psadt-deploy-skill 0.41.0 → 0.43.0

package/README.md

@@ -15,8 +15,7 @@
 <p align="center"><sub><a href="#quick-start">Quick start</a> · <a href="#how-it-works">How it works</a> · <a href="#what-makes-it-different">What makes it different</a> · <a href="#go-deeper">Go deeper</a> · <a href="#security">Security</a> · <a href="#changelog">Changelog</a></sub></p>
 
 ---
-
-<img width="3200" height="2000" alt="psadt-workflow-v035" src="https://github.com/user-attachments/assets/d9b1c137-3e0a-4a80-a40f-9a234903bb97" />
+<img width="3200" height="1637" alt="psadt-workflow" src="https://github.com/user-attachments/assets/6a0eff79-8165-4994-83e0-d2476f204ff8" />
 
 ## What is this?
 
@@ -104,7 +103,7 @@ the same app from disagreeing about their own version.
 - **A dossier is produced every time**, uploaded or not: one self-contained bilingual HTML file with the
   return-code map, the detection rule, the hooks, the test results - and a ready-to-paste Company-Portal
   description.
-- **738 Pester tests**, including drift guards that fail when the documentation and the code disagree -
+- **757 Pester tests**, including drift guards that fail when the documentation and the code disagree -
   one of them reads the published landing page and compares its figures against this repository.
 
 ## Go deeper
@@ -122,7 +121,7 @@ the same app from disagreeing about their own version.
 ## Status
 
 In active use for the full build → package → test → dossier workflow, with the direct Graph upload
-verified against a live tenant. The helper scripts are covered by 738 Pester tests.
+verified against a live tenant. The helper scripts are covered by 757 Pester tests.
 
 One open point, honestly: **the driver `pnputil` exit-code semantics are documented, not verified here.**
 `0` / `259` / `3010` and the two `0xE...` failures come from Microsoft's documentation; confirming them
@@ -171,9 +170,12 @@ installed.
 **[CHANGELOG.md](CHANGELOG.md)** carries the complete history, every release since 0.1.0, and nothing is
 ever removed from it.
 
-Latest: **0.41.0 - The catalog proved it, and the ladder went looking anyway.** The store recorded a
-proven uninstall switch and the research gate never read it, so a sub-agent was dispatched to find a
-command the skill had already proven. On Firefox 156.0 that cut the dispatch from three agents to two,
-and an exact hash match now leaves exactly one - the Intune pitfalls, which no local run can settle. A
-version bump changes the hash, not the installation, so a neighbouring build's proof is demoted to
-`medium` and handed to the probe run instead of to a search.
+Latest: **0.43.0 - The command that writes to the tenant could not bind.** A deep analysis of 0.42.0 read
+every control `SECURITY.md` claims, packaged an app end to end and ran the suite; its five stop-ship
+findings are fixed here. The Phase 9 upload command shown in `SKILL.md` could not bind, because
+`-IntuneWinPath` was mandatory while the artifact had been in the manifest since Phase 7 - and a new guard
+now binds every invocation the control plane shows against the real parameter sets. The third-party WinGet
+module that ships inside the `.intunewin` is pinned by SHA256 instead of a two-byte header. Three operator
+values that reached scripts running as SYSTEM are escaped or validated. A legacy config can no longer be
+written to, so the secret cannot be created inside the skill folder. The dossier template no longer names a
+customer.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "psadt-deploy-skill",
-  "version": "0.41.0",
+  "version": "0.43.0",
   "description": "Installer for the psadt-deploy Claude Code skill: build, test and deploy PSADT v4.x Intune Win32 packages.",
   "keywords": [
     "psadt",