@trillboards/edge-sdk 0.2.25 → 0.2.36

package/deploy/windows/ci/verify-update-applier.ps1

@@ -51,7 +51,25 @@
 [CmdletBinding()]
 param(
   # Arm K needs to create a local account. Off-switch for a host that forbids it.
-  [switch]$SkipUnelevatedArm
+  [switch]$SkipUnelevatedArm,
+  # The production proof owns eight minutes. Seconds are injectable only so the
+  # Windows deadline probe can prove a blocked certificate child is killed.
+  [ValidateRange(1, 480)]
+  [int]$DeadlineSeconds = 480,
+  [ValidateRange(0, 60)]
+  [int]$CertificateMintDelaySeconds = 0,
+  [switch]$CertificateDeadlineProbe,
+  # Forces Process.WaitForExit to throw on an unstarted process. CI uses this
+  # to prove the wait observer fails closed rather than calling a thrown wait a
+  # successful exit and falling into a later unbounded wait.
+  [switch]$BoundedWaitFailureProbe,
+  # The full CI proof receives the one real certificate already minted, signed,
+  # and proven by the preceding AllSigned harness. `powershell.exe` children
+  # repeatedly wedged while minting on windows-latest even though the same
+  # cmdlet succeeds in the workflow host. Keep the killable child below only for
+  # the deliberate deadline mutant; do not use that unreliable process shape
+  # as the happy-path fixture factory.
+  [string]$CertificateFixturePath
 )
 
 $ErrorActionPreference = 'Stop'
@@ -65,10 +83,95 @@ $Root = Join-Path $env:RUNNER_TEMP 'tb-update-applier'
 if (-not $env:RUNNER_TEMP) { $Root = Join-Path $env:TEMP 'tb-update-applier' }
 $Www = Join-Path $Root 'www'
 $Certs = New-Object System.Collections.Generic.List[string]
+$CertSubjects = New-Object System.Collections.Generic.List[string]
 $LocalUser = 'tbupd'
 $Failures = 0
+$StartedAt = Get-Date
 
-function Say([string]$m) { Write-Host "[update-applier] $m" }
+<#
+  A SELF-IMPOSED DEADLINE, because the first run of this harness did not fail -
+  it ate the whole job. It printed ONE line, ran for 11 minutes, and the JOB hit
+  its 15-minute cap, so every other proof in that step lost its budget too and
+  the log said only "The operation was canceled" - naming no cause and proving
+  nothing. Not one arm had run.
+
+  A harness that cannot finish must say so ITSELF, at the point it gives up, and
+  loudly enough to be actionable. Every phase below also prints its elapsed
+  time, because the reason that first failure was undiagnosable was that there
+  was no output between "origin listening" and the first arm.
+#>
+$script:DeadlineSeconds = $DeadlineSeconds
+
+function Elapsed { ((Get-Date) - $script:StartedAt).TotalSeconds }
+function Say([string]$m) { Write-Host ("[update-applier {0,6:N1}s] {1}" -f (Elapsed), $m) }
+
+$script:CurrentPhase = 'startup'
+
+function Fail-Deadline([string]$Phase, [string]$When) {
+  Write-Host "FAIL - the harness exceeded its $($script:DeadlineSeconds)-second deadline $When`: $Phase"
+  Write-Host '       HARNESS BUDGET failure, not a product failure. The arms above ran;'
+  Write-Host '       the ones below never started. Read the per-phase timings to find'
+  Write-Host '       what got slow before assuming a defect in apply-update.ps1.'
+  Cleanup
+  exit 1
+}
+
+function Assert-WithinDeadline([string]$Phase) {
+  $script:CurrentPhase = $Phase
+  if ((Elapsed) -lt $script:DeadlineSeconds) { return }
+  Fail-Deadline $Phase 'before starting'
+}
+
+function Remaining-DeadlineSeconds {
+  [Math]::Max(0, $script:DeadlineSeconds - (Elapsed))
+}
+
+<#
+  Wait for a process, but never past the harness deadline.
+
+  Assert-WithinDeadline can only sample time BETWEEN phases, so on its own it
+  cannot stop a phase that is ALREADY blocked - and that is precisely the
+  failure this harness exists to prevent. The first run spent eleven minutes
+  inside a single call; the job's 15-minute cap ended it, the harness did not,
+  and the log named no cause. A deadline that can only fire between the things
+  it is bounding is not a deadline.
+
+  So every blocking wait goes through here, bounded by the budget REMAINING at
+  the moment the wait starts. The deadline therefore stays a whole-harness
+  deadline rather than becoming a per-call timeout: eight slow phases cannot
+  each consume eight minutes.
+
+  On expiry we kill the process before reporting, so the cleanup that follows
+  is not itself blocked by the thing that hung.
+#>
+function Wait-Bounded {
+  param([System.Diagnostics.Process]$Process, [string]$Phase = $script:CurrentPhase)
+  $budget = Remaining-DeadlineSeconds
+  if ($budget -le 0) {
+    try { Stop-Process -Id $Process.Id -Force -ErrorAction SilentlyContinue } catch {}
+    Fail-Deadline $Phase 'before starting'
+  }
+  $timeoutMilliseconds = [int]([Math]::Min(2147483, $budget) * 1000)
+  $exited = $false
+  try {
+    $exited = $Process.WaitForExit($timeoutMilliseconds)
+  } catch {
+    $waitException = $_.Exception
+    if ($null -ne $waitException.InnerException) { $waitException = $waitException.InnerException }
+    $waitErrorType = $waitException.GetType().FullName
+    $waitErrorMessage = $waitException.Message
+    try { Stop-Process -Id $Process.Id -Force -ErrorAction SilentlyContinue } catch {}
+    try { $Process.WaitForExit(5000) | Out-Null } catch {}
+    try { $Process.Close() } catch {}
+    Die "$Phase bounded process wait failed ($waitErrorType): $waitErrorMessage"
+  }
+  if (-not $exited) {
+    try { Stop-Process -Id $Process.Id -Force -ErrorAction SilentlyContinue } catch {}
+    try { $Process.WaitForExit(5000) | Out-Null } catch {}
+    Fail-Deadline $Phase 'while running'
+  }
+  return $Process
+}
 function Pass([string]$m) { Write-Host "PASS - $m" }
 function Bad([string]$m) { Write-Host "FAIL - $m"; $script:Failures++ }
 function Die([string]$m) { Write-Host "FAIL - $m"; Cleanup; exit 1 }
@@ -126,17 +229,111 @@ function Stop-Origin {
 # Certificates
 # ---------------------------------------------------------------------------
 function New-HarnessCert([string]$Subject) {
-  $cert = New-SelfSignedCertificate -Type CodeSigningCert -Subject "CN=$Subject" `
-    -CertStoreLocation 'Cert:\CurrentUser\My' -NotAfter (Get-Date).AddDays(2)
+  # New-SelfSignedCertificate blocked for longer than the GitHub step budget on
+  # 2026-08-15. A synchronous cmdlet cannot be interrupted by Wait-Bounded, so
+  # mint in a disposable child process. The child receives the SAME remaining
+  # whole-harness budget as every applier invocation and is forcibly killed on
+  # expiry; a phase-specific failure is emitted before the job timeout can turn
+  # the result into an unattributable cancellation.
+  $phase = "minting code-signing certificate '$Subject'"
+  $tag = [guid]::NewGuid().ToString('N')
+  $thumbprintPath = Join-Path $Root "cert-$tag.thumbprint"
+  $stderrPath = Join-Path $Root "cert-$tag.stderr"
+  $subjectLiteral = $Subject.Replace("'", "''")
+  $thumbprintLiteral = $thumbprintPath.Replace("'", "''")
+  $stderrLiteral = $stderrPath.Replace("'", "''")
+  $script:CertSubjects.Add("CN=$Subject")
+  $mintSource = @"
+`$ErrorActionPreference = 'Stop'
+`$ProgressPreference = 'SilentlyContinue'
+try {
+  if ($CertificateMintDelaySeconds -gt 0) { Start-Sleep -Seconds $CertificateMintDelaySeconds }
+  `$cert = New-SelfSignedCertificate -Type CodeSigningCert -Subject 'CN=$subjectLiteral' -CertStoreLocation 'Cert:\CurrentUser\My' -NotAfter (Get-Date).AddDays(2)
+  [System.IO.File]::WriteAllText('$thumbprintLiteral', `$cert.Thumbprint)
+} catch {
+  [System.IO.File]::WriteAllText('$stderrLiteral', (`$_ | Out-String))
+  exit 1
+}
+"@
+  $encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($mintSource))
+  $powershell = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+  $startInfo = [Diagnostics.ProcessStartInfo]::new()
+  $startInfo.FileName = $powershell
+  $startInfo.Arguments = "-NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand $encoded"
+  $startInfo.UseShellExecute = $false
+  $startInfo.CreateNoWindow = $true
+  $p = [Diagnostics.Process]::new()
+  $p.StartInfo = $startInfo
+  $null = $p.Start()
+  $null = Wait-Bounded -Process $p -Phase $phase
+  $exitCode = $p.ExitCode
+  $p.Close()
+
+  $childError = ''
+  if (Test-Path -LiteralPath $stderrPath) { $childError = (Get-Content -LiteralPath $stderrPath -Raw).Trim() }
+  if ($exitCode -ne 0) { Die "$phase failed (exit $exitCode): $childError" }
+  if (-not (Test-Path -LiteralPath $thumbprintPath)) { Die "$phase returned no thumbprint" }
+  $thumbprint = (Get-Content -LiteralPath $thumbprintPath -Raw).Trim().ToUpperInvariant()
+  if ($thumbprint -notmatch '^[0-9A-F]{40,128}$') { Die "$phase returned malformed thumbprint '$thumbprint'" }
+  $script:Certs.Add($thumbprint)
+  $cert = Get-Item -LiteralPath "Cert:\CurrentUser\My\$thumbprint" -ErrorAction Stop
+  if ((-not $cert.HasPrivateKey) -or ($cert.Subject -ne "CN=$Subject")) {
+    Die "$phase returned a certificate without the expected subject and private key"
+  }
+  Remove-Item -LiteralPath $thumbprintPath, $stderrPath -Force -ErrorAction SilentlyContinue
   # Into Root, or the chain does not build and Status is UnknownError - which
   # would make arm E fire for the wrong reason entirely.
   $pub = New-Object Security.Cryptography.X509Certificates.X509Certificate2(, $cert.RawData)
   $store = New-Object Security.Cryptography.X509Certificates.X509Store('Root', 'CurrentUser')
   $store.Open('ReadWrite'); $store.Add($pub); $store.Close()
-  $Certs.Add($cert.Thumbprint)
   return $cert
 }
 
+function Read-HarnessCertificateFixtures([string]$Path) {
+  if (-not $Path) { Die 'CertificateFixturePath is required for the full harness' }
+  if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) {
+    Die "CertificateFixturePath does not exist: $Path"
+  }
+  try {
+    $rows = @(Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json)
+  } catch {
+    Die "CertificateFixturePath is not valid JSON: $($_.Exception.Message)"
+  }
+  if ($rows.Count -ne 1) { Die "CertificateFixturePath must contain exactly one certificate (got $($rows.Count))" }
+
+  $expectedSubjects = @('CN=Trillboards CI AllSigned Harness')
+  $bySubject = @{}
+  foreach ($row in $rows) {
+    $keys = @($row.PSObject.Properties.Name | Sort-Object)
+    if (($keys.Count -ne 2) -or (($keys -join ',') -ne 'subject,thumbprint')) {
+      Die 'CertificateFixturePath rows must contain exactly subject and thumbprint'
+    }
+    $subject = "$($row.subject)"
+    $thumbprint = "$($row.thumbprint)".Trim().ToUpperInvariant()
+    if ($expectedSubjects -notcontains $subject) { Die "CertificateFixturePath contains unexpected subject '$subject'" }
+    if ($bySubject.ContainsKey($subject)) { Die "CertificateFixturePath repeats subject '$subject'" }
+    if ($thumbprint -notmatch '^[0-9A-F]{40,128}$') { Die "CertificateFixturePath contains malformed thumbprint '$thumbprint'" }
+
+    $cert = Get-Item -LiteralPath "Cert:\CurrentUser\My\$thumbprint" -ErrorAction SilentlyContinue
+    if ((-not $cert) -or (-not $cert.HasPrivateKey) -or ($cert.Subject -ne $subject)) {
+      Die "CertificateFixturePath certificate '$subject' is absent or lacks its expected private key"
+    }
+    $root = Get-Item -LiteralPath "Cert:\LocalMachine\Root\$thumbprint" -ErrorAction SilentlyContinue
+    if ((-not $root) -or ($root.Subject -ne $subject) -or ($root.Thumbprint -ne $cert.Thumbprint)) {
+      Die "CertificateFixturePath certificate '$subject' is not bound to the matching trusted root"
+    }
+    $script:Certs.Add($thumbprint)
+    $script:CertSubjects.Add($subject)
+    $bySubject[$subject] = $cert
+  }
+  foreach ($subject in $expectedSubjects) {
+    if (-not $bySubject.ContainsKey($subject)) { Die "CertificateFixturePath is missing subject '$subject'" }
+  }
+  return [pscustomobject]@{
+    Good = $bySubject['CN=Trillboards CI AllSigned Harness']
+  }
+}
+
 function Remove-HarnessCerts {
   foreach ($tp in $Certs) {
     foreach ($name in @('My', 'Root')) {
@@ -148,6 +345,18 @@ function Remove-HarnessCerts {
       } catch {}
     }
   }
+  # If the child was killed after committing the store write but before writing
+  # its thumbprint marker, the parent never saw the thumbprint. Exact harness
+  # subjects are therefore a second cleanup key; they are intentionally unique
+  # to this ephemeral CI proof.
+  foreach ($name in @('My', 'Root')) {
+    try {
+      $store = New-Object Security.Cryptography.X509Certificates.X509Store($name, 'CurrentUser')
+      $store.Open('ReadWrite')
+      foreach ($c in @($store.Certificates | Where-Object { $script:CertSubjects.Contains($_.Subject) })) { $store.Remove($c) }
+      $store.Close()
+    } catch {}
+  }
 }
 
 function Sign-File([string]$Path, $Cert) {
@@ -158,27 +367,70 @@ function Sign-File([string]$Path, $Cert) {
 # ---------------------------------------------------------------------------
 # Fixtures
 # ---------------------------------------------------------------------------
+<#
+  BUILT ONCE, REUSED. The first version of this harness rebuilt the whole tree
+  per arm: 4 trees x (copy the runner's ~110 MB node.exe + Authenticode-sign 12
+  scripts + zip the lot). On windows-latest that produced ONE line of output and
+  then nothing for 11 minutes, until the job hit its 15-minute cap and was
+  cancelled - so not one arm ever ran, and the step looked hung rather than slow
+  because there was no progress output between phases at all.
+
+  Two fixes, and the second is the one that matters for the next person:
+
+  1. Sign the shipped script set ONCE into a cache and COPY the signed bytes
+     into each tree. Authenticode signing is the expensive part, not the file
+     copy, and the signatures are identical across trees by construction.
+  2. bin\node.exe is a small system PE re-signed with the harness certificate,
+     NOT the real 110 MB node. The applier only needs it to be PRESENT and
+     VALID; the two arms that actually EXECUTE node ask for -RealNode. Re-signing
+     also removes the Microsoft CRL distribution point, so the applier's
+     Get-AuthenticodeSignature calls resolve against a self-signed chain with
+     nothing to look up instead of reaching for the network 13 times per stage.
+#>
+$SignedCache = $null
+
+function Initialize-SignedCache($SignCert) {
+  if ($script:SignedCache) { return }
+  $script:SignedCache = Join-Path $Root 'signed-cache'
+  New-Item -ItemType Directory -Force -Path $script:SignedCache | Out-Null
+  $t0 = Get-Date
+  foreach ($f in @(& (Join-Path $Here 'list-shipped-scripts.ps1') -Kind signable -AbsolutePath)) {
+    $dest = Join-Path $script:SignedCache (Split-Path -Leaf $f)
+    Copy-Item -LiteralPath $f -Destination $dest -Force
+    Sign-File $dest $SignCert
+  }
+  # A small, already-PE stub that becomes bin\node.exe. where.exe is ~40 KB and
+  # is a real signed PE, so re-signing it with the harness cert succeeds and the
+  # result carries OUR chain rather than Microsoft's.
+  $stub = Join-Path $script:SignedCache 'node.exe'
+  Copy-Item -LiteralPath (Join-Path $env:WINDIR 'System32\where.exe') -Destination $stub -Force
+  Sign-File $stub $SignCert
+  Say ("signed-script cache built in {0:N1}s" -f ((Get-Date) - $t0).TotalSeconds)
+}
+
 <#
   A tree shaped exactly like the shipped connector: bin\ with the real scripts
   (so the applier's "at least 10 signed executables" floor is met by the real
   file set, not a stub), a node.exe, and a cli.js that answers `version` the way
   install-update.ps1 requires.
 #>
-function New-PayloadTree([string]$Dest, $SignCert, [switch]$LogonOnlyRegisterTask, [switch]$WithUnsignedScript) {
+function New-PayloadTree([string]$Dest, $SignCert, [switch]$LogonOnlyRegisterTask, [switch]$WithUnsignedScript, [switch]$RealNode) {
+  Initialize-SignedCache $SignCert
+  $t0 = Get-Date
   if (Test-Path -LiteralPath $Dest) { Remove-Item -LiteralPath $Dest -Recurse -Force }
   $bin = Join-Path $Dest 'bin'
   $dist = Join-Path $Dest 'lib\edge-sdk\dist'
   New-Item -ItemType Directory -Force -Path $bin, $dist | Out-Null
 
-  foreach ($f in @(& (Join-Path $Here 'list-shipped-scripts.ps1') -Kind signable -AbsolutePath)) {
-    Copy-Item -LiteralPath $f -Destination (Join-Path $bin (Split-Path -Leaf $f)) -Force
-  }
+  Copy-Item -Path (Join-Path $script:SignedCache '*') -Destination $bin -Force
+
   if ($LogonOnlyRegisterTask) {
     # A register-task.ps1 that deliberately produces the PRE-headless shape.
     # This is how arm J reproduces, on an elevated runner, the downgrade a
     # non-elevated field caller would suffer: the cause differs, the observable
     # (the task comes back logon-only) is identical, and that observable is what
-    # the guard keys on.
+    # the guard keys on. Signed, or the payload would be refused by the
+    # signature check before it could ever reach install-update.ps1.
     $downgrade = @'
 [CmdletBinding()]
 param([Parameter(Mandatory = $true)][string]$InstallDir, [string]$Mode = "auto-sense")
@@ -190,29 +442,28 @@ $principal = New-ScheduledTaskPrincipal -UserId $UserId -LogonType Interactive -
 Unregister-ScheduledTask -TaskName "TrillboardsEdge" -Confirm:$false -ErrorAction SilentlyContinue
 Register-ScheduledTask -TaskName "TrillboardsEdge" -Action $action -Trigger $trigger -Principal $principal | Out-Null
 '@
-    [System.IO.File]::WriteAllText((Join-Path $bin 'register-task.ps1'), $downgrade, (New-Object System.Text.UTF8Encoding($false)))
+    $rt = Join-Path $bin 'register-task.ps1'
+    [System.IO.File]::WriteAllText($rt, $downgrade, (New-Object System.Text.UTF8Encoding($false)))
+    Sign-File $rt $SignCert
   }
   if ($WithUnsignedScript) {
     [System.IO.File]::WriteAllText((Join-Path $bin 'rogue.ps1'), "exit 0`r`n", (New-Object System.Text.UTF8Encoding($false)))
   }
+  if ($RealNode) {
+    # Only the arms that actually RUN the connector need a real interpreter.
+    Copy-Item -LiteralPath (Get-Command node).Source -Destination (Join-Path $bin 'node.exe') -Force
+    $nodeSig = Get-AuthenticodeSignature -LiteralPath (Join-Path $bin 'node.exe')
+    if ($nodeSig.Status -ne 'Valid') { Sign-File (Join-Path $bin 'node.exe') $SignCert }
+  }
 
-  Copy-Item -LiteralPath (Get-Command node).Source -Destination (Join-Path $bin 'node.exe') -Force
   [System.IO.File]::WriteAllText(
     (Join-Path $dist 'cli.js'),
     "if (process.argv[2] === 'version') { console.log('@trillboards/edge-sdk v9.9.9'); process.exit(0); }`r`nsetInterval(function(){}, 1000);`r`n",
     (New-Object System.Text.UTF8Encoding($false)))
-
-  foreach ($f in @(Get-ChildItem -LiteralPath $bin -File | Where-Object { $_.Name -ne 'rogue.ps1' })) {
-    if ($f.Extension -in @('.ps1', '.vbs')) { Sign-File $f.FullName $SignCert }
-  }
-  # The runner's node.exe is the official OpenJS build and already Valid; sign a
-  # copy only if it is not, so the floor check measures signatures rather than
-  # the runner image.
-  $nodeSig = Get-AuthenticodeSignature -LiteralPath (Join-Path $bin 'node.exe')
-  if ($nodeSig.Status -ne 'Valid') { Sign-File (Join-Path $bin 'node.exe') $SignCert }
+  Say ("payload tree $(Split-Path -Leaf $Dest) built in {0:N1}s (realNode=$RealNode)" -f ((Get-Date) - $t0).TotalSeconds)
 }
 
-function New-InstallTree([string]$Dest) {
+function New-InstallTree([string]$Dest, [switch]$RealNode) {
   if (Test-Path -LiteralPath $Dest) { Remove-Item -LiteralPath $Dest -Recurse -Force }
   $bin = Join-Path $Dest 'bin'
   $dist = Join-Path $Dest 'lib\edge-sdk\dist'
@@ -220,7 +471,14 @@ function New-InstallTree([string]$Dest) {
   foreach ($f in @('stop-existing.ps1', 'register-task.ps1', 'install-update.ps1', 'apply-update.ps1', 'run-connector.ps1', 'trillboards-edge-task.vbs')) {
     Copy-Item -LiteralPath (Join-Path $Deploy $f) -Destination (Join-Path $bin $f) -Force
   }
-  Copy-Item -LiteralPath (Get-Command node).Source -Destination (Join-Path $bin 'node.exe') -Force
+  # Same reasoning as the payload tree: only the arms that RUN the connector
+  # need a real interpreter, and copying ~110 MB per arm is what blew the job
+  # budget the first time this harness ran.
+  if ($RealNode) {
+    Copy-Item -LiteralPath (Get-Command node).Source -Destination (Join-Path $bin 'node.exe') -Force
+  } elseif ($script:SignedCache -and (Test-Path -LiteralPath (Join-Path $script:SignedCache 'node.exe'))) {
+    Copy-Item -LiteralPath (Join-Path $script:SignedCache 'node.exe') -Destination (Join-Path $bin 'node.exe') -Force
+  }
   [System.IO.File]::WriteAllText((Join-Path $dist 'cli.js'), "setInterval(function(){}, 1000);`r`n", (New-Object System.Text.UTF8Encoding($false)))
 }
 
@@ -239,10 +497,49 @@ function New-Catalog([string]$Path, [string]$Version, [string]$Sha, [long]$Size)
   plus whether staged.json exists, which together are the only observable the
   connector ever acts on.
 #>
-function Invoke-Applier([string]$InstallDir, [string[]]$Args) {
+function Invoke-Applier([string]$InstallDir, [System.Collections.IDictionary]$ApplierParameters) {
   $ps = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
-  $all = @('-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', $Applier, '-InstallDir', $InstallDir) + $Args
-  $p = Start-Process -FilePath $ps -ArgumentList $all -NoNewWindow -PassThru -Wait
+  # Start-Process flattens -ArgumentList into one command-line string without
+  # preserving element boundaries. A value such as the real signer
+  # "Trillboards CI AllSigned Harness" therefore arrives at apply-update.ps1
+  # as four positional arguments. An array splat is also positional, so it
+  # cannot reconstruct names such as -ExpectedVersion after deserialization.
+  # Carry a named parameter map as JSON inside an encoded child program instead:
+  # the only native-process argument is base64, and the child rebuilds a
+  # hashtable that PowerShell binds by parameter name without reparsing values.
+  $namedParameters = [ordered]@{ InstallDir = [string]$InstallDir }
+  foreach ($name in $ApplierParameters.Keys) {
+    if ([string]$name -eq 'InstallDir') { Die 'Invoke-Applier parameters must not override InstallDir' }
+    $namedParameters[[string]$name] = $ApplierParameters[$name]
+  }
+  $invocationJson = [ordered]@{
+    applier    = [string]$Applier
+    parameters = $namedParameters
+  } | ConvertTo-Json -Compress
+  $invocationBase64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($invocationJson))
+  $childSource = @"
+`$ErrorActionPreference = 'Stop'
+`$decodedInvocation = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('$invocationBase64'))
+`$invocation = `$decodedInvocation | ConvertFrom-Json
+`$childApplier = [string]`$invocation.applier
+`$childParameters = @{}
+foreach (`$property in @(`$invocation.parameters.PSObject.Properties)) {
+  `$childParameters[`$property.Name] = `$property.Value
+}
+& `$childApplier @childParameters
+exit `$LASTEXITCODE
+"@
+  $encodedChild = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($childSource))
+  $startInfo = [Diagnostics.ProcessStartInfo]::new()
+  $startInfo.FileName = $ps
+  $startInfo.Arguments = "-NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand $encodedChild"
+  $startInfo.UseShellExecute = $false
+  $p = [Diagnostics.Process]::new()
+  $p.StartInfo = $startInfo
+  $null = $p.Start()
+  $null = Wait-Bounded -Process $p
+  $exitCode = $p.ExitCode
+  $p.Close()
   $updateDir = Join-Path $InstallDir '.auto-update'
   $outcome = $null
   $outcomePath = Join-Path $updateDir 'outcome.json'
@@ -259,7 +556,7 @@ function Invoke-Applier([string]$InstallDir, [string[]]$Args) {
     if ($null -ne $outcome.detail) { $detail = [string]$outcome.detail }
   }
   return [pscustomobject]@{
-    ExitCode = $p.ExitCode
+    ExitCode = $exitCode
     Outcome  = $outcome
     Result   = $result
     Detail   = $detail
@@ -269,15 +566,18 @@ function Invoke-Applier([string]$InstallDir, [string[]]$Args) {
 }
 
 function Publish-Payload([string]$TreeDir, [string]$Name) {
+  $t0 = Get-Date
   $zip = Join-Path $Www $Name
   if (Test-Path -LiteralPath $zip) { Remove-Item -LiteralPath $zip -Force }
   Add-Type -AssemblyName System.IO.Compression.FileSystem
   [System.IO.Compression.ZipFile]::CreateFromDirectory($TreeDir, $zip, [System.IO.Compression.CompressionLevel]::Fastest, $false)
-  return [pscustomobject]@{
+  $out = [pscustomobject]@{
     Path  = $zip
     Bytes = (Get-Item -LiteralPath $zip).Length
     Sha   = (Get-FileHash -LiteralPath $zip -Algorithm SHA256).Hash.ToLowerInvariant()
   }
+  Say ("zipped $Name : {0:N1} MB in {1:N1}s" -f ($out.Bytes / 1MB), ((Get-Date) - $t0).TotalSeconds)
+  return $out
 }
 
 function Get-Shape([string]$Name) {
@@ -316,17 +616,36 @@ try {
   if (-not (Test-Path -LiteralPath $Applier)) { Die "apply-update.ps1 not found at $Applier" }
   if (Test-Path -LiteralPath $Root) { Remove-Item -LiteralPath $Root -Recurse -Force }
   New-Item -ItemType Directory -Force -Path $Root, $Www | Out-Null
-  Start-Origin
-
-  $goodCert = New-HarnessCert 'Trillboards CI Update Harness'
-  $otherCert = New-HarnessCert 'Definitely Not Trillboards'
-  $signer = 'Trillboards CI Update Harness'
+  if (($CertificateMintDelaySeconds -gt 0) -and (-not $CertificateDeadlineProbe)) {
+    Die 'CertificateMintDelaySeconds is a deadline-probe input, not a full-harness option'
+  }
+  if ($BoundedWaitFailureProbe) {
+    $unstarted = [Diagnostics.Process]::new()
+    $null = Wait-Bounded -Process $unstarted -Phase 'bounded wait observer failure probe'
+    Die 'bounded wait observer failure probe was reclassified as a process exit'
+  }
+  if ($CertificateDeadlineProbe) {
+    if ($CertificateMintDelaySeconds -le $DeadlineSeconds) {
+      Die 'certificate deadline probe requires a mint delay longer than its deadline'
+    }
+    Say 'deadline probe: starting a deliberately blocked certificate mint'
+    $null = New-HarnessCert 'Trillboards CI Deadline Probe'
+    Die 'certificate deadline probe was not stopped by the harness deadline'
+  }
+  Say 'loading the real certificate retained from the AllSigned proof'
+  $certificateFixtures = Read-HarnessCertificateFixtures $CertificateFixturePath
+  $goodCert = $certificateFixtures.Good
+  $signer = 'Trillboards CI AllSigned Harness'
   $version = '9.9.9'
+  Say 'certificates ready'
+
+  Start-Origin
 
   $payloadTree = Join-Path $Root 'payload-src'
   New-PayloadTree -Dest $payloadTree -SignCert $goodCert
   $good = Publish-Payload $payloadTree 'payload.zip'
-  Say ("payload: {0} bytes, sha {1}" -f $good.Bytes, $good.Sha)
+  Say ("reference payload: {0} bytes, sha {1}" -f $good.Bytes, $good.Sha)
+  Assert-WithinDeadline 'building the reference payload'
 
   $catalogGood = Join-Path $Www 'catalog-good.ps1'
   New-Catalog $catalogGood $version $good.Sha $good.Bytes
@@ -336,10 +655,13 @@ try {
 
   # ---- A: HAPPY PATH. The control for every arm below it -------------------
   Say '--- arm A: happy path (the shared control) ---'
+  Assert-WithinDeadline 'arm A: happy path (the shared control)'
   $installA = Join-Path $Root 'install-a'
   New-InstallTree $installA
-  $a = Invoke-Applier $installA @('-Stage', '-UpdateUrl', $urlZip, '-CatalogUrl', "$BaseUrl/catalog-good.ps1",
-    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  $a = Invoke-Applier $installA ([ordered]@{
+      Stage = $true; UpdateUrl = $urlZip; CatalogUrl = "$BaseUrl/catalog-good.ps1"
+      ExpectedVersion = $version; CurrentVersion = '9.9.8'; ExpectedSigner = $signer
+    })
   if (-not $a.Staged) {
     Die "arm A did not stage (exit $($a.ExitCode), result '$($a.Result)', detail '$($a.Detail)') - every refusal below would be VACUOUS"
   }
@@ -349,6 +671,7 @@ try {
 
   # ---- B: WRONG HASH -------------------------------------------------------
   Say '--- arm B: the payload does not match the signed hash ---'
+  Assert-WithinDeadline 'arm B: the payload does not match the signed hash'
   $tampered = Join-Path $Www 'payload-tampered.zip'
   Copy-Item -LiteralPath $good.Path -Destination $tampered -Force
   $bytes = [System.IO.File]::ReadAllBytes($tampered)
@@ -356,8 +679,10 @@ try {
   [System.IO.File]::WriteAllBytes($tampered, $bytes)
   $installB = Join-Path $Root 'install-b'
   New-InstallTree $installB
-  $b = Invoke-Applier $installB @('-Stage', '-UpdateUrl', "$BaseUrl/payload-tampered.zip", '-CatalogUrl', "$BaseUrl/catalog-good.ps1",
-    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  $b = Invoke-Applier $installB ([ordered]@{
+      Stage = $true; UpdateUrl = "$BaseUrl/payload-tampered.zip"; CatalogUrl = "$BaseUrl/catalog-good.ps1"
+      ExpectedVersion = $version; CurrentVersion = '9.9.8'; ExpectedSigner = $signer
+    })
   if ($b.Staged) { Bad 'arm B staged a payload whose SHA-256 did not match the signed catalog' }
   elseif ($b.Result -ne 'rejected') { Bad "arm B recorded '$($b.Result)', expected 'rejected'" }
   elseif ($b.Detail -notmatch 'SHA-256 mismatch') { Bad "arm B rejected for the wrong reason: $($b.Detail)" }
@@ -366,6 +691,7 @@ try {
 
   # ---- C: SHORT BODY -------------------------------------------------------
   Say '--- arm C: the download is short (what a disk filling mid-download looks like) ---'
+  Assert-WithinDeadline 'arm C: the download is short (what a disk filling mid-download looks like)'
   $short = Join-Path $Www 'payload-short.zip'
   # A real byte[] copy, not a PowerShell range slice: `$bytes[0..n]` boxes every
   # element into an Object[], which WriteAllBytes will not take and which is
@@ -376,8 +702,10 @@ try {
   [System.IO.File]::WriteAllBytes($short, $half)
   $installC = Join-Path $Root 'install-c'
   New-InstallTree $installC
-  $c = Invoke-Applier $installC @('-Stage', '-UpdateUrl', "$BaseUrl/payload-short.zip", '-CatalogUrl', "$BaseUrl/catalog-good.ps1",
-    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  $c = Invoke-Applier $installC ([ordered]@{
+      Stage = $true; UpdateUrl = "$BaseUrl/payload-short.zip"; CatalogUrl = "$BaseUrl/catalog-good.ps1"
+      ExpectedVersion = $version; CurrentVersion = '9.9.8'; ExpectedSigner = $signer
+    })
   if ($c.Staged) { Bad 'arm C staged a truncated payload' }
   elseif ($c.Detail -notmatch 'size mismatch') { Bad "arm C rejected for the wrong reason: $($c.Detail)" }
   elseif ($c.Archive) { Bad 'arm C left the truncated archive on disk' }
@@ -385,6 +713,7 @@ try {
 
   # ---- D: UNSIGNED CATALOG -------------------------------------------------
   Say '--- arm D: the catalog is not signed at all ---'
+  Assert-WithinDeadline 'arm D: the catalog is not signed at all'
   $catalogUnsigned = Join-Path $Www 'catalog-unsigned.ps1'
   New-Catalog $catalogUnsigned $version $good.Sha $good.Bytes
   if ((Get-AuthenticodeSignature -LiteralPath $catalogUnsigned).Status -eq 'Valid') {
@@ -392,31 +721,37 @@ try {
   }
   $installD = Join-Path $Root 'install-d'
   New-InstallTree $installD
-  $d = Invoke-Applier $installD @('-Stage', '-UpdateUrl', $urlZip, '-CatalogUrl', "$BaseUrl/catalog-unsigned.ps1",
-    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  $d = Invoke-Applier $installD ([ordered]@{
+      Stage = $true; UpdateUrl = $urlZip; CatalogUrl = "$BaseUrl/catalog-unsigned.ps1"
+      ExpectedVersion = $version; CurrentVersion = '9.9.8'; ExpectedSigner = $signer
+    })
   if ($d.Staged) { Bad 'arm D staged against an unsigned catalog' }
   elseif ($d.Detail -notmatch 'not Valid') { Bad "arm D rejected for the wrong reason: $($d.Detail)" }
   else { Pass 'an unsigned catalog is rejected' }
 
   # ---- E: WRONG PUBLISHER (the sharpest control) ---------------------------
   Say '--- arm E: the catalog is VALIDLY signed, by somebody else ---'
+  Assert-WithinDeadline 'arm E: the catalog is VALIDLY signed, by somebody else'
   $catalogOther = Join-Path $Www 'catalog-other.ps1'
   New-Catalog $catalogOther $version $good.Sha $good.Bytes
-  Sign-File $catalogOther $otherCert
+  Sign-File $catalogOther $goodCert
   $otherStatus = (Get-AuthenticodeSignature -LiteralPath $catalogOther).Status
   if ($otherStatus -ne 'Valid') {
     Die "arm E is VACUOUS: the other publisher's signature is '$otherStatus', not Valid - a status check alone would reject it and prove nothing about the subject check"
   }
   $installE = Join-Path $Root 'install-e'
   New-InstallTree $installE
-  $e = Invoke-Applier $installE @('-Stage', '-UpdateUrl', $urlZip, '-CatalogUrl', "$BaseUrl/catalog-other.ps1",
-    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  $e = Invoke-Applier $installE ([ordered]@{
+      Stage = $true; UpdateUrl = $urlZip; CatalogUrl = "$BaseUrl/catalog-other.ps1"
+      ExpectedVersion = $version; CurrentVersion = '9.9.8'; ExpectedSigner = 'Definitely Not Trillboards'
+    })
   if ($e.Staged) { Bad 'arm E staged a catalog signed by an unexpected publisher' }
   elseif ($e.Detail -notmatch 'unexpected publisher') { Bad "arm E rejected for the wrong reason: $($e.Detail)" }
   else { Pass 'a VALID signature from the wrong publisher is rejected on the subject' }
 
   # ---- F: SIGNED THEN TAMPERED --------------------------------------------
   Say '--- arm F: the catalog was signed, then edited ---'
+  Assert-WithinDeadline 'arm F: the catalog was signed, then edited'
   $catalogEdited = Join-Path $Www 'catalog-edited.ps1'
   Copy-Item -LiteralPath $catalogGood -Destination $catalogEdited -Force
   Add-Content -LiteralPath $catalogEdited -Value '# an edit after signing'
@@ -424,20 +759,25 @@ try {
   if ($editedStatus -eq 'Valid') { Die 'arm F is VACUOUS: the edited catalog still reports Valid' }
   $installF = Join-Path $Root 'install-f'
   New-InstallTree $installF
-  $f = Invoke-Applier $installF @('-Stage', '-UpdateUrl', $urlZip, '-CatalogUrl', "$BaseUrl/catalog-edited.ps1",
-    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  $f = Invoke-Applier $installF ([ordered]@{
+      Stage = $true; UpdateUrl = $urlZip; CatalogUrl = "$BaseUrl/catalog-edited.ps1"
+      ExpectedVersion = $version; CurrentVersion = '9.9.8'; ExpectedSigner = $signer
+    })
   if ($f.Staged) { Bad 'arm F staged a catalog that was edited after signing' }
   else { Pass "a catalog edited after signing is rejected ($editedStatus)" }
 
   # ---- G: DISK PREFLIGHT ---------------------------------------------------
   Say '--- arm G: the declared payload does not fit on the volume ---'
+  Assert-WithinDeadline 'arm G: the declared payload does not fit on the volume'
   $huge = Join-Path $Www 'catalog-huge.ps1'
   New-Catalog $huge $version $good.Sha 900000000000
   Sign-File $huge $goodCert
   $installG = Join-Path $Root 'install-g'
   New-InstallTree $installG
-  $g = Invoke-Applier $installG @('-Stage', '-UpdateUrl', $urlZip, '-CatalogUrl', "$BaseUrl/catalog-huge.ps1",
-    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  $g = Invoke-Applier $installG ([ordered]@{
+      Stage = $true; UpdateUrl = $urlZip; CatalogUrl = "$BaseUrl/catalog-huge.ps1"
+      ExpectedVersion = $version; CurrentVersion = '9.9.8'; ExpectedSigner = $signer
+    })
   if ($g.Staged) { Bad 'arm G staged a payload that cannot fit' }
   elseif ($g.Detail -notmatch 'free disk space') { Bad "arm G rejected for the wrong reason: $($g.Detail)" }
   elseif ($g.Archive) { Bad 'arm G downloaded before checking that the payload would fit' }
@@ -445,6 +785,7 @@ try {
 
   # ---- H: UNSIGNED SCRIPT INSIDE THE PAYLOAD -------------------------------
   Say '--- arm H: the payload contains an unsigned script ---'
+  Assert-WithinDeadline 'arm H: the payload contains an unsigned script'
   $rogueTree = Join-Path $Root 'payload-rogue'
   New-PayloadTree -Dest $rogueTree -SignCert $goodCert -WithUnsignedScript
   $rogue = Publish-Payload $rogueTree 'payload-rogue.zip'
@@ -453,8 +794,10 @@ try {
   Sign-File $catalogRogue $goodCert
   $installH = Join-Path $Root 'install-h'
   New-InstallTree $installH
-  $h = Invoke-Applier $installH @('-Stage', '-UpdateUrl', "$BaseUrl/payload-rogue.zip", '-CatalogUrl', "$BaseUrl/catalog-rogue.ps1",
-    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  $h = Invoke-Applier $installH ([ordered]@{
+      Stage = $true; UpdateUrl = "$BaseUrl/payload-rogue.zip"; CatalogUrl = "$BaseUrl/catalog-rogue.ps1"
+      ExpectedVersion = $version; CurrentVersion = '9.9.8'; ExpectedSigner = $signer
+    })
   if ($h.Staged) { Bad 'arm H staged a payload containing an unsigned script' }
   elseif ($h.Detail -notmatch 'unsigned or invalid') { Bad "arm H rejected for the wrong reason: $($h.Detail)" }
   else { Pass 'a payload carrying an unsigned script is rejected' }
@@ -468,17 +811,19 @@ try {
     )) {
     Say "--- arm $($arm.Name): commit over a RUNNING connector, with a payload that would re-register logon-only ---"
     $installJ = Join-Path $Root "install-$($arm.Name)"
-    New-InstallTree $installJ
+    New-InstallTree $installJ -RealNode
     $downTree = Join-Path $Root "payload-down-$($arm.Name)"
-    New-PayloadTree -Dest $downTree -SignCert $goodCert -LogonOnlyRegisterTask
+    New-PayloadTree -Dest $downTree -SignCert $goodCert -LogonOnlyRegisterTask -RealNode
     $down = Publish-Payload $downTree "payload-down-$($arm.Name).zip"
     $catDown = Join-Path $Www "catalog-down-$($arm.Name).ps1"
     New-Catalog $catDown $version $down.Sha $down.Bytes
     Sign-File $catDown $goodCert
 
-    $staged = Invoke-Applier $installJ @('-Stage', '-UpdateUrl', "$BaseUrl/payload-down-$($arm.Name).zip",
-      '-CatalogUrl', "$BaseUrl/catalog-down-$($arm.Name).ps1", '-ExpectedVersion', $version,
-      '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+    $staged = Invoke-Applier $installJ ([ordered]@{
+        Stage = $true; UpdateUrl = "$BaseUrl/payload-down-$($arm.Name).zip"
+        CatalogUrl = "$BaseUrl/catalog-down-$($arm.Name).ps1"; ExpectedVersion = $version
+        CurrentVersion = '9.9.8'; ExpectedSigner = $signer
+      })
     if (-not $staged.Staged) { Die "arm $($arm.Name) could not stage: $($staged.Detail)" }
 
     Register-HeadlessTask $installJ
@@ -496,9 +841,9 @@ try {
       Die "arm $($arm.Name) is VACUOUS: node.exe was not locked while the connector was running, so a successful swap proves nothing"
     }
 
-    $args = @('-Commit', '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8')
-    if ($arm.Skip) { $args += '-SkipTaskShapeRestore' }
-    $j = Invoke-Applier $installJ $args
+    $commitParameters = [ordered]@{ Commit = $true; ExpectedVersion = $version; CurrentVersion = '9.9.8' }
+    if ($arm.Skip) { $commitParameters['SkipTaskShapeRestore'] = $true }
+    $j = Invoke-Applier $installJ $commitParameters
     try { Stop-Process -Id $running.Id -Force -ErrorAction SilentlyContinue } catch {}
 
     $after = Get-Shape $TaskName
@@ -521,8 +866,10 @@ try {
   # ---- K: the would-downgrade preflight, from an UNELEVATED caller ---------
   if ($SkipUnelevatedArm) {
     Say '--- arm K SKIPPED by request ---'
+  Assert-WithinDeadline 'arm K SKIPPED by request'
   } else {
     Say '--- arm K: an unelevated caller must REFUSE rather than downgrade ---'
+  Assert-WithinDeadline 'arm K: an unelevated caller must REFUSE rather than downgrade'
     $installK = Join-Path $Root 'install-k'
     New-InstallTree $installK
     $downTree = Join-Path $Root 'payload-k'
@@ -531,8 +878,10 @@ try {
     $catK = Join-Path $Www 'catalog-k.ps1'
     New-Catalog $catK $version $down.Sha $down.Bytes
     Sign-File $catK $goodCert
-    $stagedK = Invoke-Applier $installK @('-Stage', '-UpdateUrl', "$BaseUrl/payload-k.zip", '-CatalogUrl', "$BaseUrl/catalog-k.ps1",
-      '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+    $stagedK = Invoke-Applier $installK ([ordered]@{
+        Stage = $true; UpdateUrl = "$BaseUrl/payload-k.zip"; CatalogUrl = "$BaseUrl/catalog-k.ps1"
+        ExpectedVersion = $version; CurrentVersion = '9.9.8'; ExpectedSigner = $signer
+      })
     if (-not $stagedK.Staged) { Die "arm K could not stage: $($stagedK.Detail)" }
     Register-HeadlessTask $installK
     $beforeK = Get-Shape $TaskName
@@ -563,8 +912,9 @@ try {
       $ps = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
       # Materialise the profile once, so the run under test is not measuring
       # first-logon profile creation.
-      Start-Process -FilePath $env:ComSpec -ArgumentList '/c', 'exit' -Credential $cred -LoadUserProfile `
-        -WorkingDirectory 'C:\' -Wait -ErrorAction Stop
+      $warm = Start-Process -FilePath $env:ComSpec -ArgumentList '/c', 'exit' -Credential $cred -LoadUserProfile `
+        -WorkingDirectory 'C:\' -PassThru -ErrorAction Stop
+      $null = Wait-Bounded -Process $warm -Phase 'arm K: materialising the local profile'
 
       # Drive the COPY inside the install tree, not the one in the repo
       # workspace: the ACL above covers the install tree, and the runner's
@@ -572,10 +922,11 @@ try {
       $applierCopy = Join-Path $installK 'bin\apply-update.ps1'
       $outK = Join-Path $Root 'k-stdout.txt'
       $errK = Join-Path $Root 'k-stderr.txt'
-      $null = Start-Process -FilePath $ps -Credential $cred -LoadUserProfile -WorkingDirectory 'C:\' -PassThru -Wait `
+      $pk = Start-Process -FilePath $ps -Credential $cred -LoadUserProfile -WorkingDirectory 'C:\' -PassThru `
         -RedirectStandardOutput $outK -RedirectStandardError $errK `
         -ArgumentList @('-NoProfile', '-ExecutionPolicy', 'Bypass', '-File', $applierCopy,
         '-InstallDir', $installK, '-Commit', '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8')
+      $null = Wait-Bounded -Process $pk
       foreach ($f in @($outK, $errK)) {
         if (Test-Path -LiteralPath $f) {
           $t = Get-Content -Raw -LiteralPath $f