@trillboards/edge-sdk 0.2.16 → 0.2.18

package/deploy/windows/ci/verify-allsigned-enforcement.ps1

@@ -0,0 +1,608 @@
+<#
+.SYNOPSIS
+  Prove, on a real Windows host, that the shipped scripts survive a machine-wide
+  `AllSigned` policy - and prove the assertion FAILS against unsigned scripts
+  first, so a green result cannot mean "the policy never applied".
+
+.DESCRIPTION
+  The product's runtime invocation sites all pass `-ExecutionPolicy Bypass`.
+  That sets only the *Process* scope, and PowerShell resolves policy
+  MachinePolicy > UserPolicy > Process > CurrentUser > LocalMachine - so a GPO
+  of `AllSigned` (routine on a managed corporate estate) overrides every one of
+  them. This script sets that GPO for real (HKLM\SOFTWARE\Policies\...) and
+  measures what happens.
+
+  It is built the way the desktop-less window probe should have been built (see
+  .claude/lessons/2026-08-14-a-hosted-windows-runner-has-no-desktop-...md): every
+  positive assertion is paired with a control that MUST fire. Four controls:
+
+    A  unsigned            -> must be BLOCKED   (policy is really in force)
+    B  signed, publisher untrusted -> must be BLOCKED   (we measure trust, not bytes)
+    C  signed + publisher trusted  -> must be ALLOWED   <- the deliverable
+    D  signed then tampered        -> must be BLOCKED   (we measure THIS signature)
+
+  If A, B or D does not fire, the harness reports VACUOUS and exits non-zero.
+  A pass therefore cannot be produced by a policy that failed to apply, by a
+  cert store that trusts everything, or by a gate that ignores the signature.
+
+  Shipped scripts are probed WITHOUT executing them. Their bodies stop scheduled
+  tasks and move install trees, so the probe invokes each one with an unknown
+  named parameter: PowerShell checks the execution policy when it LOADS the file,
+  before it binds parameters, so a [CmdletBinding()] script gives up the gate's
+  verdict and then dies on a binding error with its body never entered. Two of
+  the shipped scripts do not declare [CmdletBinding()] - an unknown argument
+  would fall through to positional binding and RUN them - so those assert the two
+  inputs to the same decision instead (signature Valid, publisher trusted).
+  Which route each file took is printed, never inferred.
+
+  NB `(Get-Command <path> -CommandType ExternalScript).ScriptBlock` looks like it
+  should work and does NOT: command discovery does not run the policy check, and
+  it reports 'allowed' for a file the policy really blocks. Measured, not
+  assumed - the probe validates itself against the unsigned canary before it is
+  trusted on anything.
+
+  Execution itself is proven on canaries carrying the IDENTICAL signature
+  provenance (in -AlreadySigned mode the canaries are signed by the production
+  certificate in the same signing call as the shipped files).
+
+.PARAMETER ScriptPath      Shipped .ps1 files to prove.
+.PARAMETER VbsPath         Shipped .vbs files to prove.
+.PARAMETER CmdPath         Shipped .cmd files. Recorded, not gated - see below.
+.PARAMETER CanaryPs1       An already-signed .ps1 that is safe to EXECUTE.
+.PARAMETER CanaryVbs       An already-signed .vbs that is safe to EXECUTE.
+.PARAMETER SelfSign        Hermetic mode: mint a throwaway code-signing cert and
+                           sign COPIES of the inputs. Used by the per-PR lane,
+                           where no Azure Trusted Signing credential exists.
+.PARAMETER AlreadySigned   Release mode: the inputs are already Authenticode
+                           signed (by Azure Trusted Signing) and are proved
+                           as-is, with the unsigned control derived by stripping
+                           the signature block from a copy.
+
+.NOTES
+  .cmd/.bat have no Authenticode SIP and cmd.exe has no execution policy, so a
+  batch file can be neither signed nor blocked by AllSigned. This harness proves
+  that rather than assuming it, so the claim in the runbook stays measured.
+#>
+[CmdletBinding()]
+param(
+  [string[]]$ScriptPath = @(),
+  [string[]]$VbsPath = @(),
+  [string[]]$CmdPath = @(),
+  [string]$CanaryPs1 = "",
+  [string]$CanaryVbs = "",
+  [switch]$SelfSign,
+  [switch]$AlreadySigned
+)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+
+if (-not ($SelfSign -xor $AlreadySigned)) {
+  Write-Error 'Choose exactly one of -SelfSign or -AlreadySigned.'
+  exit 2
+}
+
+$PolicyKey = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell'
+$WshKey = 'HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings'
+$Work = Join-Path ([IO.Path]::GetTempPath()) ("tb-allsigned-" + [Guid]::NewGuid().ToString('N').Substring(0, 8))
+$failures = New-Object System.Collections.Generic.List[string]
+$addedThumbprints = New-Object System.Collections.Generic.List[string]
+
+function Say($m) { Write-Host "[allsigned] $m" }
+function Fail($m) { $script:failures.Add($m); Write-Host "[allsigned] FAIL: $m" -ForegroundColor Red }
+
+# ---------------------------------------------------------------------------
+# Signature-block handling. Both PowerShell and WSH append the Authenticode
+# blob as trailing COMMENT lines, so an unsigned twin is the file up to the
+# begin marker. Byte-exact on the retained prefix, which is what lets the
+# "content unchanged by signing" assertion below be meaningful.
+# ---------------------------------------------------------------------------
+# The comment prefix differs per SIP - PowerShell writes
+# `# SIG # Begin signature block` and WSH writes `'' SIG '' Begin signature
+# block` - so cut on the part they SHARE and walk back to the start of that
+# line. Hardcoding either prefix silently fails to strip the other, and a
+# "unsigned" control that is still signed does not fire, which is the one
+# outcome this harness must never produce.
+function Copy-WithoutSignature([string]$Source, [string]$Destination) {
+  $text = [IO.File]::ReadAllText($Source)
+  $idx = $text.IndexOf('Begin signature block', [StringComparison]::Ordinal)
+  $found = ($idx -ge 0)
+  if ($found) {
+    $lineStart = $text.LastIndexOf("`n", $idx)
+    $cut = if ($lineStart -ge 0) { $lineStart + 1 } else { 0 }
+    $text = $text.Substring(0, $cut)
+  }
+  [IO.File]::WriteAllText($Destination, $text, (New-Object System.Text.UTF8Encoding($false)))
+  return $found
+}
+
+# ---------------------------------------------------------------------------
+# The gate probes.
+# ---------------------------------------------------------------------------
+
+# PS 5.1 turns any stderr from a NATIVE command into an ErrorRecord, and with
+# $ErrorActionPreference = 'Stop' that becomes terminating. A blocked script
+# prints "cannot be loaded" to stderr, so the harness would die the moment a
+# control fired correctly - the probes must run with Continue.
+function Invoke-Native([string]$Exe, [string[]]$Arguments) {
+  $prev = $ErrorActionPreference
+  $ErrorActionPreference = 'Continue'
+  try { & $Exe @Arguments *> $null } finally { $ErrorActionPreference = $prev }
+}
+
+# Actually EXECUTES a canary and reports whether it got to run. The canary
+# writes a marker; the marker, not the exit code, is the evidence.
+function Test-ScriptExecution([string]$Path) {
+  $marker = Join-Path $Work ("ran-" + [Guid]::NewGuid().ToString('N').Substring(0, 6) + ".txt")
+  $ps = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+  Invoke-Native $ps @('-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', $Path, '-MarkerPath', $marker)
+  if (Test-Path -LiteralPath $marker) { return 'allowed' }
+  return 'blocked'
+}
+
+function Test-VbsExecution([string]$Path) {
+  $marker = Join-Path $Work ("vbs-" + [Guid]::NewGuid().ToString('N').Substring(0, 6) + ".txt")
+  $cscript = Join-Path $env:SystemRoot 'System32\cscript.exe'
+  Invoke-Native $cscript @('//nologo', '//B', $Path, $marker)
+  if (Test-Path -LiteralPath $marker) { return 'allowed' }
+  return 'blocked'
+}
+
+function Test-CmdExecution([string]$Path) {
+  $marker = Join-Path $Work ("cmd-" + [Guid]::NewGuid().ToString('N').Substring(0, 6) + ".txt")
+  Invoke-Native $env:ComSpec @('/c', $Path, $marker)
+  if (Test-Path -LiteralPath $marker) { return 'allowed' }
+  return 'blocked'
+}
+
+# A DIRECT policy probe for scripts that declare [CmdletBinding()]: an unknown
+# named parameter is a terminating binding error, and PowerShell checks the
+# execution policy when it LOADS the file, before it binds. So the gate's verdict
+# is observable without the body ever running.
+#
+# Restricted to [CmdletBinding()] scripts on purpose. Without it, an unrecognised
+# named argument falls through to positional binding or $args and the script
+# RUNS - and two of the shipped scripts register scheduled tasks.
+function Test-ScriptPolicyByBinding([string]$Path) {
+  $probe = @'
+$out = $args[1]
+try {
+  & $args[0] -TbAllSignedProbeUnbindable
+  [IO.File]::WriteAllText($out, 'allowed')
+} catch {
+  if (($_.Exception -is [System.Management.Automation.PSSecurityException]) -or
+      ($_.FullyQualifiedErrorId -like 'UnauthorizedAccess*')) {
+    [IO.File]::WriteAllText($out, 'blocked')
+  } else {
+    [IO.File]::WriteAllText($out, 'allowed')
+  }
+}
+'@
+  $id = [Guid]::NewGuid().ToString('N').Substring(0, 8)
+  $probeFile = Join-Path $Work "bind-$id.txt"
+  $resultFile = Join-Path $Work "bindverdict-$id.txt"
+  [IO.File]::WriteAllText($probeFile, $probe, (New-Object System.Text.UTF8Encoding($false)))
+  $ps = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+  $inline = '& ([scriptblock]::Create([IO.File]::ReadAllText(''' + $probeFile + '''))) ''' + $Path + ''' ''' + $resultFile + ''''
+  Invoke-Native $ps @('-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', $inline)
+  if (-not (Test-Path -LiteralPath $resultFile)) { return 'indeterminate(no-verdict)' }
+  return ([IO.File]::ReadAllText($resultFile)).Trim()
+}
+
+function Test-DeclaresCmdletBinding([string]$Path) {
+  return ([IO.File]::ReadAllText($Path)) -match '(?m)^\s*\[CmdletBinding\(\)\]'
+}
+
+# StrictMode makes a missing property a terminating error, so registry values
+# that may not exist have to be read through the property bag.
+function Get-RegValue([string]$Key, [string]$Name) {
+  if (-not (Test-Path $Key)) { return $null }
+  $item = Get-ItemProperty -Path $Key -ErrorAction SilentlyContinue
+  if (-not $item) { return $null }
+  if ($item.PSObject.Properties.Name -notcontains $Name) { return $null }
+  return $item.$Name
+}
+
+function Add-CertToStore([Security.Cryptography.X509Certificates.X509Certificate2]$Cert, [string]$StoreName) {
+  # The PUBLIC certificate only. Nothing here reads, prints or persists a
+  # private key, a password or a token - the signing material never leaves the
+  # Trusted Signing service.
+  $store = New-Object Security.Cryptography.X509Certificates.X509Store($StoreName, 'LocalMachine')
+  $store.Open('ReadWrite')
+  $store.Add($Cert)
+  $store.Close()
+}
+
+function Remove-CertFromStore([string]$Thumbprint, [string]$StoreName) {
+  $store = New-Object Security.Cryptography.X509Certificates.X509Store($StoreName, 'LocalMachine')
+  $store.Open('ReadWrite')
+  foreach ($c in @($store.Certificates | Where-Object { $_.Thumbprint -eq $Thumbprint })) { $store.Remove($c) }
+  $store.Close()
+}
+
+# ---------------------------------------------------------------------------
+# Set up
+# ---------------------------------------------------------------------------
+New-Item -ItemType Directory -Force -Path $Work | Out-Null
+
+$priorPolicy = $null
+$priorEnableScripts = $null
+$hadPolicyKey = Test-Path $PolicyKey
+$priorTrustPolicy = $null
+$priorUseWinSafer = $null
+
+try {
+  # --- canaries -------------------------------------------------------------
+  # Committed next to this harness so both modes prove the same bytes. In
+  # -AlreadySigned mode the release workflow has already signed them in the same
+  # Trusted Signing call as the shipped scripts; in -SelfSign mode they are
+  # signed below with the throwaway certificate.
+  if (-not $CanaryPs1) { $CanaryPs1 = Join-Path $PSScriptRoot 'tb-canary.ps1' }
+  if (-not $CanaryVbs) { $CanaryVbs = Join-Path $PSScriptRoot 'tb-canary.vbs' }
+  if (-not (Test-Path -LiteralPath $CanaryPs1)) { Write-Error "canary not found: $CanaryPs1"; exit 2 }
+  if (-not (Test-Path -LiteralPath $CanaryVbs)) { Write-Error "canary not found: $CanaryVbs"; exit 2 }
+  $canaryPs1Src = Join-Path $Work 'tb-canary.ps1'
+  $canaryVbsSrc = Join-Path $Work 'tb-canary.vbs'
+  Copy-Item -LiteralPath $CanaryPs1 -Destination $canaryPs1Src -Force
+  Copy-Item -LiteralPath $CanaryVbs -Destination $canaryVbsSrc -Force
+
+  # --- assemble the signed / unsigned pairs ---------------------------------
+  $signedDir = Join-Path $Work 'signed'
+  $unsignedDir = Join-Path $Work 'unsigned'
+  New-Item -ItemType Directory -Force -Path $signedDir, $unsignedDir | Out-Null
+
+  $subjects = @()
+  foreach ($p in @($ScriptPath + $VbsPath)) {
+    if (-not (Test-Path -LiteralPath $p)) { throw "input not found: $p" }
+    $name = Split-Path -Leaf $p
+    $signed = Join-Path $signedDir $name
+    $unsigned = Join-Path $unsignedDir $name
+    Copy-Item -LiteralPath $p -Destination $signed -Force
+    $stripped = Copy-WithoutSignature -Source $p -Destination $unsigned
+    # In -AlreadySigned mode the input MUST carry a block to strip. If it does
+    # not, the "unsigned" control is not unsigned and would not fire.
+    if ($AlreadySigned -and -not $stripped) { Fail "$name : no signature block found to strip - the unsigned control would be vacuous" }
+    $subjects += [pscustomobject]@{
+      Name = $name; Signed = $signed; Unsigned = $unsigned
+      Kind = ([IO.Path]::GetExtension($p).TrimStart('.').ToLower())
+      # Only [CmdletBinding()] scripts can be probed without risking execution.
+      Probeable = (([IO.Path]::GetExtension($p) -ieq '.ps1') -and (Test-DeclaresCmdletBinding $unsigned))
+    }
+  }
+  foreach ($c in @(@{ n = 'tb-canary.ps1'; s = $canaryPs1Src }, @{ n = 'tb-canary.vbs'; s = $canaryVbsSrc })) {
+    $signed = Join-Path $signedDir $c.n
+    $unsigned = Join-Path $unsignedDir $c.n
+    Copy-Item -LiteralPath $c.s -Destination $signed -Force
+    $stripped = Copy-WithoutSignature -Source $c.s -Destination $unsigned
+    if ($AlreadySigned -and -not $stripped) { Fail "$($c.n): no signature block found to strip - the unsigned control would be vacuous" }
+  }
+
+  # --- sign (hermetic mode only) -------------------------------------------
+  if ($SelfSign) {
+    Say 'Minting a throwaway code-signing certificate (hermetic mode).'
+    $cert = New-SelfSignedCertificate -Type CodeSigningCert -Subject 'CN=Trillboards CI AllSigned Harness' `
+      -CertStoreLocation 'Cert:\CurrentUser\My' -NotAfter (Get-Date).AddDays(2)
+    $pub = New-Object Security.Cryptography.X509Certificates.X509Certificate2(, $cert.RawData)
+    # A self-signed cert must be in Root for the chain to build at all; without
+    # this its Status is UnknownError and control B would fire for the wrong
+    # reason.
+    Add-CertToStore -Cert $pub -StoreName 'Root'
+    $addedThumbprints.Add('Root|' + $pub.Thumbprint)
+    foreach ($f in @(Get-ChildItem -LiteralPath $signedDir -File)) {
+      $r = Set-AuthenticodeSignature -FilePath $f.FullName -Certificate $cert -HashAlgorithm SHA256
+      if ($r.Status -ne 'Valid') { throw "self-signing produced $($r.Status) for $($f.Name)" }
+    }
+  }
+
+  # --- what signing did to the file, measured ------------------------------
+  # The signer does NOT merely append: measured on windows-latest,
+  # Set-AuthenticodeSignature rewrites the whole file, and PS 5.1 re-emits it
+  # with a UTF-8 BOM and CRLF line endings. That is fine - it happens before
+  # packaging - but it is worth knowing, because it is the same mechanism that
+  # makes a post-signing edit so dangerous: whoever rewrites the file last wins,
+  # and the signature dies silently.
+  #
+  # So the assertion here is on the TEXT, normalised for the signer's own
+  # re-encoding. A genuine content change (mojibake from a codepage round-trip,
+  # a truncated line) still fails. The exact byte-identity claim belongs to the
+  # release lane, which compares the SHIPPED file to the SIGNED file - both
+  # post-signing, so no normalisation is needed or allowed there.
+  function Get-NormalisedText([string]$Path) {
+    $t = [IO.File]::ReadAllText($Path)
+    if ($t.Length -gt 0 -and $t[0] -eq [char]0xFEFF) { $t = $t.Substring(1) }
+    return ($t -replace "`r`n", "`n") -replace "`r", "`n"
+  }
+  foreach ($s in $subjects) {
+    $originalNoSig = Join-Path $Work ('orig-' + $s.Name)
+    $null = Copy-WithoutSignature -Source $s.Signed -Destination $originalNoSig
+    # TrimEnd: the retained prefix stops at the start of the signature block's
+    # line, so it carries one newline the original does not. That is the block's
+    # separator, not script content.
+    $before = (Get-NormalisedText $s.Unsigned).TrimEnd()
+    $after = (Get-NormalisedText $originalNoSig).TrimEnd()
+    if ($before -ne $after) {
+      Fail "$($s.Name): signing changed the script TEXT, not just encoding and the appended block"
+    }
+    $exact = ((Get-FileHash -Algorithm SHA256 -LiteralPath $s.Unsigned).Hash -eq
+              (Get-FileHash -Algorithm SHA256 -LiteralPath $originalNoSig).Hash)
+    if (-not $exact) { Say ("  note: signer re-encoded " + $s.Name + " (BOM/line endings); text is unchanged") }
+  }
+
+  # --- every signed input must be pure ASCII --------------------------------
+  # These files ship WITHOUT a BOM, so Windows PowerShell 5.1 decodes them with
+  # the machine's ANSI codepage. The Authenticode digest is taken over the
+  # DECODED text, so one non-ASCII byte makes a signature that verifies on the
+  # signing machine and fails on a customer machine in another locale. The
+  # existing guard in windowsHiddenSupervisor.test.ts covers string literals
+  # only, because that is all that breaks PARSING - comments break SIGNING.
+  foreach ($s in $subjects) {
+    $bytes = [IO.File]::ReadAllBytes($s.Unsigned)
+    if ($bytes | Where-Object { $_ -gt 127 }) {
+      Fail "$($s.Name): contains non-ASCII bytes and ships without a BOM - its signature is locale-dependent"
+    }
+  }
+
+  # --- turn the GPO on ------------------------------------------------------
+  if ($hadPolicyKey) {
+    $priorPolicy = Get-RegValue $PolicyKey 'ExecutionPolicy'
+    $priorEnableScripts = Get-RegValue $PolicyKey 'EnableScripts'
+  } else {
+    New-Item -Path $PolicyKey -Force | Out-Null
+  }
+  Set-ItemProperty -Path $PolicyKey -Name 'EnableScripts' -Value 1 -Type DWord
+  Set-ItemProperty -Path $PolicyKey -Name 'ExecutionPolicy' -Value 'AllSigned' -Type String
+
+  $ps = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+  # No embedded double quotes: the native command-line parser strips them and
+  # PowerShell then reads a bare `=` as an assignment (InvalidLeftHandSide).
+  $listed = & $ps -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command 'Get-ExecutionPolicy -List | Out-String'
+  Say ("Scopes seen by a child with -ExecutionPolicy Bypass:`r`n" + ((@($listed) -join [Environment]::NewLine).Trim()))
+  $effective = ((& $ps -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command 'Get-ExecutionPolicy') | Out-String).Trim()
+  Say "Effective policy inside -ExecutionPolicy Bypass: $effective"
+  if ($effective -ne 'AllSigned') {
+    Fail "MachinePolicy did not take effect (effective policy is '$effective') - every result below would be meaningless"
+    throw 'VACUOUS: the AllSigned machine policy did not apply.'
+  }
+
+  # =========================================================================
+  # CONTROL A - unsigned must be BLOCKED
+  #
+  # The canary is EXECUTED (`powershell -File`), which is unambiguously
+  # policy-checked; that result is mandatory. The non-executing Get-Command
+  # probe used on the shipped scripts is validated against the same unsigned
+  # canary first: if it does not report 'blocked' there, the technique does not
+  # observe the gate and the shipped-file assertions fall back to the
+  # signature + trusted-publisher decision PowerShell itself makes. Which mode
+  # was used is printed, never inferred.
+  # =========================================================================
+  Say '--- control A: unsigned under MachinePolicy=AllSigned ---'
+  $canaryUnsignedPs1 = Join-Path $unsignedDir 'tb-canary.ps1'
+  $rc = Test-ScriptExecution $canaryUnsignedPs1
+  Say "  A  canary EXECUTION (unsigned)      $rc"
+  if ($rc -ne 'blocked') { Fail 'VACUOUS: an unsigned canary EXECUTED under MachinePolicy=AllSigned' }
+
+  # Validate the non-executing probe against that same unsigned canary before
+  # trusting it on the shipped scripts. Measured on windows-latest, the
+  # Get-Command/.ScriptBlock route reports 'allowed' for a file the policy really
+  # does block - command discovery does NOT run the policy check - so it is not
+  # used. The unbindable-parameter route does observe the gate.
+  $probeOnCanary = Test-ScriptPolicyByBinding $canaryUnsignedPs1
+  $policyProbeUsable = ($probeOnCanary -eq 'blocked')
+  Say ("  A  non-executing probe on the same unsigned canary: $probeOnCanary" +
+    $(if ($policyProbeUsable) { '  -> probe IS gated; shipped scripts get the direct assertion' }
+      else { '  -> probe is NOT gated; shipped scripts fall back to the signature/trust decision' }))
+
+  foreach ($s in ($subjects | Where-Object { $_.Kind -eq 'ps1' })) {
+    if (-not ($policyProbeUsable -and $s.Probeable)) { continue }
+    $r = Test-ScriptPolicyByBinding $s.Unsigned
+    Say ("  A  {0,-30} {1}" -f $s.Name, $r)
+    if ($r -ne 'blocked') { Fail "control A did not fire for $($s.Name): $r" }
+  }
+
+  # =========================================================================
+  # CONTROL B - signed but publisher not trusted must be BLOCKED
+  # =========================================================================
+  Say '--- control B: signed, publisher NOT yet in TrustedPublisher ---'
+  $rc = Test-ScriptExecution (Join-Path $signedDir 'tb-canary.ps1')
+  Say "  B  canary EXECUTION (signed, untrusted publisher)  $rc"
+  if ($rc -ne 'blocked') { Fail 'control B did not fire: a signature from an UNTRUSTED publisher was executed under AllSigned' }
+
+  foreach ($s in ($subjects | Where-Object { $_.Kind -eq 'ps1' })) {
+    $sig = Get-AuthenticodeSignature -LiteralPath $s.Signed
+    if ($sig.Status -ne 'Valid') { Fail "$($s.Name): Authenticode status is $($sig.Status), expected Valid"; continue }
+    # Only the production signature can carry a countersignature - the hermetic
+    # mode signs with a throwaway cert and no timestamp authority. In production
+    # this is not optional: the Trusted Signing leaf is issued for ~72 hours
+    # (measured on the live artifact: notBefore Aug 12 20:09:38, notAfter Aug 15
+    # 20:09:38), so an untimestamped signature is dead within days.
+    if ($AlreadySigned -and -not $sig.TimeStamperCertificate) {
+      Fail "$($s.Name): signed but NOT RFC3161 timestamped - the Trusted Signing leaf lives ~3 days, so this stops validating almost immediately"
+    }
+    if ($policyProbeUsable -and $s.Probeable) {
+      $r = Test-ScriptPolicyByBinding $s.Signed
+      Say ("  B  {0,-30} {1}" -f $s.Name, $r)
+      if ($r -ne 'blocked') { Fail "control B did not fire for $($s.Name): untrusted publisher was admitted ($r)" }
+    } else {
+      Say ("  B  {0,-30} Authenticode={1} timestamped={2}" -f $s.Name, $sig.Status, [bool]$sig.TimeStamperCertificate)
+    }
+  }
+
+  # =========================================================================
+  # trust the publisher - PUBLIC certificate, taken from the signed file
+  # =========================================================================
+  $signerCert = (Get-AuthenticodeSignature -LiteralPath (Join-Path $signedDir 'tb-canary.ps1')).SignerCertificate
+  if (-not $signerCert) { throw 'could not read a signer certificate off the signed canary' }
+  Say ("Trusting publisher: " + $signerCert.Subject)
+  Add-CertToStore -Cert $signerCert -StoreName 'TrustedPublisher'
+  $addedThumbprints.Add('TrustedPublisher|' + $signerCert.Thumbprint)
+
+  # =========================================================================
+  # ASSERTION C - the shipped scripts are admitted. This is the deliverable.
+  # =========================================================================
+  Say '--- assertion C: shipped scripts under MachinePolicy=AllSigned ---'
+  $rc = Test-ScriptExecution (Join-Path $signedDir 'tb-canary.ps1')
+  Say "  C  canary EXECUTION (signed, trusted)              $rc"
+  if ($rc -ne 'allowed') { Fail 'a signed, trusted canary did not execute under AllSigned' }
+
+  foreach ($s in ($subjects | Where-Object { $_.Kind -eq 'ps1' })) {
+    if ($policyProbeUsable -and $s.Probeable) {
+      $r = Test-ScriptPolicyByBinding $s.Signed
+      Say ("  C  {0,-30} {1}  (policy gate, body not run)" -f $s.Name, $r)
+      if ($r -ne 'allowed') { Fail "$($s.Name) is STILL blocked under AllSigned after signing: $r" }
+    } else {
+      # The two inputs to PowerShell's AllSigned decision, asserted directly.
+      $sig = Get-AuthenticodeSignature -LiteralPath $s.Signed
+      $trusted = $sig.SignerCertificate -and ($sig.SignerCertificate.Thumbprint -eq $signerCert.Thumbprint)
+      Say ("  C  {0,-30} Valid={1} publisher-trusted={2}" -f $s.Name, ($sig.Status -eq 'Valid'), $trusted)
+      if ($sig.Status -ne 'Valid') { Fail "$($s.Name): Authenticode status is $($sig.Status)" }
+      if (-not $trusted) { Fail "$($s.Name): signed by a publisher other than the one proved to run under AllSigned" }
+    }
+  }
+
+
+  # =========================================================================
+  # E - is publisher trust DURABLE, or does it die with the 72-hour leaf?
+  #
+  # This is the question that decides whether "the admin trusts our publisher
+  # once" is a real enterprise story or a weekly chore. The Trusted Signing leaf
+  # is reissued about every 72 hours, so if AllSigned matches the LEAF in
+  # TrustedPublisher, every release needs a fresh trust deployment. If it accepts
+  # an issuer in the chain, one GPO covers every future release.
+  #
+  # Measured, not asserted, and not a pass/fail: it is a property of Windows, not
+  # of our code. Recorded here so the answer is a CI artifact rather than folklore.
+  # =========================================================================
+  Say '--- E: does trusting the ISSUER (not the 72h leaf) satisfy AllSigned? ---'
+  $issuer = $null
+  try {
+    $chain = New-Object Security.Cryptography.X509Certificates.X509Chain
+    $chain.ChainPolicy.RevocationMode = 'NoCheck'
+    $null = $chain.Build($signerCert)
+    if ($chain.ChainElements.Count -gt 1) { $issuer = $chain.ChainElements[1].Certificate }
+  } catch { Say "  E  could not build the certificate chain: $($_.Exception.Message)" }
+
+  if (-not $issuer) {
+    Say '  E  no issuer above the leaf (self-signed harness cert) - not measurable in this mode'
+  } else {
+    Remove-CertFromStore -Thumbprint $signerCert.Thumbprint -StoreName 'TrustedPublisher'
+    Add-CertToStore -Cert $issuer -StoreName 'TrustedPublisher'
+    $addedThumbprints.Add('TrustedPublisher|' + $issuer.Thumbprint)
+    $rIssuer = Test-ScriptExecution (Join-Path $signedDir 'tb-canary.ps1')
+    Say ("  E  issuer trusted instead of leaf: " + $issuer.Subject)
+    Say ("  E  signed canary EXECUTION with ISSUER trusted: $rIssuer")
+    if ($rIssuer -eq 'allowed') {
+      Say '  E  => publisher trust is DURABLE: one GPO deployment of the issuer covers every future release.'
+    } else {
+      Say '  E  => publisher trust binds the LEAF, which rotates about every 72 hours. A one-time trust'
+      Say '  E     deployment does NOT survive a release; an AllSigned estate needs a publisher rule that'
+      Say '  E     matches on subject (AppLocker/WDAC) or a per-release trust push.'
+    }
+    # Put the leaf back so any later assertion sees the state assertion C proved.
+    Remove-CertFromStore -Thumbprint $issuer.Thumbprint -StoreName 'TrustedPublisher'
+    Add-CertToStore -Cert $signerCert -StoreName 'TrustedPublisher'
+  }
+
+  # =========================================================================
+  # CONTROL D - tamper with a signed file, it must go back to BLOCKED
+  # =========================================================================
+  Say '--- control D: signed then tampered ---'
+  # Prepending a comment leaves the script functionally identical and still
+  # breaks the digest, so a 'blocked' here can only come from the signature.
+  $tampered = Join-Path $Work 'tampered.ps1'
+  Copy-Item -LiteralPath (Join-Path $signedDir 'tb-canary.ps1') -Destination $tampered -Force
+  $t = [IO.File]::ReadAllText($tampered)
+  [IO.File]::WriteAllText($tampered, ("# tampered`r`n" + $t), (New-Object System.Text.UTF8Encoding($false)))
+  $r = Test-ScriptExecution $tampered
+  Say "  D  tampered canary EXECUTION        $r"
+  if ($r -ne 'blocked') { Fail "control D did not fire: a TAMPERED signed script ran under AllSigned ($r)" }
+
+  # =========================================================================
+  # VBScript - a different gate (WSH TrustPolicy), same shape
+  # =========================================================================
+  if ($VbsPath.Count -gt 0 -or (Test-Path -LiteralPath (Join-Path $signedDir 'tb-canary.vbs'))) {
+    Say '--- VBScript: WSH TrustPolicy=2 (run only signed, trusted scripts) ---'
+    if (-not (Test-Path $WshKey)) { New-Item -Path $WshKey -Force | Out-Null }
+    $priorTrustPolicy = Get-RegValue $WshKey 'TrustPolicy'
+    $priorUseWinSafer = Get-RegValue $WshKey 'UseWINSAFER'
+    # UseWINSAFER=1 makes WSH defer to software restriction policy and IGNORE
+    # TrustPolicy entirely - the exact way this probe could silently measure
+    # nothing.
+    Set-ItemProperty -Path $WshKey -Name 'UseWINSAFER' -Value 0 -Type DWord
+    Set-ItemProperty -Path $WshKey -Name 'TrustPolicy' -Value 2 -Type DWord
+
+    $rv = Test-VbsExecution (Join-Path $unsignedDir 'tb-canary.vbs')
+    Say "  A  vbs canary EXECUTION (unsigned) $rv"
+    if ($rv -ne 'blocked') { Fail 'VACUOUS: an unsigned .vbs executed under WSH TrustPolicy=2' }
+
+    $rv = Test-VbsExecution (Join-Path $signedDir 'tb-canary.vbs')
+    Say "  C  vbs canary EXECUTION (signed)   $rv"
+    if ($rv -ne 'allowed') { Fail 'a signed, trusted .vbs did not execute under WSH TrustPolicy=2' }
+
+    foreach ($s in ($subjects | Where-Object { $_.Kind -eq 'vbs' })) {
+      $sig = Get-AuthenticodeSignature -LiteralPath $s.Signed
+      Say ("  C  {0,-30} Authenticode={1}" -f $s.Name, $sig.Status)
+      if ($sig.Status -ne 'Valid') { Fail "$($s.Name): Authenticode status is $($sig.Status), expected Valid" }
+    }
+  }
+
+  # =========================================================================
+  # .cmd - measured, not assumed
+  # =========================================================================
+  if ($CmdPath.Count -gt 0) {
+    Say '--- .cmd: no Authenticode SIP, and no execution policy to block it ---'
+    $probeCmd = Join-Path $Work 'tb-canary.cmd'
+    [IO.File]::WriteAllText($probeCmd, "@echo off`r`n> %1 echo ran`r`n", (New-Object System.Text.ASCIIEncoding))
+    $signable = 'no'
+    try {
+      $c = Get-ChildItem Cert:\CurrentUser\My -CodeSigningCert -ErrorAction SilentlyContinue | Select-Object -First 1
+      if ($c) {
+        $res = Set-AuthenticodeSignature -FilePath $probeCmd -Certificate $c -ErrorAction Stop
+        if ($res.Status -eq 'Valid') { $signable = 'YES' }
+      } else { $signable = 'not-attempted(no local cert)' }
+    } catch { $signable = 'no (' + $_.Exception.Message.Split([char]10)[0].Trim() + ')' }
+    Say "  .cmd Authenticode signable: $signable"
+
+    $rcmd = Test-CmdExecution $probeCmd
+    Say "  .cmd EXECUTION under MachinePolicy=AllSigned: $rcmd"
+    if ($rcmd -ne 'allowed') {
+      Fail 'unexpected: a .cmd was blocked under AllSigned - the runbook claim that AllSigned does not gate batch files is wrong'
+    }
+    foreach ($p in $CmdPath) {
+      Say ("  .cmd shipped, unsignable by design: " + (Split-Path -Leaf $p))
+    }
+  }
+
+} finally {
+  # Restore both policies. Ephemeral CI does not need this; a developer box does.
+  try {
+    if ($hadPolicyKey) {
+      if ($null -ne $priorPolicy) { Set-ItemProperty -Path $PolicyKey -Name 'ExecutionPolicy' -Value $priorPolicy -Type String }
+      else { Remove-ItemProperty -Path $PolicyKey -Name 'ExecutionPolicy' -ErrorAction SilentlyContinue }
+      if ($null -ne $priorEnableScripts) { Set-ItemProperty -Path $PolicyKey -Name 'EnableScripts' -Value $priorEnableScripts -Type DWord }
+      else { Remove-ItemProperty -Path $PolicyKey -Name 'EnableScripts' -ErrorAction SilentlyContinue }
+    } else {
+      Remove-Item -Path $PolicyKey -Recurse -Force -ErrorAction SilentlyContinue
+    }
+    if ($null -ne $priorTrustPolicy) { Set-ItemProperty -Path $WshKey -Name 'TrustPolicy' -Value $priorTrustPolicy -Type DWord -ErrorAction SilentlyContinue }
+    elseif (Test-Path $WshKey) { Remove-ItemProperty -Path $WshKey -Name 'TrustPolicy' -ErrorAction SilentlyContinue }
+    if ($null -ne $priorUseWinSafer) { Set-ItemProperty -Path $WshKey -Name 'UseWINSAFER' -Value $priorUseWinSafer -Type DWord -ErrorAction SilentlyContinue }
+    elseif (Test-Path $WshKey) { Remove-ItemProperty -Path $WshKey -Name 'UseWINSAFER' -ErrorAction SilentlyContinue }
+    foreach ($entry in $addedThumbprints) {
+      $parts = $entry.Split('|')
+      Remove-CertFromStore -Thumbprint $parts[1] -StoreName $parts[0]
+    }
+  } catch {
+    Write-Host "[allsigned] cleanup warning: $($_.Exception.Message)" -ForegroundColor Yellow
+  }
+  Remove-Item -Recurse -Force $Work -ErrorAction SilentlyContinue
+}
+
+if ($failures.Count -gt 0) {
+  Write-Host ''
+  Write-Host "[allsigned] $($failures.Count) failure(s):" -ForegroundColor Red
+  foreach ($f in $failures) { Write-Host "  - $f" -ForegroundColor Red }
+  exit 1
+}
+
+Say 'PASSED - unsigned is blocked, untrusted-publisher is blocked, tampered is blocked, and every shipped script is admitted.'
+exit 0