v1 Hands-Off Rerun Acceptance

Operator date: 2026-08-30

Status: Accepted — the exact release-candidate implementation passed the complete LabZ1 workflow twice without installation or ConfigMgr object change; the first run refreshed only stale authenticated evidence and the immediate second run was zero-action.

This record closes the live gate for the first setup-cm release. It records only sanitized identities, hashes, test counts, and state results. It contains no credentials, tokens, private URLs, generated configuration, raw policies, or log bodies.

Accepted scope

The marker remains a required deployment to one direct member only. No other device or collection is an accepted v1 target. Production, additional clients, distributed MECM, co-management, Patch My PC, reporting expansion, tenant integrations, VM rebuilds, and client-wide security-policy changes remain outside this release.

Exact execution source

The archive was generated with git archive, transferred through a temporary lab-only listener, checked by SHA-256 on both Windows targets, and checked on CM01 with git get-tar-commit-id before extraction. The listener was stopped after staging.

The acceptance-record commit is documentation-only relative to the live-tested implementation. Before tagging, all non-documentation release paths must remain identical to this commit. Any executable, configuration, workflow, or test-tree difference requires renewed acceptance rather than a documentation exception.

Quality gates

The native evidence-channel tests include a real Windows proof that a newly created file inherits target-computer Modify rights. This test caught and closed the earlier directory-only inheritance defect before formal acceptance.

Bounded repair lineage

The lab entered the final acceptance window with all installation and fixed ConfigMgr object state valid. The authenticated receipt is deliberately fresh for only 30 minutes, so the pre-run boundary reported exactly Client/ClientEvidencePending; SQL, MECM, acquisition, marker objects, content, distribution, targeting, and server compliance were already compliant.

The first run therefore permitted only RequestClientPolicy and WaitForConvergence. It requested the supported paired client evaluation and waited for a new target-owned receipt. No acquisition, installer, SQL/MECM repair, application/content/distribution, collection, membership, assignment, or detector mutation was permitted or observed.

An earlier candidate closed the stage-output contract defect. Final review then found that the signed bootstrapper architecture exception was broader than its known x86-PE/x64-product case and that Health used an empty repair path before failing. Commit 33535c6a0e47bb0bb0f838eb990b0e9e9cb2ac95 narrows that exception and makes Health a single check-only evaluation with named failed checks. Both changes have failing-before and passing-after regression proof.

Exact marker and target identity

Final inspection found exactly one item in the bounded evidence directory: the accepted marker-evidence.json. The application, deployment type, package, distribution, collection, direct membership, and assignment identities did not change across either formal run.

Formal run one

All six Health values were true: SQL, MECM, Management Point, Distribution Point, client reachability, and active non-obsolete client registration.

Formal run two

The second run used the same command and exact source revision. Mutation mocks would have failed the run if acquisition, SQL repair, MECM repair, marker repair, content distribution, collection membership, deployment, policy, or installer paths had been invoked.

Independent before/after snapshots

Snapshot hashes differ because each file includes its observation time. The comparison gate separately normalized and compared the owned values. Server application, deployment-type, distribution, collection, rule, membership, and assignment properties were identical. Client marker, Agent, firewall, execution-policy, trust-store, scheduled-task, and scoped service hashes were identical.

The formal snapshots hash all Windows service definitions except OS-managed BITS and record BITS separately. The stable 296-service scoped SHA-256 was 682863423E9B331756C8025FDE4592A4E140F9480AA9587483FF105C975BEDB0; BITS was Manual/Stopped at baseline and Auto/Running after the bounded policy-refresh window and second run. No setup-cm-owned service value, service definition in the scoped hash, or other client configuration changed.

Independent infrastructure and controller proof

• Proxmox node pve2 reported the two-node cluster quorate.
• VMs 107, 111, 115, and 135 plus CT 500 were all running.
• Controller /healthz returned {"ok":true}.
• Controller release 2026.08.48 reported source 8ba1c80.
• Accepted Agents agent-labz1-cm01 / VM 107 and agent-ring0ivy24-01 / VM 135 checked in currently at version 2026.8.48.0 and were not revoked.
• A stale historical osd-fullos controller identity also names CM01. It is not the accepted Agent and was left untouched because historical-object deletion is explicitly outside v1.

Evidence hygiene and cleanup

• Both accepted run directories parsed as JSON and produced zero sensitive keys, credentials, bearer values, private URLs, or raw policy patterns.
• A stalled direct SFTP attempt created only two exact zero-byte staging placeholders. The two transfer-only SFTP processes were stopped and those empty placeholders were removed before the proven temporary lab-only listener was used; no source had been extracted from them.
• The temporary listener was stopped immediately after both archive hashes matched. The two verified staging archives and two generated testResults.xml files were removed after acceptance; both extracted source roots then matched the exact 96-file manifest again.
• Earlier acceptance work removed two exact target-owned failed-attempt .tmp receipts, one rejected source-stager helper, three superseded client helpers, and hash-only BITS diagnostic state only after identity checks. All were temporary and regenerable. No user document, ConfigMgr object, source media, accepted evidence, or unrelated lab file was deleted.

Safe restart

Routine validation should stay read-only. From the accepted source root on CM01, run:

$commit = '33535c6a0e47bb0bb0f838eb990b0e9e9cb2ac95'
pwsh "C:\ProgramData\SetupCm\source\$commit\scripts\Invoke-SetupCm.ps1" `
  -ConfigPath 'C:\ProgramData\SetupCm\config\lab.local.yaml' `
  -Mode Unattended -Stage Health -SourceCommit $commit

Use the complete five-stage command only from an exact reviewed source when a full no-op confirmation or a proven owned-component repair is required. Do not replay bootstrap installers merely for newer timestamps, broaden the marker collection, weaken client policy, or delete historical objects as recovery.

Once published, the v1.0.0 tag and GitHub release will be the authoritative publication identity for this accepted implementation. The release notes must retain this topology, evidence boundary, test counts, limitations, and safe restart rule.