Close three documentation gaps left by recent PRs - #212
Merged
Conversation
- The remote-side path guard (#205): PR #203 made every path-taking remote activity repeat the AllowedRoots + reparse-point check inside the WinRM target's own PowerShell context, which inverts the previous "the API cannot resolve the remote host's reparse map" statement. The docs site carried the new behaviour; claude-reference did not. - OpenTelemetry:RedactHostnames (#200): the default flipped to true, so after an upgrade host.name disappears from OTLP and service.instance.id stops being hostname:pid. siem-logging.md described it; the README config table and the hardening-flags table did not, and neither did the docs site. - LeaderOnlyAttribute (#200): the middleware now checks endpoint metadata before its path heuristics, which is how a semantically mutating GET (webhook ingress) gets fenced on a follower. Named in enterprise-features.md and the HA page so the next such endpoint gets the attribute. - av-exclusions (#184): PR #183 added a detailed A.1 row for %TEMP%\nodepilot-artifact-* without touching the older maintenance- window row, leaving the same path listed twice with contradictory priorities — and the old row said "Installation" although the updater has used that path since Update-NodePilot.ps1 gained artifact staging. The row now matches A.1 and points at it. Closes #205 Closes #200 Closes #184
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documentation only — no code changes. Closes the three open docs-drift issues in one pass.
#205 — remote-side path guard
PR #203 introduced
TargetPathGuardScript, so theAllowedRoots+ reparse-point check now runs a second time inside the WinRM target's own PowerShell context (injected byfileOperation/folderOperation,textFileEdit,fileHash,zipOperation,startProgram). That inverts the previous "the API cannot resolve the remote host's reparse map locally" position. The docs site was updated by #203;docs/claude-reference.mdwas not — both the hardening-flags row and the hot-reload row now say it (the script is rebuilt per step from liveIConfiguration, so a change applies from the next step onward).#200 —
OpenTelemetry:RedactHostnames+LeaderOnlyAttributetrue. After an upgrade,host.namevanishes from OTLP andservice.instance.idstops beinghostname:pid— silently, for anyone relying on host attribution in Tempo/Grafana.docs/siem-logging.mdalready covered it (contrary to the issue text, which predates that); the README config table, the hardening-flags table and the docs-site observability page now do too, each naming the way back.LeaderOnlyAttributeis now named indocs/enterprise-features.md(middleware description + important-files list) and on the HA page: endpoint metadata is checked before the path heuristics, which is what fences a semantically mutatingGETsuch as the webhook ingress on a follower.#184 — av-exclusions duplicate entry
PR #183 (merged) added a detailed A.1 row for
%TEMP%\nodepilot-artifact-*without touching the older maintenance-window row, so both files listed the same path twice with contradictory priorities ("Empfohlen" vs "Pflicht während der Installation"). The older row also said Installation only, although the updater has staged into that path sinceUpdate-NodePilot.ps1gained artifact extraction — true onmainindependently of #183.The maintenance-window row stays (an AV team works through that checklist) but now matches A.1: "Empfohlen, für Installation und Update", with a pointer to the detailed entry.
Closes #205
Closes #200
Closes #184