3 files changed, 42 insertions, 1 deletions
diff --git a/scripts/Operational-E2E.ps1 b/scripts/Operational-E2E.ps1
index c1b45a4..138cd55 100644
--- a/scripts/Operational-E2E.ps1
+++ b/scripts/Operational-E2E.ps1
@@ -249,7 +249,7 @@ process_runで executable=$dotnetYaml, cwd=$fixtureYaml, args=[\"$dllPath\",\"--
         }
     }
     $auditText = $audit -join "`n"
-    if ($auditText -notmatch 'file.overwrite' -or $auditText -notmatch 'process.start' -or $auditText -notmatch 'wfp.remove' -or $auditText -notmatch 'acl.restore') { throw 'Audit trace is incomplete.' }
+    if ($auditText -notmatch 'file.write' -or $auditText -notmatch 'process.start' -or $auditText -notmatch 'network.rule.remove' -or $auditText -notmatch 'acl.restore') { throw 'Audit trace is incomplete.' }
     $passed = $true
     Write-Output "Operational E2E $Transport/$HttpHost PASS: $root"
 }
diff --git a/scripts/Publish-Release.ps1 b/scripts/Publish-Release.ps1
index 78b97ef..a36c2b4 100644
--- a/scripts/Publish-Release.ps1
+++ b/scripts/Publish-Release.ps1
@@ -40,6 +40,9 @@ $required = @(
 foreach ($relative in $required) {
     if (-not (Test-Path -LiteralPath (Join-Path $bundle $relative))) { throw "Release Bundle is missing $relative" }
 }
+foreach ($relative in @('agent.local.yaml', 'config\agent.local.example.yaml')) {
+    if (Test-Path -LiteralPath (Join-Path $bundle $relative)) { throw "Release Bundle must not contain local override input: $relative" }
+}
 
 $manifestPath = Join-Path $bundle 'publish-manifest.sha256'
 Get-ChildItem -LiteralPath $bundle -File -Recurse |
diff --git a/scripts/Read-AgentLog.ps1 b/scripts/Read-AgentLog.ps1
new file mode 100644
index 0000000..f842e45
--- /dev/null
+++ b/scripts/Read-AgentLog.ps1
@@ -0,0 +1,38 @@
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$Path,
+    [string]$TaskId,
+    [string]$SessionId,
+    [string]$Event,
+    [string]$CallId,
+    [ValidateRange(1, 100000)]
+    [int]$Tail = 200
+)
+
+$ErrorActionPreference = 'Stop'
+$resolvedLog = (Resolve-Path -LiteralPath $Path).Path
+Get-Content -LiteralPath $resolvedLog -Tail $Tail | ForEach-Object {
+    try { $entry = $_ | ConvertFrom-Json -ErrorAction Stop }
+    catch { return }
+
+    $entryTaskId = $entry.task_id ?? $entry.taskId
+    $entrySessionId = $entry.session_id ?? $entry.sessionId
+    if ($TaskId -and [string]$entryTaskId -ne $TaskId) { return }
+    if ($SessionId -and [string]$entrySessionId -ne $SessionId) { return }
+    if ($Event -and [string]$entry.event_name -ne $Event -and [string]$entry.event -ne $Event) { return }
+    if ($CallId -and [string]$entry.call_id -ne $CallId) { return }
+
+    [pscustomobject]@{
+        timestamp = $entry.timestamp ?? $entry.ts
+        event = $entry.event_name ?? $entry.event
+        task_id = $entryTaskId
+        session_id = $entrySessionId
+        call_id = $entry.call_id
+        phase = $entry.phase
+        iteration = $entry.iteration
+        replan = $entry.replan
+        tool = $entry.tool_name
+        success = $entry.success
+        output = $entry.output
+    }
+} | Format-Table -AutoSize -Wrap