- Admin check uses -not (IsAdmin); the old call passed -eq $false as arguments.
- Named instances: WQL filter Name='MSSQL$DEV' unescaped, lookup errors surface.
- SANs decoded from the raw extension (DER walk) and matched as whole names.
- Immutable deploy-, request- and rollback- records; already-bound instances
get no snapshot; -Rollback takes the newest snapshot not yet rolled back,
-Snapshot picks one.
- certreq -new, -submit, -accept and the key grants go through ShouldProcess;
a declined or failed prerequisite binds nothing.
- Rollback and automatic restore work per instance, read back, report failures.
Also found while testing: PowerShell 7 returns RSACng for a CSP key, so the
provider check now reads CERT_KEY_PROV_INFO; ForEach-Object member form returned
nothing under -WhatIf; stderr capture under Stop threw on 5.1; LocalSystem and
NetworkService accounts go to icacls as SIDs; SQL Agent is started again after
a restart; signature checked by OID.
DEPLOY.md gains the run procedure: preflight, DEV, docker-1 checks, production, rollback.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
New repo for the Packet Station rebuild (Python 3.12, FastAPI, PostgreSQL 16,
React, VisualKit, MFilesKit, Docker Compose on docker-1). Nothing is migrated
from the M: install.
- CLAUDE.md with the safety rules, README, CHANGELOG, docs (BRIEF, PLAN,
SECURITY rewritten for the server with the requirement ID table, DEPLOY,
stubs for FEED, POLICY, SCHEMA, GO-LIVE, PAPER-FALLBACK).
- packetstation CLI: app, worker (heartbeat stub), migrate, doctor, version,
healthcheck. Settings from the environment with secret files. Stack guard
(test never points at VISUAL production). Security headers and CSP.
Trusted proxy resolved by name. JSON logs with redaction.
- Migration runner and 0001_base: settings, append-only audit_events with
hash chain, ps_notify, grants for ps_app.
- Multi-stage Dockerfile (ODBC Driver 18, PESCO libraries from the Gitea
index only), compose base, proxy overlay for npm_default, CI overlay,
postgres initdb roles, env examples, NPM proxy host notes, Gitea Actions.
- Frontend: Vite, React, TypeScript, the PESCO dark theme ported with
self-hosted fonts, placeholder sign-in and home.
- Verified on docker-1: image builds, CI stack comes up healthy, doctor
database checks pass, 77 server tests pass against PostgreSQL.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
spencermandClaude Opus 5.5