Lifecycle And Independent Verification

Lifecycle And Independent Verification

1. Establish verified UUID, attempt ID, protected serial boundary, and expected policy. A new VNC attempt may begin only with the Setup and elevation checks above. No prior status can establish its completion.
2. Observe the NSIS start and actual child exit. A nonzero exit is failure; a missing exit or reboot during execution is unknown. NSIS verifies its required steps and actual state before returning zero; repeating an explicitly authorized invocation converges the owned configuration without duplicates.
3. Require a matching boot-witness record, then perform an authenticated, message-encrypted WinRM command. Independently read the listener, service, authentication, and firewall properties and compare each with the expected descriptor. HTTP 401/503 and bare TCP are never readiness.
4. On subsequent drift or interrupted execution, report failure/unknown. The witness does not repair it; only an explicitly authorized installer rerun can do so. Do not change unrelated or ambiguously owned state.
5. Before shutdown or media attachment, recheck VM UUID and state. A verified WinRM acknowledgement means only accepted; a rejection means rejected, and a disconnect without acknowledgement means unknown. Poll actual VirtualBox power state independently, then try ACPI and, only with this run's separate opt-in, hard poweroff. Never mutate while snapshotting or state is unknown; states other than running and poweroff are not silently treated as either. After a managed power cycle, require observed off/on, a new boot ID, current witness status, and encrypted WinRM readback. A fresh start without a prior baseline is reported separately. For a guest-only reboot, require an independently proven boot observation in addition to the changed boot ID; while the source remains unresolved, report unknown.
6. Only with separately authorized Actions access, obtain a complete runner inventory for the intended repository. Confirm one matching runner is online with all requested labels, and match its numeric ID to the local registration for the running service. Missing permission, incomplete pagination, duplicate names, or an ID mismatch is failure. Never infer this proof from the registration command's exit alone.

The private serial file and guest logs remain protected local evidence; only the validated redacted receipt and hashes may be published. A BitLocker signature is recorded as a signature with protection state unknown, not as the proven failure cause. Unlocking, decrypting, repairing, forcing a reader, or mounting media writable requires separate operator authorization.