# Nexus Agent 1.0 — Evidence Checklist

Capture screenshots from a Release build after Nexus Shell starts (agent hosts in-process on `http://127.0.0.1:5055`).

| File | What to show |
|------|----------------|
| `agent-status.png` | Top status bar **NEXUS AGENT** pill: Tilsluttet, agent version, last heartbeat time; Device Manager **Nexus Agent** section with connection KPIs |
| `agent-inventory.png` | Browser or REST client `GET http://127.0.0.1:5055/agent/inventory` JSON **or** Device Manager hardware sections fed by agent (ComputerName, OS, CPU, RAM, Storage, GPU, adapters, displays, printers, USB, Bluetooth) |
| `agent-health.png` | `GET http://127.0.0.1:5055/agent/health` showing Overall Healthy/Warning/Critical plus CPU/RAM/Disk/Network; optional temperature field |

## Local API endpoints

| Method | Path | Purpose |
|--------|------|---------|
| GET | `/agent/status` | Connected, versions, last heartbeat |
| GET | `/agent/device` | DeviceId, registration, backend URL |
| GET | `/agent/inventory` | Full hardware inventory snapshot |
| GET | `/agent/health` | Health status snapshot |

## Config & logs

- Config: `%LocalAppData%/NinjaNexus/agent/agent-config.json`
- Logs: `%LocalAppData%/NinjaNexus/agent/logs/agent-YYYYMMDD.log`

## Backend (graceful degradation)

- `POST {BackendUrl}/api/devices/register` — Identity authority by default (`appsettings.json` → `Identity:Authority`)
- `POST {BackendUrl}/api/devices/heartbeat` — every 60s (configurable)
- If backend offline: agent logs warning and continues (POC)

## Security (Phase 1)

- No remote execution, scripts, PowerShell passthrough, registry writes, or Windows service install
- Local API bound to localhost only

## v2 plan (not in scope)

- Standalone Windows Service agent process
- Shell routes all Device Manager WMI reads through agent only
- Authenticated agent ↔ backend (mTLS / device token)
- Persistent device store in Control Center DB
- Remote control, deployment, policy enforcement
