68df59e117
OWNERSHIP.md Every expensive bug in this pipeline has had one shape: two systems setting the same thing, last writer winning silently. Four happened on 2026-08-06 alone - computer name (package vs run-enrollment), drive letters (PESetup vs a volume finder), enrollment (package vs an at-logon -ManualFallback task that syspreped finished machines), kiosk URLs (GE-Enforce vs site-config). Each is written down with the evidence so the next person deletes a writer instead of adding one. share-drift.py The share is production and the repo is meant to describe it, but drift runs both ways: live hand-edits nobody committed, and repo fixes never deployed. The unattend outage lived only on the share while the repo copy was fine, and nothing compared them. Each mapped pair is classified. git-owned means the repo wins and the pair must match - those fail the run. unreconciled means the two have genuinely diverged and nobody has decided; reported, not failed. The unattends are unreconciled on purpose: live is ~17 KB against ~12 KB in the repo, so a blind push would regress production. Reads over SSH via base64 so BOM and CRLF survive the hop. First run: 8 git-owned pairs all match, 4 known-unreconciled. Run-ShopfloorSetup.ps1 Corrects a comment that was actively misleading. It claimed shopfloor PCs are "vanilla by design" and that the orchestrator runs -ManualFallback to skip BPRT injection and the package entirely. Shopfloor bays DO enrol - the SFLD package joins Entra with its BPRT token and a human assigns the device category in Intune. -ManualFallback runs sysprep /oobe /reboot, which is why wiring it to an at-logon task destroyed the deployment chain. The absent Entra wait is still correct, for a different reason: at that point the bay is on the isolated PXE LAN with no route to Entra (579C144 held 172.16.9.81 and 172.24.19.142, neither in the production ranges). sync_intune retries until the tech re-cables. "Entra ID Joined: false" right after imaging is normal.
6.0 KiB
Executable File
6.0 KiB
Executable File