machine-health: let /machine-health:setup add and remove service exclusions #9258

Activity

1. github-actions

   added

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 22, 2026
2. github-actions commented on Oct 22, 2026

   

   github-actionsBot

   on Oct 22, 2026 – with GitHub Actions

   Last edited by melodic-automation-lanes

   Contributor

   More actions

   Proposed work class: work-class: scoped
   Basis: automated intake triage; the lanes App applied this class.

   Size: Medium
   Complexity: Medium
   Uncertainty: Known
   Flags: none
   Blocked by: none

   Understood: /machine-health:setup should be able to add and remove service exclusions through Set-ApprovalState (validated, locked, atomic, like mutes). The schema and approvals.md should then stop calling the key hand-edited. The refinement comment already lists acceptance criteria and the files involved, and nothing further is missing. The related work it names (#9260, #8925, #9226) is context, not a duplicate. I found no duplicate among the open issues.

   _{Automated triage, applied by the lanes App.}
3. github-actions

   added

   priority: lowNice-to-have, cosmetic, or speculative; opportunistic.Nice-to-have, cosmetic, or speculative; opportunistic.

   and removed

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 22, 2026
4. github-actions

   added the

   Feature

   issue type on Oct 22, 2026
5. kyle-sexton

   added a commit that references this issue on Oct 22, 2026

   docs(machine-health): name service_exclusions as the one hand-edited key

   ...

   b32cfe1
6. github-actions commented on Oct 26, 2026

   

   github-actionsBot

   on Oct 26, 2026 – with GitHub Actions

   Contributor

   More actions

   The triage sweep dispatched intake triage for this issue (attempt 1 of 2).
7. github-actions

   added

   priority: mediumReal value, no hard deadline; normal backlog flow.Real value, no hard deadline; normal backlog flow.

   and removed

   priority: lowNice-to-have, cosmetic, or speculative; opportunistic.Nice-to-have, cosmetic, or speculative; opportunistic.

   on Oct 26, 2026
8. melodic-automation-lanes

   added

   status: readyTriaged, unblocked, and fully specified; eligible to pick up.Triaged, unblocked, and fully specified; eligible to pick up.

   work-class: scopedA briefed fix or small feature; blast radius bounded by the brief, tests exist.A briefed fix or small feature; blast radius bounded by the brief, tests exist.

   status: confirmedA maintainer confirmed the item is real and in scope; ready to be worked.A maintainer confirmed the item is real and in scope; ready to be worked.

   and removed

   status: readyTriaged, unblocked, and fully specified; eligible to pick up.Triaged, unblocked, and fully specified; eligible to pick up.

   on Oct 26, 2026
9. melodic-automation-lanes commented on Oct 26, 2026

   

   melodic-automation-lanesBot

   on Oct 26, 2026

   Contributor

   More actions

   Not admitted to the issue lane: no trusted-human acceptance criteria: a listed human must put the confirmed - [ ] criteria in the body or post them as their own comment, or, on an issue a listed human filed, intake's newest refinement comment must hold them unedited. Admission takes the issue once each of those is met, when intake triages it again (.github/actions/resolve-config/admission-rules.json).
10. melodic-automation-lanes commented on Oct 26, 2026

    

    melodic-automation-lanesBot

    on Oct 26, 2026

    Last edited by melodic-automation-lanes

    Contributor

    More actions

    The latest triage verdict holds nothing: the issue is at status: ready.
11. melodic-automation-lanes

    added

    needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

    and removed

    status: confirmedA maintainer confirmed the item is real and in scope; ready to be worked.A maintainer confirmed the item is real and in scope; ready to be worked.

    on Oct 26, 2026
12. melodic-automation-lanes commented on Oct 26, 2026

    

    melodic-automation-lanesBot

    on Oct 26, 2026

    Contributor

    More actions

    Refinement. A read-only run explored this repository, searched its issues and pull requests, and read the allowed docs to draft what follows. On an issue a listed human filed, it counts as the issue's spec once posted, while unedited; it is still model text, so check it.

    Intended outcome: /machine-health:setup apply can add and remove a service exclusion through Set-ApprovalState (validated, locked, atomic), and the schema and approvals.md no longer call the key hand-edited.

    Acceptance criteria

    • Set-ApprovalState.ps1 ValidateSet on -Action gains two actions, exclude-service and include-service, taking a service name parameter.
    • exclude-service appends the name to check_overrides.services.service_exclusions, creating check_overrides and services when absent, and keeps all other keys such as remediations and migration.
    • A name already listed (case-insensitive, as Restart-StoppedService matches) is not added twice and the call returns Changed false.
    • include-service removes the matching entry case-insensitively and throws when the name is not listed, like unmute.
    • An empty or whitespace name, or a name with control characters, throws and writes nothing.
    • Both actions run under approvals.lock, check the result against approvals.schema.json and replace the file through Write-StateFile, the same path as approve and revoke.
    • Set-ApprovalState.Tests.ps1 has passing Pester tests for add, duplicate add, remove, remove of an absent name, an invalid name, and preservation of remediations.
    • skills/setup/SKILL.md lists non-interactive arguments (e.g. exclude-service=<name>, include-service=<name>) in apply, the argument-hint and the re-read confirmation, and SkillCommands tests still pass.
    • approvals.schema.json:5 drops the exception saying setup cannot write service_exclusions yet.
    • reference/shared/approvals.md:85-87 drops the hand-edit sentence and names the new setup arguments; the Writing section no longer implies an exempt key.
    • plugins/machine-health/CHANGELOG.md has an entry for the new setup arguments.

    Dependencies

    • PR 9260 (merged per CHANGELOG.md:41) already made Restart-StoppedService read service_exclusions; nothing else is awaited.

    Related work

    • fix(machine-health): honor service_exclusions and drop the unread noise_allowlist #9260 (related): Closed PR that made Restart-StoppedService honor service_exclusions; this issue adds the writer.
    • feat(machine-health): add the state writer, run lock and sync-root guard #8925 (related): Added the state writer, run lock and sync-root guard that Set-ApprovalState builds on.
    • feat(machine-health): add the decision page and setup picks #9226 (related): Added setup picks that use Set-ApprovalState for mutes and approvals.

    Sources read

    • plugins/machine-health/skills/audit/scripts/windows/lib/Set-ApprovalState.ps1:44: Action ValidateSet is mute, unmute, approve, revoke only; no exclusion action.
    • plugins/machine-health/skills/audit/scripts/windows/lib/Set-ApprovalState.ps1:120-146: approve and revoke show the pattern (File, Validate, Apply) to follow.
    • plugins/machine-health/skills/audit/catalog/schemas/approvals.schema.json:5: description says setup cannot write service_exclusions yet.
    • plugins/machine-health/skills/audit/catalog/schemas/approvals.schema.json:63-67: service_exclusions is an array of strings.
    • plugins/machine-health/skills/audit/reference/shared/approvals.md:85-87: says the owner edits the key by hand.
    • plugins/machine-health/skills/setup/SKILL.md:167-195: lists the non-interactive apply arguments and how Set-ApprovalState is called.
    • plugins/machine-health/skills/audit/tests/windows/lib/Set-ApprovalState.Tests.ps1:203-208: test that approve preserves service_exclusions.
    • plugins/machine-health/CHANGELOG.md:41: Restart-StoppedService honors service_exclusions.

    _{Automated refinement by the lanes App. Intake triages the issue again with it.}
13. github-actions

    removed

    needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

    on Oct 26, 2026
14. melodic-automation-lanes

    added

    status: readyTriaged, unblocked, and fully specified; eligible to pick up.Triaged, unblocked, and fully specified; eligible to pick up.

    admission-deferred

    on Oct 26, 2026
15. melodic-software-github-iac

    removed

    admission-deferred

    on Oct 27, 2026
16. melodic-automation-lanes

    added

    agent-readyFully specified and briefed; eligible for autonomous pickup from the frontier.Fully specified and briefed; eligible for autonomous pickup from the frontier.

    on Oct 27, 2026
17. melodic-automation-lanes commented on Oct 27, 2026

    

    melodic-automation-lanesBot

    on Oct 27, 2026

    Contributor

    More actions

    The work-resolve-issue run that agent-ready started failed or was cancelled before it reported, or it stopped or the token broker refused it because its workflow files differ from main's. work-unblock removed and added agent-ready back to start a fresh run on main's workflow files. If this run ends the same way, it re-fires the issue again, waiting longer each time.
18. melodic-automation-lanes

    added

    agent-readyFully specified and briefed; eligible for autonomous pickup from the frontier.Fully specified and briefed; eligible for autonomous pickup from the frontier.

    and removed

    agent-readyFully specified and briefed; eligible for autonomous pickup from the frontier.Fully specified and briefed; eligible for autonomous pickup from the frontier.

    on Oct 27, 2026
19. melodic-automation-lanes commented on Oct 27, 2026

    

    melodic-automation-lanesBot

    on Oct 27, 2026

    Contributor

    More actions

    The work-resolve-issue run that agent-ready started failed or was cancelled before it reported, or it stopped or the token broker refused it because its workflow files differ from main's. work-unblock removed and added agent-ready back to start a fresh run on main's workflow files. If this run ends the same way, it re-fires the issue again, waiting longer each time.
20. melodic-automation-lanes

    added

    agent-readyFully specified and briefed; eligible for autonomous pickup from the frontier.Fully specified and briefed; eligible for autonomous pickup from the frontier.

    and removed

    agent-readyFully specified and briefed; eligible for autonomous pickup from the frontier.Fully specified and briefed; eligible for autonomous pickup from the frontier.

    on Oct 27, 2026
21. melodic-automation-lanes

    closed this as completedin #10524on Oct 27, 2026