/** Reviewed against the complete Dummy Work population (both assessments).
 * Conditions are published Context results, never imports of its catalogue.
 * Broad Context conditions alone cannot establish a shared intervention: source
 * setting anchors distinguish the actual change target. No scores or verdicts.
 */
interface Candidate { tool: string; title: string; outcome: string; identityKey?: string; scope?: string }
interface Intervention {
  id: string; cluster: string; title: string; reason: string;
  conditions?: readonly string[]; settings?: readonly string[]; warnings?: boolean;
}
const entries: Intervention[] = [];
function add(cluster: string, id: string, title: string, reason: string,
  conditions: string[] = [], settings: string[] = [], warnings = false) {
  entries.push({ cluster, id, title, reason, conditions, settings, warnings });
}
// Exact published semantic conditions can span scanner evidence and GPO declarations.
add('ad-persistence-indicators', 'admin-protection', 'Review protected administrative object permissions',
  'Review AdminSDHolder permissions and stale adminCount protection together; retain each source assertion.',
  ['ad-stale-admincount', 'adminsdholder-permissions-changed']);
add('ad-privileged-account-exposure', 'admin-identities', 'Protect and restrict administrative identities',
  'Review Protected Users membership and use of the built-in Administrator in the same privileged identity inventory.',
  ['ad-admins-not-protected-users', 'ad-builtin-admin-used']);
add('ad-privileged-account-exposure', 'directory-write-protection', 'Review privileged directory write protection',
  'Review privileged object permissions and LDAP write mitigations; each source remains a separate technical check.',
  ['dsheuristics-ldap-mitigation-off', 'ad-shadow-credentials-privileged']);
add('ad-reconnaissance-exposure', 'anonymous-directory', 'Restrict anonymous and legacy directory read access',
  'Review anonymous LDAP and Pre-Windows 2000 permissions as one directory access change.',
  ['anonymous-ldap-bind', 'prewin2000-access-broad', 'prewin2000-membership-changed']);
add('ad-reconnaissance-exposure', 'anonymous-windows', 'Restrict unauthenticated Windows enumeration',
  'Review exposed named pipes and network session enumeration permissions together.',
  ['anonymous-named-pipes', 'net-session-enumeration-open']);
add('ad-recovery-gaps', 'object-recovery', 'Prepare directory object recovery',
  'Verify backup freshness, Recycle Bin and accidental deletion protection in the same directory recovery procedure.',
  ['ad-recycle-bin-disabled', 'ad-backup-outdated', 'ou-deletion-unprotected']);
add('ad-recovery-gaps', 'dc-resilience', 'Review domain controller topology and redundancy',
  'Review controller redundancy and subnet declarations within the same site topology.',
  ['dc-redundancy-missing', 'dc-subnet-declaration-incomplete']);
add('adcs-escalation', 'certificate-templates', 'Review certificate template issuance permissions',
  'Review requester-controlled certificate properties and insecure template configuration together.',
  ['adcs-template-requester-san', 'adcs-template-insecure-config']);
add('cloud-app-consent-exposure', 'app-lifecycle', 'Review application and credential lifecycles',
  'Inventory applications, renew expiring credentials and remove unused credentials or applications after review.',
  ['entra-app-credentials-expiring', 'entra-app-credentials-stale'], [], true);
add('cloud-app-consent-exposure', 'consent-workflow', 'Restrict application consent and enable approval',
  'Configure who can consent and how users request administrative approval as one consent workflow.',
  ['entra-users-can-consent-apps', 'entra-admin-consent-workflow-missing']);
add('cloud-external-access-exposure', 'guest-invitation', 'Restrict guest invitations and allowed domains',
  'Coordinate guest inviter permissions and approved external domains.',
  ['entra-guest-invites-unrestricted', 'entra-guest-invite-domains-unrestricted']);
add('cloud-external-access-exposure', 'sharepoint-sharing', 'Restrict SharePoint external sharing',
  'Configure SharePoint sharing scope and approved domain or group restrictions together.', ['sharepoint-external-sharing-broad']);
add('cloud-external-access-exposure', 'self-service-signup', 'Restrict tenant self-service signup',
  'Review email subscription signup and tenant joining by email validation together.', ['entra-self-service-signup-allowed']);
add('cloud-sign-in-protection-gaps', 'risk-policies', 'Coordinate risky user and sign-in policies',
  'Review risky user and sign-in responses together, retaining the individual policy requirements.', [],
  ['high risk', 'sign-in risk', 'sign in risk', 'risky sign', 'user risk']);
add('cloud-sign-in-protection-gaps', 'authentication-methods', 'Harden authentication methods',
  'Coordinate phishing-resistant methods, weak method restrictions and FIDO key requirements.', [],
  ['phishing-resistant', 'phishing resistant', 'sms', 'fido', 'third-party software']);
add('cloud-sign-in-protection-gaps', 'authenticator-fatigue', 'Configure Authenticator prompts and suspicious activity reporting',
  'Review Authenticator login context, OTP and suspicious activity reporting together.', ['entra-mfa-fatigue-protection-weak'],
  ['login context', 'suspicious activity', 'otp']);
add('cloud-sign-in-protection-gaps', 'registration', 'Secure authentication method registration',
  'Coordinate MFA registration requirements and trusted registration locations or devices.',
  ['entra-mfa-registration-incomplete', 'entra-mfa-registration-unrestricted'],
  ['registration', 'register security']);
add('cloud-sign-in-protection-gaps', 'device-compliance', 'Enforce managed device compliance',
  'Review managed device access, compliance policy coverage and device cleanup together.', [],
  ['intune', 'compliant', 'managed device']);
add('cloud-sign-in-protection-gaps', 'legacy-authentication', 'Block legacy authentication',
  'Coordinate Conditional Access restrictions for legacy authentication clients.', [], ['legacy authentication']);
add('cloud-sign-in-protection-gaps', 'conditional-access-integrity', 'Repair Conditional Access references and exclusions',
  'Review deleted objects, fallback exclusions and directory synchronization scoping in the same policy inventory.', [],
  ['deleted', 'non-existent', 'nonexistent', 'fallback', 'directory sync', 'directory synchronization']);
add('cloud-sign-in-protection-gaps', 'conditional-access-coverage', 'Review Conditional Access coverage',
  'Review unsupported platforms, application restrictions and uncovered access targets in the same policy rollout.', [],
  ['insider risk', 'azure devops', 'unsupported', 'application restrictions', 'application enforced restrictions']);
add('cloud-sign-in-protection-gaps', 'session-controls', 'Configure sign-in session controls',
  'Coordinate persistent browser sessions and sign-in frequency.', [], ['persistent', 'sign-in frequency']);
add('cloud-sign-in-protection-gaps', 'password-protection', 'Configure cloud password protection',
  'Review password protection mode and smart lockout together.', [], ['password protection', 'smart lockout']);
add('credential-relay-exposure', 'name-resolution', 'Disable unnecessary legacy name resolution',
  'Review multicast and NetBIOS name resolution fallback in one network policy rollout.', [],
  ['multicast', 'netbios', 'netbt', 'llmnr']);
add('credential-relay-exposure', 'dns-permissions', 'Harden DNS trust and update permissions',
  'Review DNS client configuration, DNS server selection and directory DNS update permissions.',
  ['gpo-dns-client-policy-deviates', 'adidns-authenticated-create'], ['dns servers']);
add('credential-relay-exposure', 'proxy-discovery', 'Restrict proxy discovery and proxy authentication',
  'Review WPAD and loopback proxy authentication together.', [], ['wpad', 'proxy']);
add('credential-relay-exposure', 'ldap-transport', 'Require protected LDAP transport',
  'Coordinate LDAP signing, channel binding and domain controller TLS settings.', ['dc-ldaps-legacy-tls'], ['ldap server', 'ldaps']);
add('credential-relay-exposure', 'smb-audit', 'Enable SMB client and server security auditing',
  'Enable the related SMB guest, signing and encryption audit events in one logging rollout.', [], ['audit']);
add('credential-relay-exposure', 'smb-guest', 'Remove insecure SMB guest and mailslot access',
  'Review insecure guest access and remote mailslots on the SMB client and server.', [], ['mailslot', 'insecure guest']);
add('credential-relay-exposure', 'smb-protocol', 'Enforce SMB protocol protection',
  'Coordinate SMB signing, encryption and minimum protocol versions.', [],
  ['digitally sign', 'minimum smb', 'minimum version of smb', 'require encryption']);
add('credential-relay-exposure', 'smb-rate', 'Configure SMB authentication rate limiting',
  'Review SMB authentication rate limiter enablement and delay together.', [], ['rate limit']);
add('credential-relay-exposure', 'unc-paths', 'Harden UNC paths',
  'Review mutual authentication and integrity requirements for the retained UNC paths.', [], ['hardened unc', 'hardened paths']);
add('credential-relay-exposure', 'ntlm-protocol', 'Restrict NTLM versions and session security',
  'Coordinate LAN Manager authentication level and NTLM client/server minimum session security.', [],
  ['lan manager', 'minimum session security', 'old ntlm', 'ntlmv1']);
add('credential-relay-exposure', 'ntlm-identities', 'Restrict fallback authentication identities',
  'Review LocalSystem NTLM identity, NULL fallback and PKU2U authentication together.', [], ['localsystem', 'local system', 'pku2u']);
add('credential-relay-exposure', 'dc-print-spooler', 'Restrict printing on domain controllers',
  'Review the same domain controller Print Spooler exposure reported by each source.', ['ad-dc-spooler-coercion'], ['print spooler']);
add('data-sharing-exposure', 'cross-device-sync', 'Restrict cross-device synchronization',
  'Review clipboard, activity and message synchronization in the same cross-device data policy.', [],
  ['clipboard synchronization', 'user activities', 'message service']);
add('data-sharing-exposure', 'search-data', 'Restrict search and location data exposure',
  'Review encrypted file indexing, online search highlights and location disclosure together.', [],
  ['indexing of encrypted', 'search highlights', 'turn off location']);
add('data-sharing-exposure', 'consumer-cloud', 'Restrict consumer cloud identities and content',
  'Coordinate consumer Microsoft account authentication and cloud content policy.', [],
  ['microsoft account', 'cloud consumer', 'cloud optimized']);
add('data-sharing-exposure', 'diagnostic-collection', 'Limit diagnostic data collection',
  'Coordinate diagnostic data levels, logs, dumps and telemetry transport.', [],
  ['allow diagnostic data', 'diagnostic log', 'dump collection', 'authenticated proxy', 'onesettings auditing']);
add('data-sharing-exposure', 'feedback-reporting', 'Restrict feedback and error reporting',
  'Review support diagnostics, performance tracking, customer experience and error reporting.', [],
  ['support diagnostic', 'perftrack', 'customer experience', 'error reporting', 'feedback notification', 'handwriting']);
add('data-sharing-exposure', 'online-personalization', 'Restrict online personalization services',
  'Coordinate online tips, speech, fonts and advertising identifiers.', [], ['online tips', 'online speech', 'font providers', 'advertising id']);
add('data-sharing-exposure', 'http-printing', 'Restrict Internet printing and print downloads',
  'Review HTTP printing, driver downloads and online print ordering together.', [], ['print drivers over http', 'printing over http', 'order prints']);
add('data-sharing-exposure', 'online-wizards', 'Restrict online publishing and registration wizards',
  'Review Internet connection, publishing and registration tasks in one online service policy.', [],
  ['internet connection wizard', 'web publishing', 'publish to web', 'registration if']);
add('data-sharing-exposure', 'online-downloads', 'Restrict unsolicited online downloads and notifications',
  'Review metadata applications, push install, attachments, search updates and network notifications.', [],
  ['notifications network usage', 'device metadata', 'push to install', 'enclosures', 'search companion']);
add('detection-blind-spots', 'privileged-alerts', 'Enable privileged role assignment and activation alerts',
  'Coordinate privileged role alerts in the same cloud monitoring workflow.', ['entra-privileged-role-alerts-missing']);
add('detection-blind-spots', 'ntlm-audit', 'Enable NTLM usage auditing',
  'Coordinate incoming, outgoing and domain NTLM audit coverage.', ['ntlm-usage-not-audited']);
add('detection-blind-spots', 'powershell-process', 'Enable script and process execution evidence',
  'Coordinate process creation, command-line capture, PowerShell script logging and transcription.',
  ['powershell-logging-off', 'process-creation-not-logged']);
add('detection-blind-spots', 'security-log', 'Configure Security event log retention',
  'Coordinate Security log capacity and full-log behavior.', ['security-event-log-small']);
add('detection-blind-spots', 'application-log', 'Configure Application event log retention',
  'Coordinate Application log capacity and full-log behavior.', [], ['application:']);
add('detection-blind-spots', 'setup-system-log', 'Configure Setup and System event log retention',
  'Coordinate Setup and System log capacity and full-log behavior.', [], ['setup:', 'system: control event', 'system: specify']);
add('detection-blind-spots', 'firewall-domain', 'Enable Domain firewall connection logging',
  'Review declared GPO logging and observed dropped/successful connection logging for the Domain profile.', [], ['domainprofile', 'firewall: domain:']);
add('detection-blind-spots', 'firewall-private', 'Enable Private firewall connection logging',
  'Review declared GPO logging and observed dropped/successful connection logging for the Private profile.', [], ['privateprofile', 'firewall: private:']);
add('detection-blind-spots', 'firewall-public', 'Enable Public firewall connection logging',
  'Review declared GPO logging and observed dropped/successful connection logging for the Public profile.', [], ['publicprofile', 'firewall: public:']);
add('detection-blind-spots', 'audit-authentication', 'Enable authentication and logon auditing',
  'Coordinate credential validation, Kerberos, lockout and logon events.', [],
  ['audit credential', 'audit kerberos', 'audit account lockout', 'audit other logon']);
add('detection-blind-spots', 'audit-directory', 'Enable directory and account change auditing',
  'Coordinate directory, account and group change events and the domain controller audit policy review.', ['dc-audit-incomplete'],
  ['audit directory', 'audit distribution', 'audit other account', 'audit application group', 'audit user account', 'audit group membership']);
add('detection-blind-spots', 'audit-object', 'Enable object and share access auditing',
  'Coordinate file share, removable storage and object access events.', [], ['audit detailed file', 'audit file share', 'audit other object', 'audit removable']);
add('detection-blind-spots', 'audit-policy-system', 'Enable security policy and system auditing',
  'Coordinate policy changes, privilege use and security subsystem events; enable subcategory precedence.', [],
  ['audit: force', 'audit other policy', 'audit authorization', 'audit security system', 'audit pnp', 'audit mpssvc', 'audit ipsec', 'audit sensitive privilege']);
add('host-credential-privilege-exposure', 'backup-rights', 'Restrict backup and restore privileges',
  'Review backup/restore rights in declared GPOs and scanner checks together.', [],
  ['sebackupprivilege', 'serestoreprivilege', 'back up files', 'restore files']);
add('host-credential-privilege-exposure', 'driver-rights', 'Restrict driver loading privileges',
  'Review the same driver loading right in declared GPOs and scanner evidence.', [], ['seloaddriverprivilege', 'load and unload']);
add('host-credential-privilege-exposure', 'operating-rights', 'Restrict sensitive operating privileges',
  'Review system time, shutdown, scheduling and audit privileges with the privileged rights inventory.', [],
  ['seincreasebasepriorityprivilege', 'seremoteshutdownprivilege', 'seauditprivilege', 'change the system time', 'force shutdown', 'shut down the system', 'dangerous user rights']);
add('host-credential-privilege-exposure', 'logon-rights', 'Restrict interactive, batch and service logon rights',
  'Review allow and deny logon assignments together, preserving each access type.', [],
  ['allow log on locally', 'deny access', 'deny log on', 'log on as a batch']);
add('host-credential-privilege-exposure', 'uac', 'Harden User Account Control',
  'Coordinate administrator elevation and Admin Approval Mode.', [], ['user account control:']);
add('host-credential-privilege-exposure', 'stored-credentials', 'Restrict stored and reusable credentials',
  'Review automatic logon, saved network/RDP passwords and WinRM RunAs credential storage.', [],
  ['automatic logon', 'autoadminlogon', 'saving passwords', 'passwords to be saved', 'password upon connection', 'storage of passwords', 'runas']);
add('host-credential-privilege-exposure', 'credential-components', 'Harden credential providers and delegation',
  'Review LSASS providers, MPR notifications, CredSSP and remote credential delegation.', [],
  ['custom ssps', 'mpr notification', 'credential delegation', 'delegation of non-exportable credentials', 'encryption oracle']);
add('host-credential-privilege-exposure', 'print-driver-privileges', 'Restrict print driver installation privileges',
  'Coordinate driver installation, Point and Print updates, queue files and Windows protected printing.', [],
  ['point and print', 'driver installation', 'queue-specific', 'protected print']);
add('host-credential-privilege-exposure', 'print-rpc', 'Harden Print RPC access and authentication',
  'Coordinate Print RPC transport, listener authentication, privacy and redirection protection.', [],
  ['print spooler to accept', 'rpc', 'redirection guard']);
add('host-credential-privilege-exposure', 'print-tls', 'Require trusted TLS for IPPS printing',
  'Configure IPPS and certificate issuer, name, date and server validation together.', [], ['ipps', 'tls']);
add('kerberoasting-exposure', 'kerberos-encryption', 'Restrict weak Kerberos encryption',
  'Review Kerberos encryption types and weak domain controller encryption support together.', [], ['encryption types', 'rc4', 'des encryption']);
add('kerberoasting-exposure', 'service-identities', 'Strengthen service account credentials',
  'Review service account password policy and managed service account adoption together.', [], ['service account', 'service accounts', 'gmsa']);
add('kerberos-delegation-abuse', 'delegation-permissions', 'Review sensitive delegation permissions',
  'Review delegation rights, privileged identity delegation flags and resource-based delegation ACLs.',
  ['gpo-delegation-right-deviates', 'ad-admins-delegatable', 'ad-rbcd-write-on-dc', 'ad-rbcd-write-on-krbtgt'], ['delegation', 'delegated']);
add('kerberos-delegation-abuse', 'computer-registration', 'Restrict computer account creation',
  'Review who can register computer accounts and the machine account quota together.', ['ad-users-can-add-computers'], ['add computer', 'join computer', 'register computer']);
add('lateral-movement-exposure', 'network-logon', 'Restrict network logon rights',
  'Review the same network logon right across declared GPOs and scanner evidence.', [], ['senetworklogonright', 'access this computer']);
add('lateral-movement-exposure', 'firewall-log-files', 'Configure firewall log file capacity',
  'Coordinate firewall log paths and capacities across profiles.', [], ['logging: name', 'logging: size']);
add('lateral-movement-exposure', 'firewall-enforcement', 'Enforce firewall state and inbound rules',
  'Review enabled firewall profiles and inbound defaults together.', [], ['firewall state', 'inbound connections']);
add('lateral-movement-exposure', 'firewall-local-policy', 'Restrict local firewall overrides and notifications',
  'Review local rule merging and notification behavior across profiles.', [], ['display a notification', 'apply local']);
add('lateral-movement-exposure', 'rdp-redirection', 'Restrict RDP device and data redirection',
  'Review RDP redirection channels together, retaining the requirement for each device/data type.', [], ['redirection', 'drive redirection', 'clipboard']);
add('lateral-movement-exposure', 'remote-assistance', 'Restrict Remote Assistance',
  'Coordinate solicited and offered Remote Assistance policy.', [], ['remote assistance']);
add('lateral-movement-exposure', 'rdp-session', 'Restrict RDP session duration and temporary data',
  'Coordinate session limits, single-session policy and temporary folder cleanup.', [], ['time limit', 'single session', 'single remote desktop', 'temporary folders', 'temp folders']);
add('lateral-movement-exposure', 'rdp-authentication', 'Harden RDP authentication and encryption',
  'Coordinate NLA, secure RPC, security layer, encryption and the source-reported Terminal Services policy gaps.', [],
  ['network level authentication', 'secure rpc', 'encryption level', 'security layer', 'terminal services']);
add('lateral-movement-exposure', 'winrm', 'Harden WinRM authentication and remote access',
  'Coordinate WinRM client/server authentication, transport and remote management access.',
  ['winrm-basic-auth', 'winrm-unencrypted'], ['winrm client', 'disallow digest', 'winrm service', 'remote server management', 'remote shell']);
add('lateral-movement-exposure', 'smb1', 'Remove SMBv1 client and server support',
  'Coordinate removal of the same legacy protocol on client and server.', [], ['smb v1', 'smbv1']);
add('lateral-movement-exposure', 'ip-routing', 'Harden IP routing behavior',
  'Review source routing, ICMP redirects and router discovery together.', [], ['source routing', 'icmp redirect', 'router discovery', 'performrouterdiscovery']);
add('lateral-movement-exposure', 'network-discovery', 'Restrict legacy network discovery and bridging',
  'Review topology discovery, peer networking, NetBIOS releases, bridging and connection sharing.', [],
  ['lltd', 'link-layer', 'responder (rspndr)', 'peer-to-peer', 'network bridge', 'internet connection sharing', 'netbios name release']);
add('lateral-movement-exposure', 'network-connections', 'Control network connection configuration',
  'Review simultaneous connections, network location changes and IPv6 transition configuration.', [],
  ['network location', "network's location", 'simultaneous connections', 'disabledcomponents']);
add('lateral-movement-exposure', 'tcp-resilience', 'Configure TCP connection resilience',
  'Coordinate retransmission and keep-alive limits.', [], ['retransmission', 'keepalivetime', 'keep alive']);
add('malicious-code-execution-exposure', 'allowlisting', 'Configure application allowlisting rules',
  'Review executable, DLL, MSI and script rules as one application control rollout.',
  ['gpo-application-control-deviates', 'gpo-software-restriction-policy-deviates', 'gpo-applocker-policy-deviates'], ['safer', 'srpv2']);
add('malicious-code-execution-exposure', 'asr', 'Configure Attack Surface Reduction',
  'Review ASR rule enablement and source-reported ASR coverage together.', [], ['attack surface reduction', 'asr']);
add('malicious-code-execution-exposure', 'app-installer', 'Restrict App Installer bypasses and execution interfaces',
  'Coordinate App Installer features, validation bypasses, protocol and command-line interfaces.', [], ['app installer', 'windows package manager']);
add('malicious-code-execution-exposure', 'installer-control', 'Restrict user-controlled application installation',
  'Review application installation, sharing and installer user control together.', [],
  ['special profiles', 'per-user unsigned packages', 'user control over installs', 'internet explorer security prompt', 'share application data']);
add('malicious-code-execution-exposure', 'exploit-mitigation', 'Enable operating system exploit mitigations',
  'Review DEP, heap, shell protocol, signature padding, log file authentication and boot driver protection.', [],
  ['data execution prevention', 'heap termination', 'shell protocol', 'padding', 'clfs', 'boot-start', 'prevent users from modifying settings']);
add('malicious-code-execution-exposure', 'untrusted-files', 'Restrict untrusted file and script execution',
  'Review zone provenance and source-reported script execution boundaries.',
  ['mark-of-the-web-suppressed', 'script-engines-reach-internet', 'script-files-run-on-double-click'],
  ['zone information', 'folder options', 'script execution', 'script engines']);
add('malicious-code-execution-exposure', 'defender-realtime', 'Enable Defender real-time and behavioral protection',
  'Coordinate real-time scanning, downloaded file checks, behavior/script monitoring and EDR block mode.', [],
  ['real-time', 'downloaded files', 'behavior monitoring', 'script scanning', 'edr']);
add('malicious-code-execution-exposure', 'defender-cloud', 'Configure Defender cloud protection and reporting',
  'Review MAPS membership, local overrides, hash submission and reporting together.', [], ['maps', 'watson', 'file hash', 'out-of-box']);
add('malicious-code-execution-exposure', 'defender-scans', 'Configure Defender scan coverage and schedules',
  'Coordinate archive, removable media, email and quick scan coverage.', [], ['packed files', 'packed executables', 'removable drives', 'e-mail', 'quick scan']);
add('malicious-code-execution-exposure', 'defender-policy', 'Restrict local Defender policy modifications',
  'Review local exclusion visibility and user configuration changes.', [], ['exclusions']);
add('malicious-code-execution-exposure', 'defender-ransomware', 'Configure Defender ransomware protections',
  'Coordinate remote encryption and brute force protection modes.', [], ['remote encryption', 'brute force', 'brute-force']);
add('malicious-code-execution-exposure', 'web-application-protection', 'Configure web and unwanted application protection',
  'Review SmartScreen, dangerous site protection and unwanted application blocking together.', [], ['smartscreen', 'dangerous', 'unwanted', 'convert warn verdict to block']);
add('malicious-code-execution-exposure', 'autorun', 'Disable unnecessary Autorun and Autoplay',
  'Coordinate drive Autoplay, non-volume devices and default Autorun behavior.', [], ['autorun', 'autoplay']);
add('password-guessing-exposure', 'password-policy', 'Strengthen domain password policy',
  'Coordinate minimum length and complexity across declared policies and scanner evidence.',
  ['password-length-below-14', 'password-length-below-8', 'password-complexity-off', 'ad-privileged-weak-password-policy'],
  ['minimumpasswordlength', 'passwordcomplexity', 'minimum password length', 'password complexity', 'weak password policy']);
add('password-guessing-exposure', 'lockout-threshold', 'Configure account lockout thresholds',
  'Review the same lockout threshold in declared GPOs and scanner evidence.', [], ['lockoutbadcount', 'lockout threshold']);
add('password-guessing-exposure', 'lockout-duration', 'Configure lockout duration and reset window',
  'Coordinate lockout duration and counter reset to avoid contradictory settings.', [],
  ['lockoutduration', 'resetlockoutcount', 'lockout duration', 'reset account lockout']);
add('password-guessing-exposure', 'password-lifetime', 'Review non-expiring account passwords',
  'Review maximum password age and non-expiring account exceptions together.',
  ['domain-admins-password-never-expires', 'ad-password-never-expires', 'ad-privileged-password-never-expires'],
  ['maximumpasswordage', 'never expire', 'never expires']);
add('password-guessing-exposure', 'builtin-names', 'Review built-in account naming',
  'Coordinate the built-in Administrator and Guest naming requirements.', [], ['rename administrator', 'rename guest']);
add('password-guessing-exposure', 'kerberos-armoring', 'Configure Kerberos armoring',
  'Coordinate client and domain controller support for Kerberos armoring.', [], ['armoring']);
add('password-guessing-exposure', 'credential-cryptography', 'Harden account credential cryptography',
  'Review SAM password-change encryption and vulnerable Windows Hello key restrictions.', [], ['sam:', 'sam change password', 'roca']);
add('patch-configuration-drift', 'windows-update', 'Configure Windows update deployment',
  'Coordinate update scheduling, restart behavior, preview builds and quality update receipt.', ['cis-windows-update-unmet']);
add('patch-configuration-drift', 'policy-refresh', 'Ensure security policy refresh',
  'Coordinate background security policy processing and reapplication of unchanged policies.', [], ['configure security policy processing']);
add('physical-local-access-exposure', 'session-lock', 'Enforce workstation session locking',
  'Coordinate inactivity, wake passwords, smart card removal and logon hours enforcement.', ['gpo-logon-hours-enforcement-deviates'],
  ['machine inactivity', 'password when a computer wakes', 'smart card removal']);
add('physical-local-access-exposure', 'sign-in-privacy', 'Restrict sign-in screen information disclosure',
  'Review account enumeration, network selection, password reveal and input method disclosure.', [],
  ['showing account details', 'network selection', 'enumerate connected', 'enumerate administrator', 'last signed-in', 'password reveal', 'copying of user input']);
add('physical-local-access-exposure', 'legal-notice', 'Configure the interactive logon notice',
  'Coordinate the notice title and text as one policy change.', [], ['message text', 'message title']);
add('physical-local-access-exposure', 'lock-screen-features', 'Restrict lock screen applications and features',
  'Coordinate camera, slideshow, notifications and Windows Ink access at the lock screen.', [], ['lock screen', 'windows ink']);
add('physical-local-access-exposure', 'wireless-standby', 'Restrict wireless setup and standby connectivity',
  'Coordinate Windows Connect Now and network connectivity during connected standby.', [], ['windows connect now', 'connected-standby']);
add('physical-local-access-exposure', 'physical-devices', 'Restrict local device access',
  'Review camera access, external DMA devices and pairing requirements in the local device policy.', [], ['use of camera', 'kernel dma', 'pin for pairing']);
add('physical-local-access-exposure', 'local-authentication', 'Harden local authentication methods',
  'Review convenience PIN and biometric anti-spoofing policy together.', [], ['convenience pin', 'anti-spoofing']);

export const INTERVENTION_CATALOG: readonly Intervention[] = entries;
export function matchIntervention(cluster: string, finding: Candidate, conditionIds: readonly string[]) {
  const title = finding.title.toLowerCase();
  const candidates = INTERVENTION_CATALOG.filter(rule => rule.cluster === cluster
    && (finding.outcome !== 'warning' || rule.warnings));
  // Specific published semantics take precedence over a term that also occurs
  // in a conditional clause of the original rule text (e.g. MFA fatigue).
  return candidates.find(rule => rule.conditions?.some(id => conditionIds.includes(id)))
    ?? ((Boolean(finding.identityKey && finding.scope)
      || ['cis-cat', 'group-policy', 'maester', 'pingcastle', 'purple-knight'].includes(finding.tool))
      ? candidates.find(rule => rule.settings?.some(anchor => title.includes(anchor))) : undefined);
}