Skip to content

v15.2.9-FINAL - Final line audit gate, 1008 assertions, 0 ERROR/WARN

Choose a tag to compare

View all tags
@ryderlacin-pixel ryderlacin-pixel released this 08 Jun 21:45
· 4 commits to main since this release
v15.2.9
7e8a067

v15.2.9-FINAL - Consolidated production release

Merged GitHub main (95 files) + ULTIMATE lib audit + final line audit gate. Not installed on build machine - offline test gate only.

P0 - Install must not brick internet

Fix Detail
No catch-all during install STEP 6 adds exemptions + allows only; KS-Block-* activated by monitor after health check
DNS lock gate STEP 18f defers system DNS lock until Test-DnscryptListening (127.0.0.1:53)
Deferred DNS lock (v15.2.8) Requires stable stack before guards apply
Install lock + fail-open Remove-InstallBlocks during install; EnableFailsafe default true

P1 - Security & script generation

Fix Detail
Invoke-SafeNetsh cmd.exe /c instead of Invoke-Expression
repair.ps1 firewall restore cmd.exe /c instead of Invoke-Expression
wg-safety.ps1 DHCP rules cmd.exe /c instead of Invoke-Expression
UpgradePaths heredoc Fixed WebRTC forwarder @"..."@ (was broken concatenation)

P2 - v15.2.6 audit fixes (retained)

Mutex $acquired + Dispose(), Test-IsMainMonitor, ScriptsPath -> repo root, GPO regex, admin check before dot-source, $TUNNEL_SVC safe interpolation.

P2 - v15.2.9 install final-check (retained)

Register-RepairTaskDualTrigger, Refresh-RegistryTaskBackups, vault finalize before services, monitor wait loop, NSSM cleanup guard.

P3 - Final line audit (v15.2.9)

Every repo file scanned dot-by-dot: parse, semantic rules, version parity, SHA256 manifest. Gate requires 0 ERROR, 0 WARN.

Verification (build machine - no install)

scripts/test-suite.ps1          -> 1008 PASS (1001+ baseline; 17 gates incl. final line audit)
scripts/file-coverage-test.ps1  -> 682 PASS (49 production files, anti-hollow gate)
scripts/final-line-audit.ps1    -> 95 files dot-by-dot, 0 ERROR, 0 WARN
scripts/behavior-sim-test.ps1   -> 216 PC reaction scenarios + sim<->monitor parity
scripts/reboot-sim-test.ps1     -> 510 post-reboot internet survival scenarios
scripts/ci.ps1                  -> CI QUALITY GATE: PASSED (x3 + Phase 5 audit)
scripts/pre-push-gate.ps1       -> PRE-PUSH GATE: PASSED

Each repo file: universal line scan + tier classification + SHA256 manifest (audit-results/). Production files: parse + Scriptblock::Create + role contracts (>=4 meaningful checks). Generated monitor/GPO/repair/watchdog/wg-safety: extract + compile, not grep-only.

Deploy

.\install.ps1 -DryRun    # first run - no firewall changes
.\install.ps1 -NoPause   # production install

Stuck internet: emergency-reset.bat (once, then reboot if prompted).

Assets 2
Loading