v1.0.0 — Public release of the Citrix VDA upgrade orchestrator

Public repository

Extracted and generalized from flathack/MyScripts at Citrix/VDA-Update/VDA-Update-Orchestrator-v2.ps1
Source commit: 0a1132e63eea4964a97be15b910646e8822b272e
Original-file SHA-256: 45297974198d37b31077675f798bafb85615363096766df86c0e8b893f8d118c

Git tree: f9a060adc1f90008db41c2ed77f18c0f37224113
Manifest fingerprint SHA-256: d9cc85e67e25e5cf40a08af082c759ecba83b7236bbc959b95ec66137dfb22cf
Per-file SHA-256 fingerprints are pinned in the Windows-side candidate verifier.

A neutral, MIT-licensed Citrix VDA upgrade orchestrator for Windows 10/11 single-session workstation and Remote PC VDA deployments.
Local vda-update.config.example.psd1 and a .gitignore scope that excludes the production configuration, state, logs, payloads, and installer binaries.
An administrator runbook documenting the trust boundary, the recovery path, and the explicit destructive-operation warning.
A portable PowerShell 7.4 test suite (no network) and a Windows PowerShell 5.1 system test suite that exercises the orchestrator as NT AUTHORITY\SYSTEM on a disposable VM.

The fixed runtime root is established under C:\ProgramData\Citrix-VDA-Update and is hardened to SYSTEM and local Administrators only.
The orchestrator inherits reparse-point rejection at the runtime root and its ancestors and rejects any pre-existing mutable directory handle before trusting the namespace.
A separate WRITE_DAC | WRITE_OWNER probe with FILE_SHARE_NONE rejects any pre-existing DACL-control capability on the runtime root before the namespace-freezing guard is enabled.
A retained Task namespace guard binds scheduled-task artifact creation, registration, post-registration logging, start, and SYSTEM child acknowledgement; failure anywhere in that window triggers exact-ownership disable, stop, unregister, and absence verification before the guard is released.
Cached Citrix launchers are validated through a retained no-follow directory chain, a no-follow no-write/no-delete read handle, exact approved publisher identity, and immediate ACL/owner escalation-capability rejection.
The fixed PVS remnants path is destroyed through a no-follow ancestor chain, retained no-follow no-write/delete handles, and bottom-up SetFileInformationByHandle(FileDispositionInfo) — never a path-based recursive delete.
Supported only on Windows 10/11 single-session workstation or Remote PC VDA deployments. Windows Server and multi-session VDA deployments are explicitly out of scope.

#< + integer constant, $true, $false are the only allowed literal forms; coercive casts, computed keys, and AST subexpressions are rejected.
The literal engine path uses PowerShell 5.1 and PowerShell 7.4; the AST allowlist is verified across both engines.
The same-boot AwaitingReboot path is idempotent and does not reschedule shutdown or consume another reboot attempt.
Terminal Completed and Failed states require a verified disabled task before they are reported.

Windows Server, multi-session VDA deployments.
Anything that requires the orchestrator to write outside the protected runtime root.
Any third-party Citrix product or alternative deployment tooling.

The immediately preceding development snapshot fe94cdafbef50bcb8bc09513f09f6d3de9240bf7 remains in the public repository as a non-deployable checkpoint.
Earlier candidates 7efc8499451513177f976c8e0038d439610a0a7a and 93ae395eaa8ea3ef340613b71962df04bc7004ea were rejected by independent review and are not part of this release.