Component View

Component View

Component	Container	Responsibility
build-virtualbox.ps1/.sh (Windows-LabVIEW)	VM provisioning	Create a VirtualBox VM from an explicit identity input set (VmName/BaseFolder/GuestFullName/GuestHostname are mandatory with no default; a few non-identity parameters like the ISO path, guest username, and WinRM port have generic, non-fork-specific defaults)
build-virtualbox.ps1/.sh (Ubuntu-LabVIEW)	VM provisioning	Same contract, dual Linux/Windows adapters so either host OS can orchestrate (REQ-021 in Software-Requirements-Specification)
provision-windows-guest.py	VM provisioning	WinRM command dispatcher: shutdown-guest, wait-ready (real round-trip, not bare TCP), install-vipm, install-labview, register-runner. Its current shutdown helper can report a request as sent even when a transport exception precedes transmission; the planned contract separates that from observed poweroff.
vm/ubuntu-labview/install-actions-runner.sh, complete-runner-registration.sh	VM provisioning	Ubuntu-LabVIEW's register-runner phase (REQ-038): SSH/systemd analog of provision-windows-guest.py's register-runner, achieving functional parity -- dedicated non-privileged service account, pinned+verified actions-runner tarball, config.sh + svc.sh registration, and a live gh api cross-check of the registered runner (status + labels) rather than trusting the registration command's own exit code alone (REQ-020's discipline)
vnc-bootstrap.py, vnc-console.sh	VM provisioning	VNC-based delivery of the Windows guest installer without relying on FirstLogonCommands surviving a restart. Current success uses an unauthenticated HTTP response and does not capture the installer exit; it is not proof of the planned contract below.
winrm-setup-installer.nsi, host-bootstrap-installer.nsi	VM provisioning	NSIS-compiled bootstrap installers with per-step logging (see .github/skills/nsis-host-installers/SKILL.md). The current guest installer logs failed steps but does not propagate their failures as its overall result.
vm/windows-labview/winrm-service-bootstrap-installer.nsi	VM provisioning	Research prototype (not yet wired into any workflow) for a genuine Windows-Service-based WinRM bootstrap alternative to FirstLogonCommands/RunOnce, which issue #191's own closing comment found did not survive a Windows-Update-triggered restart
Test-RunnerAdministrator.ps1	VM provisioning	Windows-only helper checking whether the current identity is a local Administrator; no current caller anywhere in this repo (standalone utility)
vm/windows-labview/provisioning-manifest.json	VM provisioning	Versioned schema (projectbuddy/windows-labview-provisioning@1) pinning the exact ISO/VIPM/LabVIEW/Actions-runner/PowerShell/NSSM binary hashes this pipeline is proven against
runner-inventory.example.json	VM provisioning	Versioned schema (vm-provisioning/windows-labview-runner-inventory@3) a fork copies to track its own real, fork-local VM/runner fleet
vm/windows-labview/batch-provision.sh	VM provisioning	Serially provisions every "status": "queued" entry in runner-inventory.json through register-runner, with bounded per-VM retry and automatic VNC-console pop-open at ready-for-activation; does not yet pass per-VM guest_hostname/guest_full_name (VITechnologies/projectbuddy#69, open)
Register-WindowsRunner.ps1	VM provisioning	Re-registers a Windows self-hosted GitHub Actions runner service (plan-by-default, requires explicit authorization + -Run to mutate)
Register-WslRunnerKeepAlive.ps1	VM provisioning	Creates a WSL-instance keep-alive scheduled task/shortcut on the runner host
package-vagrant-box.py, build-activation-receipt.py, verify-*-receipt.py, verify-vagrant-clone.py, clone-profile.json, clone-profile.v1.json (Ubuntu-LabVIEW)	VM provisioning	Snapshot-based appliance lifecycle: base and activated transitions each produce and independently verify a receipt (verify-base-receipt.py, build-activation-receipt.py/verify-activation-receipt.py); the intended package-ready transition has no corresponding receipt verifier and package-build is non-functional in this engine repo (VITechnologies/projectbuddy#62). package-vagrant-box.py, clone-profile.json, and the frozen clone-profile.v1.json (read only for @1 clone receipts; VITechnologies/projectbuddy#192) set one consumer's package name and version as required values, which verify-vagrant-clone.py and verify-vagrant-clone-receipt.py read through the neutral scripts/vagrant_clone/ core: a disclosed narrow-purpose exception (REQ-001; VITechnologies/projectbuddy#167 item 8), as is provision-ubuntu-vm.yml's package-build phase template. package-vagrant-box.py scans the running source VM for an Actions runner through scripts/vagrant_clone/guest.py, which the clone check shares, powers it off itself, and records the scan in its projectbuddy/ubuntu-vagrant-box@2 receipt (REQ-105)
Run-Pipeline.ps1	Native SBOM pipeline	Orchestrate checkout, VIPM manifest/SBOM/scan/publish stages for one project, Windows only (REQ-022 through REQ-028 in Software-Requirements-Specification)
Run-Pipeline.sh	Not part of the SBOM pipeline	A separate, unrelated Linux LabVIEWCLI MassCompile/VI Analyzer tool for NI's own open-source example VIs, analysis-only per its own header comment -- not a native-pipeline counterpart to Run-Pipeline.ps1; the Linux-capable SBOM path is the Containerized SBOM pipeline (docker/linux-sbom/)
Build-Sbom.ps1	Native SBOM pipeline	Dot-sourced library: DT-mode resolution/readiness, pipeline-run.json lifecycle, VIPM build/package helpers, plus the build.packages VI-package stage (Resolve-PackageBuildPlan)
internal/Pipeline.Stages.ps1	Native SBOM pipeline	The 6 ordered per-project stage functions (checkout, source-checkout, LVLIBP dependency fetch, manifest, SBOM, Grype scan); Publish-DependencyTrack runs upload/metrics then calls the Test-PipelinePolicyGate helper as its own last step (not a separate preceding stage)
Test-SbomArtifact.ps1	Native SBOM pipeline	Verifies a downloaded pipeline artifact against its run record, project config, and vipm.toml (REQ-009/REQ-025 consumer); real Pester fixture tests cover all 3 documented failure classes (scripts/tests/Test-SbomArtifact.Tests.ps1)
scripts/Test-ToolchainPresence.ps1, .github/workflows/toolchain-smoke-test.yml	Native SBOM pipeline	Reports whether named command-line tools are present/resolved on PATH; toolchain-smoke-test.yml is this engine's one workflow_call-consumable workflow and the canonical uses:@sha pin example (REQ-008)
scripts/Convert-VipbJson.py	Native SBOM pipeline	Inspects/declaratively patches .vipb XML without hand-editing; unit-tested (scripts/tests/test_convert_vipb_json.py)
Test-Environment.ps1	Native SBOM pipeline	Enterprise environment/toolchain auditor validating PowerShell, SVN, Git, VIPM, Syft, Grype, and critical API credentials against minimum version thresholds; no current caller anywhere in this repo (standalone operator utility)
vipm-exit-codes.json, pipeline-config.schema.json	Native + Containerized SBOM pipeline	Shared VIPM CLI exit-code/remediation lookup and project-config JSON Schema, both mounted into the container images too -- actually validated against by Run-Pipeline.ps1, Add-Project.ps1, and docker/windows-sbom/windows_sbom_pipeline.ps1; docker/linux-sbom/linux_sbom_pipeline.py's load_config() does its own separate, narrower inline validation instead of validating against this schema
linux_sbom_pipeline.py, windows_sbom_pipeline.ps1	Containerized SBOM pipeline	In-container equivalents of the native pipeline's SBOM-producing stages, each with its own complete environment-variable-driven contract (REQ-029 in Software-Requirements-Specification)
scripts/Decode-LbaCapture.py	Agent diagnostics	Decodes a labview-benchmark-actor capture directory (schema labview-benchmark-actor/launch-capture@1/.../capture-status@1) into a structured summary -- per-resource/per-disk stats, peak I/O, dualPacket integrity, and source-verified anomaly flags (ADR-0005's Addendum); unit-tested with synthetic fixtures (scripts/tests/test_decode_lba_capture.py), 99% coverage
scripts/assisted_benchmark_live_policy.py	Live-agent authorization primitives (P0 of #250/#251)	Compile/claim a one-use host-bound provision permit, verify and bind exactly one newly created UUID, then issue immutable exact-call grants and one-shot teardown target; model output cannot create or expand authority (SYS-REQ-030, REQ-121, REQ-122, TEST-122, TEST-123). This is not a live coordinator/provisioner adapter.
scripts/assisted_benchmark_synthetic_ui.py, scripts/assisted_benchmark_synthetic_oracle.py, scripts/assisted_benchmark_mcp_router.py, scripts/assisted_benchmark_calibration.py, tools/assisted-benchmark/synthetic-ui/	Live-agent evaluation fixtures (P1 of #250/#253)	Deterministic standalone Windows UI task, separate observation oracle, one-of-two exact server-bound UI action route, and non-qualifying per-mode metric scorer (SYS-REQ-031, SYS-REQ-032, REQ-123, REQ-124, REQ-125, TEST-124, TEST-125, TEST-126). Integrated offline through PR #254; no live capture, model, VM, or frozen thresholds are claimed.
scripts/assisted_benchmark_active_capture.py, scripts/assisted_benchmark_session.py, scripts/assisted_benchmark_mcp_router.py (#255)	Live-agent orchestration (P2 candidate)	Read Actor #45's versioned frame/event MCP resources, preserve opaque run/VM identity and ordered cursors, bound all three local-model modes, and route one exact granted synthetic action (SYS-REQ-033, REQ-126, REQ-127, TEST-127, TEST-128). Integrated in develop through PRs #256 and #258; no native Windows live qualification exists. Proposed NSIS staging, guest relay, and end-to-end qualification remain REQ-128, REQ-129, REQ-130, and Planned-Epic-250-Native-Qualification-Design. ProjectBuddy must not crawl Actor storage.
Run-LinuxSbom.ps1, Run-WindowsSbom.ps1	Containerized SBOM pipeline	Host-side launchers: build the respective container image fresh (no cache) from a resolved digest, mount this repository, and run the in-container pipeline; no project is selected by default
docker/windows-sbom/Install-VerifiedNugetPackage.ps1	Containerized SBOM pipeline	Generic, reusable SHA-512-verify-then-extract helper for any .nupkg; restored in VITechnologies/projectbuddy#76 after an incorrect v0.3.24 removal (a real consumer, SandboxSBOMReporting, independently depends on it); real Pester tests (scripts/tests/Install-VerifiedNugetPackage.Tests.ps1)
Build-LvlibpCandidate.ps1	Containerized SBOM pipeline	Narrow, single-purpose script building one hosted .lvlibp candidate for the dependencies repo's own CI, not part of the general pipeline flow
Add-Project.ps1	Project registration	Local schema/TOML validation + gh workflow run add-project.yml dispatch; also calls a consumer-authored credential-reference validator and runtime validator by convention (.github/scripts/validate-project-registration.py, .github/scripts/project_runtime.py), deliberately not published in this engine itself since each consumer's credential/runtime rules differ ($WorkspaceRoot's own doc comment)
New-HumanEscalation.ps1	Human escalation	Idempotent create/update of a structured escalation issue; verifies an existing-issue match against the real issue body client-side (not just GitHub's search index) before treating it as "the" existing escalation
Get-HumanEscalations.ps1	Human escalation	Cross-repo dashboard of open escalations
Enable-RepoIssueTracking.ps1	Repo onboarding	Enable Issues + idempotently seed (via gh label create --force) the needs-human-decision label; a label-create failure is a real, surfaced error, never silently swallowed
.github/workflows/release.yml	Release automation	workflow_dispatch-only: validates vX.Y.Z format, rejects a tag that already exists on the remote (via git ls-remote, not a local check -- actions/checkout doesn't fetch tags by default), extracts the matching CHANGELOG.md section to a file, and calls gh release create --notes-file (never splicing untrusted content into a run: script expression)
.github/skills/projectbuddy-identity/	Agent orientation	SKILL.md + agents/openai.yaml: orients an AI agent on what this repo is, its consumption model, and known open threads (issue #188/#191/#280); kept in sync with the real workflow phase lists and Run-Pipeline.sh's real identity as findings in this session's semantic audit repeatedly caught it drifting out of sync