1 files changed, 32 insertions, 0 deletions
diff --git a/scripts/Verify-AdminIpcAttackMatrix.ps1 b/scripts/Verify-AdminIpcAttackMatrix.ps1
new file mode 100644
index 0000000..c0703f0
--- /dev/null
+++ b/scripts/Verify-AdminIpcAttackMatrix.ps1
@@ -0,0 +1,32 @@
+param(
+    [string]$Configuration = 'Release',
+    [string]$BundlePath = 'build\Release\publish\agent-sandbox-mcp-1.0.0-win-x64'
+)
+
+$ErrorActionPreference = 'Stop'
+$repository = (Resolve-Path (Join-Path $PSScriptRoot '..')).Path
+$harnessDirectory = Join-Path $repository "build\$Configuration\Agent.Admin.AcceptanceHarness\net10.0-windows10.0.26100.0"
+$sourceAppHost = Join-Path $harnessDirectory 'Agent.Admin.AcceptanceHarness.exe'
+$testAppHost = Join-Path $harnessDirectory 'agent-mcp.exe'
+$helper = Join-Path ([IO.Path]::GetFullPath((Join-Path $repository $BundlePath))) 'admin\agent-mcp-admin.exe'
+
+if (-not (Test-Path -LiteralPath $sourceAppHost) -or -not (Test-Path -LiteralPath $helper)) {
+    throw 'Build the solution and publish the Release Bundle before running this acceptance matrix.'
+}
+
+# The helper independently requires the parent image name agent-mcp.exe. Renaming only
+# the test apphost preserves its embedded managed DLL target while exercising that check.
+Copy-Item -LiteralPath $sourceAppHost -Destination $testAppHost -Force
+
+& $testAppHost local-peer
+if ($LASTEXITCODE -ne 0) { throw 'Local peer PID authentication failed.' }
+& $testAppHost remote-peer
+if ($LASTEXITCODE -ne 0) { throw 'Remote-form Named Pipe rejection failed.' }
+
+Write-Host 'Four UAC prompts follow. Approve each prompt to test the real elevated helper.' -ForegroundColor Yellow
+foreach ($scenario in 'wrong-task', 'wrong-version', 'double-apply', 'oversized') {
+    & $testAppHost $scenario $helper
+    if ($LASTEXITCODE -ne 0) { throw "Administrative IPC scenario '$scenario' failed." }
+}
+
+Write-Output 'Administrative IPC actual-Process attack matrix PASS.'