shopdb-flask/docs/GE-ENFORCE.md

# GE-Enforce: concepts, the shopdb plugin, and imaging-time integration

This guide explains how GE-Enforce works, how the shopdb `geenforce` plugin
manages it, and when GE-Enforce installs and takes over during the imaging
process. It is written for site IT.

It pairs with two companion docs:
- `docs/GE-ENFORCE-CLIENT.md` - the client fetch/report contract + the reference
  PowerShell kit (`plugins/geenforce/client/`).
- `docs/proposals/ge-enforce-plugin.md` - the design/plan and the staged cutover.

The ground truth for behavior is the engine itself
(`Install-FromManifest.ps1`) and the on-share manifests; this guide describes
what they do, it does not replace them.

---

## 1. What GE-Enforce is

GE-Enforce is a **desired-state enforcement** system for shopfloor PCs. Instead
of a one-time install during imaging, it continuously makes each PC match a
declared list of what should be installed - and RE-installs anything that drifts
(uninstalled, corrupted, or overwritten). It is the shopfloor equivalent of a
lightweight, air-gapped-friendly configuration-management agent.

Two things make up the system:

1. **The engine + dispatcher on each PC** - PowerShell that reads a manifest and
   enforces it every logon and periodically.
2. **The manifests** - JSON files that declare, per imaging PC type, what to
   install / copy / write and how to detect whether it is already correct.

The shopdb `geenforce` plugin adds a third piece: it lets you **author, publish,
and version those manifests in shopdb** (instead of hand-editing JSON on a file
share) and **see what every PC actually did** (fleet compliance reporting).

---

## 2. How GE-Enforce works (the framework)

### 2.1 Two phases

Every shopfloor PC is governed in two distinct phases:

| Phase | When | Runs what | Purpose |
|---|---|---|---|
| **Preinstall** | ONCE, at imaging | `preinstall.json` (via the imaging `00-PreInstall` step) | Day-zero foundation: PowerShell 7, the VC++ redistributable matrix, Oracle Client, Adobe Reader, HostExplorer, serial drivers, etc. "Install once at imaging, no drift correction." |
| **Runtime** | EVERY logon + periodically | `common/manifest.json`, then `gea-shopfloor-<type>/manifest.json`, then an optional `<type>-<subtype>` manifest | Ongoing enforcement + self-heal: app versions, config-file drift, registry drift, per-cycle scripts (asset report, VNC firewall, EventSaver), version-gated installs. |

The two phases share the same entry SHAPE (field names) but are run by different
runners with different capabilities. Preinstall is a one-shot at imaging that
implements only `Type=MSI` and `Type=EXE`, with only `Registry` / `File`
detection (other types/detections are skipped). Runtime is the continuous
enforcement loop and implements the full Type + DetectionMethod matrix below.

### 2.2 The runtime loop, step by step

On each cycle (`GE-Enforce.ps1` on the PC):

1. Read the PC's identity from `C:\Enrollment\` (see 2.4).
2. Look up the SFLD share credential in the registry and **mount the share**
   (SYSTEM cannot reach the share as its computer account, so it mounts as the
   provisioned SFLD user - `net use W: ...`). If no credential yet, exit 0 and
   retry next cycle (Azure DSC has not provisioned it).
3. Run the engine (`Install-FromManifest.ps1`) against `common/manifest.json`,
   then `gea-shopfloor-<pctype>/manifest.json`, then a `<pctype>-<subtype>`
   manifest if one exists. Common runs first so shared prerequisites (e.g.
   Oracle Client) land before type-specific apps that depend on them.
4. Write a status file back to the share (and, in the shopdb model, POST a
   report - see 4.3).

Every failure is non-fatal (exit 0) so a network blip or a not-yet-provisioned
credential never blocks or breaks a PC.

### 2.3 The manifest: scopes and entries

A manifest is `{ "Version", "_comment", "Applications": [ entry, ... ] }`. Each
imaging PC type is a **scope** with its own manifest, plus the fleet-wide
`common` scope:

- `common` - runs on EVERY PC type; entries use a `PCTypes` filter to target
  subsets (e.g. "EventSaver on collections + heattreat, but not CMM").
- `gea-shopfloor-collections`, `-nocollections`, `-cmm`, `-keyence`, `-common`
  (lab/timeclock), `-genspect`, `-heattreat`, `-partmarker`, `-waxtrace` - each
  runs only on PCs of that type, so its entries usually do NOT set `PCTypes`
  (the manifest already only runs there). Keyence is the exception: it uses
  `PCTypes` for hardware SUBTYPE targeting (`keyence-vr6000` vs `keyence-vr3000`).

Each **entry** declares one action. Its `Type` picks the action:

| Type | Action |
|---|---|
| MSI / EXE / CMD / BAT | run an installer with `InstallArgs` |
| PS1 | run a script from the share |
| INF | install a driver via `pnputil` |
| File | copy `Source` -> `Destination` |
| Registry | write a value |

### 2.4 Self-heal via detection

Every entry has a `DetectionMethod` that decides whether the action fires:

| Method | Means "already correct" when... |
|---|---|
| Registry | the key/value exists (optionally equals a value) |
| File | the file exists |
| FileVersion | the file's version string matches exactly (fleet convention is a 4-part string like 6.4.5.0; the engine does a raw string compare, it does not enforce 4 parts) |
| Hash | the file's SHA256 matches (case-insensitive) |
| MarkerFile | a marker file exists (the engine writes it after a clean install) |
| ValueMatches | a registry value equals the entry's target |
| pnputil | a driver matching a pattern is present |
| Always / (none) | fires EVERY cycle (used for per-cycle scripts) |

If detection says "not correct," the action runs. That is the self-heal: delete
`DncMain.exe` and next cycle re-installs eDNC; corrupt a config file whose Hash
no longer matches and next cycle re-copies it. **Entry order is execution
order** - config-restore entries sit AFTER their installer so a mid-cycle vendor
overwrite is healed on the same cycle.

### 2.5 Targeting gates (all ANDed)

An entry can be narrowed by any combination of:

- `PCTypes` - which PC types (alias-aware: old names like `Standard` map to
  `collections`/`nocollections`/`common`). Fleet-wide `common` uses this heavily.
- `TargetHostnames` - specific hostnames (supports `*` wildcards).
- `TargetMachineNumbers` - specific bay machine numbers (e.g. Okuma bays).
- `_CmmVersion` - CMM PCs only: a tagged entry applies when it equals the bay's
  resolved PC-DMIS version (`C:\Enrollment\cmm\version.txt`). IMPORTANT: if no
  version is resolved (file missing/empty - a pre-picker bay), ALL tagged
  entries apply (deliberate legacy "install-all" behavior), so such a bay gets
  every PC-DMIS version, not none. Requires engine lib >= 2.6.
- `PCTypesStrict` - disables alias expansion (PREINSTALL runner only; the runtime
  engine ignores it).

Different PC types have different niche gates: CMM uses a version gate, Keyence a
model subtype, Collections per-bay machine numbers. The shopdb editor shows only
the gates a given scope actually uses (see 4.1).

### 2.6 What the PC needs to know about itself (enrollment)

The runtime engine reads the PC's identity from `C:\Enrollment\`:

- `pc-type.txt` - the imaging PC type (which scope to run). `pc-subtype.txt` is
  LEGACY (no longer written at imaging since the 2026-05-04 rename reorg; the
  dispatcher still honors it if present on older fleet PCs).
- `machine-number.txt` - the bay number FALLBACK; the eDNC/DNC registry
  `MachineNo` value wins if present. `9999` is the imaging placeholder by
  convention - the enforcement engine does NOT special-case it; it is simply a
  value that won't match a real bay number in a `TargetMachineNumbers` gate.
  (The 9999-skip you may see is only in the status write-back, not enforcement.)
- `cmm/version.txt` - CMM bays only: the resolved PC-DMIS version for `_CmmVersion`.
- `site-config.json` - the share root and site settings.
- SFLD credentials at `HKLM:\SOFTWARE\GE\SFLD\Credentials` - provisioned by
  Azure DSC after enrollment (this is what gates the runtime phase starting).

Note: all of the identity files above (pc-type, machine-number, cmm version,
site-config) are written in WinPE at the PXE menu, BEFORE the image boots - the
preinstall phase already reads them. What happens post-imaging is only Intune
enrollment + the Azure DSC credential (see the timeline below).

---

## 3. When GE-Enforce installs / takes over (the imaging timeline)

This is the "when to implement it during imaging" question. The order is:

```
[0] WinPE / PXE menu (BEFORE the image boots)
      - identity written to C:\Enrollment: pc-type.txt, machine-number.txt,
        cmm/version.txt, site-config.json (startnet.cmd). The PC already knows
        what it is before Windows starts.
      |
      v
    PXE image applied, Windows boots
      |
      v
[1] PREINSTALL  (00-PreInstall runner runs preinstall.json ONCE)
      - reads the step-0 identity files, then installs the foundation:
        PowerShell 7, VC++ redists, Oracle Client, Adobe Reader, HostExplorer,
        serial drivers, Display kiosk app, ... (things later runtime apps need)
      - preinstall implements MSI/EXE + Registry/File detection only
      |
      v
[2] GE-ENFORCE ITSELF is laid down during imaging
      - the dispatcher (GE-Enforce.ps1), the engine lib (Install-FromManifest.ps1),
        and a scheduled task (at-logon + every ~5 min + shift windows) are
        registered as part of the image / shopfloor setup
      |
      v
[3] ENROLLMENT (post-imaging)
      - Intune / GCCH enrollment, THEN Azure DSC provisions the SFLD share
        credential into HKLM:\SOFTWARE\GE\SFLD\Credentials
      - (the identity files already exist from step 0 - enrollment adds only the
        credential, which is what unblocks runtime)
      |
      v
[4] FIRST LOGON  -> RUNTIME ENFORCEMENT BEGINS
      - the scheduled task runs GE-Enforce.ps1: mount share, run common + the
        PC-type (+ subtype) manifests, install/self-heal, report
      - repeats every logon + periodically forever after
```

Key points on timing:

- **Preinstall (step 1) is the imaging-time install.** Put anything that must
  exist before first logon, or that never needs drift correction, here (runtimes,
  redistributables, drivers). It runs once and is done.
- **Runtime enforcement (step 4) does not start until enrollment (step 3)
  provisions the SFLD credential.** Before that, GE-Enforce exits 0 each cycle
  and waits. So a freshly imaged PC that is not yet enrolled is inert, by design.
- **The engine lib version matters.** `_CmmVersion` gating needs lib >= 2.6 on
  the PC; deploy the lib before a manifest that uses it.
- Some apps appear in BOTH phases: preinstalled at imaging for day-zero, then
  carried by a runtime entry so drift is corrected later (Oracle, UDC, Adobe,
  HostExplorer, Defect Tracker).

Rule of thumb: **imaging-time (preinstall) = foundation that must be there or
never drifts; runtime = everything that needs to stay correct over the PC's
life.**

---

## 4. How the shopdb plugin manages this

The `geenforce` plugin turns the manifest from hand-edited JSON on a share into
shopdb data you author, version, publish, and monitor. It lives under the
top-level **GE-Enforce** section (Manifests | Enforcement Reports), not Settings,
because it is a full management surface.

### 4.1 Manifests - authoring (GE-Enforce > Manifests)

- **PC Types (scopes):** each imaging PC type is a row; add/edit/delete. (The
  scope carries an optional `computertypeid` reference field, but the collector's
  imaging-pc-type -> ComputerType mapping is configured separately at
  Settings > Collector PC Types.)
- **Entries:** an ordered list (Up/Down = the execution-order contract). Add/Edit
  opens a typed form: the payload fields switch on `Type` (MSI shows Installer +
  InstallArgs, PS1 shows Script + Args, File shows Source + Destination, Registry
  shows the Reg* fields), a detection block, an InUseCheck editor, and a
  **Targeting** section that shows only the gates the scope uses (CMM shows the
  version gate; the common/preinstall scopes show PC types; a scope whose entries
  use machine numbers shows those) with a "Show all targeting options" escape
  hatch.
- **Simulate ("what would a PC get?"):** enter a PC profile (type, subtype,
  hostname, machine number, CMM version) and see which entries apply and why the
  rest are filtered - without reading a PowerShell log.
- **Publish / Versions / Roll Back:** editing changes a DRAFT only. Publish
  freezes an immutable version; PCs are only ever served the published version;
  Roll Back restores an earlier one. History (date, author, note) per version.

### 4.2 Milestone 1 - export to the share (engine unchanged)

Today the enforcement engine still reads manifests from the SFLD share. The
plugin's **Export to Share** button writes the current published manifest to
`<shareroot>/<scope>/manifest.json` (backing up the old file to `_meta/history`
first). So the workflow is:

**author + publish in shopdb -> Export to Share -> the unchanged engine picks it
up next cycle.**

Nothing about the engine, the share layout, or the PCs changes. Rollback is
restoring the `_meta/history` backup (or re-publishing an older version and
re-exporting). This is the safe first milestone: all the authoring benefit, zero
client risk.

Configure the share root once at the top of the Manifests page.

### 4.3 Enforcement Reports - fleet compliance (GE-Enforce > Enforcement Reports)

Each PC reports its enforcement result back to shopdb (see the client kit). The
Reports page shows, per PC:

- **Received** - did the PC apply the latest published version? (applied vs
  latest). "behind" means it has not picked up your newest publish yet.
- **Status** - `ok` (nothing needed), `selfhealed` (drift corrected), `failed`.
- **Counts** - installed / skipped / failed, plus per-entry detail (action,
  self-heal flag, exit code, message) in the row's Detail view.

This is the observed-state half of the loop: the manifest is what SHOULD be
installed; the report is what each PC ACTUALLY did.

### 4.4 The client side (per PC)

The engine sources the manifest and reports results using the reference kit in
`plugins/geenforce/client/` (`ShopdbEnforceClient.psm1` +
`Invoke-ShopdbEnforce.ps1`), configured from `HKLM:\SOFTWARE\GE\ShopDB`
(BaseUrl + a `geenforce.fetch`/`geenforce.report` service token). See
`docs/GE-ENFORCE-CLIENT.md` for the fetch/report contract, the last-known-good
cache, shadow mode, and the staged cutover from share-sourced to shopdb-sourced
manifests. Until that cutover, the client only REPORTS; the manifest still comes
from the share via Export to Share (4.2).

---

## 5. Day-to-day: common tasks

All in GE-Enforce > Manifests. No PowerShell, no editing JSON on the share.

- **Add an app to a PC type:** open the PC type, Add Entry, pick the Type (the
  form adapts), fill the installer + detection + any targeting, place it in order
  with Up/Down (config restores go BELOW their installer), Preview, Publish, then
  Export to Share.
- **Bump an app version:** drop the new installer in the scope's `apps/` folder
  on the share, open the entry, update the Installer filename + the Detection
  value (the new version), Publish, Export to Share. PCs self-heal next cycle.
- **Roll back a bad publish:** the PC type's Versions list -> Roll Back to the
  last good version -> Export to Share.
- **Canary a risky change:** add the one test PC under Target hostnames (via
  "Show all targeting options"), Publish; when happy, remove the filter and
  Publish again.
- **Check "did PC Y get app X":** use Simulate with that PC's type / machine
  number / CMM version; and check Enforcement Reports for what it actually did.

---

## 6. Reference

- Engine (behavior ground truth): `Install-FromManifest.ps1` (lib >= 2.6).
- Dispatcher: `GE-Enforce.ps1` (mount + run common then type scope).
- Preinstall runner: `00-PreInstall-*` over `preinstall.json` (imaging-time).
- shopdb model + API: `plugins/geenforce/` (models, importer/serializer,
  filters mirror, service, routes).
- Behavioral parity gate (proves the shopdb model round-trips the real
  manifests): `plugins/geenforce/parity.py` + `flask geenforce parity`.
- Client kit + contract: `plugins/geenforce/client/`, `docs/GE-ENFORCE-CLIENT.md`.
- Agent deployment (per PC, any imaging path): `docs/GE-ENFORCE-DEPLOY.md` +
  `plugins/geenforce/client/Install-GEEnforce.ps1`.
- Design + cutover plan: `docs/proposals/ge-enforce-plugin.md`.