CPU from the scheduler monitor ring buffer,
blocking (sleeping head blockers with open transactions), and deadlocks
from system_health continuing from the last file offset.
Rules: configuration (memory, MAXDOP per Microsoft NUMA guidance, cost
threshold, ad hoc bloat, risky options, pending changes), databases
(state, settings, backups, log backups, CHECKDB, suspect pages, VLFs,
autogrowth, max size, Query Store, tempdb), waits (THREADPOOL, signal
waits, locks, I/O, WRITELOG, parallelism, PAGELATCH), I/O latency, CPU,
memory grants, blocking and deadlocks. Missing data makes a rule not
measurable with the collector's reason.
Integration tests run every collector as the least-privilege login and
reproduce real blocking and a real deadlock; green on 2017 and 2022.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E3EExwndy8Z22EK2Qpt6BK
- .NET 10 solution with Core, Connectivity, Rules, Contracts, Agent, Web and Hub
- Capability model gating collectors and rules by SQL Server version (2000 and later);
rules that cannot run are reported as not measurable, never as passed
- Connectivity via Microsoft.Data.SqlClient with ODBC fallback for legacy instances,
hardened monitoring session settings valid back to SQL Server 2000
- Support lifecycle rule (SQLI-VER-001) with lifecycle data shipped as a rule pack
- Version-aware least-privilege permissions script, verified by integration tests
against SQL Server in Docker (reads monitoring sources, cannot read customer data)
- Forgejo Actions CI, contributing guide, code of conduct, issue templates,
legacy version notes
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E3EExwndy8Z22EK2Qpt6BK
