{'command': ['git', 'diff', '527cd8e8d7ef192892d5630fce10e69a6d811893', '7890ead39bb7f14ed44aaae44b0951f098ffe9ac', '--', 'crates'], 'start_utc': '2026-09-14T13:12:34.638419+00:00', 'end_utc': '2026-09-14T13:12:34.909558+00:00', 'exit': 0, 'stdout': 'diff --git a/crates/spt-daemon/src/bootstrap_firewall/windows.rs b/crates/spt-daemon/src/bootstrap_firewall/windows.rs\nindex 56ff9176..c7cc6786 100644\n--- a/crates/spt-daemon/src/bootstrap_firewall/windows.rs\n+++ b/crates/spt-daemon/src/bootstrap_firewall/windows.rs\n@@ -29,7 +29,7 @@ const RULE_GROUP: &str = "spt-core bootstrap TCP";\n /// and `desired_specs` all derive from these constants instead of repeating them.\n const RULE_NAMES: &[&str] = &[RULE_NAME_TAILNET, RULE_NAME_LAN];\n \n-/// The one ActiveStore enforcement code that certifies a rule is in force.\n+/// The positive ActiveStore code, combined with PrimaryStatus and the code-20 veto.\n ///\n /// A NUMBER, NEVER A SPELLING. The host renders this code as a display string, and\n /// which string is a property of the host rather than of the rule: measured on\n@@ -41,19 +41,12 @@ const RULE_NAMES: &[&str] = &[RULE_NAME_TAILNET, RULE_NAME_LAN];\n // [impl->REQ-BOOTSTRAP-FIREWALL-ENFORCEMENT-CODES]\n const ENFORCEMENT_SUCCESS: u16 = 1;\n \n-/// The COMPLETE certified evidence: exactly one element, the success code.\n-///\n-/// STRICTNESS IS THE REQUIREMENT, not an implementation detail. This is compared with\n-/// `!=` against the whole slice, so `[1, 1]` and `[1, 5]` both refuse. Equality must\n-/// never become membership: a success code sitting beside another code means the host\n-/// reported something else as well. What an array of several codes MEANS is not\n-/// resolved -- the documented values describe individual codes and say nothing about\n-/// how a multi-element array should be read -- so this policy refuses rather than\n-/// interpreting. Empty, unknown and additional values all refuse here, and\n-/// anything the query could not transport as a number never reaches this comparison at\n-/// all -- it fails deserialization and surfaces as a query error instead.\n+/// Run-02 on HFENDULEAM measured OK/[5,1] without a package binding and\n+/// Inactive/[5,20] with `-Package Any`. A multi-profile rule need not have a\n+/// singleton enforcement array: the inactive Domain profile contributes 5.\n // [impl->REQ-BOOTSTRAP-FIREWALL-ENFORCEMENT-CODES]\n-const ENFORCEMENT_CERTIFIED: [u16; 1] = [ENFORCEMENT_SUCCESS];\n+const ENFORCEMENT_NO_LOCAL_USER: u16 = 20;\n+const PRIMARY_STATUS_OK: u16 = 1;\n \n // Enumerate then compare the exact immutable name: a failed query must not be\n // confused with NetSecurity\'s non-terminating \'named object not found\' error.\n@@ -74,11 +67,11 @@ function Value($object, $name) {\n # verdict compared against "Full" -- so the success value itself was refused and no host\n # state could satisfy the arm. The repair is this ACCESSOR, not a cast: casting the\n # adapted value throws on "Enforced". CimInstanceProperties is the unadapted CIM view.\n-function RawValue($object, $name) {\n+function RawValue($object, $name, $expectedType = \'UInt16Array\') {\n $property = $object.CimInstanceProperties[$name]\n if ($null -eq $property) { throw "ENFORCEMENT_REPRESENTATION_FAULT: NetSecurity omitted required CIM property $name" }\n- if ([string]$property.CimType -ne \'UInt16Array\') {\n- throw "ENFORCEMENT_REPRESENTATION_FAULT: CIM property $name has type $($property.CimType), expected UInt16Array"\n+ if ([string]$property.CimType -ne $expectedType) {\n+ throw "ENFORCEMENT_REPRESENTATION_FAULT: CIM property $name has type $($property.CimType), expected $expectedType"\n }\n $property.Value\n }\n@@ -142,12 +135,14 @@ function Describe($rule) {\n # NOT: it is reported below and decided in Rust, because a policy expressed\n # only as text handed to another interpreter cannot be unit-tested, which is\n # how two contradictory amendments coexisted with nothing red (releases#304).\n+ # Run-02 measured an empty Package when New-NetFirewallRule omitted -Package.\n+ # Literal Any is a binding here, unlike the Program filter\'s unrestricted spelling.\n $hygiene = (Is $rule \'Enabled\' \'True\') -and\n (Is $rule \'Direction\' \'Inbound\') -and (Is $rule \'Action\' \'Allow\') -and\n (Empty $rule \'Platform\') -and (Empty $rule \'Owner\') -and\n (Is $port \'RemotePort\' \'Any\') -and (Is $port \'DynamicTarget\' \'Any\') -and\n (Is $address \'LocalAddress\' \'Any\') -and\n- (Is $app \'Package\' \'Any\') -and (Is $service \'Service\' \'Any\') -and\n+ (Empty $app \'Package\') -and (Is $service \'Service\' \'Any\') -and\n (Is $interface \'InterfaceAlias\' \'Any\') -and (Is $type \'InterfaceType\' \'Any\') -and\n (Is $security \'Authentication\' \'NotRequired\') -and (Is $security \'Encryption\' \'NotRequired\') -and\n (Is $security \'OverrideBlockRules\' \'False\') -and\n@@ -185,6 +180,10 @@ function Describe($rule) {\n }\n [int]$_\n })\n+ $primaryStatusRaw = RawValue $rule \'PrimaryStatus\' \'UInt16\'\n+ if ($null -eq $primaryStatusRaw -or $primaryStatusRaw -isnot [uint16]) {\n+ throw "ENFORCEMENT_REPRESENTATION_FAULT: invalid raw PrimaryStatus for $name, expected System.UInt16"\n+ }\n # WHERE THE EFFECTIVE RULE CAME FROM. Reported, never judged here: the Rust\n # side decides what counts as persistent. \'Local\' names the local persistent\n # store as this effective rule\'s source, which is how ONE ActiveStore pass\n@@ -199,6 +198,7 @@ function Describe($rule) {\n remotes = @(Value $address \'RemoteAddress\' | ForEach-Object { [string]$_ })\n hygiene = [bool]$hygiene\n enforcement = $enforcement\n+ primaryStatus = [int]$primaryStatusRaw\n }\n }\n # ONE STORE PASS, NOT TWO. The old query enumerated PersistentStore and\n@@ -259,14 +259,12 @@ struct Rule {\n /// anything the query cannot transport as a number -- a null, a display\n /// string, a negative -- fails deserialization and surfaces as a query error\n /// rather than arriving as a code the verdict would then judge.\n- ///\n- /// NO NAME IS ATTACHED TO ANY CODE, here or anywhere downstream. The captured\n- /// class on the measuring host exposes ValueMap (0..25) with the Values\n- /// qualifier ABSENT, so no code-to-name mapping is derivable from the host at\n- /// all -- including for the success code. Naming one would be documentation\n- /// smuggled in as an observation.\n+ /// PrimaryStatus is transported separately so a success code cannot override\n+ /// the provider reporting the rule inactive.\n // [impl->REQ-BOOTSTRAP-FIREWALL-ENFORCEMENT-CODES]\n enforcement: Vec,\n+ #[serde(rename = "primaryStatus")]\n+ primary_status: u16,\n /// Which store this EFFECTIVE rule came from, as NetSecurity reports it:\n /// `Local` for the local persistent store, `GroupPolicy` for domain policy,\n /// `Dynamic` for a rule that exists only until reboot. Reported here and\n@@ -456,6 +454,8 @@ fn desired_specs(binder_normalized: &str, bound_port: u16, lan: &LanScope) -> Ve\n /// the emitted rule text can be compared against the spec WITHOUT a live\n /// NetSecurity, and an effector whose output nothing can read is how a scope\n /// policy expressed as script text went unchecked in the first place.\n+/// Run-02 isolated `-Package Any` as the argument making the rule inactive.\n+/// Omit the binding; Get-NetFirewallApplicationFilter reports an empty Package.\n // [impl->REQ-WEB-LAN-BOOTSTRAP-FIREWALL]\n fn render_writes(want: &[RuleSpec]) -> String {\n want.iter()\n@@ -465,7 +465,7 @@ fn render_writes(want: &[RuleSpec]) -> String {\n r#"\n New-NetFirewallRule -PolicyStore PersistentStore -Name \'{name}\' -DisplayName \'{name}\' -Group $ruleGroup `\n -Enabled True -Direction Inbound -Action Allow -Profile {profile} -Protocol TCP -LocalPort {port} `\n- -RemotePort Any -LocalAddress Any -RemoteAddress {remotes} {program_arg}-Package Any -Service Any `\n+ -RemotePort Any -LocalAddress Any -RemoteAddress {remotes} {program_arg}-Service Any `\n -InterfaceAlias Any -InterfaceType Any -Authentication NotRequired -Encryption NotRequired `\n -LocalUser Any -RemoteUser Any -RemoteMachine Any -OverrideBlockRules $false -DynamicTarget Any `\n -EdgeTraversalPolicy Block -ErrorAction Stop | Out-Null\n@@ -832,11 +832,15 @@ fn decide(state: &Snapshot, expected_program: &str, port: u16) -> ResultREQ-BOOTSTRAP-FIREWALL-ENFORCEMENT-CODES]\n- if rule.enforcement.as_slice() != ENFORCEMENT_CERTIFIED {\n+ if rule.primary_status != PRIMARY_STATUS_OK\n+ || !rule.enforcement.contains(&ENFORCEMENT_SUCCESS)\n+ || rule.enforcement.contains(&ENFORCEMENT_NO_LOCAL_USER)\n+ {\n return Err(format!(\n- "Bootstrap rule {} is configured but ActiveStore enforcement codes are {:?}, \\\n- not exactly [{}]",\n- rule.name, rule.enforcement, ENFORCEMENT_SUCCESS\n+ "Bootstrap rule {} is configured but ActiveStore PrimaryStatus is {} and \\\n+ enforcement codes are {:?}; expected PrimaryStatus {} with code {} present and code {} absent",\n+ rule.name, rule.primary_status, rule.enforcement, PRIMARY_STATUS_OK,\n+ ENFORCEMENT_SUCCESS, ENFORCEMENT_NO_LOCAL_USER\n ));\n }\n }\n@@ -1029,10 +1033,10 @@ mod tests {\n "active": [\n {"name": RULE_NAME_TAILNET, "program": "Any", "ports": ["29470"],\n "profile": "Any", "remotes": ["100.64.0.0/10"], "hygiene": true,\n- "enforcement": [1], "sourceType": "Local"},\n+ "enforcement": [1], "primaryStatus": 1, "sourceType": "Local"},\n {"name": RULE_NAME_LAN, "program": "Any", "ports": ["29470"],\n "profile": "Private,Domain", "remotes": ["192.168.1.0/24"],\n- "hygiene": true, "enforcement": [1], "sourceType": "Local"}\n+ "hygiene": true, "enforcement": [5, 1], "primaryStatus": 1, "sourceType": "Local"}\n ],\n "addresses": addresses\n }).to_string();\n@@ -1157,6 +1161,7 @@ mod tests {\n remotes: remotes.iter().map(|r| r.to_string()).collect(),\n hygiene: true,\n enforcement: vec![ENFORCEMENT_SUCCESS],\n+ primary_status: PRIMARY_STATUS_OK,\n source_type: "Local".to_string(),\n }\n }\n@@ -1658,6 +1663,33 @@ mod tests {\n );\n }\n \n+ /// The run-02 scratch control isolates `-Package Any`: adding it to an\n+ /// otherwise identical rule changes OK/[5,1] to Inactive/[5,20].\n+ /// An unrestricted bootstrap rule must omit that package binding entirely.\n+ // [unit->REQ-WEB-LAN-BOOTSTRAP-FIREWALL]\n+ #[test]\n+ fn unrestricted_rules_omit_the_package_parameter() {\n+ let want = desired_specs("c:/spt/spt.exe", 5470, &one_lan());\n+ let rendered = render_writes(&want);\n+ let mut calls = rendered.split("New-NetFirewallRule").skip(1);\n+ for spec in &want {\n+ let call = calls\n+ .next()\n+ .expect("each admission half must have a create call");\n+ assert!(\n+ call.contains(spec.name),\n+ "the assertion must inspect the named half"\n+ );\n+ assert!(\n+ !call\n+ .split_ascii_whitespace()\n+ .any(|argument| argument == "-Package"),\n+ "{} must not acquire the package restriction measured to disable admission: {call}",\n+ spec.name\n+ );\n+ }\n+ }\n+\n // ---- observed-spelling regression cells (hertz, releases#304 W2) ----\n //\n // Appended onto FOLD-4 (10d18b7f). Boundary agreed with todlando: everything\n@@ -1719,23 +1751,46 @@ mod tests {\n }\n }\n \n- /// H2 — AN UNENFORCED RULE IS STILL REFUSED, AFTER THE PAIR MATCHES.\n- ///\n- /// Enforcement is decided at its own `decide` arm, on a field the FOLD-4\n- /// normalizers never see, and it returns `Err` rather than `Ok(false)`. No\n- /// sibling asserts it: the source-store arm has :1136, this one had nothing.\n- /// It exists so a comparison repair cannot fold enforcement into a WEAKER\n- /// comparison — a rule that is configured but not in force must stay a LOUD\n- /// refusal and not a quiet non-match. That intent is unchanged; only its\n- /// mechanism moved. It once guarded against folding enforcement into STRING\n- /// handling, because the field was Vec; the field is now Vec and\n- /// the live risk is equality silently becoming MEMBERSHIP, so the cases below\n- /// include a repeated success code and a success code beside a non-success one.\n- ///\n- /// No case here asserts a NAME for any code. The host that produced the A7\n- /// capture rendered its codes as display text and exposed no Values qualifier,\n- /// so no code-to-name mapping is derivable from it; what makes 1 the success\n- /// code is the documented specification, asserted nowhere but in the constant.\n+ // [unit->REQ-BOOTSTRAP-FIREWALL-ENFORCEMENT-CODES]\n+ #[test]\n+ fn an_ok_multi_profile_rule_with_codes_5_and_1_is_enforced() {\n+ let want = desired_specs("c:/spt/spt.exe", 29470, &one_lan());\n+ let mut active = reconciled_store(&want);\n+ active[1].enforcement = vec![5, 1];\n+ let state = Snapshot {\n+ active,\n+ addresses: one_lan_census(),\n+ };\n+ assert_eq!(decide(&state, "c:/spt/spt.exe", 29470), Ok(true));\n+ }\n+\n+ // [unit->REQ-BOOTSTRAP-FIREWALL-ENFORCEMENT-CODES]\n+ #[test]\n+ fn an_inactive_rule_with_codes_5_and_20_is_refused() {\n+ let want = desired_specs("c:/spt/spt.exe", 29470, &one_lan());\n+ let mut active = reconciled_store(&want);\n+ active[1].primary_status = 2;\n+ active[1].enforcement = vec![5, 20];\n+ let state = Snapshot {\n+ active,\n+ addresses: one_lan_census(),\n+ };\n+ assert!(decide(&state, "c:/spt/spt.exe", 29470).is_err());\n+ }\n+\n+ // [unit->REQ-BOOTSTRAP-FIREWALL-ENFORCEMENT-CODES]\n+ #[test]\n+ fn an_ok_rule_with_code_1_is_enforced() {\n+ let want = desired_specs("c:/spt/spt.exe", 29470, &one_lan());\n+ let state = Snapshot {\n+ active: reconciled_store(&want),\n+ addresses: one_lan_census(),\n+ };\n+ assert_eq!(decide(&state, "c:/spt/spt.exe", 29470), Ok(true));\n+ }\n+\n+ /// A matching rule still needs positive enforcement and no code-20 veto.\n+ /// Null/type faults remain a separate query/deserialization failure.\n // [unit->REQ-WEB-LAN-BOOTSTRAP-FIREWALL]\n #[test]\n fn an_unenforced_rule_is_refused_loudly_after_the_pair_matches() {\n@@ -1751,28 +1806,15 @@ mod tests {\n "control: the unperturbed snapshot decides reconciled"\n );\n \n- // Every case is a REFUSAL, and the list is the requirement\'s acceptance\n- // table written as literals: [0], [2], [5], [20], [1,1], [1,5] and [].\n- // [5,20] is carried beyond that list because two non-success codes is a\n- // distinct shape from one. The arms that matter after the repair are the\n- // REPEATED success code and the success code accompanied by a non-success\n- // one — they fail only if `as_slice() != ENFORCEMENT_CERTIFIED` is ever\n- // softened into "contains the success code".\n- //\n- // WHAT THIS FILE CANNOT COVER, so that it is not read as covered: the\n- // requirement\'s null arms and its distinguishable REPRESENTATION FAULT\n- // live in the PowerShell query, before any JSON exists. Their Rust-side\n- // shadow is the deserialization cell below — a null element and a null\n- // field both refuse there; the faults themselves are the\n- // extraction-boundary exercise\'s subject.\n+ // An empty or non-success array cannot certify admission. Code 20 vetoes\n+ // even an otherwise positive array; inactive-profile code 5 alone is not success.\n // [unit->REQ-BOOTSTRAP-FIREWALL-ENFORCEMENT-CODES]\n for status in [\n vec![0u16],\n vec![2u16],\n vec![5u16],\n vec![20u16],\n- vec![ENFORCEMENT_SUCCESS, ENFORCEMENT_SUCCESS],\n- vec![ENFORCEMENT_SUCCESS, 5u16],\n+ vec![ENFORCEMENT_SUCCESS, ENFORCEMENT_NO_LOCAL_USER],\n vec![5u16, 20u16],\n Vec::new(),\n ] {\n@@ -1787,6 +1829,16 @@ mod tests {\n (status {status:?}): {refusal}"\n );\n }\n+ let mut inactive = effective;\n+ inactive[0].primary_status = 2;\n+ let state = Snapshot {\n+ active: inactive,\n+ addresses: one_lan_census(),\n+ };\n+ assert!(\n+ decide(&state, "c:/spt/spt.exe", 29470).is_err(),\n+ "a success code cannot override non-OK PrimaryStatus"\n+ );\n }\n \n \n@@ -1807,7 +1859,7 @@ mod tests {\n format!(\n r#"{{"name":"n","program":"Any","ports":["29470"],"profile":"Any",\n "remotes":["Any"],"hygiene":true,"enforcement":{enforcement},\n- "sourceType":"Local"}}"#\n+ "primaryStatus":1,"sourceType":"Local"}}"#\n )\n }\n \n@@ -1859,14 +1911,12 @@ mod tests {\n // filters plus DynamicTarget and the Platform/Owner emptiness checks. Those\n // cmdlets were never run, so the inputs do not exist. `true` here ISOLATES\n // the representation axes; it does not assert what the host would report.\n- // - `enforcement`: SYNTHETIC. The capture reads {ProfileInactive, NoLocalUser} in\n- // ActiveStore. Those are the host’s ADAPTED DISPLAY NAMES, not codes, and THE\n- // BOOTSTRAP PAIR’S NUMERIC VALUES REMAIN UNKNOWN: the raw UInt16 1 was measured\n- // on a SEPARATE, pre-existing 5470 rule, not on either bootstrap rule. So nothing\n- // here may be read as "the pair really carried 1 and only rendered badly".\n- // ENFORCEMENT_SUCCESS is used because it keeps these cells about the COMPARISON\n- // axes; it asserts nothing about what that host would have reported. The captured\n- // value is a SEPARATE FINDING, reported to doyle, not smuggled into a fixture.\n+ // - `enforcement` and `primary_status`: the September 12 display-name capture\n+ // was not a successful pair. Window 6 subsequently measured its raw [5,20]\n+ // refusal. These comparison fixtures now use OK/[5,1], measured on the\n+ // Private+Domain scratch rule without -Package in run-02 (2026-09-14).\n+ // It is deliberately COMPOSED evidence: not a new capture of these named\n+ // bootstrap rules, and not a measured all-profile/tailnet array.\n // - the port: SYNTHETIC. Its captured value is not in hand. The port axis is not an\n // equivalence axis and R5 covers its drift, so the spec\'s port is used.\n \n@@ -1880,7 +1930,8 @@ mod tests {\n profile: "Any".to_string(), // captured\n remotes: vec!["100.64.0.0/255.192.0.0".to_string()], // captured — MASK form\n hygiene: true, // SYNTHETIC, not captured — see above\n- enforcement: vec![ENFORCEMENT_SUCCESS], // SYNTHETIC, not captured — see above\n+ enforcement: vec![5, ENFORCEMENT_SUCCESS], // run-02 enforced-shape composition\n+ primary_status: PRIMARY_STATUS_OK,\n source_type: "Local".to_string(), // captured\n }\n }\n@@ -1895,7 +1946,8 @@ mod tests {\n profile: "Domain, Private".to_string(), // captured\n remotes: vec!["192.168.1.0/255.255.255.0".to_string()], // captured — MASK form\n hygiene: true, // SYNTHETIC, not captured — see above\n- enforcement: vec![ENFORCEMENT_SUCCESS], // SYNTHETIC, not captured — see above\n+ enforcement: vec![5, ENFORCEMENT_SUCCESS], // run-02 enforced-shape composition\n+ primary_status: PRIMARY_STATUS_OK,\n source_type: "Local".to_string(), // captured\n }\n }\n', 'stderr': ''} {'phase-a': 3417, 'phase-b': 224}