Files

cproudlock eaf2dbf167 test harness: smoke-pass B-enforce, fix four issues

Harness now passes 9/9 across baseline + heal + idempotent phases on the
win11 VM (Standard/Machine), with 6 drift scenarios applied + healed
between the baseline and heal cycles in ~30s total.

Fixes:

1. lib/qga-run.py - extracted the qga round-trip out of an inline
   `python3 - <<PY` heredoc. The inline form clobbered stdin (heredoc
   replaces stdin to feed python the script, leaving sys.stdin empty
   for the PowerShell snippet the function caller piped in).
2. lib/qga.sh - dropped `set -euo pipefail`. When sourced, it leaked
   into the harness shell. Then any captured `out=$(qga_run_ps ...)`
   that exited non-zero (verify-state.ps1 returns 1 on any FAIL,
   normal during drift phases) would silently abort the harness.
   Callers handle non-zero with `|| rc=$?`.
3. B-enforce/run.sh do_verify - rewritten to capture rc, parse summary
   line, distinguish expect_pass=true vs false, route to ok / fail
   helper without aborting the harness on a normal non-zero verify.
4. matrix.json WJF Defect Tracker entry - switched detection from File
   to Registry (uninstall key DisplayVersion). The MSI does not drop
   the Defect_Tracker.exe artifact at the documented path even though
   the manifest's File detection treats it as installed; the uninstall
   reg entry is the reliable install marker. v2 manifest's File
   detection path may also need fixing, separate task.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-02 17:45:06 -04:00

B-enforce

test harness: smoke-pass B-enforce, fix four issues

2026-05-02 17:45:06 -04:00

lib

test harness: smoke-pass B-enforce, fix four issues

2026-05-02 17:45:06 -04:00

matrix.json

test harness: smoke-pass B-enforce, fix four issues

2026-05-02 17:45:06 -04:00

README.md

Stage 2a: unified GE-Enforce framework + share-root mirror

2026-04-22 11:19:23 -04:00

SCOPE.md

Add SCOPE.md for shopfloor test harness

2026-05-02 16:57:59 -04:00

vm-test-harness.ps1

Stage 2a: unified GE-Enforce framework + share-root mirror

2026-04-22 11:19:23 -04:00

README.md

Shopfloor enforcer regression tests

Lightweight harness for end-to-end validation of GE-Enforce.ps1 + Install-FromManifest.ps1 against the v2 staging tree, using the Win11 analyzer VM as a synthetic shopfloor PC.

Files

vm-test-harness.ps1 — setup + invocation of GE-Enforce inside the VM. Accepts -PCType and -PCSubType parameters. Creates C:\Enrollment\ stubs (pc-type.txt, pc-subtype.txt, site-config.json), stages the enforcer runtime from \\192.168.122.1\pxe-images\enforcer-stage\, injects a fake SFLD credential in HKLM:\SOFTWARE\GE\SFLD\Credentials\samba pointing at the host's samba share as if it were tsgwp00525, then runs GE-Enforce.ps1 with output captured.

Prereqs

win11 libvirt VM running, IP reachable at 192.168.122.210
qemu-guest-agent exec path available (/tmp/guest-exec.sh)
host samba shares pxe-images + windows-projects writable by camp user
enforcer staged at /home/camp/pxe-images/enforcer-stage/ (via cp <repo>/common/GE-Enforce.ps1 <repo>/common/lib/Install-FromManifest.ps1 /home/camp/pxe-images/enforcer-stage/)
v2 share staging at /home/camp/pxe-images/tsgwp00525-v2/...

Usage

From the repo root on the host:

# Round 1: Shopfloor scope (exercises common manifest, PCTypes filter for Oracle)
B64=$(iconv -f UTF-8 -t UTF-16LE common/test/vm-test-harness.ps1 | base64 -w0)
/tmp/guest-exec.sh powershell.exe "[\"-NoProfile\",\"-EncodedCommand\",\"$B64\"]"

Or with non-default pcType (wrap in a tiny outer script that sets parameters):

cat > /tmp/round.ps1 <<'EOF'
$PCType = 'Standard'
$PCSubType = 'Machine'
EOF
sed -n '/^param(/,/^)/!p' common/test/vm-test-harness.ps1 >> /tmp/round.ps1
B64=$(iconv -f UTF-8 -t UTF-16LE /tmp/round.ps1 | base64 -w0)
/tmp/guest-exec.sh powershell.exe "[\"-NoProfile\",\"-EncodedCommand\",\"$B64\"]"

What each round validates

Round	pcType / pcSubType	Exercises
1	Shopfloor / —	common manifest only, PCTypes filter (Oracle skips)
2	Standard / Machine	common + standard-machine manifests, eDNC upgrade detection, UDC skip, eMxInfo cmd
3	Keyence / —	common + keyence manifest, VR-6000 MSI detection, pnputil INF detection
4	Display / —	common + display manifest, kiosk-setup CMD wrapper
5 (composite)	Shopfloor with a corrupted manifest / bad SFLD creds / tampered local XML	graceful-degradation paths + upgrade/rollback via hash mismatch

See the main repo enforcer design doc (TBD) for scenario details.

Known cleanup after test runs

The harness intentionally leaves installed apps in place (Acrobat Reader DC, WJF Defect Tracker, 3OF9 font, Edge site-list XML, Firefox if tested). To reset to a clean baseline, revert the VM to the clean-base libvirt snapshot: virsh snapshot-revert win11 clean-base.
Orphan msiexec.exe workers from long-running installs (UDC_Setup, PC-DMIS) can leave the MSI mutex held, blocking the next install with 1619/1618. Between rounds if you hit this:
```
Get-Process -Name msiexec -ErrorAction SilentlyContinue | Stop-Process -Force
```
Note: a Stage 2b lib improvement is planned to retry once on 1618 after killing stale msiexec processes.