@trillboards/edge-sdk 0.2.19 → 0.2.21

package/deploy/windows/ci/verify-update-applier.ps1

@@ -0,0 +1,621 @@
+<#
+.SYNOPSIS
+  verify-update-applier.ps1 - prove apply-update.ps1 REFUSES every payload it
+  should refuse, and accepts the one it should.
+
+.DESCRIPTION
+  An updater that installs an unverified payload is a remote-code-execution
+  channel into every customer's store, so the assertions that matter here are
+  the negative ones. EVERY negative arm is paired with a control that must
+  behave differently, because an assertion that would also hold if the code did
+  nothing proves nothing.
+
+  That is not ceremony. Three probes written for this connector in one week
+  passed on hardware incapable of observing the property they asserted: a window
+  probe on a runner with no desktop, an AllSigned control that was itself
+  signed, and a policy test where the policy never applied. Arm A below is the
+  shared control for all of them - if the happy path does not stage, every
+  refusal is indistinguishable from a broken harness, and this script says so
+  and exits non-zero rather than reporting green.
+
+  Everything is served over a real HTTP listener on 127.0.0.1, so the download,
+  the size check and the hash check run against actual wire bytes rather than a
+  file copy.
+
+  WHAT THE ARMS COVER
+
+    A  happy path                  stages, and the marker names the right version
+    B  wrong hash                  rejected; the archive is deleted
+    C  short body                  rejected on size (the observable shape of a
+                                   disk that filled mid-download)
+    D  unsigned catalog            rejected
+    E  wrong publisher             rejected - and the certificate is VALID and
+                                   TRUSTED, so this proves the subject check is
+                                   what refuses it, not the status check
+    F  signed then tampered        rejected (HashMismatch)
+    G  disk preflight              rejected BEFORE any payload byte is written
+    H  unsigned script in payload  rejected
+    I  swap over a running copy    succeeds, with the existing lock control
+    J  task-shape downgrade        detected and REPAIRED; the control (-Skip
+                                   TaskShapeRestore) must leave it degraded
+    K  unelevated caller           the would-downgrade preflight refuses
+
+  WHAT THIS CANNOT PROVE. A hosted runner cannot fill its own system volume, so
+  arm C proves the CONSEQUENCE of a disk filling mid-download (a short body is
+  rejected and the partial file removed) rather than the condition itself, and
+  arm G proves the preflight consults real free space via Get-PSDrive and
+  refuses. Neither reproduces ENOSPC inside Invoke-WebRequest.
+
+.OUTPUTS  exit 0 = every arm passed; exit 1 = a failure, INCLUDING a vacuous arm.
+#>
+[CmdletBinding()]
+param(
+  # Arm K needs to create a local account. Off-switch for a host that forbids it.
+  [switch]$SkipUnelevatedArm
+)
+
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+
+$Here = Split-Path -Parent $MyInvocation.MyCommand.Path      # deploy\windows\ci
+$Deploy = (Resolve-Path (Join-Path $Here '..')).Path         # deploy\windows
+$Applier = Join-Path $Deploy 'apply-update.ps1'
+$TaskName = 'TrillboardsEdge'
+$Root = Join-Path $env:RUNNER_TEMP 'tb-update-applier'
+if (-not $env:RUNNER_TEMP) { $Root = Join-Path $env:TEMP 'tb-update-applier' }
+$Www = Join-Path $Root 'www'
+$Certs = New-Object System.Collections.Generic.List[string]
+$LocalUser = 'tbupd'
+$Failures = 0
+
+function Say([string]$m) { Write-Host "[update-applier] $m" }
+function Pass([string]$m) { Write-Host "PASS - $m" }
+function Bad([string]$m) { Write-Host "FAIL - $m"; $script:Failures++ }
+function Die([string]$m) { Write-Host "FAIL - $m"; Cleanup; exit 1 }
+
+# ---------------------------------------------------------------------------
+# Local HTTP origin
+# ---------------------------------------------------------------------------
+$Listener = $null
+$ServerPs = $null
+$BaseUrl = $null
+
+function Start-Origin {
+  foreach ($port in 34110..34140) {
+    $listener = New-Object System.Net.HttpListener
+    $listener.Prefixes.Add("http://127.0.0.1:$port/")
+    try { $listener.Start() } catch { continue }
+    $script:Listener = $listener
+    $script:BaseUrl = "http://127.0.0.1:$port"
+    break
+  }
+  if (-not $script:Listener) { Die 'could not bind a local HTTP port for the origin' }
+
+  $script:ServerPs = [powershell]::Create()
+  $null = $script:ServerPs.AddScript({
+      param($listener, $root)
+      while ($listener.IsListening) {
+        try { $ctx = $listener.GetContext() } catch { break }
+        try {
+          $rel = [Uri]::UnescapeDataString($ctx.Request.Url.AbsolutePath).TrimStart('/')
+          $file = Join-Path $root $rel
+          if (Test-Path -LiteralPath $file) {
+            $bytes = [System.IO.File]::ReadAllBytes($file)
+            $ctx.Response.StatusCode = 200
+            $ctx.Response.ContentLength64 = $bytes.Length
+            $ctx.Response.OutputStream.Write($bytes, 0, $bytes.Length)
+          } else {
+            $ctx.Response.StatusCode = 404
+          }
+        } catch {
+        } finally {
+          try { $ctx.Response.OutputStream.Close() } catch {}
+        }
+      }
+    }).AddArgument($script:Listener).AddArgument($Www)
+  $null = $script:ServerPs.BeginInvoke()
+  Say "origin listening on $script:BaseUrl"
+}
+
+function Stop-Origin {
+  try { if ($script:Listener) { $script:Listener.Stop(); $script:Listener.Close() } } catch {}
+  try { if ($script:ServerPs) { $script:ServerPs.Dispose() } } catch {}
+}
+
+# ---------------------------------------------------------------------------
+# Certificates
+# ---------------------------------------------------------------------------
+function New-HarnessCert([string]$Subject) {
+  $cert = New-SelfSignedCertificate -Type CodeSigningCert -Subject "CN=$Subject" `
+    -CertStoreLocation 'Cert:\CurrentUser\My' -NotAfter (Get-Date).AddDays(2)
+  # Into Root, or the chain does not build and Status is UnknownError - which
+  # would make arm E fire for the wrong reason entirely.
+  $pub = New-Object Security.Cryptography.X509Certificates.X509Certificate2(, $cert.RawData)
+  $store = New-Object Security.Cryptography.X509Certificates.X509Store('Root', 'CurrentUser')
+  $store.Open('ReadWrite'); $store.Add($pub); $store.Close()
+  $Certs.Add($cert.Thumbprint)
+  return $cert
+}
+
+function Remove-HarnessCerts {
+  foreach ($tp in $Certs) {
+    foreach ($name in @('My', 'Root')) {
+      try {
+        $store = New-Object Security.Cryptography.X509Certificates.X509Store($name, 'CurrentUser')
+        $store.Open('ReadWrite')
+        foreach ($c in @($store.Certificates | Where-Object { $_.Thumbprint -eq $tp })) { $store.Remove($c) }
+        $store.Close()
+      } catch {}
+    }
+  }
+}
+
+function Sign-File([string]$Path, $Cert) {
+  $r = Set-AuthenticodeSignature -FilePath $Path -Certificate $Cert -HashAlgorithm SHA256
+  if ($r.Status -ne 'Valid') { Die "harness could not sign $Path (got $($r.Status))" }
+}
+
+# ---------------------------------------------------------------------------
+# Fixtures
+# ---------------------------------------------------------------------------
+<#
+  A tree shaped exactly like the shipped connector: bin\ with the real scripts
+  (so the applier's "at least 10 signed executables" floor is met by the real
+  file set, not a stub), a node.exe, and a cli.js that answers `version` the way
+  install-update.ps1 requires.
+#>
+function New-PayloadTree([string]$Dest, $SignCert, [switch]$LogonOnlyRegisterTask, [switch]$WithUnsignedScript) {
+  if (Test-Path -LiteralPath $Dest) { Remove-Item -LiteralPath $Dest -Recurse -Force }
+  $bin = Join-Path $Dest 'bin'
+  $dist = Join-Path $Dest 'lib\edge-sdk\dist'
+  New-Item -ItemType Directory -Force -Path $bin, $dist | Out-Null
+
+  foreach ($f in @(& (Join-Path $Here 'list-shipped-scripts.ps1') -Kind signable -AbsolutePath)) {
+    Copy-Item -LiteralPath $f -Destination (Join-Path $bin (Split-Path -Leaf $f)) -Force
+  }
+  if ($LogonOnlyRegisterTask) {
+    # A register-task.ps1 that deliberately produces the PRE-headless shape.
+    # This is how arm J reproduces, on an elevated runner, the downgrade a
+    # non-elevated field caller would suffer: the cause differs, the observable
+    # (the task comes back logon-only) is identical, and that observable is what
+    # the guard keys on.
+    $downgrade = @'
+[CmdletBinding()]
+param([Parameter(Mandatory = $true)][string]$InstallDir, [string]$Mode = "auto-sense")
+$ErrorActionPreference = "Stop"
+$UserId = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
+$action = New-ScheduledTaskAction -Execute (Join-Path $env:WINDIR "System32\cmd.exe") -Argument "/c exit"
+$trigger = New-ScheduledTaskTrigger -AtLogOn -User $UserId
+$principal = New-ScheduledTaskPrincipal -UserId $UserId -LogonType Interactive -RunLevel Limited
+Unregister-ScheduledTask -TaskName "TrillboardsEdge" -Confirm:$false -ErrorAction SilentlyContinue
+Register-ScheduledTask -TaskName "TrillboardsEdge" -Action $action -Trigger $trigger -Principal $principal | Out-Null
+'@
+    [System.IO.File]::WriteAllText((Join-Path $bin 'register-task.ps1'), $downgrade, (New-Object System.Text.UTF8Encoding($false)))
+  }
+  if ($WithUnsignedScript) {
+    [System.IO.File]::WriteAllText((Join-Path $bin 'rogue.ps1'), "exit 0`r`n", (New-Object System.Text.UTF8Encoding($false)))
+  }
+
+  Copy-Item -LiteralPath (Get-Command node).Source -Destination (Join-Path $bin 'node.exe') -Force
+  [System.IO.File]::WriteAllText(
+    (Join-Path $dist 'cli.js'),
+    "if (process.argv[2] === 'version') { console.log('@trillboards/edge-sdk v9.9.9'); process.exit(0); }`r`nsetInterval(function(){}, 1000);`r`n",
+    (New-Object System.Text.UTF8Encoding($false)))
+
+  foreach ($f in @(Get-ChildItem -LiteralPath $bin -File | Where-Object { $_.Name -ne 'rogue.ps1' })) {
+    if ($f.Extension -in @('.ps1', '.vbs')) { Sign-File $f.FullName $SignCert }
+  }
+  # The runner's node.exe is the official OpenJS build and already Valid; sign a
+  # copy only if it is not, so the floor check measures signatures rather than
+  # the runner image.
+  $nodeSig = Get-AuthenticodeSignature -LiteralPath (Join-Path $bin 'node.exe')
+  if ($nodeSig.Status -ne 'Valid') { Sign-File (Join-Path $bin 'node.exe') $SignCert }
+}
+
+function New-InstallTree([string]$Dest) {
+  if (Test-Path -LiteralPath $Dest) { Remove-Item -LiteralPath $Dest -Recurse -Force }
+  $bin = Join-Path $Dest 'bin'
+  $dist = Join-Path $Dest 'lib\edge-sdk\dist'
+  New-Item -ItemType Directory -Force -Path $bin, $dist, (Join-Path $Dest 'logs') | Out-Null
+  foreach ($f in @('stop-existing.ps1', 'register-task.ps1', 'install-update.ps1', 'apply-update.ps1', 'run-connector.ps1', 'trillboards-edge-task.vbs')) {
+    Copy-Item -LiteralPath (Join-Path $Deploy $f) -Destination (Join-Path $bin $f) -Force
+  }
+  Copy-Item -LiteralPath (Get-Command node).Source -Destination (Join-Path $bin 'node.exe') -Force
+  [System.IO.File]::WriteAllText((Join-Path $dist 'cli.js'), "setInterval(function(){}, 1000);`r`n", (New-Object System.Text.UTF8Encoding($false)))
+}
+
+function New-Catalog([string]$Path, [string]$Version, [string]$Sha, [long]$Size) {
+  $lines = @(
+    '# Trillboards connector update catalog - harness fixture.',
+    ("`$TrillboardsUpdateVersion = '" + $Version + "'"),
+    ("`$TrillboardsUpdateSha256 = '" + $Sha + "'"),
+    ("`$TrillboardsUpdateSizeBytes = " + $Size)
+  )
+  [System.IO.File]::WriteAllText($Path, (($lines -join "`r`n") + "`r`n"), (New-Object System.Text.UTF8Encoding($false)))
+}
+
+<#
+  Run the applier and report what it concluded. Returns the parsed outcome.json
+  plus whether staged.json exists, which together are the only observable the
+  connector ever acts on.
+#>
+function Invoke-Applier([string]$InstallDir, [string[]]$Args) {
+  $ps = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+  $all = @('-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', $Applier, '-InstallDir', $InstallDir) + $Args
+  $p = Start-Process -FilePath $ps -ArgumentList $all -NoNewWindow -PassThru -Wait
+  $updateDir = Join-Path $InstallDir '.auto-update'
+  $outcome = $null
+  $outcomePath = Join-Path $updateDir 'outcome.json'
+  if (Test-Path -LiteralPath $outcomePath) {
+    try { $outcome = Get-Content -LiteralPath $outcomePath -Raw | ConvertFrom-Json } catch {}
+  }
+  # Precomputed rather than inlined into the hashtable: an `if` in a hashtable
+  # VALUE position is a statement, and Set-StrictMode makes the property reads
+  # inside it throw when $outcome is absent.
+  $result = ''
+  $detail = ''
+  if ($null -ne $outcome) {
+    $result = [string]$outcome.result
+    if ($null -ne $outcome.detail) { $detail = [string]$outcome.detail }
+  }
+  return [pscustomobject]@{
+    ExitCode = $p.ExitCode
+    Outcome  = $outcome
+    Result   = $result
+    Detail   = $detail
+    Staged   = (Test-Path -LiteralPath (Join-Path $updateDir 'staged.json'))
+    Archive  = (Test-Path -LiteralPath (Join-Path $updateDir 'payload.zip'))
+  }
+}
+
+function Publish-Payload([string]$TreeDir, [string]$Name) {
+  $zip = Join-Path $Www $Name
+  if (Test-Path -LiteralPath $zip) { Remove-Item -LiteralPath $zip -Force }
+  Add-Type -AssemblyName System.IO.Compression.FileSystem
+  [System.IO.Compression.ZipFile]::CreateFromDirectory($TreeDir, $zip, [System.IO.Compression.CompressionLevel]::Fastest, $false)
+  return [pscustomobject]@{
+    Path  = $zip
+    Bytes = (Get-Item -LiteralPath $zip).Length
+    Sha   = (Get-FileHash -LiteralPath $zip -Algorithm SHA256).Hash.ToLowerInvariant()
+  }
+}
+
+function Get-Shape([string]$Name) {
+  $t = Get-ScheduledTask -TaskName $Name -ErrorAction SilentlyContinue
+  if (-not $t) { return $null }
+  $xml = Export-ScheduledTask -TaskName $Name
+  $logon = 'unknown'
+  $m = [regex]::Match($xml, '<LogonType>([^<]+)</LogonType>')
+  if ($m.Success) { $logon = $m.Groups[1].Value }
+  $free = ($xml -match '<BootTrigger>') -or ($xml -match '<Repetition>')
+  return [pscustomobject]@{ LogonType = $logon; Headless = ($free -and ($logon -ne 'InteractiveToken')) }
+}
+
+function Register-HeadlessTask([string]$InstallDir) {
+  $userId = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
+  $action = New-ScheduledTaskAction -Execute (Join-Path $env:WINDIR 'System32\cmd.exe') -Argument '/c exit'
+  # A repetition trigger far in the future: logon-free by shape, and it cannot
+  # fire during the run and start anything.
+  $trigger = New-ScheduledTaskTrigger -Once -At ((Get-Date).AddDays(3650)) `
+    -RepetitionInterval (New-TimeSpan -Minutes 5) -RepetitionDuration (New-TimeSpan -Days 3650)
+  $principal = New-ScheduledTaskPrincipal -UserId $userId -LogonType S4U -RunLevel Limited
+  Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false -ErrorAction SilentlyContinue
+  Register-ScheduledTask -TaskName $TaskName -Action $action -Trigger $trigger -Principal $principal | Out-Null
+}
+
+function Cleanup {
+  Stop-Origin
+  Remove-HarnessCerts
+  try { Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false -ErrorAction SilentlyContinue } catch {}
+  try { Unregister-ScheduledTask -TaskName 'TrillboardsEdgeUpdateProbe' -Confirm:$false -ErrorAction SilentlyContinue } catch {}
+  try { Remove-LocalUser -Name $LocalUser -ErrorAction SilentlyContinue } catch {}
+}
+
+# ---------------------------------------------------------------------------
+try {
+  if (-not (Test-Path -LiteralPath $Applier)) { Die "apply-update.ps1 not found at $Applier" }
+  if (Test-Path -LiteralPath $Root) { Remove-Item -LiteralPath $Root -Recurse -Force }
+  New-Item -ItemType Directory -Force -Path $Root, $Www | Out-Null
+  Start-Origin
+
+  $goodCert = New-HarnessCert 'Trillboards CI Update Harness'
+  $otherCert = New-HarnessCert 'Definitely Not Trillboards'
+  $signer = 'Trillboards CI Update Harness'
+  $version = '9.9.9'
+
+  $payloadTree = Join-Path $Root 'payload-src'
+  New-PayloadTree -Dest $payloadTree -SignCert $goodCert
+  $good = Publish-Payload $payloadTree 'payload.zip'
+  Say ("payload: {0} bytes, sha {1}" -f $good.Bytes, $good.Sha)
+
+  $catalogGood = Join-Path $Www 'catalog-good.ps1'
+  New-Catalog $catalogGood $version $good.Sha $good.Bytes
+  Sign-File $catalogGood $goodCert
+
+  $urlZip = "$BaseUrl/payload.zip"
+
+  # ---- A: HAPPY PATH. The control for every arm below it -------------------
+  Say '--- arm A: happy path (the shared control) ---'
+  $installA = Join-Path $Root 'install-a'
+  New-InstallTree $installA
+  $a = Invoke-Applier $installA @('-Stage', '-UpdateUrl', $urlZip, '-CatalogUrl', "$BaseUrl/catalog-good.ps1",
+    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  if (-not $a.Staged) {
+    Die "arm A did not stage (exit $($a.ExitCode), result '$($a.Result)', detail '$($a.Detail)') - every refusal below would be VACUOUS"
+  }
+  $stagedVersion = (Get-Content -LiteralPath (Join-Path $installA '.auto-update\staged.json') -Raw | ConvertFrom-Json).version
+  if ($stagedVersion -ne $version) { Bad "arm A staged version '$stagedVersion', expected '$version'" }
+  else { Pass 'a correct, signed payload stages, and the marker names the staged version' }
+
+  # ---- B: WRONG HASH -------------------------------------------------------
+  Say '--- arm B: the payload does not match the signed hash ---'
+  $tampered = Join-Path $Www 'payload-tampered.zip'
+  Copy-Item -LiteralPath $good.Path -Destination $tampered -Force
+  $bytes = [System.IO.File]::ReadAllBytes($tampered)
+  $bytes[$bytes.Length - 1] = [byte](($bytes[$bytes.Length - 1] + 1) % 256)
+  [System.IO.File]::WriteAllBytes($tampered, $bytes)
+  $installB = Join-Path $Root 'install-b'
+  New-InstallTree $installB
+  $b = Invoke-Applier $installB @('-Stage', '-UpdateUrl', "$BaseUrl/payload-tampered.zip", '-CatalogUrl', "$BaseUrl/catalog-good.ps1",
+    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  if ($b.Staged) { Bad 'arm B staged a payload whose SHA-256 did not match the signed catalog' }
+  elseif ($b.Result -ne 'rejected') { Bad "arm B recorded '$($b.Result)', expected 'rejected'" }
+  elseif ($b.Detail -notmatch 'SHA-256 mismatch') { Bad "arm B rejected for the wrong reason: $($b.Detail)" }
+  elseif ($b.Archive) { Bad 'arm B left the rejected archive on disk' }
+  else { Pass 'a payload that fails the signed hash is rejected and deleted' }
+
+  # ---- C: SHORT BODY -------------------------------------------------------
+  Say '--- arm C: the download is short (what a disk filling mid-download looks like) ---'
+  $short = Join-Path $Www 'payload-short.zip'
+  # A real byte[] copy, not a PowerShell range slice: `$bytes[0..n]` boxes every
+  # element into an Object[], which WriteAllBytes will not take and which is
+  # pathologically slow at payload scale.
+  $full = [System.IO.File]::ReadAllBytes($good.Path)
+  $half = New-Object byte[] ([int]($good.Bytes / 2))
+  [System.Array]::Copy($full, 0, $half, 0, $half.Length)
+  [System.IO.File]::WriteAllBytes($short, $half)
+  $installC = Join-Path $Root 'install-c'
+  New-InstallTree $installC
+  $c = Invoke-Applier $installC @('-Stage', '-UpdateUrl', "$BaseUrl/payload-short.zip", '-CatalogUrl', "$BaseUrl/catalog-good.ps1",
+    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  if ($c.Staged) { Bad 'arm C staged a truncated payload' }
+  elseif ($c.Detail -notmatch 'size mismatch') { Bad "arm C rejected for the wrong reason: $($c.Detail)" }
+  elseif ($c.Archive) { Bad 'arm C left the truncated archive on disk' }
+  else { Pass 'a short download is rejected on size and the partial file is removed' }
+
+  # ---- D: UNSIGNED CATALOG -------------------------------------------------
+  Say '--- arm D: the catalog is not signed at all ---'
+  $catalogUnsigned = Join-Path $Www 'catalog-unsigned.ps1'
+  New-Catalog $catalogUnsigned $version $good.Sha $good.Bytes
+  if ((Get-AuthenticodeSignature -LiteralPath $catalogUnsigned).Status -eq 'Valid') {
+    Die 'arm D is VACUOUS: the "unsigned" catalog reports a Valid signature'
+  }
+  $installD = Join-Path $Root 'install-d'
+  New-InstallTree $installD
+  $d = Invoke-Applier $installD @('-Stage', '-UpdateUrl', $urlZip, '-CatalogUrl', "$BaseUrl/catalog-unsigned.ps1",
+    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  if ($d.Staged) { Bad 'arm D staged against an unsigned catalog' }
+  elseif ($d.Detail -notmatch 'not Valid') { Bad "arm D rejected for the wrong reason: $($d.Detail)" }
+  else { Pass 'an unsigned catalog is rejected' }
+
+  # ---- E: WRONG PUBLISHER (the sharpest control) ---------------------------
+  Say '--- arm E: the catalog is VALIDLY signed, by somebody else ---'
+  $catalogOther = Join-Path $Www 'catalog-other.ps1'
+  New-Catalog $catalogOther $version $good.Sha $good.Bytes
+  Sign-File $catalogOther $otherCert
+  $otherStatus = (Get-AuthenticodeSignature -LiteralPath $catalogOther).Status
+  if ($otherStatus -ne 'Valid') {
+    Die "arm E is VACUOUS: the other publisher's signature is '$otherStatus', not Valid - a status check alone would reject it and prove nothing about the subject check"
+  }
+  $installE = Join-Path $Root 'install-e'
+  New-InstallTree $installE
+  $e = Invoke-Applier $installE @('-Stage', '-UpdateUrl', $urlZip, '-CatalogUrl', "$BaseUrl/catalog-other.ps1",
+    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  if ($e.Staged) { Bad 'arm E staged a catalog signed by an unexpected publisher' }
+  elseif ($e.Detail -notmatch 'unexpected publisher') { Bad "arm E rejected for the wrong reason: $($e.Detail)" }
+  else { Pass 'a VALID signature from the wrong publisher is rejected on the subject' }
+
+  # ---- F: SIGNED THEN TAMPERED --------------------------------------------
+  Say '--- arm F: the catalog was signed, then edited ---'
+  $catalogEdited = Join-Path $Www 'catalog-edited.ps1'
+  Copy-Item -LiteralPath $catalogGood -Destination $catalogEdited -Force
+  Add-Content -LiteralPath $catalogEdited -Value '# an edit after signing'
+  $editedStatus = (Get-AuthenticodeSignature -LiteralPath $catalogEdited).Status
+  if ($editedStatus -eq 'Valid') { Die 'arm F is VACUOUS: the edited catalog still reports Valid' }
+  $installF = Join-Path $Root 'install-f'
+  New-InstallTree $installF
+  $f = Invoke-Applier $installF @('-Stage', '-UpdateUrl', $urlZip, '-CatalogUrl', "$BaseUrl/catalog-edited.ps1",
+    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  if ($f.Staged) { Bad 'arm F staged a catalog that was edited after signing' }
+  else { Pass "a catalog edited after signing is rejected ($editedStatus)" }
+
+  # ---- G: DISK PREFLIGHT ---------------------------------------------------
+  Say '--- arm G: the declared payload does not fit on the volume ---'
+  $huge = Join-Path $Www 'catalog-huge.ps1'
+  New-Catalog $huge $version $good.Sha 900000000000
+  Sign-File $huge $goodCert
+  $installG = Join-Path $Root 'install-g'
+  New-InstallTree $installG
+  $g = Invoke-Applier $installG @('-Stage', '-UpdateUrl', $urlZip, '-CatalogUrl', "$BaseUrl/catalog-huge.ps1",
+    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  if ($g.Staged) { Bad 'arm G staged a payload that cannot fit' }
+  elseif ($g.Detail -notmatch 'free disk space') { Bad "arm G rejected for the wrong reason: $($g.Detail)" }
+  elseif ($g.Archive) { Bad 'arm G downloaded before checking that the payload would fit' }
+  else { Pass 'the disk preflight consults real free space and refuses before downloading' }
+
+  # ---- H: UNSIGNED SCRIPT INSIDE THE PAYLOAD -------------------------------
+  Say '--- arm H: the payload contains an unsigned script ---'
+  $rogueTree = Join-Path $Root 'payload-rogue'
+  New-PayloadTree -Dest $rogueTree -SignCert $goodCert -WithUnsignedScript
+  $rogue = Publish-Payload $rogueTree 'payload-rogue.zip'
+  $catalogRogue = Join-Path $Www 'catalog-rogue.ps1'
+  New-Catalog $catalogRogue $version $rogue.Sha $rogue.Bytes
+  Sign-File $catalogRogue $goodCert
+  $installH = Join-Path $Root 'install-h'
+  New-InstallTree $installH
+  $h = Invoke-Applier $installH @('-Stage', '-UpdateUrl', "$BaseUrl/payload-rogue.zip", '-CatalogUrl', "$BaseUrl/catalog-rogue.ps1",
+    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  if ($h.Staged) { Bad 'arm H staged a payload containing an unsigned script' }
+  elseif ($h.Detail -notmatch 'unsigned or invalid') { Bad "arm H rejected for the wrong reason: $($h.Detail)" }
+  else { Pass 'a payload carrying an unsigned script is rejected' }
+
+  # ---- I + J: COMMIT over a running connector, and the shape guard ---------
+  # Both use the same fixture, because the shape guard only means anything on a
+  # commit that actually swapped something.
+  foreach ($arm in @(
+      @{ Name = 'J-control'; Skip = $true; ExpectHeadless = $false; ExpectResult = 'failed' },
+      @{ Name = 'J'; Skip = $false; ExpectHeadless = $true; ExpectResult = 'success' }
+    )) {
+    Say "--- arm $($arm.Name): commit over a RUNNING connector, with a payload that would re-register logon-only ---"
+    $installJ = Join-Path $Root "install-$($arm.Name)"
+    New-InstallTree $installJ
+    $downTree = Join-Path $Root "payload-down-$($arm.Name)"
+    New-PayloadTree -Dest $downTree -SignCert $goodCert -LogonOnlyRegisterTask
+    $down = Publish-Payload $downTree "payload-down-$($arm.Name).zip"
+    $catDown = Join-Path $Www "catalog-down-$($arm.Name).ps1"
+    New-Catalog $catDown $version $down.Sha $down.Bytes
+    Sign-File $catDown $goodCert
+
+    $staged = Invoke-Applier $installJ @('-Stage', '-UpdateUrl', "$BaseUrl/payload-down-$($arm.Name).zip",
+      '-CatalogUrl', "$BaseUrl/catalog-down-$($arm.Name).ps1", '-ExpectedVersion', $version,
+      '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+    if (-not $staged.Staged) { Die "arm $($arm.Name) could not stage: $($staged.Detail)" }
+
+    Register-HeadlessTask $installJ
+    $before = Get-Shape $TaskName
+    if (-not $before.Headless) { Die "arm $($arm.Name) is VACUOUS: the fixture task is not headless to begin with" }
+
+    # A live connector holding bin\node.exe, exactly as in the field.
+    $node = Join-Path $installJ 'bin\node.exe'
+    $running = Start-Process -FilePath $node -ArgumentList (Join-Path $installJ 'lib\edge-sdk\dist\cli.js') -PassThru -WindowStyle Hidden
+    Start-Sleep -Seconds 3
+    $lockedBefore = $false
+    try { $s = [IO.File]::Open($node, [IO.FileMode]::Open, [IO.FileAccess]::ReadWrite, [IO.FileShare]::None); $s.Dispose() }
+    catch { $lockedBefore = $true }
+    if (-not $lockedBefore) {
+      Die "arm $($arm.Name) is VACUOUS: node.exe was not locked while the connector was running, so a successful swap proves nothing"
+    }
+
+    $args = @('-Commit', '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8')
+    if ($arm.Skip) { $args += '-SkipTaskShapeRestore' }
+    $j = Invoke-Applier $installJ $args
+    try { Stop-Process -Id $running.Id -Force -ErrorAction SilentlyContinue } catch {}
+
+    $after = Get-Shape $TaskName
+    $isHeadless = ($null -ne $after) -and $after.Headless
+    $afterLogon = 'absent'
+    if ($null -ne $after) { $afterLogon = $after.LogonType }
+    if ($isHeadless -ne $arm.ExpectHeadless) {
+      Bad "arm $($arm.Name): task headless=$isHeadless, expected $($arm.ExpectHeadless) (logonType $afterLogon)"
+    } elseif ($j.Result -ne $arm.ExpectResult) {
+      Bad "arm $($arm.Name): recorded '$($j.Result)', expected '$($arm.ExpectResult)' (detail '$($j.Detail)')"
+    } elseif (-not $arm.Skip -and -not (Test-Path -LiteralPath (Join-Path $installJ 'lib\edge-sdk\dist\cli.js'))) {
+      Bad "arm $($arm.Name): the swap did not land the new lib tree"
+    } else {
+      if ($arm.Skip) { Pass 'CONTROL: with the shape guard disabled the task IS left logon-only, and that is recorded as failed' }
+      else { Pass 'the swap lands over a running connector, and a task left logon-only is detected and repaired' }
+    }
+    Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false -ErrorAction SilentlyContinue
+  }
+
+  # ---- K: the would-downgrade preflight, from an UNELEVATED caller ---------
+  if ($SkipUnelevatedArm) {
+    Say '--- arm K SKIPPED by request ---'
+  } else {
+    Say '--- arm K: an unelevated caller must REFUSE rather than downgrade ---'
+    $installK = Join-Path $Root 'install-k'
+    New-InstallTree $installK
+    $downTree = Join-Path $Root 'payload-k'
+    New-PayloadTree -Dest $downTree -SignCert $goodCert -LogonOnlyRegisterTask
+    $down = Publish-Payload $downTree 'payload-k.zip'
+    $catK = Join-Path $Www 'catalog-k.ps1'
+    New-Catalog $catK $version $down.Sha $down.Bytes
+    Sign-File $catK $goodCert
+    $stagedK = Invoke-Applier $installK @('-Stage', '-UpdateUrl', "$BaseUrl/payload-k.zip", '-CatalogUrl', "$BaseUrl/catalog-k.ps1",
+      '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+    if (-not $stagedK.Staged) { Die "arm K could not stage: $($stagedK.Detail)" }
+    Register-HeadlessTask $installK
+    $beforeK = Get-Shape $TaskName
+    if (($null -eq $beforeK) -or (-not $beforeK.Headless)) {
+      Die 'arm K is VACUOUS: the fixture task is not headless'
+    }
+
+    # The technique is lifted from e2e/test-headless-principal.ps1, which
+    # measured it working on this runner image (run 31836760844): a STANDARD
+    # local account, `Start-Process -Credential -LoadUserProfile`, and icacls
+    # rather than Set-Acl. Each of those details is load-bearing -- without
+    # -LoadUserProfile the child has no %USERPROFILE%, and without a
+    # pre-materialised profile the first run measures profile creation rather
+    # than the thing under test.
+    $ok = $true
+    try {
+      $plain = 'Tb!' + [guid]::NewGuid().ToString('N').Substring(0, 16)
+      $pw = ConvertTo-SecureString $plain -AsPlainText -Force
+      Get-LocalUser -Name $LocalUser -ErrorAction SilentlyContinue | Remove-LocalUser -ErrorAction SilentlyContinue
+      New-LocalUser -Name $LocalUser -Password $pw -AccountNeverExpires -PasswordNeverExpires `
+        -UserMayNotChangePassword -Description 'Trillboards update-applier probe' -ErrorAction Stop | Out-Null
+      # Users ONLY, never Administrators -- an admin account can create the S4U
+      # shape and this arm would assert nothing.
+      Add-LocalGroupMember -Group (Get-LocalGroup -SID 'S-1-5-32-545').Name -Member $LocalUser -ErrorAction SilentlyContinue
+      & icacls.exe $installK /grant '*S-1-1-0:(OI)(CI)M' /T | Out-Null
+
+      $cred = New-Object System.Management.Automation.PSCredential($LocalUser, $pw)
+      $ps = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+      # Materialise the profile once, so the run under test is not measuring
+      # first-logon profile creation.
+      Start-Process -FilePath $env:ComSpec -ArgumentList '/c', 'exit' -Credential $cred -LoadUserProfile `
+        -WorkingDirectory 'C:\' -Wait -ErrorAction Stop
+
+      # Drive the COPY inside the install tree, not the one in the repo
+      # workspace: the ACL above covers the install tree, and the runner's
+      # workspace is not necessarily readable by a fresh local account.
+      $applierCopy = Join-Path $installK 'bin\apply-update.ps1'
+      $outK = Join-Path $Root 'k-stdout.txt'
+      $errK = Join-Path $Root 'k-stderr.txt'
+      $null = Start-Process -FilePath $ps -Credential $cred -LoadUserProfile -WorkingDirectory 'C:\' -PassThru -Wait `
+        -RedirectStandardOutput $outK -RedirectStandardError $errK `
+        -ArgumentList @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', $applierCopy,
+        '-InstallDir', $installK, '-Commit', '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8')
+      foreach ($f in @($outK, $errK)) {
+        if (Test-Path -LiteralPath $f) {
+          $t = Get-Content -Raw -LiteralPath $f
+          if ($t -and $t.Trim()) { Say "  [arm K $(Split-Path -Leaf $f)] $($t.Trim())" }
+        }
+      }
+    } catch {
+      $ok = $false
+      Say "arm K could not run as a standard user on this host: $($_.Exception.Message)"
+      Write-Host 'UNPROVEN - arm K: the unelevated caller could not be created, so the would-downgrade refusal is NOT observed on this host'
+      $script:Failures++
+    }
+    if ($ok) {
+      $after = Get-Shape $TaskName
+      $k = $null
+      $op = Join-Path $installK '.auto-update\outcome.json'
+      if (Test-Path -LiteralPath $op) { try { $k = Get-Content -LiteralPath $op -Raw | ConvertFrom-Json } catch {} }
+      $result = if ($k) { [string]$k.result } else { '' }
+      $detail = if ($k -and $k.detail) { [string]$k.detail } else { '' }
+      if ($null -ne $after -and $after.Headless -and $result -eq 'rejected' -and $detail -match 'logon-only') {
+        Pass 'an unelevated caller REFUSES the update rather than downgrading a headless machine'
+      } elseif ($null -ne $after -and $after.Headless -and $result -eq 'success') {
+        # The account this ran as could still register the shape. Say so plainly
+        # rather than claiming a refusal that did not happen.
+        Write-Host 'UNPROVEN - arm K: the standard user was able to re-create the headless shape, so the refusal branch did not fire'
+        $script:Failures++
+      } else {
+        Bad "arm K: headless=$(if ($after) { $after.Headless } else { 'absent' }), result '$result', detail '$detail'"
+      }
+    }
+    Unregister-ScheduledTask -TaskName $TaskName -Confirm:$false -ErrorAction SilentlyContinue
+  }
+
+  Cleanup
+  if ($Failures -gt 0) { Write-Host "$Failures arm(s) failed"; exit 1 }
+  Write-Host 'All update-applier arms passed, every negative arm against a control that fired.'
+  exit 0
+} catch {
+  Write-Host "FAIL - harness error: $($_.Exception.Message)"
+  Write-Host $_.ScriptStackTrace
+  Cleanup
+  exit 1
+}

package/dist/CloudSensingManager.d.ts

@@ -369,6 +369,9 @@ export declare class CloudSensingManager extends EventEmitter {
         name: string;
         captureCount: number;
         postCount: number;
+        /** Of those posts, how many the server REJECTED. `postCount - postRejected`
+         *  is the only number that means "observations that were actually stored". */
+        postRejected: number;
         faceDetected: boolean;
         currentIntervalMs: number;
         admissionDeniedCount: number;
@@ -485,6 +488,13 @@ export declare class CloudSensingManager extends EventEmitter {
             analyses: number;
             admissionDenied: number;
             motionSkipped: number;
+            /**
+             * Uploads the SERVER rejected this run. Present because a rejected feed is
+             * otherwise indistinguishable from a quiet one: `analyses` simply stops
+             * rising, and the `unavailable` beacon that would say so travels over the
+             * same rejected credential.
+             */
+            rejected: number;
             /** This feed's skips, attributed to the cascade stage that made them. */
             motionSkippedByReason: Record<MotionGateReason, number>;
             /** Candidates this feed is holding right now — "camera 12 is waiting". */