[blitzcrieg1]

#394 put the reported account on the trail, but nothing showed it. This adds an Identity section to the existing dashboard, and adds Codex account IDs and the Antigravity account domain so those two stop being blank.

The maintainer decided on 2026-11-07 to build this as an exception to the feature stop.

What the section shows

• Personal accounts and Corporate accounts, counted as domains because one row can hold several people, with agents, sessions, detections and last seen. Expanding a row shows how the account is known, organization IDs, OS accounts, hosts and dates, and a detection opens the existing investigation page.
• Accounts with no domain, only when one exists. Codex reports IDs, so it is not guessed at.
• Agent coverage, where an agent that reports nothing shows as Unknown with its own reason, so a blank does not read as clean.
• Approved accounts, a list of domains or account IDs kept in that browser.

Decisions worth checking

• Personal means a built-in provider list; corporate means anything else. core/audit/personal_domains.py cannot be complete, and somebody's own domain reads as corporate. The page says so. Look-alikes such as outlook.company.com and gmail.com.evil.test stay corporate. This label exists only on the dashboard, and events sent to a SIEM carry the domain alone.
• One domain is one row. Only Claude reports an organization, which split the same domain in two. A row is a domain, not a person, so it does not prove two agents share an address.
• Coverage counts from an agent's first report, so events from before this field existed do not read as an agent that stopped reporting.
• Codex's IDs come from the first line of its session file. Only a .jsonl file under CODEX_HOME or ~/.codex is opened, and nothing past the first line is read. auth.json is never touched. The format is not a stable interface, and an ID says nothing about whether an account is personal.
• Antigravity reads its last sign-in. Its hook input has no account field, so the domain comes from jetski.onboarding.lastLoginUsername in its undocumented app_storage.json, labelled local_config. It means the account last signed in on the machine, the key can change between versions, and only the Windows path has been run.
• Coverage status follows the newest event. An agent reporting again reads as reporting, and the sentence keeps the earlier gap visible, for example "23 earlier events since the first report had none".
• ZCode stays Unknown. No account setting was found in its folders on one machine, only addresses inside conversation content.
• No built-in rule. The frozen detection files are untouched, and the fingerprint stays 15846a0915769d4a.

Checks

Run from this branch on Windows:

• pytest -q: 2251 passed, 7 skipped
• ruff check agentmetry tests: clean
• agentmetry benchmark: 0 missed, 0 false positives
• Dashboard: 200 tests pass, type check clean, lint has no errors, build passes
• In a browser on the demo data: the sections, row details, approved list, detection link, phone width and light mode. Injected test data covered a very long domain, five agents on a row and a page with no accounts
• On a read-only snapshot of the maintainer's real trail: personal and corporate sections and agent coverage. 30 days loaded in under a second
• The Codex read on 3 real session files: both IDs found in about 1 ms each, values not shown
• The Antigravity read on one real machine: a domain found in about 1 ms, value not shown
• A scan of the diff and new files for the maintainer's real account values: 0 matches

Not proven

• No real Codex or Antigravity session has produced these values through a live hook. That test comes after merge.
• The copy buttons showed no confirmation in the test browser, which may block the clipboard, so they need a manual check.
• The phone layout is unchanged, and tables scroll sideways below about 760 px.
• No real detection has been linked to an account on live data. The link is tested on demo data and through the real ingest path in tests.
• The dashboard covers one machine. A fleet view belongs in Enterprise.
• Copilot and the other agents have not been checked beyond their documented hooks, where looked at.
• It does nothing for an agent with no hook, or for browser use.
• Email is personal data. EU employee-monitoring and GDPR questions need a lawyer before this is pitched that way.

🤖 Generated with Claude Code