@trillboards/edge-sdk 0.2.26 → 0.2.36

package/deploy/windows/ci/verify-allsigned-enforcement.ps1

@@ -57,6 +57,12 @@
                            signed (by Azure Trusted Signing) and are proved
                            as-is, with the unsigned control derived by stripping
                            the signature block from a copy.
+.PARAMETER RetainSelfSignedFixturePath
+                           In hermetic mode, retain the exact proven root until
+                           a downstream proof cleans it and write only its
+                           subject/thumbprint metadata to this path. The owning
+                           harness emits this directly; callers must not scan
+                           the certificate provider after the proof.
 
 .NOTES
   .cmd/.bat have no Authenticode SIP and cmd.exe has no execution policy, so a
@@ -71,7 +77,8 @@ param(
   [string]$CanaryPs1 = "",
   [string]$CanaryVbs = "",
   [switch]$SelfSign,
-  [switch]$AlreadySigned
+  [switch]$AlreadySigned,
+  [string]$RetainSelfSignedFixturePath = ""
 )
 
 $ErrorActionPreference = 'Stop'
@@ -81,12 +88,17 @@ if (-not ($SelfSign -xor $AlreadySigned)) {
   Write-Error 'Choose exactly one of -SelfSign or -AlreadySigned.'
   exit 2
 }
+if ($RetainSelfSignedFixturePath -and -not $SelfSign) {
+  Write-Error '-RetainSelfSignedFixturePath is valid only with -SelfSign.'
+  exit 2
+}
 
 $PolicyKey = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell'
 $WshKey = 'HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings'
 $Work = Join-Path ([IO.Path]::GetTempPath()) ("tb-allsigned-" + [Guid]::NewGuid().ToString('N').Substring(0, 8))
 $failures = New-Object System.Collections.Generic.List[string]
 $addedThumbprints = New-Object System.Collections.Generic.List[string]
+$retainedRootThumbprint = $null
 
 function Say($m) { Write-Host "[allsigned] $m" }
 function Fail($m) { $script:failures.Add($m); Write-Host "[allsigned] FAIL: $m" -ForegroundColor Red }
@@ -288,6 +300,7 @@ try {
     # reason.
     Add-CertToStore -Cert $pub -StoreName 'Root'
     $addedThumbprints.Add('Root|' + $pub.Thumbprint)
+    if ($RetainSelfSignedFixturePath) { $retainedRootThumbprint = $pub.Thumbprint }
     foreach ($f in @(Get-ChildItem -LiteralPath $signedDir -File)) {
       $r = Set-AuthenticodeSignature -FilePath $f.FullName -Certificate $cert -HashAlgorithm SHA256
       if ($r.Status -ne 'Valid') { throw "self-signing produced $($r.Status) for $($f.Name)" }
@@ -589,6 +602,7 @@ try {
     elseif (Test-Path $WshKey) { Remove-ItemProperty -Path $WshKey -Name 'UseWINSAFER' -ErrorAction SilentlyContinue }
     foreach ($entry in $addedThumbprints) {
       $parts = $entry.Split('|')
+      if ($retainedRootThumbprint -and $parts[0] -eq 'Root' -and $parts[1] -eq $retainedRootThumbprint) { continue }
       Remove-CertFromStore -Thumbprint $parts[1] -StoreName $parts[0]
     }
   } catch {
@@ -604,5 +618,14 @@ if ($failures.Count -gt 0) {
   exit 1
 }
 
+if ($RetainSelfSignedFixturePath) {
+  if (-not $cert -or -not $cert.HasPrivateKey -or $cert.Thumbprint -ne $retainedRootThumbprint) {
+    Write-Error 'the retained self-signed fixture is not the exact proven certificate'
+    exit 1
+  }
+  @([pscustomobject]@{ subject = $cert.Subject; thumbprint = $cert.Thumbprint }) |
+    ConvertTo-Json -Depth 3 | Set-Content -LiteralPath $RetainSelfSignedFixturePath -Encoding UTF8
+}
+
 Say 'PASSED - unsigned is blocked, untrusted-publisher is blocked, tampered is blocked, and every shipped script is admitted.'
 exit 0

package/deploy/windows/ci/verify-update-applier.ps1

@@ -51,7 +51,25 @@
 [CmdletBinding()]
 param(
   # Arm K needs to create a local account. Off-switch for a host that forbids it.
-  [switch]$SkipUnelevatedArm
+  [switch]$SkipUnelevatedArm,
+  # The production proof owns eight minutes. Seconds are injectable only so the
+  # Windows deadline probe can prove a blocked certificate child is killed.
+  [ValidateRange(1, 480)]
+  [int]$DeadlineSeconds = 480,
+  [ValidateRange(0, 60)]
+  [int]$CertificateMintDelaySeconds = 0,
+  [switch]$CertificateDeadlineProbe,
+  # Forces Process.WaitForExit to throw on an unstarted process. CI uses this
+  # to prove the wait observer fails closed rather than calling a thrown wait a
+  # successful exit and falling into a later unbounded wait.
+  [switch]$BoundedWaitFailureProbe,
+  # The full CI proof receives the one real certificate already minted, signed,
+  # and proven by the preceding AllSigned harness. `powershell.exe` children
+  # repeatedly wedged while minting on windows-latest even though the same
+  # cmdlet succeeds in the workflow host. Keep the killable child below only for
+  # the deliberate deadline mutant; do not use that unreliable process shape
+  # as the happy-path fixture factory.
+  [string]$CertificateFixturePath
 )
 
 $ErrorActionPreference = 'Stop'
@@ -65,6 +83,7 @@ $Root = Join-Path $env:RUNNER_TEMP 'tb-update-applier'
 if (-not $env:RUNNER_TEMP) { $Root = Join-Path $env:TEMP 'tb-update-applier' }
 $Www = Join-Path $Root 'www'
 $Certs = New-Object System.Collections.Generic.List[string]
+$CertSubjects = New-Object System.Collections.Generic.List[string]
 $LocalUser = 'tbupd'
 $Failures = 0
 $StartedAt = Get-Date
@@ -81,7 +100,7 @@ $StartedAt = Get-Date
   time, because the reason that first failure was undiagnosable was that there
   was no output between "origin listening" and the first arm.
 #>
-$DeadlineMinutes = 8
+$script:DeadlineSeconds = $DeadlineSeconds
 
 function Elapsed { ((Get-Date) - $script:StartedAt).TotalSeconds }
 function Say([string]$m) { Write-Host ("[update-applier {0,6:N1}s] {1}" -f (Elapsed), $m) }
@@ -89,7 +108,7 @@ function Say([string]$m) { Write-Host ("[update-applier {0,6:N1}s] {1}" -f (Elap
 $script:CurrentPhase = 'startup'
 
 function Fail-Deadline([string]$Phase, [string]$When) {
-  Write-Host "FAIL - the harness exceeded its $($script:DeadlineMinutes)-minute deadline $When`: $Phase"
+  Write-Host "FAIL - the harness exceeded its $($script:DeadlineSeconds)-second deadline $When`: $Phase"
   Write-Host '       HARNESS BUDGET failure, not a product failure. The arms above ran;'
   Write-Host '       the ones below never started. Read the per-phase timings to find'
   Write-Host '       what got slow before assuming a defect in apply-update.ps1.'
@@ -99,12 +118,12 @@ function Fail-Deadline([string]$Phase, [string]$When) {
 
 function Assert-WithinDeadline([string]$Phase) {
   $script:CurrentPhase = $Phase
-  if (((Get-Date) - $script:StartedAt).TotalMinutes -lt $script:DeadlineMinutes) { return }
+  if ((Elapsed) -lt $script:DeadlineSeconds) { return }
   Fail-Deadline $Phase 'before starting'
 }
 
 function Remaining-DeadlineSeconds {
-  [Math]::Max(0, ($script:DeadlineMinutes * 60) - (Elapsed))
+  [Math]::Max(0, $script:DeadlineSeconds - (Elapsed))
 }
 
 <#
@@ -132,14 +151,25 @@ function Wait-Bounded {
     try { Stop-Process -Id $Process.Id -Force -ErrorAction SilentlyContinue } catch {}
     Fail-Deadline $Phase 'before starting'
   }
+  $timeoutMilliseconds = [int]([Math]::Min(2147483, $budget) * 1000)
   $exited = $false
-  try { $exited = $Process.WaitForExit([int]([Math]::Min(2147483, $budget) * 1000)) } catch { $exited = $true }
+  try {
+    $exited = $Process.WaitForExit($timeoutMilliseconds)
+  } catch {
+    $waitException = $_.Exception
+    if ($null -ne $waitException.InnerException) { $waitException = $waitException.InnerException }
+    $waitErrorType = $waitException.GetType().FullName
+    $waitErrorMessage = $waitException.Message
+    try { Stop-Process -Id $Process.Id -Force -ErrorAction SilentlyContinue } catch {}
+    try { $Process.WaitForExit(5000) | Out-Null } catch {}
+    try { $Process.Close() } catch {}
+    Die "$Phase bounded process wait failed ($waitErrorType): $waitErrorMessage"
+  }
   if (-not $exited) {
     try { Stop-Process -Id $Process.Id -Force -ErrorAction SilentlyContinue } catch {}
     try { $Process.WaitForExit(5000) | Out-Null } catch {}
     Fail-Deadline $Phase 'while running'
   }
-  try { $Process.Refresh() } catch {}
   return $Process
 }
 function Pass([string]$m) { Write-Host "PASS - $m" }
@@ -199,17 +229,111 @@ function Stop-Origin {
 # Certificates
 # ---------------------------------------------------------------------------
 function New-HarnessCert([string]$Subject) {
-  $cert = New-SelfSignedCertificate -Type CodeSigningCert -Subject "CN=$Subject" `
-    -CertStoreLocation 'Cert:\CurrentUser\My' -NotAfter (Get-Date).AddDays(2)
+  # New-SelfSignedCertificate blocked for longer than the GitHub step budget on
+  # 2026-08-15. A synchronous cmdlet cannot be interrupted by Wait-Bounded, so
+  # mint in a disposable child process. The child receives the SAME remaining
+  # whole-harness budget as every applier invocation and is forcibly killed on
+  # expiry; a phase-specific failure is emitted before the job timeout can turn
+  # the result into an unattributable cancellation.
+  $phase = "minting code-signing certificate '$Subject'"
+  $tag = [guid]::NewGuid().ToString('N')
+  $thumbprintPath = Join-Path $Root "cert-$tag.thumbprint"
+  $stderrPath = Join-Path $Root "cert-$tag.stderr"
+  $subjectLiteral = $Subject.Replace("'", "''")
+  $thumbprintLiteral = $thumbprintPath.Replace("'", "''")
+  $stderrLiteral = $stderrPath.Replace("'", "''")
+  $script:CertSubjects.Add("CN=$Subject")
+  $mintSource = @"
+`$ErrorActionPreference = 'Stop'
+`$ProgressPreference = 'SilentlyContinue'
+try {
+  if ($CertificateMintDelaySeconds -gt 0) { Start-Sleep -Seconds $CertificateMintDelaySeconds }
+  `$cert = New-SelfSignedCertificate -Type CodeSigningCert -Subject 'CN=$subjectLiteral' -CertStoreLocation 'Cert:\CurrentUser\My' -NotAfter (Get-Date).AddDays(2)
+  [System.IO.File]::WriteAllText('$thumbprintLiteral', `$cert.Thumbprint)
+} catch {
+  [System.IO.File]::WriteAllText('$stderrLiteral', (`$_ | Out-String))
+  exit 1
+}
+"@
+  $encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($mintSource))
+  $powershell = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+  $startInfo = [Diagnostics.ProcessStartInfo]::new()
+  $startInfo.FileName = $powershell
+  $startInfo.Arguments = "-NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand $encoded"
+  $startInfo.UseShellExecute = $false
+  $startInfo.CreateNoWindow = $true
+  $p = [Diagnostics.Process]::new()
+  $p.StartInfo = $startInfo
+  $null = $p.Start()
+  $null = Wait-Bounded -Process $p -Phase $phase
+  $exitCode = $p.ExitCode
+  $p.Close()
+
+  $childError = ''
+  if (Test-Path -LiteralPath $stderrPath) { $childError = (Get-Content -LiteralPath $stderrPath -Raw).Trim() }
+  if ($exitCode -ne 0) { Die "$phase failed (exit $exitCode): $childError" }
+  if (-not (Test-Path -LiteralPath $thumbprintPath)) { Die "$phase returned no thumbprint" }
+  $thumbprint = (Get-Content -LiteralPath $thumbprintPath -Raw).Trim().ToUpperInvariant()
+  if ($thumbprint -notmatch '^[0-9A-F]{40,128}$') { Die "$phase returned malformed thumbprint '$thumbprint'" }
+  $script:Certs.Add($thumbprint)
+  $cert = Get-Item -LiteralPath "Cert:\CurrentUser\My\$thumbprint" -ErrorAction Stop
+  if ((-not $cert.HasPrivateKey) -or ($cert.Subject -ne "CN=$Subject")) {
+    Die "$phase returned a certificate without the expected subject and private key"
+  }
+  Remove-Item -LiteralPath $thumbprintPath, $stderrPath -Force -ErrorAction SilentlyContinue
   # Into Root, or the chain does not build and Status is UnknownError - which
   # would make arm E fire for the wrong reason entirely.
   $pub = New-Object Security.Cryptography.X509Certificates.X509Certificate2(, $cert.RawData)
   $store = New-Object Security.Cryptography.X509Certificates.X509Store('Root', 'CurrentUser')
   $store.Open('ReadWrite'); $store.Add($pub); $store.Close()
-  $Certs.Add($cert.Thumbprint)
   return $cert
 }
 
+function Read-HarnessCertificateFixtures([string]$Path) {
+  if (-not $Path) { Die 'CertificateFixturePath is required for the full harness' }
+  if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) {
+    Die "CertificateFixturePath does not exist: $Path"
+  }
+  try {
+    $rows = @(Get-Content -LiteralPath $Path -Raw | ConvertFrom-Json)
+  } catch {
+    Die "CertificateFixturePath is not valid JSON: $($_.Exception.Message)"
+  }
+  if ($rows.Count -ne 1) { Die "CertificateFixturePath must contain exactly one certificate (got $($rows.Count))" }
+
+  $expectedSubjects = @('CN=Trillboards CI AllSigned Harness')
+  $bySubject = @{}
+  foreach ($row in $rows) {
+    $keys = @($row.PSObject.Properties.Name | Sort-Object)
+    if (($keys.Count -ne 2) -or (($keys -join ',') -ne 'subject,thumbprint')) {
+      Die 'CertificateFixturePath rows must contain exactly subject and thumbprint'
+    }
+    $subject = "$($row.subject)"
+    $thumbprint = "$($row.thumbprint)".Trim().ToUpperInvariant()
+    if ($expectedSubjects -notcontains $subject) { Die "CertificateFixturePath contains unexpected subject '$subject'" }
+    if ($bySubject.ContainsKey($subject)) { Die "CertificateFixturePath repeats subject '$subject'" }
+    if ($thumbprint -notmatch '^[0-9A-F]{40,128}$') { Die "CertificateFixturePath contains malformed thumbprint '$thumbprint'" }
+
+    $cert = Get-Item -LiteralPath "Cert:\CurrentUser\My\$thumbprint" -ErrorAction SilentlyContinue
+    if ((-not $cert) -or (-not $cert.HasPrivateKey) -or ($cert.Subject -ne $subject)) {
+      Die "CertificateFixturePath certificate '$subject' is absent or lacks its expected private key"
+    }
+    $root = Get-Item -LiteralPath "Cert:\LocalMachine\Root\$thumbprint" -ErrorAction SilentlyContinue
+    if ((-not $root) -or ($root.Subject -ne $subject) -or ($root.Thumbprint -ne $cert.Thumbprint)) {
+      Die "CertificateFixturePath certificate '$subject' is not bound to the matching trusted root"
+    }
+    $script:Certs.Add($thumbprint)
+    $script:CertSubjects.Add($subject)
+    $bySubject[$subject] = $cert
+  }
+  foreach ($subject in $expectedSubjects) {
+    if (-not $bySubject.ContainsKey($subject)) { Die "CertificateFixturePath is missing subject '$subject'" }
+  }
+  return [pscustomobject]@{
+    Good = $bySubject['CN=Trillboards CI AllSigned Harness']
+  }
+}
+
 function Remove-HarnessCerts {
   foreach ($tp in $Certs) {
     foreach ($name in @('My', 'Root')) {
@@ -221,6 +345,18 @@ function Remove-HarnessCerts {
       } catch {}
     }
   }
+  # If the child was killed after committing the store write but before writing
+  # its thumbprint marker, the parent never saw the thumbprint. Exact harness
+  # subjects are therefore a second cleanup key; they are intentionally unique
+  # to this ephemeral CI proof.
+  foreach ($name in @('My', 'Root')) {
+    try {
+      $store = New-Object Security.Cryptography.X509Certificates.X509Store($name, 'CurrentUser')
+      $store.Open('ReadWrite')
+      foreach ($c in @($store.Certificates | Where-Object { $script:CertSubjects.Contains($_.Subject) })) { $store.Remove($c) }
+      $store.Close()
+    } catch {}
+  }
 }
 
 function Sign-File([string]$Path, $Cert) {
@@ -361,11 +497,49 @@ function New-Catalog([string]$Path, [string]$Version, [string]$Sha, [long]$Size)
   plus whether staged.json exists, which together are the only observable the
   connector ever acts on.
 #>
-function Invoke-Applier([string]$InstallDir, [string[]]$Args) {
+function Invoke-Applier([string]$InstallDir, [System.Collections.IDictionary]$ApplierParameters) {
   $ps = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
-  $all = @('-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', $Applier, '-InstallDir', $InstallDir) + $Args
-  $p = Start-Process -FilePath $ps -ArgumentList $all -NoNewWindow -PassThru
+  # Start-Process flattens -ArgumentList into one command-line string without
+  # preserving element boundaries. A value such as the real signer
+  # "Trillboards CI AllSigned Harness" therefore arrives at apply-update.ps1
+  # as four positional arguments. An array splat is also positional, so it
+  # cannot reconstruct names such as -ExpectedVersion after deserialization.
+  # Carry a named parameter map as JSON inside an encoded child program instead:
+  # the only native-process argument is base64, and the child rebuilds a
+  # hashtable that PowerShell binds by parameter name without reparsing values.
+  $namedParameters = [ordered]@{ InstallDir = [string]$InstallDir }
+  foreach ($name in $ApplierParameters.Keys) {
+    if ([string]$name -eq 'InstallDir') { Die 'Invoke-Applier parameters must not override InstallDir' }
+    $namedParameters[[string]$name] = $ApplierParameters[$name]
+  }
+  $invocationJson = [ordered]@{
+    applier    = [string]$Applier
+    parameters = $namedParameters
+  } | ConvertTo-Json -Compress
+  $invocationBase64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($invocationJson))
+  $childSource = @"
+`$ErrorActionPreference = 'Stop'
+`$decodedInvocation = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('$invocationBase64'))
+`$invocation = `$decodedInvocation | ConvertFrom-Json
+`$childApplier = [string]`$invocation.applier
+`$childParameters = @{}
+foreach (`$property in @(`$invocation.parameters.PSObject.Properties)) {
+  `$childParameters[`$property.Name] = `$property.Value
+}
+& `$childApplier @childParameters
+exit `$LASTEXITCODE
+"@
+  $encodedChild = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($childSource))
+  $startInfo = [Diagnostics.ProcessStartInfo]::new()
+  $startInfo.FileName = $ps
+  $startInfo.Arguments = "-NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand $encodedChild"
+  $startInfo.UseShellExecute = $false
+  $p = [Diagnostics.Process]::new()
+  $p.StartInfo = $startInfo
+  $null = $p.Start()
   $null = Wait-Bounded -Process $p
+  $exitCode = $p.ExitCode
+  $p.Close()
   $updateDir = Join-Path $InstallDir '.auto-update'
   $outcome = $null
   $outcomePath = Join-Path $updateDir 'outcome.json'
@@ -382,7 +556,7 @@ function Invoke-Applier([string]$InstallDir, [string[]]$Args) {
     if ($null -ne $outcome.detail) { $detail = [string]$outcome.detail }
   }
   return [pscustomobject]@{
-    ExitCode = $p.ExitCode
+    ExitCode = $exitCode
     Outcome  = $outcome
     Result   = $result
     Detail   = $detail
@@ -442,15 +616,31 @@ try {
   if (-not (Test-Path -LiteralPath $Applier)) { Die "apply-update.ps1 not found at $Applier" }
   if (Test-Path -LiteralPath $Root) { Remove-Item -LiteralPath $Root -Recurse -Force }
   New-Item -ItemType Directory -Force -Path $Root, $Www | Out-Null
-  Start-Origin
-
-  Say 'minting two throwaway code-signing certificates'
-  $goodCert = New-HarnessCert 'Trillboards CI Update Harness'
-  $otherCert = New-HarnessCert 'Definitely Not Trillboards'
-  $signer = 'Trillboards CI Update Harness'
+  if (($CertificateMintDelaySeconds -gt 0) -and (-not $CertificateDeadlineProbe)) {
+    Die 'CertificateMintDelaySeconds is a deadline-probe input, not a full-harness option'
+  }
+  if ($BoundedWaitFailureProbe) {
+    $unstarted = [Diagnostics.Process]::new()
+    $null = Wait-Bounded -Process $unstarted -Phase 'bounded wait observer failure probe'
+    Die 'bounded wait observer failure probe was reclassified as a process exit'
+  }
+  if ($CertificateDeadlineProbe) {
+    if ($CertificateMintDelaySeconds -le $DeadlineSeconds) {
+      Die 'certificate deadline probe requires a mint delay longer than its deadline'
+    }
+    Say 'deadline probe: starting a deliberately blocked certificate mint'
+    $null = New-HarnessCert 'Trillboards CI Deadline Probe'
+    Die 'certificate deadline probe was not stopped by the harness deadline'
+  }
+  Say 'loading the real certificate retained from the AllSigned proof'
+  $certificateFixtures = Read-HarnessCertificateFixtures $CertificateFixturePath
+  $goodCert = $certificateFixtures.Good
+  $signer = 'Trillboards CI AllSigned Harness'
   $version = '9.9.9'
   Say 'certificates ready'
 
+  Start-Origin
+
   $payloadTree = Join-Path $Root 'payload-src'
   New-PayloadTree -Dest $payloadTree -SignCert $goodCert
   $good = Publish-Payload $payloadTree 'payload.zip'
@@ -468,8 +658,10 @@ try {
   Assert-WithinDeadline 'arm A: happy path (the shared control)'
   $installA = Join-Path $Root 'install-a'
   New-InstallTree $installA
-  $a = Invoke-Applier $installA @('-Stage', '-UpdateUrl', $urlZip, '-CatalogUrl', "$BaseUrl/catalog-good.ps1",
-    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  $a = Invoke-Applier $installA ([ordered]@{
+      Stage = $true; UpdateUrl = $urlZip; CatalogUrl = "$BaseUrl/catalog-good.ps1"
+      ExpectedVersion = $version; CurrentVersion = '9.9.8'; ExpectedSigner = $signer
+    })
   if (-not $a.Staged) {
     Die "arm A did not stage (exit $($a.ExitCode), result '$($a.Result)', detail '$($a.Detail)') - every refusal below would be VACUOUS"
   }
@@ -487,8 +679,10 @@ try {
   [System.IO.File]::WriteAllBytes($tampered, $bytes)
   $installB = Join-Path $Root 'install-b'
   New-InstallTree $installB
-  $b = Invoke-Applier $installB @('-Stage', '-UpdateUrl', "$BaseUrl/payload-tampered.zip", '-CatalogUrl', "$BaseUrl/catalog-good.ps1",
-    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  $b = Invoke-Applier $installB ([ordered]@{
+      Stage = $true; UpdateUrl = "$BaseUrl/payload-tampered.zip"; CatalogUrl = "$BaseUrl/catalog-good.ps1"
+      ExpectedVersion = $version; CurrentVersion = '9.9.8'; ExpectedSigner = $signer
+    })
   if ($b.Staged) { Bad 'arm B staged a payload whose SHA-256 did not match the signed catalog' }
   elseif ($b.Result -ne 'rejected') { Bad "arm B recorded '$($b.Result)', expected 'rejected'" }
   elseif ($b.Detail -notmatch 'SHA-256 mismatch') { Bad "arm B rejected for the wrong reason: $($b.Detail)" }
@@ -508,8 +702,10 @@ try {
   [System.IO.File]::WriteAllBytes($short, $half)
   $installC = Join-Path $Root 'install-c'
   New-InstallTree $installC
-  $c = Invoke-Applier $installC @('-Stage', '-UpdateUrl', "$BaseUrl/payload-short.zip", '-CatalogUrl', "$BaseUrl/catalog-good.ps1",
-    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  $c = Invoke-Applier $installC ([ordered]@{
+      Stage = $true; UpdateUrl = "$BaseUrl/payload-short.zip"; CatalogUrl = "$BaseUrl/catalog-good.ps1"
+      ExpectedVersion = $version; CurrentVersion = '9.9.8'; ExpectedSigner = $signer
+    })
   if ($c.Staged) { Bad 'arm C staged a truncated payload' }
   elseif ($c.Detail -notmatch 'size mismatch') { Bad "arm C rejected for the wrong reason: $($c.Detail)" }
   elseif ($c.Archive) { Bad 'arm C left the truncated archive on disk' }
@@ -525,8 +721,10 @@ try {
   }
   $installD = Join-Path $Root 'install-d'
   New-InstallTree $installD
-  $d = Invoke-Applier $installD @('-Stage', '-UpdateUrl', $urlZip, '-CatalogUrl', "$BaseUrl/catalog-unsigned.ps1",
-    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  $d = Invoke-Applier $installD ([ordered]@{
+      Stage = $true; UpdateUrl = $urlZip; CatalogUrl = "$BaseUrl/catalog-unsigned.ps1"
+      ExpectedVersion = $version; CurrentVersion = '9.9.8'; ExpectedSigner = $signer
+    })
   if ($d.Staged) { Bad 'arm D staged against an unsigned catalog' }
   elseif ($d.Detail -notmatch 'not Valid') { Bad "arm D rejected for the wrong reason: $($d.Detail)" }
   else { Pass 'an unsigned catalog is rejected' }
@@ -536,15 +734,17 @@ try {
   Assert-WithinDeadline 'arm E: the catalog is VALIDLY signed, by somebody else'
   $catalogOther = Join-Path $Www 'catalog-other.ps1'
   New-Catalog $catalogOther $version $good.Sha $good.Bytes
-  Sign-File $catalogOther $otherCert
+  Sign-File $catalogOther $goodCert
   $otherStatus = (Get-AuthenticodeSignature -LiteralPath $catalogOther).Status
   if ($otherStatus -ne 'Valid') {
     Die "arm E is VACUOUS: the other publisher's signature is '$otherStatus', not Valid - a status check alone would reject it and prove nothing about the subject check"
   }
   $installE = Join-Path $Root 'install-e'
   New-InstallTree $installE
-  $e = Invoke-Applier $installE @('-Stage', '-UpdateUrl', $urlZip, '-CatalogUrl', "$BaseUrl/catalog-other.ps1",
-    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  $e = Invoke-Applier $installE ([ordered]@{
+      Stage = $true; UpdateUrl = $urlZip; CatalogUrl = "$BaseUrl/catalog-other.ps1"
+      ExpectedVersion = $version; CurrentVersion = '9.9.8'; ExpectedSigner = 'Definitely Not Trillboards'
+    })
   if ($e.Staged) { Bad 'arm E staged a catalog signed by an unexpected publisher' }
   elseif ($e.Detail -notmatch 'unexpected publisher') { Bad "arm E rejected for the wrong reason: $($e.Detail)" }
   else { Pass 'a VALID signature from the wrong publisher is rejected on the subject' }
@@ -559,8 +759,10 @@ try {
   if ($editedStatus -eq 'Valid') { Die 'arm F is VACUOUS: the edited catalog still reports Valid' }
   $installF = Join-Path $Root 'install-f'
   New-InstallTree $installF
-  $f = Invoke-Applier $installF @('-Stage', '-UpdateUrl', $urlZip, '-CatalogUrl', "$BaseUrl/catalog-edited.ps1",
-    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  $f = Invoke-Applier $installF ([ordered]@{
+      Stage = $true; UpdateUrl = $urlZip; CatalogUrl = "$BaseUrl/catalog-edited.ps1"
+      ExpectedVersion = $version; CurrentVersion = '9.9.8'; ExpectedSigner = $signer
+    })
   if ($f.Staged) { Bad 'arm F staged a catalog that was edited after signing' }
   else { Pass "a catalog edited after signing is rejected ($editedStatus)" }
 
@@ -572,8 +774,10 @@ try {
   Sign-File $huge $goodCert
   $installG = Join-Path $Root 'install-g'
   New-InstallTree $installG
-  $g = Invoke-Applier $installG @('-Stage', '-UpdateUrl', $urlZip, '-CatalogUrl', "$BaseUrl/catalog-huge.ps1",
-    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  $g = Invoke-Applier $installG ([ordered]@{
+      Stage = $true; UpdateUrl = $urlZip; CatalogUrl = "$BaseUrl/catalog-huge.ps1"
+      ExpectedVersion = $version; CurrentVersion = '9.9.8'; ExpectedSigner = $signer
+    })
   if ($g.Staged) { Bad 'arm G staged a payload that cannot fit' }
   elseif ($g.Detail -notmatch 'free disk space') { Bad "arm G rejected for the wrong reason: $($g.Detail)" }
   elseif ($g.Archive) { Bad 'arm G downloaded before checking that the payload would fit' }
@@ -590,8 +794,10 @@ try {
   Sign-File $catalogRogue $goodCert
   $installH = Join-Path $Root 'install-h'
   New-InstallTree $installH
-  $h = Invoke-Applier $installH @('-Stage', '-UpdateUrl', "$BaseUrl/payload-rogue.zip", '-CatalogUrl', "$BaseUrl/catalog-rogue.ps1",
-    '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+  $h = Invoke-Applier $installH ([ordered]@{
+      Stage = $true; UpdateUrl = "$BaseUrl/payload-rogue.zip"; CatalogUrl = "$BaseUrl/catalog-rogue.ps1"
+      ExpectedVersion = $version; CurrentVersion = '9.9.8'; ExpectedSigner = $signer
+    })
   if ($h.Staged) { Bad 'arm H staged a payload containing an unsigned script' }
   elseif ($h.Detail -notmatch 'unsigned or invalid') { Bad "arm H rejected for the wrong reason: $($h.Detail)" }
   else { Pass 'a payload carrying an unsigned script is rejected' }
@@ -613,9 +819,11 @@ try {
     New-Catalog $catDown $version $down.Sha $down.Bytes
     Sign-File $catDown $goodCert
 
-    $staged = Invoke-Applier $installJ @('-Stage', '-UpdateUrl', "$BaseUrl/payload-down-$($arm.Name).zip",
-      '-CatalogUrl', "$BaseUrl/catalog-down-$($arm.Name).ps1", '-ExpectedVersion', $version,
-      '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+    $staged = Invoke-Applier $installJ ([ordered]@{
+        Stage = $true; UpdateUrl = "$BaseUrl/payload-down-$($arm.Name).zip"
+        CatalogUrl = "$BaseUrl/catalog-down-$($arm.Name).ps1"; ExpectedVersion = $version
+        CurrentVersion = '9.9.8'; ExpectedSigner = $signer
+      })
     if (-not $staged.Staged) { Die "arm $($arm.Name) could not stage: $($staged.Detail)" }
 
     Register-HeadlessTask $installJ
@@ -633,9 +841,9 @@ try {
       Die "arm $($arm.Name) is VACUOUS: node.exe was not locked while the connector was running, so a successful swap proves nothing"
     }
 
-    $args = @('-Commit', '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8')
-    if ($arm.Skip) { $args += '-SkipTaskShapeRestore' }
-    $j = Invoke-Applier $installJ $args
+    $commitParameters = [ordered]@{ Commit = $true; ExpectedVersion = $version; CurrentVersion = '9.9.8' }
+    if ($arm.Skip) { $commitParameters['SkipTaskShapeRestore'] = $true }
+    $j = Invoke-Applier $installJ $commitParameters
     try { Stop-Process -Id $running.Id -Force -ErrorAction SilentlyContinue } catch {}
 
     $after = Get-Shape $TaskName
@@ -670,8 +878,10 @@ try {
     $catK = Join-Path $Www 'catalog-k.ps1'
     New-Catalog $catK $version $down.Sha $down.Bytes
     Sign-File $catK $goodCert
-    $stagedK = Invoke-Applier $installK @('-Stage', '-UpdateUrl', "$BaseUrl/payload-k.zip", '-CatalogUrl', "$BaseUrl/catalog-k.ps1",
-      '-ExpectedVersion', $version, '-CurrentVersion', '9.9.8', '-ExpectedSigner', $signer)
+    $stagedK = Invoke-Applier $installK ([ordered]@{
+        Stage = $true; UpdateUrl = "$BaseUrl/payload-k.zip"; CatalogUrl = "$BaseUrl/catalog-k.ps1"
+        ExpectedVersion = $version; CurrentVersion = '9.9.8'; ExpectedSigner = $signer
+      })
     if (-not $stagedK.Staged) { Die "arm K could not stage: $($stagedK.Detail)" }
     Register-HeadlessTask $installK
     $beforeK = Get-Shape $TaskName

package/dist/EdgeAgent.js

@@ -44,7 +44,7 @@ const edge_ads_1 = require("@trillboards/edge-ads");
 const CommandRouter_1 = require("./CommandRouter");
 const config_1 = require("./config");
 const dataDir_1 = require("./dataDir");
-const SDK_VERSION = '0.2.26';
+const SDK_VERSION = '0.2.36';
 class EdgeAgent extends events_1.EventEmitter {
     constructor(config, deps) {
         super();

package/dist/diagnose.d.ts

@@ -31,7 +31,7 @@ export interface DiagnosticReport {
         skipped: number;
     };
 }
-declare const SDK_VERSION = "0.2.26";
+declare const SDK_VERSION = "0.2.36";
 declare function checkNodeVersion(): CheckResult;
 declare function checkPlatform(): CheckResult;
 declare function checkMemory(): CheckResult;

package/dist/diagnose.js

@@ -63,7 +63,7 @@ const localNetworkAccess_1 = require("./localNetworkAccess");
 // ---------------------------------------------------------------------------
 // SDK version — mirrors package.json; kept in sync by CI
 // ---------------------------------------------------------------------------
-const SDK_VERSION = '0.2.26';
+const SDK_VERSION = '0.2.36';
 exports._SDK_VERSION = SDK_VERSION;
 // ---------------------------------------------------------------------------
 // ANSI helpers (no external deps)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trillboards/edge-sdk",
-  "version": "0.2.26",
+  "version": "0.2.36",
   "description": "Composable cross-platform Edge AI SDK for audience sensing on DOOH/CTV devices",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",