diff options
Diffstat (limited to 'scripts/Run-Final-ElevatedVerification.ps1')
| -rw-r--r-- | scripts/Run-Final-ElevatedVerification.ps1 | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/scripts/Run-Final-ElevatedVerification.ps1 b/scripts/Run-Final-ElevatedVerification.ps1 index 9039c77..627bd65 100644 --- a/scripts/Run-Final-ElevatedVerification.ps1 +++ b/scripts/Run-Final-ElevatedVerification.ps1 @@ -12,6 +12,18 @@ if (-not $evidence.StartsWith($repository + [IO.Path]::DirectorySeparatorChar, [ } New-Item -ItemType Directory -Force -Path $evidence | Out-Null $failed = $false +$metadata = Join-Path $evidence 'metadata.txt' +$administrator = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole( + [Security.Principal.WindowsBuiltInRole]::Administrator) +@( + "timestamp=$(Get-Date -Format o)" + "commit=$(git -C $repository rev-parse HEAD)" + "administrator=$administrator" + "working_tree_clean=$(-not [bool](git -C $repository status --porcelain))" + "os=$([Environment]::OSVersion.VersionString)" + "dotnet=$(& dotnet --version)" +) | Set-Content -LiteralPath $metadata -Encoding utf8NoBOM +if (-not $administrator) { throw 'Final elevated verification must run as Windows Administrator.' } function Invoke-VerificationStep { param([string]$Name, [scriptblock]$Action) @@ -50,6 +62,14 @@ Invoke-VerificationStep 'e2e-02-http-ipv4' { Invoke-VerificationStep 'e2e-02-http-ipv6' { & (Join-Path $PSScriptRoot 'Operational-E2E.ps1') -Transport http -HttpHost ::1 } +Invoke-VerificationStep 'residual-state' { + $journalCount = @(Get-ChildItem -LiteralPath (Join-Path $bundle 'state\journals') -File -ErrorAction SilentlyContinue).Count + $backupCount = @(Get-ChildItem -LiteralPath (Join-Path $bundle 'state\backups') -File -Recurse -ErrorAction SilentlyContinue).Count + $bundleAgent = Join-Path $bundle 'agent-mcp.exe' + $processCount = @(Get-Process -Name agent-mcp -ErrorAction SilentlyContinue | Where-Object { try { $_.Path -eq $bundleAgent } catch { $false } }).Count + "journal_count=$journalCount backup_count=$backupCount published_process_count=$processCount" + if ($journalCount -ne 0 -or $backupCount -ne 0 -or $processCount -ne 0) { throw 'Task Resource residue was detected.' } +} if ($failed) { Write-Error "Final elevated verification FAILED. Evidence: $evidence" |