@trillboards/edge-sdk 0.2.16 → 0.2.17

package/THIRD-PARTY-NOTICES.md

@@ -47,3 +47,54 @@ SOFTWARE.
 Frigate™ is a trademark of Frigate, Inc. Its use here is nominative — to
 identify the upstream project this code was ported from. Trillboards is not
 affiliated with, endorsed by, or sponsored by Frigate, Inc.
+
+---
+
+## FFmpeg
+
+The Windows and macOS connector installers bundle a prebuilt static
+`ffmpeg` binary. RTSP capture goes through it — `RTSPCameraProvider` spawns it
+per frame — so it is redistributed as part of the product, not merely used at
+build time.
+
+**Which binary.** The Windows x64 build pinned at
+`deploy/windows/build-windows.ps1` is
+`eugeneware/ffmpeg-static` release `b6.0`, asset `ffmpeg-win32-x64`, SHA-256
+`e9fd5e711debab9d680955fc1e38a2c1160fd280b144476cc3f62bc43ef49db1`. That
+project republishes upstream Windows x64 builds from
+[gyan.dev](https://www.gyan.dev/ffmpeg/builds/).
+
+**License: GPL v3.** Confirmed two independent ways rather than assumed. The
+upstream builder states "All builds are 64-bit, static and licensed as GPLv3",
+and the binary reports its own configuration as
+
+```
+--enable-gpl --enable-version3 --enable-static ... --enable-libx264
+--enable-libx265 --enable-libxvid --enable-libvidstab --enable-librubberband
+--enable-libvmaf --enable-libopencore-amrnb --enable-libopencore-amrwb
+--enable-libvo-amrwbenc ...
+```
+
+`--enable-gpl` plus `--enable-version3` makes the combined work GPL v3.
+`--enable-nonfree` is **absent**, so the build is redistributable; a `nonfree`
+build would not be, and swapping the pin for one would make shipping it
+unlawful. Check that flag before ever changing the pin.
+
+**Corresponding Source (GPL v3 §6).** Trillboards conveys this object code and
+will provide the complete Corresponding Source for the exact binary above, on
+any medium customarily used for software interchange, to anyone who asks at
+**legal@trillboards.com**, for as long as we offer spare parts or customer
+support for this product. The upstream sources are FFmpeg
+(<https://ffmpeg.org/download.html>, <https://git.ffmpeg.org/ffmpeg.git>) and
+the build recipe published by the builder above.
+
+**Our modification, stated plainly (GPL v3 §5(a)).** Trillboards redistributes
+this binary unmodified except for one thing: we Authenticode-sign it with our
+own code-signing certificate (publisher `Aethercorp Inc`) before bundling it.
+Upstream ships it unsigned, which makes it an EDR and antivirus false-positive
+magnet and the one unsigned executable in an otherwise fully signed bundle. The
+signature is appended to the PE certificate table; no byte of the program image
+is altered, its version and configuration strings are untouched, and it imposes
+no restriction on anyone — a recipient remains free to strip the signature,
+replace the binary, or rebuild it from the Corresponding Source above. Nothing
+in the product requires `bin\ffmpeg.exe` to be signed in order to run.

package/deploy/macos/build-macos-pkg.sh

@@ -37,11 +37,41 @@
 #                                     air-gapped CI)
 #
 # --universal builds ONE fat arm64+x86_64 .pkg (node + ffmpeg lipo'd from both
-# arches; bundled fsevents.node is already universal) that installs + runs on
-# every Mac. This is the RELEASE artifact: a browser can't reliably detect a
-# Mac's CPU arch (Safari reports "MacIntel" even on Apple Silicon), so the portal
-# cannot hand out an arch-specific download. --arch builds a single-arch .pkg
-# (faster, for local testing).
+# arches; bundled fsevents.node is already universal). --arch builds a
+# single-arch .pkg.
+#
+# THE RELEASE ARTIFACT IS `--arch arm64`, NOT `--universal`. This comment used to
+# say the opposite — that universal "installs + runs on every Mac" and "is the
+# RELEASE artifact" — and that sentence is why PR #12228 tried to switch the
+# release lane to it. Do not repeat that. A universal .pkg makes `node` and
+# `ffmpeg` fat, and changes nothing about the constraint that actually decides
+# this: `litert_lm_api` is published ONLY for `macosx_12_0_arm64`. There is no
+# macOS x86_64 build to lipo against, and the installed `liblitert-lm.dylib` is
+# arm64-thin. scripts/setup-litertlm.sh:151,156 already encodes that —
+#
+#     if [ "$HOST_OS" = "Darwin" ] && [ "$HOST_ARCH" != "arm64" ]; then
+#       [ "$REQUIRE_BUNDLED_MODEL" = "1" ] && fail "local AI requires Apple silicon"
+#
+# — and postinstall sets TRILLBOARDS_REQUIRE_BUNDLED_MODEL=1, so on an Intel Mac
+# that refusal is an abort, not a downgrade.
+#
+# The arm64-thin binaries in the shipped .pkg are therefore a SYMPTOM OF THE
+# CORRECT BUILD, not a defect. What the two options actually do on an Intel Mac:
+#
+#   --arch arm64 (today) : Installer.app refuses up front. Nothing is written.
+#   --universal          : the installer ACCEPTS, lays down 2.27 GB, then dies in
+#                          postinstall — and there is no uninstaller to clean up.
+#
+# Failing before the download beats failing after it. Ship universal only when
+# upstream ships an x86_64 litert-lm AND the arch gate above is relaxed in the
+# same change; the `macos-release-arch-lockstep` guard below fails the build if
+# those two ever disagree.
+#
+# The one true thing the old comment said, kept because it still binds: a browser
+# cannot reliably detect a Mac's CPU arch (Safari reports "MacIntel" even on
+# Apple Silicon), so the portal cannot hand out an arch-specific download. That
+# is an argument for ONE artifact at one URL — it is not an argument that the
+# artifact can run everywhere, and conflating those is the error above.
 #
 # ffmpeg: a pinned static darwin build (eugeneware/ffmpeg-static b6.0 — the same
 # upstream the ffmpeg-static npm package ships) is downloaded at build time and

package/deploy/windows/build-windows.ps1

@@ -35,6 +35,15 @@
 .PARAMETER NodeVersion   Pinned Node runtime (default v22.22.0, matches macOS).
 .PARAMETER Offline       Skip downloads; copy the host node/ffmpeg (air-gapped CI).
 .PARAMETER SkipNsis      Stage only; do not compile the NSIS .exe (for unit checks).
+.PARAMETER FfmpegPath    Stage THIS ffmpeg.exe instead of downloading one. The
+                         release workflow fetches the pinned build, verifies its
+                         SHA-256, Authenticode-signs it, and passes the signed
+                         copy here — signing changes the bytes, so the hash gate
+                         has to run before it, not after.
+.PARAMETER PrintFfmpegPin
+                         Print "<download-url> <sha256>" and exit. The release
+                         workflow reads the pin from here rather than restating
+                         it, so the two can never drift.
 
 .OUTPUTS
   Prints the inner installer path on the last line:
@@ -44,7 +53,9 @@
 param(
   [string]$NodeVersion = "v22.22.0",
   [switch]$Offline,
-  [switch]$SkipNsis
+  [switch]$SkipNsis,
+  [string]$FfmpegPath = "",
+  [switch]$PrintFfmpegPin
 )
 
 $ErrorActionPreference = "Stop"
@@ -55,6 +66,9 @@ Set-StrictMode -Version Latest
 # verified after download; refuse to bundle an unverified binary.
 $FfmpegStaticTag = if ($env:FFMPEG_STATIC_TAG) { $env:FFMPEG_STATIC_TAG } else { "b6.0" }
 $FfmpegSha256Win = if ($env:FFMPEG_SHA256_WIN) { $env:FFMPEG_SHA256_WIN } else { "e9fd5e711debab9d680955fc1e38a2c1160fd280b144476cc3f62bc43ef49db1" }
+$FfmpegUrl = "https://github.com/eugeneware/ffmpeg-static/releases/download/$FfmpegStaticTag/ffmpeg-win32-x64"
+
+if ($PrintFfmpegPin) { Write-Output "$FfmpegUrl $FfmpegSha256Win"; exit 0 }
 
 # ─── Locate ourselves + the edge-sdk package root ─────────────────────────────
 $Here = Split-Path -Parent $MyInvocation.MyCommand.Path          # deploy\windows
@@ -152,8 +166,17 @@ if ($Offline) {
   $hostFf = (Get-Command ffmpeg -ErrorAction SilentlyContinue).Source
   if (-not $hostFf) { Die "offline mode: no host ffmpeg on PATH to copy." }
   Copy-Item -Force $hostFf $FfmpegBin
+} elseif ($FfmpegPath) {
+  # Supplied by the release workflow AFTER it verified the pinned SHA-256 and
+  # Authenticode-signed the binary. Re-checking the hash here would fail by
+  # construction: the signature is appended to the PE certificate table, so the
+  # signed file cannot hash to the unsigned pin. The pin still gates the build —
+  # just one step earlier, in the caller, against the bytes it downloaded.
+  if (-not (Test-Path -LiteralPath $FfmpegPath)) { Die "-FfmpegPath does not exist: $FfmpegPath" }
+  Log "Staging supplied ffmpeg: $FfmpegPath"
+  Copy-Item -Force -LiteralPath $FfmpegPath -Destination $FfmpegBin
 } else {
-  $url = "https://github.com/eugeneware/ffmpeg-static/releases/download/$FfmpegStaticTag/ffmpeg-win32-x64"
+  $url = $FfmpegUrl
   Log "Downloading pinned static ffmpeg: $url"
   Invoke-WebRequest -Uri $url -OutFile "$Scratch\ffmpeg.exe" -UseBasicParsing
   $actual = (Get-FileHash -Algorithm SHA256 "$Scratch\ffmpeg.exe").Hash.ToLower()

package/deploy/windows/ci/list-shipped-scripts.ps1

@@ -0,0 +1,58 @@
+<#
+.SYNOPSIS
+  Emit the scripts that actually ship inside the connector installer, DERIVED
+  from build-windows.ps1 rather than restated.
+
+.DESCRIPTION
+  "What ships" is decided by the `Copy-Item -Force "$Here\<file>"
+  "$Payload\bin\..."` calls in build-windows.ps1 - nothing else. A hand-kept
+  list beside it is a list that goes stale the first time someone adds a script
+  and forgets, and the failure is silent: the new file ships unsigned and only a
+  customer under GPO AllSigned finds out.
+
+  Consumers: the release workflow (which files to Authenticode-sign) and the
+  AllSigned enforcement harness (which files to prove).
+
+  Note deploy/windows/install-service.ps1 is deliberately absent: it is the
+  legacy service path, is not copied into the payload, and does not ship.
+
+.PARAMETER Kind
+  ps1 | vbs | cmd | signable (ps1 + vbs) | all
+
+.PARAMETER AbsolutePath
+  Emit full paths into deploy/windows instead of bare file names.
+#>
+[CmdletBinding()]
+param(
+  [ValidateSet('ps1', 'vbs', 'cmd', 'signable', 'all')][string]$Kind = 'all',
+  [switch]$AbsolutePath
+)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+
+$windowsDir = (Resolve-Path (Join-Path $PSScriptRoot '..')).Path
+$build = Join-Path $windowsDir 'build-windows.ps1'
+if (-not (Test-Path -LiteralPath $build)) { throw "build-windows.ps1 not found next to $PSScriptRoot" }
+
+$text = [IO.File]::ReadAllText($build)
+$matched = [regex]::Matches($text, 'Copy-Item\s+-Force\s+"\$Here\\([^"\\]+)"\s+"\$Payload\\bin\\')
+$names = @($matched | ForEach-Object { $_.Groups[1].Value } | Select-Object -Unique)
+
+# Derivation floor. If the Copy-Item shape in build-windows.ps1 ever changes,
+# this fails loudly here instead of silently signing nothing downstream.
+if ($names.Count -lt 12) {
+  throw "only $($names.Count) staged script(s) derived from build-windows.ps1 - the Copy-Item pattern changed; fix this derivation before trusting any signing step"
+}
+
+$selected = switch ($Kind) {
+  'ps1' { $names | Where-Object { $_ -like '*.ps1' } }
+  'vbs' { $names | Where-Object { $_ -like '*.vbs' } }
+  'cmd' { $names | Where-Object { $_ -like '*.cmd' } }
+  'signable' { $names | Where-Object { $_ -like '*.ps1' -or $_ -like '*.vbs' } }
+  default { $names }
+}
+
+foreach ($n in ($selected | Sort-Object)) {
+  if ($AbsolutePath) { Write-Output (Join-Path $windowsDir $n) } else { Write-Output $n }
+}

package/deploy/windows/ci/tb-canary.ps1

@@ -0,0 +1,18 @@
+# tb-canary.ps1 - CI only. Never staged into the installer payload.
+#
+# The AllSigned enforcement proof needs something it can actually RUN and watch
+# be blocked or admitted. The shipped scripts stop scheduled tasks and move
+# install trees, so they are proved through PowerShell's policy gate without
+# being executed; this stands in for them at execution time, and the release
+# workflow signs it in the SAME Trusted Signing call as the shipped scripts so
+# it carries identical signature provenance.
+#
+# Keep it ASCII and keep it trivial: anything it does other than write a marker
+# would make a 'blocked' result ambiguous.
+# [CmdletBinding()] on purpose: it lets the harness validate its non-executing
+# policy probe against this same file, because an unknown named parameter then
+# fails to bind instead of falling through to $args and running the body.
+[CmdletBinding()]
+param([string]$MarkerPath = "")
+if ($MarkerPath) { [IO.File]::WriteAllText($MarkerPath, "ran") }
+exit 0

package/deploy/windows/ci/tb-canary.vbs

@@ -0,0 +1,17 @@
+Option Explicit
+
+' tb-canary.vbs - CI only. Never staged into the installer payload.
+'
+' The .vbs half of the AllSigned enforcement proof. WSH has its own gate
+' (TrustPolicy=2, "run only signed and trusted scripts"), which PowerShell's
+' execution policy does not cover, so the .vbs enforcement is measured
+' separately. Signed in the same Trusted Signing call as the shipped scripts.
+
+Dim fso, args, f
+Set args = WScript.Arguments
+If args.Count > 0 Then
+  Set fso = CreateObject("Scripting.FileSystemObject")
+  Set f = fso.CreateTextFile(args(0), True)
+  f.WriteLine "ran"
+  f.Close
+End If

package/deploy/windows/ci/verify-allsigned-enforcement.ps1

@@ -0,0 +1,608 @@
+<#
+.SYNOPSIS
+  Prove, on a real Windows host, that the shipped scripts survive a machine-wide
+  `AllSigned` policy - and prove the assertion FAILS against unsigned scripts
+  first, so a green result cannot mean "the policy never applied".
+
+.DESCRIPTION
+  The product's runtime invocation sites all pass `-ExecutionPolicy Bypass`.
+  That sets only the *Process* scope, and PowerShell resolves policy
+  MachinePolicy > UserPolicy > Process > CurrentUser > LocalMachine - so a GPO
+  of `AllSigned` (routine on a managed corporate estate) overrides every one of
+  them. This script sets that GPO for real (HKLM\SOFTWARE\Policies\...) and
+  measures what happens.
+
+  It is built the way the desktop-less window probe should have been built (see
+  .claude/lessons/2026-08-14-a-hosted-windows-runner-has-no-desktop-...md): every
+  positive assertion is paired with a control that MUST fire. Four controls:
+
+    A  unsigned            -> must be BLOCKED   (policy is really in force)
+    B  signed, publisher untrusted -> must be BLOCKED   (we measure trust, not bytes)
+    C  signed + publisher trusted  -> must be ALLOWED   <- the deliverable
+    D  signed then tampered        -> must be BLOCKED   (we measure THIS signature)
+
+  If A, B or D does not fire, the harness reports VACUOUS and exits non-zero.
+  A pass therefore cannot be produced by a policy that failed to apply, by a
+  cert store that trusts everything, or by a gate that ignores the signature.
+
+  Shipped scripts are probed WITHOUT executing them. Their bodies stop scheduled
+  tasks and move install trees, so the probe invokes each one with an unknown
+  named parameter: PowerShell checks the execution policy when it LOADS the file,
+  before it binds parameters, so a [CmdletBinding()] script gives up the gate's
+  verdict and then dies on a binding error with its body never entered. Two of
+  the shipped scripts do not declare [CmdletBinding()] - an unknown argument
+  would fall through to positional binding and RUN them - so those assert the two
+  inputs to the same decision instead (signature Valid, publisher trusted).
+  Which route each file took is printed, never inferred.
+
+  NB `(Get-Command <path> -CommandType ExternalScript).ScriptBlock` looks like it
+  should work and does NOT: command discovery does not run the policy check, and
+  it reports 'allowed' for a file the policy really blocks. Measured, not
+  assumed - the probe validates itself against the unsigned canary before it is
+  trusted on anything.
+
+  Execution itself is proven on canaries carrying the IDENTICAL signature
+  provenance (in -AlreadySigned mode the canaries are signed by the production
+  certificate in the same signing call as the shipped files).
+
+.PARAMETER ScriptPath      Shipped .ps1 files to prove.
+.PARAMETER VbsPath         Shipped .vbs files to prove.
+.PARAMETER CmdPath         Shipped .cmd files. Recorded, not gated - see below.
+.PARAMETER CanaryPs1       An already-signed .ps1 that is safe to EXECUTE.
+.PARAMETER CanaryVbs       An already-signed .vbs that is safe to EXECUTE.
+.PARAMETER SelfSign        Hermetic mode: mint a throwaway code-signing cert and
+                           sign COPIES of the inputs. Used by the per-PR lane,
+                           where no Azure Trusted Signing credential exists.
+.PARAMETER AlreadySigned   Release mode: the inputs are already Authenticode
+                           signed (by Azure Trusted Signing) and are proved
+                           as-is, with the unsigned control derived by stripping
+                           the signature block from a copy.
+
+.NOTES
+  .cmd/.bat have no Authenticode SIP and cmd.exe has no execution policy, so a
+  batch file can be neither signed nor blocked by AllSigned. This harness proves
+  that rather than assuming it, so the claim in the runbook stays measured.
+#>
+[CmdletBinding()]
+param(
+  [string[]]$ScriptPath = @(),
+  [string[]]$VbsPath = @(),
+  [string[]]$CmdPath = @(),
+  [string]$CanaryPs1 = "",
+  [string]$CanaryVbs = "",
+  [switch]$SelfSign,
+  [switch]$AlreadySigned
+)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+
+if (-not ($SelfSign -xor $AlreadySigned)) {
+  Write-Error 'Choose exactly one of -SelfSign or -AlreadySigned.'
+  exit 2
+}
+
+$PolicyKey = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell'
+$WshKey = 'HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings'
+$Work = Join-Path ([IO.Path]::GetTempPath()) ("tb-allsigned-" + [Guid]::NewGuid().ToString('N').Substring(0, 8))
+$failures = New-Object System.Collections.Generic.List[string]
+$addedThumbprints = New-Object System.Collections.Generic.List[string]
+
+function Say($m) { Write-Host "[allsigned] $m" }
+function Fail($m) { $script:failures.Add($m); Write-Host "[allsigned] FAIL: $m" -ForegroundColor Red }
+
+# ---------------------------------------------------------------------------
+# Signature-block handling. Both PowerShell and WSH append the Authenticode
+# blob as trailing COMMENT lines, so an unsigned twin is the file up to the
+# begin marker. Byte-exact on the retained prefix, which is what lets the
+# "content unchanged by signing" assertion below be meaningful.
+# ---------------------------------------------------------------------------
+# The comment prefix differs per SIP - PowerShell writes
+# `# SIG # Begin signature block` and WSH writes `'' SIG '' Begin signature
+# block` - so cut on the part they SHARE and walk back to the start of that
+# line. Hardcoding either prefix silently fails to strip the other, and a
+# "unsigned" control that is still signed does not fire, which is the one
+# outcome this harness must never produce.
+function Copy-WithoutSignature([string]$Source, [string]$Destination) {
+  $text = [IO.File]::ReadAllText($Source)
+  $idx = $text.IndexOf('Begin signature block', [StringComparison]::Ordinal)
+  $found = ($idx -ge 0)
+  if ($found) {
+    $lineStart = $text.LastIndexOf("`n", $idx)
+    $cut = if ($lineStart -ge 0) { $lineStart + 1 } else { 0 }
+    $text = $text.Substring(0, $cut)
+  }
+  [IO.File]::WriteAllText($Destination, $text, (New-Object System.Text.UTF8Encoding($false)))
+  return $found
+}
+
+# ---------------------------------------------------------------------------
+# The gate probes.
+# ---------------------------------------------------------------------------
+
+# PS 5.1 turns any stderr from a NATIVE command into an ErrorRecord, and with
+# $ErrorActionPreference = 'Stop' that becomes terminating. A blocked script
+# prints "cannot be loaded" to stderr, so the harness would die the moment a
+# control fired correctly - the probes must run with Continue.
+function Invoke-Native([string]$Exe, [string[]]$Arguments) {
+  $prev = $ErrorActionPreference
+  $ErrorActionPreference = 'Continue'
+  try { & $Exe @Arguments *> $null } finally { $ErrorActionPreference = $prev }
+}
+
+# Actually EXECUTES a canary and reports whether it got to run. The canary
+# writes a marker; the marker, not the exit code, is the evidence.
+function Test-ScriptExecution([string]$Path) {
+  $marker = Join-Path $Work ("ran-" + [Guid]::NewGuid().ToString('N').Substring(0, 6) + ".txt")
+  $ps = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+  Invoke-Native $ps @('-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', $Path, '-MarkerPath', $marker)
+  if (Test-Path -LiteralPath $marker) { return 'allowed' }
+  return 'blocked'
+}
+
+function Test-VbsExecution([string]$Path) {
+  $marker = Join-Path $Work ("vbs-" + [Guid]::NewGuid().ToString('N').Substring(0, 6) + ".txt")
+  $cscript = Join-Path $env:SystemRoot 'System32\cscript.exe'
+  Invoke-Native $cscript @('//nologo', '//B', $Path, $marker)
+  if (Test-Path -LiteralPath $marker) { return 'allowed' }
+  return 'blocked'
+}
+
+function Test-CmdExecution([string]$Path) {
+  $marker = Join-Path $Work ("cmd-" + [Guid]::NewGuid().ToString('N').Substring(0, 6) + ".txt")
+  Invoke-Native $env:ComSpec @('/c', $Path, $marker)
+  if (Test-Path -LiteralPath $marker) { return 'allowed' }
+  return 'blocked'
+}
+
+# A DIRECT policy probe for scripts that declare [CmdletBinding()]: an unknown
+# named parameter is a terminating binding error, and PowerShell checks the
+# execution policy when it LOADS the file, before it binds. So the gate's verdict
+# is observable without the body ever running.
+#
+# Restricted to [CmdletBinding()] scripts on purpose. Without it, an unrecognised
+# named argument falls through to positional binding or $args and the script
+# RUNS - and two of the shipped scripts register scheduled tasks.
+function Test-ScriptPolicyByBinding([string]$Path) {
+  $probe = @'
+$out = $args[1]
+try {
+  & $args[0] -TbAllSignedProbeUnbindable
+  [IO.File]::WriteAllText($out, 'allowed')
+} catch {
+  if (($_.Exception -is [System.Management.Automation.PSSecurityException]) -or
+      ($_.FullyQualifiedErrorId -like 'UnauthorizedAccess*')) {
+    [IO.File]::WriteAllText($out, 'blocked')
+  } else {
+    [IO.File]::WriteAllText($out, 'allowed')
+  }
+}
+'@
+  $id = [Guid]::NewGuid().ToString('N').Substring(0, 8)
+  $probeFile = Join-Path $Work "bind-$id.txt"
+  $resultFile = Join-Path $Work "bindverdict-$id.txt"
+  [IO.File]::WriteAllText($probeFile, $probe, (New-Object System.Text.UTF8Encoding($false)))
+  $ps = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+  $inline = '& ([scriptblock]::Create([IO.File]::ReadAllText(''' + $probeFile + '''))) ''' + $Path + ''' ''' + $resultFile + ''''
+  Invoke-Native $ps @('-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', $inline)
+  if (-not (Test-Path -LiteralPath $resultFile)) { return 'indeterminate(no-verdict)' }
+  return ([IO.File]::ReadAllText($resultFile)).Trim()
+}
+
+function Test-DeclaresCmdletBinding([string]$Path) {
+  return ([IO.File]::ReadAllText($Path)) -match '(?m)^\s*\[CmdletBinding\(\)\]'
+}
+
+# StrictMode makes a missing property a terminating error, so registry values
+# that may not exist have to be read through the property bag.
+function Get-RegValue([string]$Key, [string]$Name) {
+  if (-not (Test-Path $Key)) { return $null }
+  $item = Get-ItemProperty -Path $Key -ErrorAction SilentlyContinue
+  if (-not $item) { return $null }
+  if ($item.PSObject.Properties.Name -notcontains $Name) { return $null }
+  return $item.$Name
+}
+
+function Add-CertToStore([Security.Cryptography.X509Certificates.X509Certificate2]$Cert, [string]$StoreName) {
+  # The PUBLIC certificate only. Nothing here reads, prints or persists a
+  # private key, a password or a token - the signing material never leaves the
+  # Trusted Signing service.
+  $store = New-Object Security.Cryptography.X509Certificates.X509Store($StoreName, 'LocalMachine')
+  $store.Open('ReadWrite')
+  $store.Add($Cert)
+  $store.Close()
+}
+
+function Remove-CertFromStore([string]$Thumbprint, [string]$StoreName) {
+  $store = New-Object Security.Cryptography.X509Certificates.X509Store($StoreName, 'LocalMachine')
+  $store.Open('ReadWrite')
+  foreach ($c in @($store.Certificates | Where-Object { $_.Thumbprint -eq $Thumbprint })) { $store.Remove($c) }
+  $store.Close()
+}
+
+# ---------------------------------------------------------------------------
+# Set up
+# ---------------------------------------------------------------------------
+New-Item -ItemType Directory -Force -Path $Work | Out-Null
+
+$priorPolicy = $null
+$priorEnableScripts = $null
+$hadPolicyKey = Test-Path $PolicyKey
+$priorTrustPolicy = $null
+$priorUseWinSafer = $null
+
+try {
+  # --- canaries -------------------------------------------------------------
+  # Committed next to this harness so both modes prove the same bytes. In
+  # -AlreadySigned mode the release workflow has already signed them in the same
+  # Trusted Signing call as the shipped scripts; in -SelfSign mode they are
+  # signed below with the throwaway certificate.
+  if (-not $CanaryPs1) { $CanaryPs1 = Join-Path $PSScriptRoot 'tb-canary.ps1' }
+  if (-not $CanaryVbs) { $CanaryVbs = Join-Path $PSScriptRoot 'tb-canary.vbs' }
+  if (-not (Test-Path -LiteralPath $CanaryPs1)) { Write-Error "canary not found: $CanaryPs1"; exit 2 }
+  if (-not (Test-Path -LiteralPath $CanaryVbs)) { Write-Error "canary not found: $CanaryVbs"; exit 2 }
+  $canaryPs1Src = Join-Path $Work 'tb-canary.ps1'
+  $canaryVbsSrc = Join-Path $Work 'tb-canary.vbs'
+  Copy-Item -LiteralPath $CanaryPs1 -Destination $canaryPs1Src -Force
+  Copy-Item -LiteralPath $CanaryVbs -Destination $canaryVbsSrc -Force
+
+  # --- assemble the signed / unsigned pairs ---------------------------------
+  $signedDir = Join-Path $Work 'signed'
+  $unsignedDir = Join-Path $Work 'unsigned'
+  New-Item -ItemType Directory -Force -Path $signedDir, $unsignedDir | Out-Null
+
+  $subjects = @()
+  foreach ($p in @($ScriptPath + $VbsPath)) {
+    if (-not (Test-Path -LiteralPath $p)) { throw "input not found: $p" }
+    $name = Split-Path -Leaf $p
+    $signed = Join-Path $signedDir $name
+    $unsigned = Join-Path $unsignedDir $name
+    Copy-Item -LiteralPath $p -Destination $signed -Force
+    $stripped = Copy-WithoutSignature -Source $p -Destination $unsigned
+    # In -AlreadySigned mode the input MUST carry a block to strip. If it does
+    # not, the "unsigned" control is not unsigned and would not fire.
+    if ($AlreadySigned -and -not $stripped) { Fail "$name : no signature block found to strip - the unsigned control would be vacuous" }
+    $subjects += [pscustomobject]@{
+      Name = $name; Signed = $signed; Unsigned = $unsigned
+      Kind = ([IO.Path]::GetExtension($p).TrimStart('.').ToLower())
+      # Only [CmdletBinding()] scripts can be probed without risking execution.
+      Probeable = (([IO.Path]::GetExtension($p) -ieq '.ps1') -and (Test-DeclaresCmdletBinding $unsigned))
+    }
+  }
+  foreach ($c in @(@{ n = 'tb-canary.ps1'; s = $canaryPs1Src }, @{ n = 'tb-canary.vbs'; s = $canaryVbsSrc })) {
+    $signed = Join-Path $signedDir $c.n
+    $unsigned = Join-Path $unsignedDir $c.n
+    Copy-Item -LiteralPath $c.s -Destination $signed -Force
+    $stripped = Copy-WithoutSignature -Source $c.s -Destination $unsigned
+    if ($AlreadySigned -and -not $stripped) { Fail "$($c.n): no signature block found to strip - the unsigned control would be vacuous" }
+  }
+
+  # --- sign (hermetic mode only) -------------------------------------------
+  if ($SelfSign) {
+    Say 'Minting a throwaway code-signing certificate (hermetic mode).'
+    $cert = New-SelfSignedCertificate -Type CodeSigningCert -Subject 'CN=Trillboards CI AllSigned Harness' `
+      -CertStoreLocation 'Cert:\CurrentUser\My' -NotAfter (Get-Date).AddDays(2)
+    $pub = New-Object Security.Cryptography.X509Certificates.X509Certificate2(, $cert.RawData)
+    # A self-signed cert must be in Root for the chain to build at all; without
+    # this its Status is UnknownError and control B would fire for the wrong
+    # reason.
+    Add-CertToStore -Cert $pub -StoreName 'Root'
+    $addedThumbprints.Add('Root|' + $pub.Thumbprint)
+    foreach ($f in @(Get-ChildItem -LiteralPath $signedDir -File)) {
+      $r = Set-AuthenticodeSignature -FilePath $f.FullName -Certificate $cert -HashAlgorithm SHA256
+      if ($r.Status -ne 'Valid') { throw "self-signing produced $($r.Status) for $($f.Name)" }
+    }
+  }
+
+  # --- what signing did to the file, measured ------------------------------
+  # The signer does NOT merely append: measured on windows-latest,
+  # Set-AuthenticodeSignature rewrites the whole file, and PS 5.1 re-emits it
+  # with a UTF-8 BOM and CRLF line endings. That is fine - it happens before
+  # packaging - but it is worth knowing, because it is the same mechanism that
+  # makes a post-signing edit so dangerous: whoever rewrites the file last wins,
+  # and the signature dies silently.
+  #
+  # So the assertion here is on the TEXT, normalised for the signer's own
+  # re-encoding. A genuine content change (mojibake from a codepage round-trip,
+  # a truncated line) still fails. The exact byte-identity claim belongs to the
+  # release lane, which compares the SHIPPED file to the SIGNED file - both
+  # post-signing, so no normalisation is needed or allowed there.
+  function Get-NormalisedText([string]$Path) {
+    $t = [IO.File]::ReadAllText($Path)
+    if ($t.Length -gt 0 -and $t[0] -eq [char]0xFEFF) { $t = $t.Substring(1) }
+    return ($t -replace "`r`n", "`n") -replace "`r", "`n"
+  }
+  foreach ($s in $subjects) {
+    $originalNoSig = Join-Path $Work ('orig-' + $s.Name)
+    $null = Copy-WithoutSignature -Source $s.Signed -Destination $originalNoSig
+    # TrimEnd: the retained prefix stops at the start of the signature block's
+    # line, so it carries one newline the original does not. That is the block's
+    # separator, not script content.
+    $before = (Get-NormalisedText $s.Unsigned).TrimEnd()
+    $after = (Get-NormalisedText $originalNoSig).TrimEnd()
+    if ($before -ne $after) {
+      Fail "$($s.Name): signing changed the script TEXT, not just encoding and the appended block"
+    }
+    $exact = ((Get-FileHash -Algorithm SHA256 -LiteralPath $s.Unsigned).Hash -eq
+              (Get-FileHash -Algorithm SHA256 -LiteralPath $originalNoSig).Hash)
+    if (-not $exact) { Say ("  note: signer re-encoded " + $s.Name + " (BOM/line endings); text is unchanged") }
+  }
+
+  # --- every signed input must be pure ASCII --------------------------------
+  # These files ship WITHOUT a BOM, so Windows PowerShell 5.1 decodes them with
+  # the machine's ANSI codepage. The Authenticode digest is taken over the
+  # DECODED text, so one non-ASCII byte makes a signature that verifies on the
+  # signing machine and fails on a customer machine in another locale. The
+  # existing guard in windowsHiddenSupervisor.test.ts covers string literals
+  # only, because that is all that breaks PARSING - comments break SIGNING.
+  foreach ($s in $subjects) {
+    $bytes = [IO.File]::ReadAllBytes($s.Unsigned)
+    if ($bytes | Where-Object { $_ -gt 127 }) {
+      Fail "$($s.Name): contains non-ASCII bytes and ships without a BOM - its signature is locale-dependent"
+    }
+  }
+
+  # --- turn the GPO on ------------------------------------------------------
+  if ($hadPolicyKey) {
+    $priorPolicy = Get-RegValue $PolicyKey 'ExecutionPolicy'
+    $priorEnableScripts = Get-RegValue $PolicyKey 'EnableScripts'
+  } else {
+    New-Item -Path $PolicyKey -Force | Out-Null
+  }
+  Set-ItemProperty -Path $PolicyKey -Name 'EnableScripts' -Value 1 -Type DWord
+  Set-ItemProperty -Path $PolicyKey -Name 'ExecutionPolicy' -Value 'AllSigned' -Type String
+
+  $ps = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+  # No embedded double quotes: the native command-line parser strips them and
+  # PowerShell then reads a bare `=` as an assignment (InvalidLeftHandSide).
+  $listed = & $ps -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command 'Get-ExecutionPolicy -List | Out-String'
+  Say ("Scopes seen by a child with -ExecutionPolicy Bypass:`r`n" + ((@($listed) -join [Environment]::NewLine).Trim()))
+  $effective = ((& $ps -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command 'Get-ExecutionPolicy') | Out-String).Trim()
+  Say "Effective policy inside -ExecutionPolicy Bypass: $effective"
+  if ($effective -ne 'AllSigned') {
+    Fail "MachinePolicy did not take effect (effective policy is '$effective') - every result below would be meaningless"
+    throw 'VACUOUS: the AllSigned machine policy did not apply.'
+  }
+
+  # =========================================================================
+  # CONTROL A - unsigned must be BLOCKED
+  #
+  # The canary is EXECUTED (`powershell -File`), which is unambiguously
+  # policy-checked; that result is mandatory. The non-executing Get-Command
+  # probe used on the shipped scripts is validated against the same unsigned
+  # canary first: if it does not report 'blocked' there, the technique does not
+  # observe the gate and the shipped-file assertions fall back to the
+  # signature + trusted-publisher decision PowerShell itself makes. Which mode
+  # was used is printed, never inferred.
+  # =========================================================================
+  Say '--- control A: unsigned under MachinePolicy=AllSigned ---'
+  $canaryUnsignedPs1 = Join-Path $unsignedDir 'tb-canary.ps1'
+  $rc = Test-ScriptExecution $canaryUnsignedPs1
+  Say "  A  canary EXECUTION (unsigned)      $rc"
+  if ($rc -ne 'blocked') { Fail 'VACUOUS: an unsigned canary EXECUTED under MachinePolicy=AllSigned' }
+
+  # Validate the non-executing probe against that same unsigned canary before
+  # trusting it on the shipped scripts. Measured on windows-latest, the
+  # Get-Command/.ScriptBlock route reports 'allowed' for a file the policy really
+  # does block - command discovery does NOT run the policy check - so it is not
+  # used. The unbindable-parameter route does observe the gate.
+  $probeOnCanary = Test-ScriptPolicyByBinding $canaryUnsignedPs1
+  $policyProbeUsable = ($probeOnCanary -eq 'blocked')
+  Say ("  A  non-executing probe on the same unsigned canary: $probeOnCanary" +
+    $(if ($policyProbeUsable) { '  -> probe IS gated; shipped scripts get the direct assertion' }
+      else { '  -> probe is NOT gated; shipped scripts fall back to the signature/trust decision' }))
+
+  foreach ($s in ($subjects | Where-Object { $_.Kind -eq 'ps1' })) {
+    if (-not ($policyProbeUsable -and $s.Probeable)) { continue }
+    $r = Test-ScriptPolicyByBinding $s.Unsigned
+    Say ("  A  {0,-30} {1}" -f $s.Name, $r)
+    if ($r -ne 'blocked') { Fail "control A did not fire for $($s.Name): $r" }
+  }
+
+  # =========================================================================
+  # CONTROL B - signed but publisher not trusted must be BLOCKED
+  # =========================================================================
+  Say '--- control B: signed, publisher NOT yet in TrustedPublisher ---'
+  $rc = Test-ScriptExecution (Join-Path $signedDir 'tb-canary.ps1')
+  Say "  B  canary EXECUTION (signed, untrusted publisher)  $rc"
+  if ($rc -ne 'blocked') { Fail 'control B did not fire: a signature from an UNTRUSTED publisher was executed under AllSigned' }
+
+  foreach ($s in ($subjects | Where-Object { $_.Kind -eq 'ps1' })) {
+    $sig = Get-AuthenticodeSignature -LiteralPath $s.Signed
+    if ($sig.Status -ne 'Valid') { Fail "$($s.Name): Authenticode status is $($sig.Status), expected Valid"; continue }
+    # Only the production signature can carry a countersignature - the hermetic
+    # mode signs with a throwaway cert and no timestamp authority. In production
+    # this is not optional: the Trusted Signing leaf is issued for ~72 hours
+    # (measured on the live artifact: notBefore Aug 12 20:09:38, notAfter Aug 15
+    # 20:09:38), so an untimestamped signature is dead within days.
+    if ($AlreadySigned -and -not $sig.TimeStamperCertificate) {
+      Fail "$($s.Name): signed but NOT RFC3161 timestamped - the Trusted Signing leaf lives ~3 days, so this stops validating almost immediately"
+    }
+    if ($policyProbeUsable -and $s.Probeable) {
+      $r = Test-ScriptPolicyByBinding $s.Signed
+      Say ("  B  {0,-30} {1}" -f $s.Name, $r)
+      if ($r -ne 'blocked') { Fail "control B did not fire for $($s.Name): untrusted publisher was admitted ($r)" }
+    } else {
+      Say ("  B  {0,-30} Authenticode={1} timestamped={2}" -f $s.Name, $sig.Status, [bool]$sig.TimeStamperCertificate)
+    }
+  }
+
+  # =========================================================================
+  # trust the publisher - PUBLIC certificate, taken from the signed file
+  # =========================================================================
+  $signerCert = (Get-AuthenticodeSignature -LiteralPath (Join-Path $signedDir 'tb-canary.ps1')).SignerCertificate
+  if (-not $signerCert) { throw 'could not read a signer certificate off the signed canary' }
+  Say ("Trusting publisher: " + $signerCert.Subject)
+  Add-CertToStore -Cert $signerCert -StoreName 'TrustedPublisher'
+  $addedThumbprints.Add('TrustedPublisher|' + $signerCert.Thumbprint)
+
+  # =========================================================================
+  # ASSERTION C - the shipped scripts are admitted. This is the deliverable.
+  # =========================================================================
+  Say '--- assertion C: shipped scripts under MachinePolicy=AllSigned ---'
+  $rc = Test-ScriptExecution (Join-Path $signedDir 'tb-canary.ps1')
+  Say "  C  canary EXECUTION (signed, trusted)              $rc"
+  if ($rc -ne 'allowed') { Fail 'a signed, trusted canary did not execute under AllSigned' }
+
+  foreach ($s in ($subjects | Where-Object { $_.Kind -eq 'ps1' })) {
+    if ($policyProbeUsable -and $s.Probeable) {
+      $r = Test-ScriptPolicyByBinding $s.Signed
+      Say ("  C  {0,-30} {1}  (policy gate, body not run)" -f $s.Name, $r)
+      if ($r -ne 'allowed') { Fail "$($s.Name) is STILL blocked under AllSigned after signing: $r" }
+    } else {
+      # The two inputs to PowerShell's AllSigned decision, asserted directly.
+      $sig = Get-AuthenticodeSignature -LiteralPath $s.Signed
+      $trusted = $sig.SignerCertificate -and ($sig.SignerCertificate.Thumbprint -eq $signerCert.Thumbprint)
+      Say ("  C  {0,-30} Valid={1} publisher-trusted={2}" -f $s.Name, ($sig.Status -eq 'Valid'), $trusted)
+      if ($sig.Status -ne 'Valid') { Fail "$($s.Name): Authenticode status is $($sig.Status)" }
+      if (-not $trusted) { Fail "$($s.Name): signed by a publisher other than the one proved to run under AllSigned" }
+    }
+  }
+
+
+  # =========================================================================
+  # E - is publisher trust DURABLE, or does it die with the 72-hour leaf?
+  #
+  # This is the question that decides whether "the admin trusts our publisher
+  # once" is a real enterprise story or a weekly chore. The Trusted Signing leaf
+  # is reissued about every 72 hours, so if AllSigned matches the LEAF in
+  # TrustedPublisher, every release needs a fresh trust deployment. If it accepts
+  # an issuer in the chain, one GPO covers every future release.
+  #
+  # Measured, not asserted, and not a pass/fail: it is a property of Windows, not
+  # of our code. Recorded here so the answer is a CI artifact rather than folklore.
+  # =========================================================================
+  Say '--- E: does trusting the ISSUER (not the 72h leaf) satisfy AllSigned? ---'
+  $issuer = $null
+  try {
+    $chain = New-Object Security.Cryptography.X509Certificates.X509Chain
+    $chain.ChainPolicy.RevocationMode = 'NoCheck'
+    $null = $chain.Build($signerCert)
+    if ($chain.ChainElements.Count -gt 1) { $issuer = $chain.ChainElements[1].Certificate }
+  } catch { Say "  E  could not build the certificate chain: $($_.Exception.Message)" }
+
+  if (-not $issuer) {
+    Say '  E  no issuer above the leaf (self-signed harness cert) - not measurable in this mode'
+  } else {
+    Remove-CertFromStore -Thumbprint $signerCert.Thumbprint -StoreName 'TrustedPublisher'
+    Add-CertToStore -Cert $issuer -StoreName 'TrustedPublisher'
+    $addedThumbprints.Add('TrustedPublisher|' + $issuer.Thumbprint)
+    $rIssuer = Test-ScriptExecution (Join-Path $signedDir 'tb-canary.ps1')
+    Say ("  E  issuer trusted instead of leaf: " + $issuer.Subject)
+    Say ("  E  signed canary EXECUTION with ISSUER trusted: $rIssuer")
+    if ($rIssuer -eq 'allowed') {
+      Say '  E  => publisher trust is DURABLE: one GPO deployment of the issuer covers every future release.'
+    } else {
+      Say '  E  => publisher trust binds the LEAF, which rotates about every 72 hours. A one-time trust'
+      Say '  E     deployment does NOT survive a release; an AllSigned estate needs a publisher rule that'
+      Say '  E     matches on subject (AppLocker/WDAC) or a per-release trust push.'
+    }
+    # Put the leaf back so any later assertion sees the state assertion C proved.
+    Remove-CertFromStore -Thumbprint $issuer.Thumbprint -StoreName 'TrustedPublisher'
+    Add-CertToStore -Cert $signerCert -StoreName 'TrustedPublisher'
+  }
+
+  # =========================================================================
+  # CONTROL D - tamper with a signed file, it must go back to BLOCKED
+  # =========================================================================
+  Say '--- control D: signed then tampered ---'
+  # Prepending a comment leaves the script functionally identical and still
+  # breaks the digest, so a 'blocked' here can only come from the signature.
+  $tampered = Join-Path $Work 'tampered.ps1'
+  Copy-Item -LiteralPath (Join-Path $signedDir 'tb-canary.ps1') -Destination $tampered -Force
+  $t = [IO.File]::ReadAllText($tampered)
+  [IO.File]::WriteAllText($tampered, ("# tampered`r`n" + $t), (New-Object System.Text.UTF8Encoding($false)))
+  $r = Test-ScriptExecution $tampered
+  Say "  D  tampered canary EXECUTION        $r"
+  if ($r -ne 'blocked') { Fail "control D did not fire: a TAMPERED signed script ran under AllSigned ($r)" }
+
+  # =========================================================================
+  # VBScript - a different gate (WSH TrustPolicy), same shape
+  # =========================================================================
+  if ($VbsPath.Count -gt 0 -or (Test-Path -LiteralPath (Join-Path $signedDir 'tb-canary.vbs'))) {
+    Say '--- VBScript: WSH TrustPolicy=2 (run only signed, trusted scripts) ---'
+    if (-not (Test-Path $WshKey)) { New-Item -Path $WshKey -Force | Out-Null }
+    $priorTrustPolicy = Get-RegValue $WshKey 'TrustPolicy'
+    $priorUseWinSafer = Get-RegValue $WshKey 'UseWINSAFER'
+    # UseWINSAFER=1 makes WSH defer to software restriction policy and IGNORE
+    # TrustPolicy entirely - the exact way this probe could silently measure
+    # nothing.
+    Set-ItemProperty -Path $WshKey -Name 'UseWINSAFER' -Value 0 -Type DWord
+    Set-ItemProperty -Path $WshKey -Name 'TrustPolicy' -Value 2 -Type DWord
+
+    $rv = Test-VbsExecution (Join-Path $unsignedDir 'tb-canary.vbs')
+    Say "  A  vbs canary EXECUTION (unsigned) $rv"
+    if ($rv -ne 'blocked') { Fail 'VACUOUS: an unsigned .vbs executed under WSH TrustPolicy=2' }
+
+    $rv = Test-VbsExecution (Join-Path $signedDir 'tb-canary.vbs')
+    Say "  C  vbs canary EXECUTION (signed)   $rv"
+    if ($rv -ne 'allowed') { Fail 'a signed, trusted .vbs did not execute under WSH TrustPolicy=2' }
+
+    foreach ($s in ($subjects | Where-Object { $_.Kind -eq 'vbs' })) {
+      $sig = Get-AuthenticodeSignature -LiteralPath $s.Signed
+      Say ("  C  {0,-30} Authenticode={1}" -f $s.Name, $sig.Status)
+      if ($sig.Status -ne 'Valid') { Fail "$($s.Name): Authenticode status is $($sig.Status), expected Valid" }
+    }
+  }
+
+  # =========================================================================
+  # .cmd - measured, not assumed
+  # =========================================================================
+  if ($CmdPath.Count -gt 0) {
+    Say '--- .cmd: no Authenticode SIP, and no execution policy to block it ---'
+    $probeCmd = Join-Path $Work 'tb-canary.cmd'
+    [IO.File]::WriteAllText($probeCmd, "@echo off`r`n> %1 echo ran`r`n", (New-Object System.Text.ASCIIEncoding))
+    $signable = 'no'
+    try {
+      $c = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert -ErrorAction SilentlyContinue | Select-Object -First 1
+      if ($c) {
+        $res = Set-AuthenticodeSignature -FilePath $probeCmd -Certificate $c -ErrorAction Stop
+        if ($res.Status -eq 'Valid') { $signable = 'YES' }
+      } else { $signable = 'not-attempted(no local cert)' }
+    } catch { $signable = 'no (' + $_.Exception.Message.Split([char]10)[0].Trim() + ')' }
+    Say "  .cmd Authenticode signable: $signable"
+
+    $rcmd = Test-CmdExecution $probeCmd
+    Say "  .cmd EXECUTION under MachinePolicy=AllSigned: $rcmd"
+    if ($rcmd -ne 'allowed') {
+      Fail 'unexpected: a .cmd was blocked under AllSigned - the runbook claim that AllSigned does not gate batch files is wrong'
+    }
+    foreach ($p in $CmdPath) {
+      Say ("  .cmd shipped, unsignable by design: " + (Split-Path -Leaf $p))
+    }
+  }
+
+} finally {
+  # Restore both policies. Ephemeral CI does not need this; a developer box does.
+  try {
+    if ($hadPolicyKey) {
+      if ($null -ne $priorPolicy) { Set-ItemProperty -Path $PolicyKey -Name 'ExecutionPolicy' -Value $priorPolicy -Type String }
+      else { Remove-ItemProperty -Path $PolicyKey -Name 'ExecutionPolicy' -ErrorAction SilentlyContinue }
+      if ($null -ne $priorEnableScripts) { Set-ItemProperty -Path $PolicyKey -Name 'EnableScripts' -Value $priorEnableScripts -Type DWord }
+      else { Remove-ItemProperty -Path $PolicyKey -Name 'EnableScripts' -ErrorAction SilentlyContinue }
+    } else {
+      Remove-Item -Path $PolicyKey -Recurse -Force -ErrorAction SilentlyContinue
+    }
+    if ($null -ne $priorTrustPolicy) { Set-ItemProperty -Path $WshKey -Name 'TrustPolicy' -Value $priorTrustPolicy -Type DWord -ErrorAction SilentlyContinue }
+    elseif (Test-Path $WshKey) { Remove-ItemProperty -Path $WshKey -Name 'TrustPolicy' -ErrorAction SilentlyContinue }
+    if ($null -ne $priorUseWinSafer) { Set-ItemProperty -Path $WshKey -Name 'UseWINSAFER' -Value $priorUseWinSafer -Type DWord -ErrorAction SilentlyContinue }
+    elseif (Test-Path $WshKey) { Remove-ItemProperty -Path $WshKey -Name 'UseWINSAFER' -ErrorAction SilentlyContinue }
+    foreach ($entry in $addedThumbprints) {
+      $parts = $entry.Split('|')
+      Remove-CertFromStore -Thumbprint $parts[1] -StoreName $parts[0]
+    }
+  } catch {
+    Write-Host "[allsigned] cleanup warning: $($_.Exception.Message)" -ForegroundColor Yellow
+  }
+  Remove-Item -Recurse -Force $Work -ErrorAction SilentlyContinue
+}
+
+if ($failures.Count -gt 0) {
+  Write-Host ''
+  Write-Host "[allsigned] $($failures.Count) failure(s):" -ForegroundColor Red
+  foreach ($f in $failures) { Write-Host "  - $f" -ForegroundColor Red }
+  exit 1
+}
+
+Say 'PASSED - unsigned is blocked, untrusted-publisher is blocked, tampered is blocked, and every shipped script is admitted.'
+exit 0

package/deploy/windows/register-litertlm-task.ps1

@@ -1,7 +1,7 @@
 <#
-  register-litertlm-task.ps1 — register the per-user Scheduled Task that runs the
+  register-litertlm-task.ps1 - register the per-user Scheduled Task that runs the
   LiteRT-LM on-device VLM server (Gemma 4 E2B) at logon, with crash-restart.
-  Per-user + Interactive logon type → NO admin/UAC (mirrors the macOS
+  Per-user + Interactive logon type -> NO admin/UAC (mirrors the macOS
   com.trillboards.litertlm LaunchAgent: KeepAlive=true + ThrottleInterval=30).
   The connector's LiteRtVlmProvider talks to the OpenAI-compatible endpoint on
   127.0.0.1:<Port>. Invoked by setup-litertlm.ps1.
@@ -14,7 +14,7 @@ $ErrorActionPreference = "Stop"
 
 $TaskName = "TrillboardsLiteRtLm"
 $UserId = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
-# litert-lm serve --host 127.0.0.1 --port <port>  (loopback only — the connector
+# litert-lm serve --host 127.0.0.1 --port <port>  (loopback only - the connector
 # is local; never expose the model server off-box).
 $argument = 'serve --host 127.0.0.1 --port ' + $Port
 $Action  = New-ScheduledTaskAction  -Execute $LitertLmPath -Argument $argument

package/deploy/windows/register-task.ps1

@@ -1,5 +1,5 @@
 <#
-  register-task.ps1 — register the per-user Scheduled Task that runs the
+  register-task.ps1 - register the per-user Scheduled Task that runs the
   Trillboards local-first connector at logon (with crash-restart). Per-user +
   Interactive logon type so NO admin/UAC is required (mirrors the home-domain,
   no-sudo macOS LaunchAgent). Invoked by the NSIS installer post-copy.
@@ -25,7 +25,7 @@ $Action = New-ScheduledTaskAction -Execute $wscript -Argument $argument -Working
 $Trigger = New-ScheduledTaskTrigger -AtLogOn -User $UserId
 $Settings = New-ScheduledTaskSettingsSet -RestartCount 99 -RestartInterval (New-TimeSpan -Minutes 1) `
   -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable `
-  -ExecutionTimeLimit ([TimeSpan]::Zero)   # no time limit — sensing runs continuously
+  -ExecutionTimeLimit ([TimeSpan]::Zero)   # no time limit - sensing runs continuously
 $Principal = New-ScheduledTaskPrincipal -UserId $UserId -LogonType Interactive -RunLevel Limited
 
 Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false -ErrorAction SilentlyContinue
@@ -33,7 +33,7 @@ Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Se
   -Principal $Principal -Description "Trillboards Edge - CCTV $Mode connector" | Out-Null
 
 # VERIFY the registration landed instead of trusting Register-ScheduledTask's
-# silence — a silently-missing task is exactly how a real 16-camera install
+# silence - a silently-missing task is exactly how a real 16-camera install
 # ended up paired with zero frames (the pairing helper then claimed success).
 # Callers (installer.nsi, trillboards-pair.cmd's self-repair) branch on our
 # exit code, so fail LOUDLY here.

package/deploy/windows/stop-existing.ps1

@@ -15,7 +15,7 @@ $rootPrefix = $root + '\'
 # DISABLE BEFORE STOP. register-task.ps1 registers the task with
 # `-RestartCount 99 -RestartInterval 1 minute`, so Stop-ScheduledTask ends the
 # instance as a FAILURE and Task Scheduler relaunches node.exe about a minute
-# later — right inside the installer's bin\ + lib\ move. That is the "reinstall
+# later - right inside the installer's bin\ + lib\ move. That is the "reinstall
 # hit a locked node.exe" the field test saw. Disabling suppresses the restart
 # AND the AtLogOn trigger for the whole swap window; install-update.ps1 owns
 # re-enabling it on every exit path, and the uninstaller deletes the task.
@@ -25,7 +25,7 @@ Start-Sleep -Milliseconds 750
 
 function Get-TrillboardsEdgeProcesses {
   # The process that actually holds bin\node.exe open is node.exe itself, and
-  # its command line names NONE of these scripts — it names the cli.js entry.
+  # its command line names NONE of these scripts - it names the cli.js entry.
   # Win32_Process.ExecutablePath is empty across a 32/64-bit boundary, and then
   # the marker list is the only matcher left, so it has to cover the runtime.
   $markers = @(

package/deploy/windows/trillboards-hidden-run.vbs

@@ -1,10 +1,10 @@
 Option Explicit
 
-' trillboards-hidden-run.vbs — run a command with NO console window, ever.
+' trillboards-hidden-run.vbs - run a command with NO console window, ever.
 '
 ' cmd's `start "" prog.exe` allocates a NEW console (conhost) for the child
 ' BEFORE the child can hide itself, so `powershell.exe -WindowStyle Hidden`
-' still flashes — and on a slow logon it is a black window the customer sees
+' still flashes - and on a slow logon it is a black window the customer sees
 ' and closes. wscript.exe is a GUI-subsystem host: WScript.Shell.Run with
 ' window style 0 (SW_HIDE) creates the process with a hidden console from the
 ' very first instruction. This is the same mechanism trillboards-edge-task.vbs
@@ -19,7 +19,7 @@ Option Explicit
 Dim shell, index, command, argument
 
 If WScript.Arguments.Count < 1 Then
-  ' Nothing to run. Exit quietly — a hidden helper must never pop a dialog.
+  ' Nothing to run. Exit quietly - a hidden helper must never pop a dialog.
   WScript.Quit 2
 End If
 

package/deploy/windows/trillboards-setup.ps1

@@ -290,8 +290,8 @@ function Stop-SetupProcess {
 function Resume-BackgroundSensing {
   # The wizard is the ONE window a customer can see, and closing it
   # taskkill /T /F's the whole pairing tree. If that happens between "config
-  # written" and "scheduled task started" — or during an upgrade, while
-  # stop-existing.ps1 has the task disabled — sensing would stay down with
+  # written" and "scheduled task started" - or during an upgrade, while
+  # stop-existing.ps1 has the task disabled - sensing would stay down with
   # nothing to retry it. Closing a window must never be what stops sensing.
   $installDir = Split-Path -Parent $BinDir
   $ensure = Join-Path $BinDir 'ensure-sensing.ps1'

package/dist/EdgeAgent.js

@@ -44,7 +44,7 @@ const edge_ads_1 = require("@trillboards/edge-ads");
 const CommandRouter_1 = require("./CommandRouter");
 const config_1 = require("./config");
 const dataDir_1 = require("./dataDir");
-const SDK_VERSION = '0.2.16';
+const SDK_VERSION = '0.2.17';
 class EdgeAgent extends events_1.EventEmitter {
     constructor(config, deps) {
         super();

package/dist/diagnose.d.ts

@@ -21,7 +21,7 @@ export interface DiagnosticReport {
         warnings: number;
     };
 }
-declare const SDK_VERSION = "0.2.16";
+declare const SDK_VERSION = "0.2.17";
 declare function checkNodeVersion(): CheckResult;
 declare function checkPlatform(): CheckResult;
 declare function checkMemory(): CheckResult;

package/dist/diagnose.js

@@ -59,7 +59,7 @@ const modelIntegrity_1 = require("./modelIntegrity");
 // ---------------------------------------------------------------------------
 // SDK version — mirrors package.json; kept in sync by CI
 // ---------------------------------------------------------------------------
-const SDK_VERSION = '0.2.16';
+const SDK_VERSION = '0.2.17';
 exports._SDK_VERSION = SDK_VERSION;
 // ---------------------------------------------------------------------------
 // ANSI helpers (no external deps)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trillboards/edge-sdk",
-  "version": "0.2.16",
+  "version": "0.2.17",
   "description": "Composable cross-platform Edge AI SDK for audience sensing on DOOH/CTV devices",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",