log ignored agent collector keys for later UI enhancements

The endpoint agent now sends disk, bios, memory, processor, osinfo, and domain telemetry. The server does not persist these yet, so ingest logs any unpersisted payload keys with a compact preview. This makes incoming telemetry observable in the logs before any UI or schema work, so we can confirm the agent is sending it and enhance the UI later.

plugins/endpoints/plugin.py

@@ -37,6 +37,21 @@ logger = logging.getLogger(__name__)
 # of a raw event firehose.
 CURATED_EVENT_IDS = frozenset(EVENT_CATALOG)
 
+# Top-level payload keys the ingest path knows about today - either persisted on
+# EndpointState, appended as events, or relayed to the computers collector.
+# Anything the agent sends outside this set is not stored yet; it is logged (see
+# apply_collector_payload) so new agent telemetry - disks, bios, memory, etc. -
+# is observable in the logs before the server grows columns for it. Keep this in
+# lockstep with the keys consumed in apply_collector_payload and the computers
+# handoff subset.
+KNOWN_PAYLOAD_KEYS = frozenset({
+    'hostname', 'adopt', 'loggedinuser', 'serialnumber', 'pctype',
+    'machinenumber', 'vendorname', 'modelnumber', 'osname', 'ipaddress',
+    'agentversion', 'lastboottime', 'uptimeseconds', 'idleseconds',
+    'cpupercent', 'memorypercent', 'services', 'ports', 'interfaces',
+    'scheduledtasks', 'events',
+})
+
 
 def _parse_dt(value):
     """Best-effort parse of an ISO-8601 string to naive UTC, or None."""
@@ -618,6 +633,22 @@ class EndpointsPlugin(BasePlugin):
 
         state.lastreportedat = datetime.utcnow()
 
+        # Log any keys the agent sent that the ingest path does not consume yet.
+        # New agent telemetry (disks, bios, memory, ...) lands here first: it is
+        # not persisted until the server grows columns for it, but logging the
+        # keys and a compact preview makes incoming telemetry visible in the
+        # logs so we can confirm the agent is sending it before wiring the UI.
+        unknown_keys = [key for key in payload if key not in KNOWN_PAYLOAD_KEYS]
+        if unknown_keys:
+            preview = {key: payload.get(key) for key in sorted(unknown_keys)}
+            try:
+                preview_text = json.dumps(preview, default=str)[:2000]
+            except (TypeError, ValueError):
+                preview_text = repr(preview)[:2000]
+            logger.info(
+                'endpoint %s sent %d unpersisted telemetry key(s): %s | preview=%s',
+                hostname, len(unknown_keys), sorted(unknown_keys), preview_text)
+
         stored_events = 0
         for record in (payload.get('events') or []):
             try:

plugins/endpoints/tests/test_plugin.py

@@ -160,6 +160,33 @@ def test_collect_now_is_allowlisted_targetless_and_routine():
     assert elevated_permission_for('collect_now') is None
 
 
+def test_known_payload_keys_cover_persisted_and_relayed_fields():
+    """The ingest allow-set must list every key the handler consumes today, so
+    those keys are never mislogged as 'unpersisted'. Anything the agent sends
+    outside this set is logged for observability before columns exist."""
+    from plugins.endpoints.plugin import KNOWN_PAYLOAD_KEYS
+
+    persisted_or_relayed = {
+        'hostname', 'adopt', 'loggedinuser', 'serialnumber', 'pctype',
+        'machinenumber', 'vendorname', 'modelnumber', 'osname', 'ipaddress',
+        'agentversion', 'lastboottime', 'uptimeseconds', 'idleseconds',
+        'cpupercent', 'memorypercent', 'services', 'ports', 'interfaces',
+        'scheduledtasks', 'events',
+    }
+    assert persisted_or_relayed <= KNOWN_PAYLOAD_KEYS
+
+
+def test_new_hardware_telemetry_keys_are_logged_not_silently_known():
+    """Disk/bios/memory inventory is collected at the agent before the server
+    persists it. Those keys must be OUTSIDE the known set so ingest logs them
+    rather than dropping them silently."""
+    from plugins.endpoints.plugin import KNOWN_PAYLOAD_KEYS
+
+    for key in ('disks', 'bios', 'memory', 'processor', 'osinfo', 'domain'):
+        assert key not in KNOWN_PAYLOAD_KEYS
+
+
+
 def test_telemetrymeta_route_is_registered_for_freshness_gating():
     """The WebUI gates panel refreshes on lastreportedat advancing, so the
     lightweight freshness probe must be exposed on the plugin blueprint."""