REQ 046

REQ-046: Read-only post-OOBE boot witness

Requirement

An NSIS-installed post-OOBE witness shall recheck and report Windows bootstrap state at subsequent guest boots without repairing it.

Rationale

Reboot survival requires current state, not a stale completion marker or an autonomous repair loop.

Fit Criterion

On each boot and authorized recheck, the witness reads the current policy and reports pass, drift, or unknown over serial. It changes no configuration; its only guest-state write is the protected, volatile boot-evidence ID. Missing witness evidence blocks success.

Verification

Planned, TEST-046; the existing optional service repairs state and disables itself, so it is not this witness.

Source

Software-Requirements-Specification

Priority

High

TestID

TEST-046

TestArtifact

Planned witness, drift, and reboot fixtures

CodeRef

vm/windows-labview/winrm-setup-installer.nsi, planned witness

Status

Planned