From 053d601e931a080dc99786b21634a1dbc6dca06d Mon Sep 17 00:00:00 2001
From: OfficeCom Codex <codex@officecom.cloud>
Date: Sat, 25 Jul 2026 02:13:13 +0200
Subject: [PATCH] Add internal development webhook configuration

---
 build/build-client-package.ps1            |  1 +
 config/ocsentinel-client.dev.example.json | 12 ++++++++++++
 docs/ocsentinel-deployment.md             |  7 +++++++
 docs/ocsentinel-n8n-contract.md           |  4 ++++
 installer/install-ocsentinel.ps1          |  3 +++
 5 files changed, 27 insertions(+)
 create mode 100644 config/ocsentinel-client.dev.example.json

diff --git a/build/build-client-package.ps1 b/build/build-client-package.ps1
index 2199784..04ffc2d 100644
--- a/build/build-client-package.ps1
+++ b/build/build-client-package.ps1
@@ -58,6 +58,7 @@ Copy-Item -Path (Join-Path $repoRoot "scripts\protect-ocsentinel-secret.ps1") -D
 
 Copy-Item -Path (Join-Path $repoRoot "config\ocsentinel-settings.example.json") -Destination (Join-Path $packageRoot "config\ocsentinel-settings.example.json") -Force
 Copy-Item -Path (Join-Path $repoRoot "config\ocsentinel-client.example.json") -Destination (Join-Path $packageRoot "config\ocsentinel-client.example.json") -Force
+Copy-Item -Path (Join-Path $repoRoot "config\ocsentinel-client.dev.example.json") -Destination (Join-Path $packageRoot "config\ocsentinel-client.dev.example.json") -Force
 Copy-Item -Path (Join-Path $repoRoot "config\update-channel.example.json") -Destination (Join-Path $packageRoot "config\update-channel.example.json") -Force
 Copy-Item -Path (Join-Path $repoRoot "samples\ninja-vulnerability-export.example.csv") -Destination (Join-Path $packageRoot "samples\ninja-vulnerability-export.example.csv") -Force
 Copy-Item -Path (Join-Path $repoRoot "samples\webhook-payload.example.json") -Destination (Join-Path $packageRoot "samples\webhook-payload.example.json") -Force
diff --git a/config/ocsentinel-client.dev.example.json b/config/ocsentinel-client.dev.example.json
new file mode 100644
index 0000000..01b16f8
--- /dev/null
+++ b/config/ocsentinel-client.dev.example.json
@@ -0,0 +1,12 @@
+{
+  "schemaVersion": "2.0",
+  "environment": "development",
+  "lookbackDays": 7,
+  "topFindings": 10,
+  "n8nWebhookUrl": "http://172.16.41.197:5678/webhook/ocsentinel-ingest",
+  "deviceIdentifierMode": "machineName",
+  "uploadTimeoutSeconds": 30,
+  "enableVulnerabilityCorrelation": true,
+  "vulnerabilityCsvPath": "",
+  "secretReference": "device-default"
+}
diff --git a/docs/ocsentinel-deployment.md b/docs/ocsentinel-deployment.md
index c231ee3..d020c9f 100644
--- a/docs/ocsentinel-deployment.md
+++ b/docs/ocsentinel-deployment.md
@@ -75,6 +75,13 @@ This writes:
 
 - `C:\ProgramData\OCSentinel\secrets\ocsentinel-upload-secret.dat`
 
+## Development Upload
+
+For the internal development environment, copy
+`config/ocsentinel-client.dev.example.json` to the installed client config
+path and use its HTTP webhook URL. Production clients must use the HTTPS
+configuration with the public Sentinel domain instead.
+
 ## Current Manual Release State
 
 As of July 16, 2026, the first manual release is already published:
diff --git a/docs/ocsentinel-n8n-contract.md b/docs/ocsentinel-n8n-contract.md
index bee41c7..fb52404 100644
--- a/docs/ocsentinel-n8n-contract.md
+++ b/docs/ocsentinel-n8n-contract.md
@@ -32,6 +32,10 @@ The webhook itself may be reachable only on the internal network. It does not
 require public access to the n8n editor or API. Every managed device must be
 able to reach the webhook URL over HTTPS.
 
+For the isolated development environment only, HTTP is permitted at
+`http://172.16.41.197:5678/webhook/ocsentinel-ingest`. Do not reuse this URL,
+the development shared secret, or a disabled-TLS configuration in production.
+
 1. `Webhook`: accept `POST` on the configured private URL.
 2. `Code`: reject a request if `X-ATN-Device`, `X-ATN-Timestamp`,
    `X-ATN-Nonce`, `X-ATN-Version`, `X-ATN-Payload-SHA256`, or
diff --git a/installer/install-ocsentinel.ps1 b/installer/install-ocsentinel.ps1
index 50ef214..40374b0 100644
--- a/installer/install-ocsentinel.ps1
+++ b/installer/install-ocsentinel.ps1
@@ -26,6 +26,9 @@ Copy-Item -Path (Join-Path $packageRoot "config\ocsentinel-settings.example.json
 if (Test-Path (Join-Path $packageRoot "config\ocsentinel-client.example.json")) {
     Copy-Item -Path (Join-Path $packageRoot "config\ocsentinel-client.example.json") -Destination (Join-Path $configRoot "ocsentinel-client.example.json") -Force
 }
+if (Test-Path (Join-Path $packageRoot "config\ocsentinel-client.dev.example.json")) {
+    Copy-Item -Path (Join-Path $packageRoot "config\ocsentinel-client.dev.example.json") -Destination (Join-Path $configRoot "ocsentinel-client.dev.example.json") -Force
+}
 Copy-Item -Path (Join-Path $packageRoot "samples\ninja-vulnerability-export.example.csv") -Destination (Join-Path $samplesRoot "ninja-vulnerability-export.example.csv") -Force
 Copy-Item -Path (Join-Path $packageRoot "scripts\run-ocsentinel.ps1") -Destination $scriptRoot -Force
 Copy-Item -Path (Join-Path $packageRoot "scripts\run-ocsentinel-monitor.ps1") -Destination $scriptRoot -Force