winpe: externalize WinPE-phase status push to scripts/winpe-status-push.ps1

The inline one-liner in startnet.cmd called Get-NetAdapter, which is
not available in WinPE's stripped PowerShell (no NetTCPIP module).
Errors silently swallowed by the surrounding try/catch - POST never
fired, dashboard never showed bays during the WIM-apply phase.

Externalize to a standalone .ps1 on the enrollment share:

  * Uses wmic (always present in WinPE 10+) for both serial AND mac
    instead of Get-CimInstance / Get-NetAdapter.
  * Logs every step to X:\Windows\Temp\winpe-status-push.log so a
    future "POST didn't fire" debug is one file read away.
  * startnet.cmd now just runs powershell -File Y:\scripts\winpe-status-
    push.ps1. Future edits to the push logic do NOT require a boot.wim
    rebuild; just edit the .ps1 on the share.

Mirror the existing pattern for run-enrollment.ps1 / wait-for-internet.ps1
/ migrate-to-wifi.ps1 (all already at /srv/samba/enrollment/scripts/).
Add the new file to the playbook's enrollment-scripts copy loop.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

playbook/pxe_server_setup.yml

@@ -404,6 +404,7 @@
         - { src: "{{ usb_mount }}/shopfloor-setup/run-enrollment.ps1", dest: "run-enrollment.ps1" }
         - { src: "{{ usb_mount }}/wait-for-internet.ps1",              dest: "wait-for-internet.ps1" }
         - { src: "{{ usb_mount }}/migrate-to-wifi.ps1",                dest: "migrate-to-wifi.ps1" }
+        - { src: "{{ usb_mount }}/winpe-status-push.ps1",              dest: "winpe-status-push.ps1" }
       ignore_errors: yes
 
     - name: "Deploy site-config.json to config/"

playbook/startnet.cmd

@@ -247,12 +247,12 @@ goto end
 echo.
 
 REM --- Push initial "WinPE staging" status to PXE webapp ---
-REM Best-effort POST so the imaging dashboard shows this bay during the
+REM Externalized to Y:\scripts\winpe-status-push.ps1 so future edits don't
-REM WinPE / WIM-apply phase, BEFORE Run-ShopfloorSetup.ps1 takes over the
+REM require a boot.wim rebuild. Best-effort; the script logs to
-REM status updates post-PPKG. Identifies the session by BIOS serial.
+REM X:\Windows\Temp\winpe-status-push.log and swallows all errors.
-REM Errors are swallowed - never block imaging on a status push.
+if exist "Y:\scripts\winpe-status-push.ps1" (
-for /f "tokens=2 delims==" %%S in ('wmic bios get serialnumber /value 2^>nul ^| find "="') do set BIOS_SERIAL=%%S
+    powershell -NoProfile -ExecutionPolicy Bypass -File "Y:\scripts\winpe-status-push.ps1"
-powershell -NoProfile -ExecutionPolicy Bypass -Command "try { $body = @{ serial=$env:BIOS_SERIAL; mac=((Get-NetAdapter -Physical | Where-Object { $_.Status -eq 'Up' } | Select-Object -First 1).MacAddress -replace '-',':'); pctype=$env:PCTYPE; current_stage='WinPE: PESetup / WIM apply'; stage_index=1; stage_total=8; status='in_progress' } | ConvertTo-Json -Compress; Invoke-WebRequest -Uri 'http://10.9.100.1:9009/imaging/status' -Method POST -Body $body -ContentType 'application/json' -UseBasicParsing -TimeoutSec 5 | Out-Null } catch { }"
+)
 
 echo Waiting for PESetup.exe to start...
 :wait_start

playbook/winpe-status-push.ps1

@@ -0,0 +1,75 @@
+# winpe-status-push.ps1 - Posts "WinPE: PESetup / WIM apply" status to the
+# PXE webapp /imaging/status endpoint so the imaging dashboard reflects
+# this bay BEFORE Run-ShopfloorSetup.ps1 takes over post-PPKG.
+#
+# Runs in WinPE's stripped PowerShell - cannot rely on Get-NetAdapter,
+# Get-CimInstance, or the NetTCPIP module (none are present in stock
+# WinPE). Uses wmic for both serial and MAC.
+#
+# Best-effort: never blocks imaging. All steps log to
+# X:\Windows\Temp\winpe-status-push.log; failures are swallowed.
+
+param(
+    [string]$PxeServer = '10.9.100.1',
+    [int]$Port = 9009,
+    [int]$TimeoutSec = 5,
+    [string]$PCType = $env:PCTYPE
+)
+
+$logFile = 'X:\Windows\Temp\winpe-status-push.log'
+function Log {
+    param([string]$msg)
+    try { "$(Get-Date -Format s) $msg" | Out-File -FilePath $logFile -Append -Encoding utf8 } catch { }
+}
+
+Log "=== winpe-status-push start ==="
+Log "server=$PxeServer:$Port  pctype=$PCType"
+
+# Serial via wmic. Always available in WinPE 10+.
+$serial = ''
+try {
+    $line = (& wmic bios get serialnumber /value 2>$null | Where-Object { $_ -match '=' } | Select-Object -First 1)
+    if ($line) { $serial = ($line -split '=', 2)[1].Trim() }
+} catch { Log "serial wmic exception: $_" }
+Log "serial=$serial"
+
+# MAC via wmic NIC enumeration. NetEnabled filter restricts to up adapters.
+$mac = ''
+try {
+    $macLines = & wmic nic where 'NetEnabled=TRUE' get MacAddress /value 2>$null |
+                Where-Object { $_ -match 'MacAddress=' }
+    if ($macLines) {
+        $first = ($macLines | Select-Object -First 1)
+        $mac = (($first -split '=', 2)[1]).Trim() -replace '-', ':'
+    }
+} catch { Log "mac wmic exception: $_" }
+Log "mac=$mac"
+
+if (-not $serial) {
+    Log "no serial captured - aborting POST"
+    exit 0
+}
+
+# Compose JSON. ConvertTo-Json works in WinPE.
+$payload = @{
+    serial        = $serial
+    pctype        = $PCType
+    current_stage = 'WinPE: PESetup / WIM apply'
+    stage_index   = 1
+    stage_total   = 8
+    status        = 'in_progress'
+}
+if ($mac) { $payload.mac = $mac }
+$body = $payload | ConvertTo-Json -Compress
+$uri  = "http://${PxeServer}:${Port}/imaging/status"
+Log "POST $uri  body=$body"
+
+try {
+    $resp = Invoke-WebRequest -Uri $uri -Method POST -Body $body `
+        -ContentType 'application/json' -UseBasicParsing -TimeoutSec $TimeoutSec -ErrorAction Stop
+    Log "OK http=$($resp.StatusCode)"
+} catch {
+    Log "ERR $($_.Exception.Message)"
+}
+
+exit 0