Add internal development webhook configuration

build/build-client-package.ps1

@@ -58,6 +58,7 @@ Copy-Item -Path (Join-Path $repoRoot "scripts\protect-ocsentinel-secret.ps1") -D
 
 Copy-Item -Path (Join-Path $repoRoot "config\ocsentinel-settings.example.json") -Destination (Join-Path $packageRoot "config\ocsentinel-settings.example.json") -Force
 Copy-Item -Path (Join-Path $repoRoot "config\ocsentinel-client.example.json") -Destination (Join-Path $packageRoot "config\ocsentinel-client.example.json") -Force
+Copy-Item -Path (Join-Path $repoRoot "config\ocsentinel-client.dev.example.json") -Destination (Join-Path $packageRoot "config\ocsentinel-client.dev.example.json") -Force
 Copy-Item -Path (Join-Path $repoRoot "config\update-channel.example.json") -Destination (Join-Path $packageRoot "config\update-channel.example.json") -Force
 Copy-Item -Path (Join-Path $repoRoot "samples\ninja-vulnerability-export.example.csv") -Destination (Join-Path $packageRoot "samples\ninja-vulnerability-export.example.csv") -Force
 Copy-Item -Path (Join-Path $repoRoot "samples\webhook-payload.example.json") -Destination (Join-Path $packageRoot "samples\webhook-payload.example.json") -Force

config/ocsentinel-client.dev.example.json

@@ -0,0 +1,12 @@
+{
+  "schemaVersion": "2.0",
+  "environment": "development",
+  "lookbackDays": 7,
+  "topFindings": 10,
+  "n8nWebhookUrl": "http://172.16.41.197:5678/webhook/ocsentinel-ingest",
+  "deviceIdentifierMode": "machineName",
+  "uploadTimeoutSeconds": 30,
+  "enableVulnerabilityCorrelation": true,
+  "vulnerabilityCsvPath": "",
+  "secretReference": "device-default"
+}

docs/ocsentinel-deployment.md

@@ -75,6 +75,13 @@ This writes:
 
 - `C:\ProgramData\OCSentinel\secrets\ocsentinel-upload-secret.dat`
 
+## Development Upload
+
+For the internal development environment, copy
+`config/ocsentinel-client.dev.example.json` to the installed client config
+path and use its HTTP webhook URL. Production clients must use the HTTPS
+configuration with the public Sentinel domain instead.
+
 ## Current Manual Release State
 
 As of July 16, 2026, the first manual release is already published:

docs/ocsentinel-n8n-contract.md

@@ -32,6 +32,10 @@ The webhook itself may be reachable only on the internal network. It does not
 require public access to the n8n editor or API. Every managed device must be
 able to reach the webhook URL over HTTPS.
 
+For the isolated development environment only, HTTP is permitted at
+`http://172.16.41.197:5678/webhook/ocsentinel-ingest`. Do not reuse this URL,
+the development shared secret, or a disabled-TLS configuration in production.
+
 1. `Webhook`: accept `POST` on the configured private URL.
 2. `Code`: reject a request if `X-ATN-Device`, `X-ATN-Timestamp`,
    `X-ATN-Nonce`, `X-ATN-Version`, `X-ATN-Payload-SHA256`, or

installer/install-ocsentinel.ps1

@@ -26,6 +26,9 @@ Copy-Item -Path (Join-Path $packageRoot "config\ocsentinel-settings.example.json
 if (Test-Path (Join-Path $packageRoot "config\ocsentinel-client.example.json")) {
     Copy-Item -Path (Join-Path $packageRoot "config\ocsentinel-client.example.json") -Destination (Join-Path $configRoot "ocsentinel-client.example.json") -Force
 }
+if (Test-Path (Join-Path $packageRoot "config\ocsentinel-client.dev.example.json")) {
+    Copy-Item -Path (Join-Path $packageRoot "config\ocsentinel-client.dev.example.json") -Destination (Join-Path $configRoot "ocsentinel-client.dev.example.json") -Force
+}
 Copy-Item -Path (Join-Path $packageRoot "samples\ninja-vulnerability-export.example.csv") -Destination (Join-Path $samplesRoot "ninja-vulnerability-export.example.csv") -Force
 Copy-Item -Path (Join-Path $packageRoot "scripts\run-ocsentinel.ps1") -Destination $scriptRoot -Force
 Copy-Item -Path (Join-Path $packageRoot "scripts\run-ocsentinel-monitor.ps1") -Destination $scriptRoot -Force