c890e5b46c
Phase 5 + 6 of the gea-shopfloor-* rename.
Get-PCProfile.ps1: when the legacy profileKey ("Standard-Machine",
"CMM", etc.) is missing from siteConfig.pcProfiles, walks the alias
group and returns the first matching new key ("gea-shopfloor-collections",
"gea-shopfloor-cmm", etc.). Vice versa: a fleet PC writing the new
string finds its profile under the old key. Same alias map shape as
GE-Enforce + Install-FromManifest, kept in sync manually for now -
extract to shared file later if drift becomes a problem.
matrix.json: adds 3 new rows for gea-shopfloor-nocollections,
gea-shopfloor-common (Timeclock+Lab merge), gea-shopfloor-heattreat
(placeholder). Existing rows for legacy names retained; the new
verify-state alias resolution lets either be requested.
verify-state.ps1: Test-MatrixEntryMatches walks the alias map so
harness invocation with "Standard Machine" or "gea-shopfloor-collections"
both resolve to the same matrix row.
Smoke-tested via qga-as-SYSTEM on win11: legacy Standard/Machine,
new gea-shopfloor-collections, and new gea-shopfloor-nocollections
all return 10/10 pass against current VM state.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Shopfloor enforcer regression tests
Lightweight harness for end-to-end validation of GE-Enforce.ps1 +
Install-FromManifest.ps1 against the v2 staging tree, using the Win11
analyzer VM as a synthetic shopfloor PC.
Files
vm-test-harness.ps1— setup + invocation of GE-Enforce inside the VM. Accepts-PCTypeand-PCSubTypeparameters. CreatesC:\Enrollment\stubs (pc-type.txt, pc-subtype.txt, site-config.json), stages the enforcer runtime from\\192.168.122.1\pxe-images\enforcer-stage\, injects a fake SFLD credential inHKLM:\SOFTWARE\GE\SFLD\Credentials\sambapointing at the host's samba share as if it were tsgwp00525, then runsGE-Enforce.ps1with output captured.
Prereqs
win11libvirt VM running, IP reachable at 192.168.122.210- qemu-guest-agent exec path available (
/tmp/guest-exec.sh) - host samba shares
pxe-images+windows-projectswritable bycampuser - enforcer staged at
/home/camp/pxe-images/enforcer-stage/(viacp <repo>/common/GE-Enforce.ps1 <repo>/common/lib/Install-FromManifest.ps1 /home/camp/pxe-images/enforcer-stage/) - v2 share staging at
/home/camp/pxe-images/tsgwp00525-v2/...
Usage
From the repo root on the host:
# Round 1: Shopfloor scope (exercises common manifest, PCTypes filter for Oracle)
B64=$(iconv -f UTF-8 -t UTF-16LE common/test/vm-test-harness.ps1 | base64 -w0)
/tmp/guest-exec.sh powershell.exe "[\"-NoProfile\",\"-EncodedCommand\",\"$B64\"]"
Or with non-default pcType (wrap in a tiny outer script that sets parameters):
cat > /tmp/round.ps1 <<'EOF'
$PCType = 'Standard'
$PCSubType = 'Machine'
EOF
sed -n '/^param(/,/^)/!p' common/test/vm-test-harness.ps1 >> /tmp/round.ps1
B64=$(iconv -f UTF-8 -t UTF-16LE /tmp/round.ps1 | base64 -w0)
/tmp/guest-exec.sh powershell.exe "[\"-NoProfile\",\"-EncodedCommand\",\"$B64\"]"
What each round validates
| Round | pcType / pcSubType | Exercises |
|---|---|---|
| 1 | Shopfloor / — | common manifest only, PCTypes filter (Oracle skips) |
| 2 | Standard / Machine | common + standard-machine manifests, eDNC upgrade detection, UDC skip, eMxInfo cmd |
| 3 | Keyence / — | common + keyence manifest, VR-6000 MSI detection, pnputil INF detection |
| 4 | Display / — | common + display manifest, kiosk-setup CMD wrapper |
| 5 (composite) | Shopfloor with a corrupted manifest / bad SFLD creds / tampered local XML | graceful-degradation paths + upgrade/rollback via hash mismatch |
See the main repo enforcer design doc (TBD) for scenario details.
Known cleanup after test runs
-
The harness intentionally leaves installed apps in place (Acrobat Reader DC, WJF Defect Tracker, 3OF9 font, Edge site-list XML, Firefox if tested). To reset to a clean baseline, revert the VM to the
clean-baselibvirt snapshot:virsh snapshot-revert win11 clean-base. -
Orphan
msiexec.exeworkers from long-running installs (UDC_Setup, PC-DMIS) can leave the MSI mutex held, blocking the next install with 1619/1618. Between rounds if you hit this:Get-Process -Name msiexec -ErrorAction SilentlyContinue | Stop-Process -ForceNote: a Stage 2b lib improvement is planned to retry once on 1618 after killing stale msiexec processes.