[CmdletBinding()] param( [Parameter(Mandatory = $true)] [ValidatePattern('^[a-z0-9_.-]{1,128}$')] [string]$CaseCode, [Parameter(Mandatory = $true)] [ValidatePattern('^[A-Za-z0-9_.:-]{1,128}$')] [string]$CommandName, [Parameter(Mandatory = $true)][string]$CommandInputFile, [Parameter(Mandatory = $true)][string]$OutputPath, [Parameter(Mandatory = $true)][string]$VerifierCliPath, [Parameter(Mandatory = $true)][string]$RuntimeCliPath, [Parameter(Mandatory = $true)][string]$UatAuthorizationFile, [Parameter(Mandatory = $true)][string]$UatTokenVaultPath, [Parameter(Mandatory = $true)] [ValidatePattern('^[A-Fa-f0-9]{64}$')] [string]$ExpectedUatAuthorizationSha256, [Parameter(Mandatory = $true)] [ValidatePattern('^[A-Fa-f0-9]{64}$')] [string]$ExpectedVerifierCliSha256, [Parameter(Mandatory = $true)] [ValidatePattern('^[0-9]{1,4}\.[0-9]{1,4}\.[0-9]{1,4}$')] [string]$ExpectedRuntimeCliVersion, [Parameter(Mandatory = $true)] [ValidatePattern('^[A-Fa-f0-9]{64}$')] [string]$ExpectedRuntimeCliSha256, [Parameter(Mandatory = $true)] [ValidatePattern('^[A-Fa-f0-9]{40}$')] [string]$ExpectedVerifierSignerThumbprint, [Parameter(Mandatory = $true)] [ValidatePattern('^[A-Fa-f0-9]{40}$')] [string]$ExpectedRuntimeSignerThumbprint, [Parameter(Mandatory = $true)] [ValidateRange(1, 2147483647)] [int]$ErpProcessId, [switch]$Execute, [Security.SecureString]$IdempotencyKey, [string]$IdempotencyKeyFile = '', [switch]$PauseAfterPlanForOperatorStaging, [switch]$NonInteractive, [ValidateRange(-1, 1000)] [int]$BusinessMutationCount = -1, [Nullable[bool]]$NativeConfirmationObserved = $null, [ValidateRange(-1, 1000)] [int]$AuditEventCount = -1, [Nullable[bool]]$SourceDocumentWritePayloadBound = $null, [ValidateRange(-1, 1000)] [int]$SourceDocumentAuditCount = -1, [string]$CorrelatedAuditOutputPath = '', [string]$RestrictedWorkingRoot = '', [ValidateRange(1000, 300000)] [int]$BridgeTimeoutMilliseconds = 180000 ) Set-StrictMode -Version 2.0 $ErrorActionPreference = 'Stop' if ($PSVersionTable.PSVersion -lt [Version]'5.1' -or [string]$PSVersionTable.PSEdition -ne 'Desktop' -or [string]::IsNullOrWhiteSpace($env:SystemRoot)) { throw 'workflow_write_case_capture_failed:windows_powershell_51_required' } $windowsIdentity = [Security.Principal.WindowsIdentity]::GetCurrent() $windowsPrincipal = [Security.Principal.WindowsPrincipal]::new($windowsIdentity) if (-not $windowsPrincipal.IsInRole( [Security.Principal.WindowsBuiltInRole]::Administrator)) { throw 'workflow_write_case_capture_failed:elevated_operator_required' } $utf8 = [Text.UTF8Encoding]::new($false, $true) $maximumResponseCharacters = 4 * 1024 * 1024 $rawDirectory = $null $idempotencyPlain = $null $uatToken = $null $uatAuditTokenSha256 = $null $verifierCliLock = $null $runtimeCliLock = $null $uatAuthorizationLock = $null $uatTokenVaultLock = $null $summaryJson = $null $stagedOutputs = New-Object System.Collections.Generic.List[string] $publishedOutputs = New-Object System.Collections.Generic.List[string] function Throw-CaptureError([string]$Code) { throw ("workflow_write_case_capture_failed:" + $Code) } function Assert-NoReparseDirectoryChain([string]$Directory, [string]$Code) { $current = [IO.DirectoryInfo]::new([IO.Path]::GetFullPath($Directory)) while ($null -ne $current) { if (-not $current.Exists -or (($current.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) { Throw-CaptureError $Code } $current = $current.Parent } } function Resolve-RegularFile( [string]$Path, [long]$MaximumBytes, [string]$Code ) { try { $full = [IO.Path]::GetFullPath($Path) if (-not [IO.File]::Exists($full)) { Throw-CaptureError $Code } $item = Get-Item -LiteralPath $full -Force if ($item.Length -le 0 -or $item.Length -gt $MaximumBytes -or (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) { Throw-CaptureError $Code } Assert-NoReparseDirectoryChain ([IO.Path]::GetDirectoryName($full)) $Code return $full } catch { if ($_.Exception.Message.StartsWith('workflow_write_case_capture_failed:')) { throw } Throw-CaptureError $Code } } function Resolve-NewJsonPath([string]$Path, [string]$Code) { try { $full = [IO.Path]::GetFullPath($Path) if ([IO.Path]::GetExtension($full) -ine '.json' -or [IO.File]::Exists($full) -or [IO.Directory]::Exists($full)) { Throw-CaptureError $Code } $directory = [IO.Path]::GetDirectoryName($full) Assert-NoReparseDirectoryChain $directory $Code return $full } catch { if ($_.Exception.Message.StartsWith('workflow_write_case_capture_failed:')) { throw } Throw-CaptureError $Code } } function New-RestrictedDirectory([string]$Root) { $path = $null try { $fullRoot = [IO.Path]::GetFullPath($Root) [IO.Directory]::CreateDirectory($fullRoot) | Out-Null Assert-NoReparseDirectoryChain $fullRoot 'restricted_working_root_invalid' $path = Join-Path $fullRoot ('case-' + [Guid]::NewGuid().ToString('N')) [IO.Directory]::CreateDirectory($path) | Out-Null $currentUser = [Security.Principal.WindowsIdentity]::GetCurrent().User $localSystem = [Security.Principal.SecurityIdentifier]::new( [Security.Principal.WellKnownSidType]::LocalSystemSid, $null) $security = New-Object Security.AccessControl.DirectorySecurity $security.SetOwner($currentUser) $security.SetAccessRuleProtection($true, $false) $inheritance = [Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [Security.AccessControl.InheritanceFlags]::ObjectInherit $propagation = [Security.AccessControl.PropagationFlags]::None $allow = [Security.AccessControl.AccessControlType]::Allow foreach ($identity in @($currentUser, $localSystem)) { $rule = [Security.AccessControl.FileSystemAccessRule]::new( $identity, [Security.AccessControl.FileSystemRights]::FullControl, $inheritance, $propagation, $allow) $security.AddAccessRule($rule) } [IO.Directory]::SetAccessControl($path, $security) $verified = [IO.Directory]::GetAccessControl($path) if (-not $verified.AreAccessRulesProtected) { Throw-CaptureError 'restricted_working_acl_invalid' } return $path } catch { if ($null -ne $path -and [IO.Directory]::Exists($path)) { try { [IO.Directory]::Delete($path, $true) } catch { } } if ($_.Exception.Message.StartsWith('workflow_write_case_capture_failed:')) { throw } Throw-CaptureError 'restricted_working_acl_invalid' } } function ConvertTo-WindowsProcessArgument([string]$Value) { if ($null -eq $Value -or $Value.Length -eq 0) { return '""' } if (-not [Text.RegularExpressions.Regex]::IsMatch($Value, '[\s"]')) { return $Value } $builder = New-Object Text.StringBuilder [void]$builder.Append([char]34) $slashes = 0 foreach ($character in $Value.ToCharArray()) { if ([int]$character -eq 92) { $slashes++ continue } if ([int]$character -eq 34) { for ($index = 0; $index -lt (($slashes * 2) + 1); $index++) { [void]$builder.Append([char]92) } [void]$builder.Append([char]34) } else { for ($index = 0; $index -lt $slashes; $index++) { [void]$builder.Append([char]92) } [void]$builder.Append($character) } $slashes = 0 } for ($index = 0; $index -lt ($slashes * 2); $index++) { [void]$builder.Append([char]92) } [void]$builder.Append([char]34) return $builder.ToString() } function Test-ExactProperties([object]$Value, [string[]]$Expected) { if ($null -eq $Value) { return $false } $names = @($Value.PSObject.Properties | ForEach-Object { $_.Name }) if ($names.Count -ne $Expected.Count) { return $false } foreach ($name in $Expected) { if ($names -cnotcontains $name) { return $false } } return $true } function Get-Sha256Hex([byte[]]$Bytes) { $sha = [Security.Cryptography.SHA256]::Create() try { return ([BitConverter]::ToString( $sha.ComputeHash($Bytes))).Replace('-', '').ToLowerInvariant() } finally { $sha.Dispose() } } function Assert-RestrictedVaultAcl([string]$Path) { try { $sections = [Security.AccessControl.AccessControlSections]::All $acl = [IO.File]::GetAccessControl($Path, $sections) $owner = $acl.GetOwner( [Security.Principal.SecurityIdentifier]).Value $currentSid = $windowsIdentity.User.Value $systemSid = [Security.Principal.SecurityIdentifier]::new( [Security.Principal.WellKnownSidType]::LocalSystemSid, $null).Value if (-not $acl.AreAccessRulesProtected -or $owner -cne $currentSid) { Throw-CaptureError 'uat_token_vault_acl_invalid' } $rules = @($acl.GetAccessRules( $true, $true, [Security.Principal.SecurityIdentifier])) if ($rules.Count -ne 2) { Throw-CaptureError 'uat_token_vault_acl_invalid' } $seen = @{} foreach ($rule in $rules) { $sid = [string]$rule.IdentityReference.Value if ($rule.IsInherited -or $rule.AccessControlType -ne [Security.AccessControl.AccessControlType]::Allow -or ($sid -cne $currentSid -and $sid -cne $systemSid) -or (($rule.FileSystemRights -band [Security.AccessControl.FileSystemRights]::FullControl) -ne [Security.AccessControl.FileSystemRights]::FullControl) -or $seen.ContainsKey($sid)) { Throw-CaptureError 'uat_token_vault_acl_invalid' } $seen[$sid] = $true } if (-not $seen.ContainsKey($currentSid) -or -not $seen.ContainsKey($systemSid)) { Throw-CaptureError 'uat_token_vault_acl_invalid' } $sddl = $acl.GetSecurityDescriptorSddlForm($sections) if ($sddl -cnotmatch 'S:.*\(ML;;NW;;;HI\)') { Throw-CaptureError 'uat_token_vault_integrity_invalid' } } catch { if ($_.Exception.Message.StartsWith( 'workflow_write_case_capture_failed:')) { throw } Throw-CaptureError 'uat_token_vault_acl_invalid' } } function Get-PreparationCommand( [string]$CaptureCaseCode, [string]$TargetCommandName ) { if ($TargetCommandName -ceq 'purchase.invoice.create' -and $CaptureCaseCode -cne 'purchase_permission_denied') { return 'purchase.invoice.resolve' } if ($TargetCommandName -ceq 'hr.leave.create' -and $CaptureCaseCode -cnotin @( 'leave_resolution_proof_bypass_blocked', 'leave_local_time_zone_rejected', 'leave_permission_denied')) { return 'hr.leave.resolve' } return $null } function Read-VerifiedUatGrant( [object]$VerifiedData, [string]$AuthorizationPath, [string]$VaultPath, [string]$CaptureCaseCode, [string]$TargetCommandName ) { try { if ($null -eq $VerifiedData -or [string]$VerifiedData.packageType -cne 'workflow_write_uat_authorization' -or [string]$VerifiedData.schemaVersion -cne '1.2' -or [string]$VerifiedData.sourceSha256 -cne $ExpectedUatAuthorizationSha256.ToLowerInvariant() -or [string]$VerifiedData.verifierCli.fileName -cne 'lserp-cli.exe' -or [string]$VerifiedData.verifierCli.sha256 -cne $expectedVerifierCliHash -or [string]$VerifiedData.verifierCli.signerThumbprint -cne $expectedVerifierCliSigner -or $VerifiedData.verifierCli.requiresElevation -ne $true -or [string]$VerifiedData.runtimeCli.fileName -cne 'lserp-agent-cli.exe' -or [string]$VerifiedData.runtimeCli.version -cne $ExpectedRuntimeCliVersion -or [string]$VerifiedData.runtimeCli.sha256 -cne $expectedRuntimeCliHash -or [string]$VerifiedData.runtimeCli.signerThumbprint -cne $expectedRuntimeCliSigner -or $VerifiedData.runtimeCli.requiresElevation -ne $false -or $VerifiedData.runtimeCli.bridgeOnly -ne $true -or $VerifiedData.runtimeCli.databaseDirectAccess -ne $false -or [string]$VerifiedData.runtimeCli.sessionSource -cne 'current_logged_in_erp_process' -or $VerifiedData.signatureVerified -ne $true -or $VerifiedData.uatAuthorized -ne $true -or $VerifiedData.productionReady -ne $false) { Throw-CaptureError 'uat_authorization_verification_invalid' } $authorizationText = [IO.File]::ReadAllText($AuthorizationPath, $utf8) $authorization = $authorizationText | ConvertFrom-Json $issuedAtMatches = [Text.RegularExpressions.Regex]::Matches( $authorizationText, '"issuedAtUtc"\s*:\s*"(?\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,7})?(?:Z|\+00:00))"', [Text.RegularExpressions.RegexOptions]::CultureInvariant) $expiresAtMatches = [Text.RegularExpressions.Regex]::Matches( $authorizationText, '"expiresAtUtc"\s*:\s*"(?\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,7})?(?:Z|\+00:00))"', [Text.RegularExpressions.RegexOptions]::CultureInvariant) if (-not (Test-ExactProperties $authorization @( 'schemaVersion', 'contentSha256', 'signatureAlgorithm', 'certificateThumbprint', 'signatureBase64', 'content')) -or [string]$authorization.schemaVersion -cne '1.2' -or $null -eq $authorization.content -or -not (Test-ExactProperties $authorization.content.erpScope @( 'accountBook', 'subSystemId', 'userId', 'userName', 'databaseScopeFingerprint')) -or [string]$authorization.content.erpScope.databaseScopeFingerprint -cne [string]$VerifiedData.erpScope.databaseScopeFingerprint -or [string]$authorization.content.authorizationId -cne [string]$VerifiedData.authorizationId -or $issuedAtMatches.Count -ne 1 -or $expiresAtMatches.Count -ne 1) { Throw-CaptureError 'uat_authorization_contract_invalid' } $signedScope = $authorization.content.erpScope foreach ($scopeField in @( 'accountBook', 'subSystemId', 'userId', 'userName')) { $scopeValue = [string]$signedScope.$scopeField if ([string]::IsNullOrWhiteSpace($scopeValue) -or $scopeValue.Length -gt 256 -or $scopeValue -cne $scopeValue.Trim()) { Throw-CaptureError 'uat_authorization_scope_invalid' } foreach ($character in $scopeValue.ToCharArray()) { if ([char]::IsControl($character)) { Throw-CaptureError 'uat_authorization_scope_invalid' } } } if ((Get-Sha256Hex ($utf8.GetBytes( [string]$signedScope.accountBook))) -cne [string]$VerifiedData.erpScope.accountBookSha256 -or (Get-Sha256Hex ($utf8.GetBytes( [string]$signedScope.subSystemId))) -cne [string]$VerifiedData.erpScope.subSystemIdSha256 -or (Get-Sha256Hex ($utf8.GetBytes( [string]$signedScope.userId))) -cne [string]$VerifiedData.erpScope.userIdSha256 -or (Get-Sha256Hex ($utf8.GetBytes( [string]$signedScope.userName))) -cne [string]$VerifiedData.erpScope.userNameSha256) { Throw-CaptureError 'uat_authorization_scope_invalid' } $workflowName = if ($CaptureCaseCode.StartsWith( 'purchase_', [StringComparison]::Ordinal)) { 'purchase' } elseif ($CaptureCaseCode.StartsWith( 'leave_', [StringComparison]::Ordinal)) { 'leave' } else { Throw-CaptureError 'uat_case_not_authorized' } $allCases = New-Object System.Collections.Generic.List[object] foreach ($workflow in @($authorization.content.workflows)) { foreach ($case in @($workflow.cases)) { $allCases.Add([pscustomobject]@{ Workflow = [string]$workflow.workflow Case = $case }) } } $matches = @($allCases | Where-Object { $_.Workflow -ceq $workflowName -and [string]$_.Case.caseCode -ceq $CaptureCaseCode }) if ($matches.Count -ne 1) { Throw-CaptureError 'uat_case_not_authorized' } $caseAuthorization = $matches[0].Case if (-not (Test-ExactProperties $caseAuthorization @( 'caseCode', 'expectedCommandName', 'allowedCommands', 'tokenSha256')) -or [string]$caseAuthorization.expectedCommandName -cne $TargetCommandName -or [string]$caseAuthorization.tokenSha256 -cnotmatch '^[a-f0-9]{64}$') { Throw-CaptureError 'uat_case_command_mismatch' } $allowedCommands = @($caseAuthorization.allowedCommands | ForEach-Object { [string]$_ }) $preparationCommand = Get-PreparationCommand ` $CaptureCaseCode $TargetCommandName if ($allowedCommands -cnotcontains $TargetCommandName -or ($null -ne $preparationCommand -and $allowedCommands -cnotcontains $preparationCommand)) { Throw-CaptureError 'uat_case_command_mismatch' } Assert-RestrictedVaultAcl $VaultPath $vault = [IO.File]::ReadAllText($VaultPath, $utf8) | ConvertFrom-Json if (-not (Test-ExactProperties $vault @( 'schemaVersion', 'authorizationId', 'protectedForUserSid', 'protectionScope', 'createdAtUtc', 'entries')) -or [string]$vault.schemaVersion -cne '1.0' -or [string]$vault.authorizationId -cne [string]$VerifiedData.authorizationId -or [string]$vault.protectedForUserSid -cne $windowsIdentity.User.Value -or [string]$vault.protectionScope -cne 'dpapi_current_user_high_integrity') { Throw-CaptureError 'uat_token_vault_contract_invalid' } $vaultEntries = @($vault.entries) if ($vaultEntries.Count -ne $allCases.Count) { Throw-CaptureError 'uat_token_vault_contract_invalid' } $entryKeys = @{} foreach ($entry in $vaultEntries) { if (-not (Test-ExactProperties $entry @( 'workflow', 'caseCode', 'protectedTokenBase64'))) { Throw-CaptureError 'uat_token_vault_contract_invalid' } $entryKey = [string]$entry.workflow + '|' + [string]$entry.caseCode if ($entryKeys.ContainsKey($entryKey)) { Throw-CaptureError 'uat_token_vault_contract_invalid' } $entryKeys[$entryKey] = $true } $tokenEntries = @($vaultEntries | Where-Object { [string]$_.workflow -ceq $workflowName -and [string]$_.caseCode -ceq $CaptureCaseCode }) if ($tokenEntries.Count -ne 1 -or [string]$tokenEntries[0].protectedTokenBase64 -cnotmatch '^[A-Za-z0-9+/]{64,4096}={0,2}$') { Throw-CaptureError 'uat_token_vault_entry_invalid' } $protectedBytes = [Convert]::FromBase64String( [string]$tokenEntries[0].protectedTokenBase64) $plainBytes = $null try { $entropy = $utf8.GetBytes([string]$VerifiedData.authorizationId) $plainBytes = [Security.Cryptography.ProtectedData]::Unprotect( $protectedBytes, $entropy, [Security.Cryptography.DataProtectionScope]::CurrentUser) $token = $utf8.GetString($plainBytes) } finally { if ($null -ne $plainBytes) { [Array]::Clear($plainBytes, 0, $plainBytes.Length) } } if ($token -cnotmatch '^[A-Za-z0-9_-]{32,128}$' -or (Get-Sha256Hex ($utf8.GetBytes($token))) -cne [string]$caseAuthorization.tokenSha256) { Throw-CaptureError 'uat_token_invalid' } return [pscustomobject]@{ AuthorizationId = [string]$VerifiedData.authorizationId AuthorizationIdSha256 = [string]$VerifiedData.authorizationIdSha256 AuthorizationSourceSha256 = [string]$VerifiedData.sourceSha256 AuthorizationContentSha256 = [string]$VerifiedData.contentSha256 AuthorizationIssuedAtUtc = $issuedAtMatches[0].Groups['value'].Value AuthorizationExpiresAtUtc = $expiresAtMatches[0].Groups['value'].Value CaseCode = $CaptureCaseCode Workflow = $workflowName TargetCommand = $TargetCommandName PreparationCommand = $preparationCommand AccountBook = [string]$signedScope.accountBook SubSystemId = [string]$signedScope.subSystemId UserId = [string]$signedScope.userId UserName = [string]$signedScope.userName DatabaseScopeFingerprint = ([string]$signedScope.databaseScopeFingerprint).ToLowerInvariant() TokenSha256 = [string]$caseAuthorization.tokenSha256 Token = $token } } catch { if ($_.Exception.Message.StartsWith( 'workflow_write_case_capture_failed:')) { throw } Throw-CaptureError 'uat_authorization_or_vault_invalid' } } function Read-CliEnvelope([string]$Text, [int]$ExitCode) { try { if ([string]::IsNullOrWhiteSpace($Text) -or $Text.Length -gt $maximumResponseCharacters) { Throw-CaptureError 'cli_response_invalid' } $document = $Text | ConvertFrom-Json if ($null -eq $document -or $null -eq $document.ok -or $document.ok -isnot [bool] -or ([string]$document.correlationId) -notmatch '^[A-Za-z0-9_.:-]{8,128}$') { Throw-CaptureError 'cli_response_invalid' } if ($document.ok) { if ($ExitCode -ne 0 -or -not (Test-ExactProperties $document @('ok', 'correlationId', 'data')) -or $null -eq $document.data) { Throw-CaptureError 'cli_response_invalid' } } else { if ($ExitCode -eq 0 -or -not (Test-ExactProperties $document @('ok', 'correlationId', 'error')) -or -not (Test-ExactProperties $document.error @('code', 'message', 'exitCode')) -or ([string]$document.error.code) -notmatch '^[a-z0-9_.-]{1,128}$' -or [int]$document.error.exitCode -ne $ExitCode) { Throw-CaptureError 'cli_response_invalid' } } return $document } catch { if ($_.Exception.Message.StartsWith('workflow_write_case_capture_failed:')) { throw } Throw-CaptureError 'cli_response_invalid' } } function Assert-TrustedVerifierCliUnchanged { $actual = (Get-FileHash -LiteralPath $script:verifierCliFull ` -Algorithm SHA256).Hash.ToLowerInvariant() if ($actual -cne $script:expectedVerifierCliHash) { Throw-CaptureError 'verifier_cli_hash_changed' } } function Assert-TrustedRuntimeCliUnchanged { $actual = (Get-FileHash -LiteralPath $script:runtimeCliFull ` -Algorithm SHA256).Hash.ToLowerInvariant() if ($actual -cne $script:expectedRuntimeCliHash) { Throw-CaptureError 'runtime_cli_hash_changed' } } function Assert-VerifierCliArguments([string[]]$Arguments) { $verifyAuthorization = $Arguments.Count -ge 4 -and $Arguments[0] -ceq 'acceptance' -and $Arguments[1] -ceq 'verify-uat-authorization' $projectObservation = $Arguments.Count -ge 6 -and $Arguments[0] -ceq 'adapters' -and $Arguments[1] -ceq 'project-write-observation-files' if (-not $verifyAuthorization -and -not $projectObservation) { Throw-CaptureError 'verifier_cli_command_denied' } } function Assert-RuntimeCliArguments([string[]]$Arguments) { $version = $Arguments.Count -eq 3 -and $Arguments[0] -ceq 'version' -and $Arguments[1] -ceq '--correlation-id' $bridge = $Arguments.Count -ge 2 -and $Arguments[0] -ceq 'bridge' -and $Arguments[1] -cin @('health', 'context', 'plan', 'execute') if (-not $version -and -not $bridge) { Throw-CaptureError 'runtime_cli_command_denied' } } function Invoke-TrustedCliProcess( [string]$ExecutablePath, [string]$ExpectedHash, [string[]]$Arguments, [string]$StandardInputValue, [string]$Step ) { $actualHash = (Get-FileHash -LiteralPath $ExecutablePath ` -Algorithm SHA256).Hash.ToLowerInvariant() if ($actualHash -cne $ExpectedHash) { Throw-CaptureError ($Step + '_cli_hash_changed') } $process = New-Object Diagnostics.Process try { $start = New-Object Diagnostics.ProcessStartInfo $start.FileName = $ExecutablePath $start.WorkingDirectory = [IO.Path]::GetDirectoryName($ExecutablePath) $start.UseShellExecute = $false $start.CreateNoWindow = $true $start.RedirectStandardOutput = $true $start.RedirectStandardError = $true $start.RedirectStandardInput = $true $start.StandardOutputEncoding = $utf8 $start.StandardErrorEncoding = $utf8 $start.Arguments = (($Arguments | ForEach-Object { ConvertTo-WindowsProcessArgument ([string]$_) }) -join ' ') $process.StartInfo = $start if (-not $process.Start()) { Throw-CaptureError ($Step + '_process_start_failed') } $stdoutTask = $process.StandardOutput.ReadToEndAsync() $stderrTask = $process.StandardError.ReadToEndAsync() if ($null -ne $StandardInputValue) { $process.StandardInput.Write($StandardInputValue) } $process.StandardInput.Close() $processTimeout = [Math]::Min(330000, $BridgeTimeoutMilliseconds + 30000) if (-not $process.WaitForExit($processTimeout)) { try { $process.Kill() } catch { } Throw-CaptureError ($Step + '_timeout') } $process.WaitForExit() $stdout = $stdoutTask.Result $stderr = $stderrTask.Result if (($process.ExitCode -eq 0 -and ([string]::IsNullOrWhiteSpace($stdout) -or -not [string]::IsNullOrWhiteSpace($stderr))) -or ($process.ExitCode -ne 0 -and ([string]::IsNullOrWhiteSpace($stderr) -or -not [string]::IsNullOrWhiteSpace($stdout)))) { Throw-CaptureError ($Step + '_stream_contract_invalid') } $raw = if ($process.ExitCode -eq 0) { $stdout } else { $stderr } $envelope = Read-CliEnvelope $raw $process.ExitCode $hashAfter = (Get-FileHash -LiteralPath $ExecutablePath ` -Algorithm SHA256).Hash.ToLowerInvariant() if ($hashAfter -cne $ExpectedHash) { Throw-CaptureError ($Step + '_cli_hash_changed') } return [PSCustomObject]@{ ExitCode = $process.ExitCode Raw = $raw Envelope = $envelope } } catch { if ($_.Exception.Message.StartsWith('workflow_write_case_capture_failed:')) { throw } Throw-CaptureError ($Step + '_process_failed') } finally { if ($null -ne $process) { $process.Dispose() } } } function Invoke-TrustedVerifierCli( [string[]]$Arguments, [string]$StandardInputValue, [string]$Step ) { Assert-VerifierCliArguments $Arguments return Invoke-TrustedCliProcess ` $script:verifierCliFull ` $script:expectedVerifierCliHash ` $Arguments ` $StandardInputValue ` $Step } function Invoke-TrustedRuntimeCli( [string[]]$Arguments, [string]$StandardInputValue, [string]$Step ) { Assert-RuntimeCliArguments $Arguments return Invoke-TrustedCliProcess ` $script:runtimeCliFull ` $script:expectedRuntimeCliHash ` $Arguments ` $StandardInputValue ` $Step } function Read-StrictIdempotencyKeyFile([string]$Path) { $full = Resolve-RegularFile $Path 512 'idempotency_key_file_invalid' try { $value = [IO.File]::ReadAllText($full, $utf8) if ($value.EndsWith("`r`n", [StringComparison]::Ordinal)) { $value = $value.Substring(0, $value.Length - 2) } elseif ($value.EndsWith("`n", [StringComparison]::Ordinal)) { $value = $value.Substring(0, $value.Length - 1) } if ($value.Contains("`r") -or $value.Contains("`n")) { Throw-CaptureError 'idempotency_key_file_invalid' } return $value } catch { if ($_.Exception.Message.StartsWith('workflow_write_case_capture_failed:')) { throw } Throw-CaptureError 'idempotency_key_file_invalid' } } function Convert-SecureStringToPlainText([Security.SecureString]$Value) { $pointer = [IntPtr]::Zero try { $pointer = [Runtime.InteropServices.Marshal]::SecureStringToBSTR($Value) return [Runtime.InteropServices.Marshal]::PtrToStringBSTR($pointer) } finally { if ($pointer -ne [IntPtr]::Zero) { [Runtime.InteropServices.Marshal]::ZeroFreeBSTR($pointer) } } } function Resolve-IntegerObservation( [int]$Current, [int]$Minimum, [int]$Maximum, [string]$Prompt, [string]$Code ) { if ($Current -ge $Minimum -and $Current -le $Maximum) { return $Current } if ($NonInteractive) { Throw-CaptureError $Code } $raw = Read-Host $Prompt $parsed = 0 if (-not [int]::TryParse($raw, [ref]$parsed) -or $parsed -lt $Minimum -or $parsed -gt $Maximum) { Throw-CaptureError $Code } return $parsed } function Resolve-BooleanObservation( [Nullable[bool]]$Current, [string]$Prompt, [string]$Code ) { if ($null -ne $Current) { return [bool]$Current } if ($NonInteractive) { Throw-CaptureError $Code } $raw = (Read-Host ($Prompt + ' [true/false]')).Trim().ToLowerInvariant() if ($raw -eq 'true') { return $true } if ($raw -eq 'false') { return $false } Throw-CaptureError $Code } function Write-StrictJson([object]$Value, [string]$Path) { $json = $Value | ConvertTo-Json -Depth 20 [IO.File]::WriteAllText($Path, $json, $utf8) } function New-StagedOutput([string]$FinalPath) { $directory = [IO.Path]::GetDirectoryName($FinalPath) $path = Join-Path $directory ('capture-' + [Guid]::NewGuid().ToString('N') + '.json') if ([IO.File]::Exists($path)) { Throw-CaptureError 'staged_output_collision' } $stagedOutputs.Add($path) return $path } function Invoke-Projection([string]$IndexPath, [string]$StagePath, [string]$Step) { $result = Invoke-TrustedVerifierCli @( 'adapters', 'project-write-observation-files', '--input', $IndexPath, '--output', $StagePath, '--correlation-id', ('projection-' + [Guid]::NewGuid().ToString('N')) ) $null $Step if ($result.ExitCode -ne 0) { Throw-CaptureError ($Step + '_' + [string]$result.Envelope.error.code) } if (-not [IO.File]::Exists($StagePath)) { Throw-CaptureError ($Step + '_output_missing') } } try { $verifierCliFull = Resolve-RegularFile ` $VerifierCliPath 128MB 'verifier_cli_file_invalid' $runtimeCliFull = Resolve-RegularFile ` $RuntimeCliPath 128MB 'runtime_cli_file_invalid' if ([IO.Path]::GetFileName($verifierCliFull) -ine 'lserp-cli.exe') { Throw-CaptureError 'verifier_cli_filename_invalid' } if ([IO.Path]::GetFileName($runtimeCliFull) -ine 'lserp-agent-cli.exe') { Throw-CaptureError 'runtime_cli_filename_invalid' } if ($verifierCliFull -ieq $runtimeCliFull) { Throw-CaptureError 'cli_role_path_conflict' } $verifierCliLock = [IO.File]::Open( $verifierCliFull, [IO.FileMode]::Open, [IO.FileAccess]::Read, [IO.FileShare]::Read) $runtimeCliLock = [IO.File]::Open( $runtimeCliFull, [IO.FileMode]::Open, [IO.FileAccess]::Read, [IO.FileShare]::Read) $expectedVerifierCliHash = $ExpectedVerifierCliSha256.ToLowerInvariant() $expectedRuntimeCliHash = $ExpectedRuntimeCliSha256.ToLowerInvariant() $expectedVerifierCliSigner = $ExpectedVerifierSignerThumbprint.ToUpperInvariant() $expectedRuntimeCliSigner = $ExpectedRuntimeSignerThumbprint.ToUpperInvariant() Assert-TrustedVerifierCliUnchanged Assert-TrustedRuntimeCliUnchanged $verifierSignature = Get-AuthenticodeSignature ` -LiteralPath $verifierCliFull $actualVerifierSigner = if ($null -eq $verifierSignature.SignerCertificate) { '' } else { ([string]$verifierSignature.SignerCertificate.Thumbprint). Replace(' ', '').ToUpperInvariant() } if ($verifierSignature.Status -ne [System.Management.Automation.SignatureStatus]::Valid -or $actualVerifierSigner -cne $expectedVerifierCliSigner) { Throw-CaptureError 'verifier_cli_signature_invalid' } $runtimeSignature = Get-AuthenticodeSignature -LiteralPath $runtimeCliFull $actualRuntimeSigner = if ($null -eq $runtimeSignature.SignerCertificate) { '' } else { ([string]$runtimeSignature.SignerCertificate.Thumbprint). Replace(' ', '').ToUpperInvariant() } if ($runtimeSignature.Status -ne [System.Management.Automation.SignatureStatus]::Valid -or $actualRuntimeSigner -cne $expectedRuntimeCliSigner) { Throw-CaptureError 'runtime_cli_signature_invalid' } $runtimeIdentityCorrelation = 'uat-runtime-' + [Guid]::NewGuid().ToString('N') $runtimeIdentityResponse = Invoke-TrustedRuntimeCli @( 'version', '--correlation-id', $runtimeIdentityCorrelation ) $null 'runtime_cli_identity' $runtimeIdentity = $runtimeIdentityResponse.Envelope.data if ($runtimeIdentityResponse.ExitCode -ne 0 -or -not $runtimeIdentityResponse.Envelope.ok -or [string]$runtimeIdentityResponse.Envelope.correlationId -cne $runtimeIdentityCorrelation -or -not (Test-ExactProperties $runtimeIdentity @( 'component', 'version', 'protocolVersion', 'bridgeOnly', 'databaseDirectAccess', 'sessionSource')) -or [string]$runtimeIdentity.component -cne 'lserp-agent-cli' -or [string]$runtimeIdentity.version -cne $ExpectedRuntimeCliVersion -or [string]$runtimeIdentity.protocolVersion -cne '1.0' -or $runtimeIdentity.bridgeOnly -isnot [bool] -or $runtimeIdentity.bridgeOnly -ne $true -or $runtimeIdentity.databaseDirectAccess -isnot [bool] -or $runtimeIdentity.databaseDirectAccess -ne $false -or [string]$runtimeIdentity.sessionSource -cne 'current_logged_in_erp_process') { Throw-CaptureError 'runtime_cli_identity_invalid' } $inputFull = Resolve-RegularFile $CommandInputFile (512KB) 'command_input_invalid' $uatAuthorizationFull = Resolve-RegularFile ` $UatAuthorizationFile (512KB) 'uat_authorization_file_invalid' $uatTokenVaultFull = Resolve-RegularFile ` $UatTokenVaultPath (512KB) 'uat_token_vault_file_invalid' if ($inputFull -ieq $uatAuthorizationFull -or $inputFull -ieq $uatTokenVaultFull -or $uatAuthorizationFull -ieq $uatTokenVaultFull -or $verifierCliFull -ieq $inputFull -or $runtimeCliFull -ieq $inputFull -or $verifierCliFull -ieq $uatAuthorizationFull -or $verifierCliFull -ieq $uatTokenVaultFull -or $runtimeCliFull -ieq $uatAuthorizationFull -or $runtimeCliFull -ieq $uatTokenVaultFull) { Throw-CaptureError 'trusted_input_path_conflict' } $uatAuthorizationLock = [IO.File]::Open( $uatAuthorizationFull, [IO.FileMode]::Open, [IO.FileAccess]::Read, [IO.FileShare]::Read) $uatTokenVaultLock = [IO.File]::Open( $uatTokenVaultFull, [IO.FileMode]::Open, [IO.FileAccess]::Read, [IO.FileShare]::Read) $actualAuthorizationHash = (Get-FileHash ` -LiteralPath $uatAuthorizationFull -Algorithm SHA256).Hash.ToLowerInvariant() if ($actualAuthorizationHash -cne $ExpectedUatAuthorizationSha256.ToLowerInvariant()) { Throw-CaptureError 'uat_authorization_hash_mismatch' } $uatVaultSha256 = (Get-FileHash ` -LiteralPath $uatTokenVaultFull -Algorithm SHA256).Hash.ToLowerInvariant() $uatVerification = Invoke-TrustedVerifierCli @( 'acceptance', 'verify-uat-authorization', '--input', $uatAuthorizationFull, '--correlation-id', ('uat-auth-' + [Guid]::NewGuid().ToString('N')) ) $null 'verify_uat_authorization' if ($uatVerification.ExitCode -ne 0 -or -not $uatVerification.Envelope.ok) { Throw-CaptureError 'uat_authorization_verification_failed' } $uatGrant = Read-VerifiedUatGrant ` $uatVerification.Envelope.data ` $uatAuthorizationFull ` $uatTokenVaultFull ` $CaseCode ` $CommandName $uatToken = [string]$uatGrant.Token $outputFull = Resolve-NewJsonPath $OutputPath 'output_path_invalid' $auditOutputFull = $null $auditCaseCode = $null if (-not [string]::IsNullOrWhiteSpace($CorrelatedAuditOutputPath)) { if ($CaseCode -eq 'purchase_unique_match_commit') { $auditCaseCode = 'purchase_audit_correlated' } elseif ($CaseCode -eq 'leave_create_draft_commit') { $auditCaseCode = 'leave_audit_correlated' } else { Throw-CaptureError 'correlated_audit_case_invalid' } $auditOutputFull = Resolve-NewJsonPath ` $CorrelatedAuditOutputPath 'correlated_audit_output_invalid' if ($auditOutputFull -ieq $outputFull) { Throw-CaptureError 'correlated_audit_output_invalid' } $uatAuditGrant = Read-VerifiedUatGrant ` $uatVerification.Envelope.data ` $uatAuthorizationFull ` $uatTokenVaultFull ` $auditCaseCode ` $CommandName $uatAuditTokenSha256 = [string]$uatAuditGrant.TokenSha256 $uatAuditGrant.Token = $null $uatAuditGrant = $null } if ([string]::IsNullOrWhiteSpace($RestrictedWorkingRoot)) { if ([string]::IsNullOrWhiteSpace($env:LOCALAPPDATA)) { Throw-CaptureError 'restricted_working_root_required' } $RestrictedWorkingRoot = Join-Path ` $env:LOCALAPPDATA 'Langsu\Lserp\AcceptanceRaw' } $rawDirectory = New-RestrictedDirectory $RestrictedWorkingRoot $sourceInputCopy = Join-Path $rawDirectory 'source-command-input.json' $inputCopy = Join-Path $rawDirectory 'command-input.json' $preparationResponsePath = Join-Path ` $rawDirectory 'preparation-response.json' $contextResponsePath = Join-Path $rawDirectory 'context-response.json' $planResponsePath = Join-Path $rawDirectory 'plan-response.json' $executeResponsePath = Join-Path $rawDirectory 'execute-response.json' $indexPath = Join-Path $rawDirectory 'case-index.json' [IO.File]::Copy($inputFull, $sourceInputCopy, $false) $postPlanStagingCases = @( 'purchase_runtime_recheck_blocked', 'leave_stale_flow_type_blocked', 'leave_runtime_recheck_blocked' ) $requiresPostPlanStaging = $CaseCode -in $postPlanStagingCases if ($requiresPostPlanStaging -and (-not $Execute -or -not $PauseAfterPlanForOperatorStaging.IsPresent)) { Throw-CaptureError 'post_plan_operator_staging_required' } if ($PauseAfterPlanForOperatorStaging.IsPresent -and (-not $Execute -or $NonInteractive -or -not $requiresPostPlanStaging)) { Throw-CaptureError 'post_plan_operator_staging_mode_invalid' } $hasSecureKey = $null -ne $IdempotencyKey $hasKeyFile = -not [string]::IsNullOrWhiteSpace($IdempotencyKeyFile) if ($hasSecureKey -and $hasKeyFile) { Throw-CaptureError 'idempotency_key_source_conflict' } if (-not $Execute -and ($hasSecureKey -or $hasKeyFile)) { Throw-CaptureError 'idempotency_key_without_execute' } if ($Execute) { if ($hasKeyFile) { $idempotencyPlain = Read-StrictIdempotencyKeyFile $IdempotencyKeyFile } else { if (-not $hasSecureKey) { if ($NonInteractive) { Throw-CaptureError 'idempotency_key_required' } $IdempotencyKey = Read-Host ` '输入本次稳定业务幂等键（不会显示）' -AsSecureString } $idempotencyPlain = Convert-SecureStringToPlainText $IdempotencyKey } if ($idempotencyPlain -cnotmatch '^[A-Za-z0-9_.:-]{8,128}$') { Throw-CaptureError 'idempotency_key_invalid' } } $healthCorrelationId = 'uat-health-' + [Guid]::NewGuid().ToString('N') $health = Invoke-TrustedRuntimeCli @( 'bridge', 'health', '--erp-process-id', [string]$ErpProcessId, '--expected-database-scope-fingerprint', [string]$uatGrant.DatabaseScopeFingerprint, '--expected-user-id', [string]$uatGrant.UserId, '--expected-user-name', [string]$uatGrant.UserName, '--expected-account-book', [string]$uatGrant.AccountBook, '--expected-subsystem-id', [string]$uatGrant.SubSystemId, '--expected-is-administrator', 'false', '--timeout-ms', [string]$BridgeTimeoutMilliseconds, '--correlation-id', $healthCorrelationId ) $null 'bridge_uat_health' $healthUat = if ($null -eq $health.Envelope.data) { $null } else { $health.Envelope.data.workflowUat } if ($health.ExitCode -ne 0 -or -not $health.Envelope.ok -or $null -eq $healthUat -or $healthUat.enabled -ne $true -or [string]$healthUat.sourceSha256 -cne [string]$uatGrant.AuthorizationSourceSha256 -or [string]$healthUat.authorizationIdSha256 -cne [string]$uatGrant.AuthorizationIdSha256 -or $healthUat.generalCapabilitiesHidden -ne $true) { Throw-CaptureError 'bridge_uat_authorization_mismatch' } $correlationId = 'uat-' + [Guid]::NewGuid().ToString('N') $context = Invoke-TrustedRuntimeCli @( 'bridge', 'context', '--erp-process-id', [string]$ErpProcessId, '--expected-database-scope-fingerprint', [string]$uatGrant.DatabaseScopeFingerprint, '--expected-user-id', [string]$uatGrant.UserId, '--expected-user-name', [string]$uatGrant.UserName, '--expected-account-book', [string]$uatGrant.AccountBook, '--expected-subsystem-id', [string]$uatGrant.SubSystemId, '--expected-is-administrator', 'false', '--timeout-ms', [string]$BridgeTimeoutMilliseconds, '--correlation-id', $correlationId ) $null 'bridge_context' if ($context.ExitCode -ne 0 -or -not $context.Envelope.ok) { Throw-CaptureError 'bridge_context_unavailable' } [IO.File]::WriteAllText($contextResponsePath, $context.Raw, $utf8) if ($null -ne $uatGrant.PreparationCommand) { $preparation = Invoke-TrustedRuntimeCli @( 'bridge', 'plan', [string]$uatGrant.PreparationCommand, '--input', $sourceInputCopy, '--uat-authorization-id', [string]$uatGrant.AuthorizationId, '--uat-case-code', $CaseCode, '--uat-token-stdin', '--erp-process-id', [string]$ErpProcessId, '--expected-database-scope-fingerprint', [string]$uatGrant.DatabaseScopeFingerprint, '--expected-user-id', [string]$uatGrant.UserId, '--expected-user-name', [string]$uatGrant.UserName, '--expected-account-book', [string]$uatGrant.AccountBook, '--expected-subsystem-id', [string]$uatGrant.SubSystemId, '--expected-is-administrator', 'false', '--timeout-ms', [string]$BridgeTimeoutMilliseconds, '--correlation-id', $correlationId ) $uatToken 'bridge_preparation_plan' [IO.File]::WriteAllText( $preparationResponsePath, $preparation.Raw, $utf8) $resolvedInput = if ($null -eq $preparation.Envelope.data -or $null -eq $preparation.Envelope.data.plan -or $null -eq $preparation.Envelope.data.plan.data) { $null } else { $preparation.Envelope.data.plan.data.resolvedInput } if ($preparation.ExitCode -ne 0 -or -not $preparation.Envelope.ok -or $preparation.Envelope.data.plan.valid -ne $true -or $preparation.Envelope.data.plan.executionAllowed -ne $false -or [string]$preparation.Envelope.data.plan.data.resolvedCommand -cne $CommandName -or $preparation.Envelope.data.plan.data.requiresFollowupPlan -ne $true -or $null -eq $resolvedInput -or $resolvedInput -isnot [pscustomobject] -or [string]$resolvedInput.resolutionProof -cnotmatch '^(?:rp1|lrp1)\.[0-9]{1,19}\.[a-f0-9]{32}\.[a-f0-9]{64}\.[A-Za-z0-9_-]{40,64}$') { Throw-CaptureError 'bridge_preparation_not_resolved' } Write-StrictJson $resolvedInput $inputCopy } else { [IO.File]::Copy($sourceInputCopy, $inputCopy, $false) } $plan = Invoke-TrustedRuntimeCli @( 'bridge', 'plan', $CommandName, '--input', $inputCopy, '--uat-authorization-id', [string]$uatGrant.AuthorizationId, '--uat-case-code', $CaseCode, '--uat-token-stdin', '--erp-process-id', [string]$ErpProcessId, '--expected-database-scope-fingerprint', [string]$uatGrant.DatabaseScopeFingerprint, '--expected-user-id', [string]$uatGrant.UserId, '--expected-user-name', [string]$uatGrant.UserName, '--expected-account-book', [string]$uatGrant.AccountBook, '--expected-subsystem-id', [string]$uatGrant.SubSystemId, '--expected-is-administrator', 'false', '--timeout-ms', [string]$BridgeTimeoutMilliseconds, '--correlation-id', $correlationId ) $uatToken 'bridge_plan' [IO.File]::WriteAllText($planResponsePath, $plan.Raw, $utf8) $executeResponseFileName = $null if ($Execute) { if ($plan.ExitCode -ne 0 -or -not $plan.Envelope.ok -or $null -eq $plan.Envelope.data.plan -or $plan.Envelope.data.plan.valid -ne $true -or $plan.Envelope.data.plan.executionAllowed -ne $true -or ([string]$plan.Envelope.data.plan.planId) -notmatch '^[A-Fa-f0-9]{32}$') { Throw-CaptureError 'bridge_plan_not_executable' } if ($PauseAfterPlanForOperatorStaging.IsPresent) { $stagingConfirmation = 'STAGED:' + $CaseCode $entered = Read-Host ( '计划已固定；请由授权 DBA/配置人员完成计划后场景变更，' + '保持当前 ERP 进程运行，然后输入 ' + $stagingConfirmation) if ([string]$entered -cne $stagingConfirmation) { Throw-CaptureError 'post_plan_operator_staging_not_confirmed' } Assert-TrustedVerifierCliUnchanged Assert-TrustedRuntimeCliUnchanged $authorizationHashAfterStaging = (Get-FileHash ` -LiteralPath $uatAuthorizationFull -Algorithm SHA256).Hash.ToLowerInvariant() $vaultHashAfterStaging = (Get-FileHash ` -LiteralPath $uatTokenVaultFull -Algorithm SHA256).Hash.ToLowerInvariant() if ($authorizationHashAfterStaging -cne $ExpectedUatAuthorizationSha256.ToLowerInvariant() -or $vaultHashAfterStaging -cne $uatVaultSha256) { Throw-CaptureError 'trusted_input_changed_during_operator_staging' } } $execute = Invoke-TrustedRuntimeCli @( 'bridge', 'execute', [string]$plan.Envelope.data.plan.planId, '--idempotency-key-stdin', '--uat-authorization-id', [string]$uatGrant.AuthorizationId, '--uat-case-code', $CaseCode, '--uat-token-stdin', '--erp-process-id', [string]$ErpProcessId, '--expected-database-scope-fingerprint', [string]$uatGrant.DatabaseScopeFingerprint, '--expected-user-id', [string]$uatGrant.UserId, '--expected-user-name', [string]$uatGrant.UserName, '--expected-account-book', [string]$uatGrant.AccountBook, '--expected-subsystem-id', [string]$uatGrant.SubSystemId, '--expected-is-administrator', 'false', '--timeout-ms', [string]$BridgeTimeoutMilliseconds, '--correlation-id', $correlationId ) ($uatToken + "`n" + $idempotencyPlain) 'bridge_execute' [IO.File]::WriteAllText($executeResponsePath, $execute.Raw, $utf8) $executeResponseFileName = 'execute-response.json' } $mutationCount = Resolve-IntegerObservation ` $BusinessMutationCount 0 1000 ` '输入 DBA 只读复核得到的业务变更行数' ` 'business_mutation_count_required' if ($Execute) { $confirmationObserved = Resolve-BooleanObservation ` $NativeConfirmationObserved ` '是否亲眼看到并处理了 ERP 原生确认窗口' ` 'native_confirmation_observation_required' } else { if ($null -ne $NativeConfirmationObserved -and [bool]$NativeConfirmationObserved) { Throw-CaptureError 'plan_only_confirmation_invalid' } $confirmationObserved = $false } $auditCount = Resolve-IntegerObservation ` $AuditEventCount 1 1000 ` '输入只读复核得到的命令审计事件数' ` 'audit_event_count_required' $sourcePayloadBound = Resolve-BooleanObservation ` $SourceDocumentWritePayloadBound ` '来源附件集合是否已在写过程 payload 中核对一致' ` 'source_payload_observation_required' $sourceAuditCount = Resolve-IntegerObservation ` $SourceDocumentAuditCount 0 1000 ` '输入同一业务审计号下去重后的来源附件审计行数' ` 'source_audit_count_required' $observedAtUtc = [DateTimeOffset]::UtcNow.ToString( "yyyy-MM-dd'T'HH:mm:ss.fff'Z'", [Globalization.CultureInfo]::InvariantCulture) $index = [ordered]@{ schemaVersion = '1.3' caseCode = $CaseCode uatAuthorizationSourceSha256 = [string]$uatGrant.AuthorizationSourceSha256 uatAuthorizationContentSha256 = [string]$uatGrant.AuthorizationContentSha256 uatAuthorizationIdSha256 = [string]$uatGrant.AuthorizationIdSha256 uatAuthorizationIssuedAtUtc = [string]$uatGrant.AuthorizationIssuedAtUtc uatAuthorizationExpiresAtUtc = [string]$uatGrant.AuthorizationExpiresAtUtc uatExecutionCaseCode = [string]$uatGrant.CaseCode uatTokenSha256 = [string]$uatGrant.TokenSha256 runtimeCliVersion = $ExpectedRuntimeCliVersion runtimeCliSha256 = $expectedRuntimeCliHash runtimeCliSignerThumbprint = $expectedRuntimeCliSigner commandName = $CommandName commandInputFile = 'command-input.json' contextCliResponseFile = 'context-response.json' planCliResponseFile = 'plan-response.json' executeCliResponseFile = $executeResponseFileName idempotencyKey = $idempotencyPlain businessMutationCount = $mutationCount nativeConfirmationObserved = $confirmationObserved auditEventCount = $auditCount sourceDocumentWritePayloadBound = $sourcePayloadBound sourceDocumentAuditCount = $sourceAuditCount observedAtUtc = $observedAtUtc } Write-StrictJson $index $indexPath $mainStage = New-StagedOutput $outputFull Invoke-Projection $indexPath $mainStage 'project_main_case' $auditStage = $null if ($null -ne $auditCaseCode) { $index.caseCode = $auditCaseCode $index.uatTokenSha256 = $uatAuditTokenSha256 $index.businessMutationCount = 0 Write-StrictJson $index $indexPath $auditStage = New-StagedOutput $auditOutputFull Invoke-Projection $indexPath $auditStage 'project_correlated_audit_case' } [IO.File]::Move($mainStage, $outputFull) $publishedOutputs.Add($outputFull) if ($null -ne $auditStage) { [IO.File]::Move($auditStage, $auditOutputFull) $publishedOutputs.Add($auditOutputFull) } Assert-TrustedVerifierCliUnchanged Assert-TrustedRuntimeCliUnchanged if ((Get-FileHash -LiteralPath $uatAuthorizationFull -Algorithm SHA256).Hash.ToLowerInvariant() -cne $ExpectedUatAuthorizationSha256.ToLowerInvariant() -or (Get-FileHash -LiteralPath $uatTokenVaultFull -Algorithm SHA256).Hash.ToLowerInvariant() -cne $uatVaultSha256) { Throw-CaptureError 'uat_locked_input_changed' } $summaryJson = ([ordered]@{ ok = $true packageType = 'workflow_write_case_capture' schemaVersion = '1.2' caseCode = $CaseCode outputFile = [IO.Path]::GetFileName($outputFull) correlatedAuditCaseCode = $auditCaseCode correlatedAuditOutputFile = if ($null -eq $auditOutputFull) { $null } else { [IO.Path]::GetFileName($auditOutputFull) } rawIdentifiersEmitted = $false rawTemporaryFilesRetained = $false uatAuthorizationSourceSha256 = [string]$uatGrant.AuthorizationSourceSha256 verifierCli = [ordered]@{ fileName = 'lserp-cli.exe' sha256 = $expectedVerifierCliHash signerThumbprint = $expectedVerifierCliSigner } runtimeCli = [ordered]@{ fileName = 'lserp-agent-cli.exe' version = $ExpectedRuntimeCliVersion sha256 = $expectedRuntimeCliHash signerThumbprint = $expectedRuntimeCliSigner bridgeOnly = $true databaseDirectAccess = $false sessionSource = 'current_logged_in_erp_process' } uatCaseTokenEmitted = $false registrationReady = $false } | ConvertTo-Json -Depth 4) } catch { foreach ($published in @($publishedOutputs)) { try { if ([IO.File]::Exists($published)) { [IO.File]::Delete($published) } } catch { } } throw } finally { $idempotencyPlain = $null $uatToken = $null $uatAuditTokenSha256 = $null $cleanupFailed = $false if ($null -ne $verifierCliLock) { try { $verifierCliLock.Dispose() } catch { $cleanupFailed = $true } } if ($null -ne $runtimeCliLock) { try { $runtimeCliLock.Dispose() } catch { $cleanupFailed = $true } } if ($null -ne $uatAuthorizationLock) { try { $uatAuthorizationLock.Dispose() } catch { $cleanupFailed = $true } } if ($null -ne $uatTokenVaultLock) { try { $uatTokenVaultLock.Dispose() } catch { $cleanupFailed = $true } } foreach ($staged in @($stagedOutputs)) { try { if ([IO.File]::Exists($staged)) { [IO.File]::Delete($staged) } } catch { $cleanupFailed = $true } } if ($null -ne $rawDirectory -and [IO.Directory]::Exists($rawDirectory)) { try { [IO.Directory]::Delete($rawDirectory, $true) } catch { $cleanupFailed = $true } } if ($cleanupFailed) { foreach ($published in @($publishedOutputs)) { try { if ([IO.File]::Exists($published)) { [IO.File]::Delete($published) } } catch { } } throw 'workflow_write_case_capture_failed:cleanup_failed' } } Write-Output $summaryJson