XFESystem

[CmdletBinding()]
param(
    [ValidateSet('Desktop','Console')][string]$Edition='Desktop',
    [Parameter(Mandatory=$true)][string]$ImagePath,
    [Parameter(Mandatory=$true)][string]$VerifiedBootResult,
    [string]$QemuPath,
    [string]$ToolsRoot,
    [ValidateSet('gtk','sdl')][string]$DisplayBackend='gtk',
    [switch]$FitToWindow,
    [switch]$NativePixels,
    [switch]$TraceConsoleRefresh,
    [switch]$Fullscreen,
    [switch]$PlanOnly,
    [switch]$ValidateOnly
)
$ErrorActionPreference='Stop'
# Python and PowerShell 7 callers may leave PS7 module directories ahead of
# Windows PowerShell 5.1 modules. Load this process's built-ins explicitly.
foreach($moduleName in @('Microsoft.PowerShell.Utility','Microsoft.PowerShell.Management')) {
    Import-Module (Join-Path $PSHOME ('Modules/'+$moduleName+'/'+$moduleName+'.psd1')) -ErrorAction Stop
}
$Edition=if($Edition -eq 'Console'){'Console'}else{'Desktop'}
if($FitToWindow -and $NativePixels){throw 'FitToWindow and NativePixels are mutually exclusive viewport policies.'}
if($DisplayBackend -eq 'sdl' -and $NativePixels){throw 'SDL uses automatic window scaling; NativePixels requires GTK.'}
$taskRoot=[IO.Path]::GetFullPath((Join-Path $PSScriptRoot '../..'))
function Get-IndependentHash([string]$Path) {
    (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash.ToLowerInvariant()
}
function Read-IndependentJson([string]$Path) {
    Get-Content -LiteralPath $Path -Raw -Encoding UTF8 | ConvertFrom-Json
}
function Get-IndependentFile([string]$Root,[string]$Relative) {
    if([IO.Path]::IsPathRooted($Relative)) { throw ('Expected a relative artifact path: '+$Relative) }
    $prefix=[IO.Path]::GetFullPath($Root).TrimEnd([char]'\',[char]'/')+[IO.Path]::DirectorySeparatorChar
    $path=[IO.Path]::GetFullPath((Join-Path $Root $Relative))
    if(!$path.StartsWith($prefix,[StringComparison]::OrdinalIgnoreCase) -or !(Test-Path -LiteralPath $path -PathType Leaf)) {
        throw ('Artifact is missing or outside its root: '+$Relative)
    }
    return $path
}
function Assert-IndependentHash([string]$Path,[string]$Expected,[string]$Label) {
    if($Expected -cnotmatch '^[0-9a-f]{64}$' -or (Get-IndependentHash $Path) -cne $Expected) {
        throw ('SHA256 verification failed: '+$Label)
    }
}
function Assert-IndependentSourceMap($Map,[string]$Root,[string]$Label) {
    if(!$Map -or @($Map.PSObject.Properties).Count -eq 0) { throw ('Empty source map: '+$Label) }
    foreach($entry in $Map.PSObject.Properties) {
        Assert-IndependentHash (Get-IndependentFile $Root $entry.Name) ([string]$entry.Value) ($Label+': '+$entry.Name)
    }
}
function Assert-IndependentSourceSubset($Expected,$Actual,[string]$Label) {
    if(!$Expected -or !$Actual) { throw ('Missing source binding: '+$Label) }
    foreach($entry in $Expected.PSObject.Properties) {
        $bound=$Actual.PSObject.Properties[$entry.Name]
        if(!$bound -or [string]$bound.Value -cne [string]$entry.Value) { throw ('Source binding differs: '+$Label+': '+$entry.Name) }
    }
}
$sourceImage=(Resolve-Path -LiteralPath $ImagePath).Path
$bootPath=(Resolve-Path -LiteralPath $VerifiedBootResult).Path
$boot=Read-IndependentJson $bootPath
$proofEdition=if($boot.Edition){[string]$boot.Edition}else{'Desktop'}
if($proofEdition -cne $Edition){throw ('Requested edition '+$Edition+' differs from its verified boot receipt: '+$proofEdition)}
if($boot.Kind -cne 'XfeIndependentKernelBootProof' -or $boot.Passed -ne $true -or
   $boot.ManagedRuntimeAcceptancePassed -ne $true -or $boot.ContainsCosmos -ne $false -or
   $boot.RamOnly -ne $true -or $boot.StorageEnabled -ne $false -or $boot.ExecutingCpus -ne 1 -or
   $boot.ImageUnchanged -ne $true -or $null -eq $boot.QemuExitCode -or $boot.QemuExitCode -ne 0 -or $boot.ForcedCleanup) {
    throw 'A passing, cleaned-up, source-bound independent managed system boot proof is required.'
}
$desktopInput=$null;$terminalWorkflow=$null;$documentWorkflow=$null;$monacoPaint=$false;$monacoEdited=$false
$bingEvidencePath=$null;$bingBinding = $null;$bingEvidence=$null
if($Edition -eq 'Desktop') {
if($boot.Kind -cne 'XfeIndependentKernelBootProof' -or $boot.Passed -ne $true -or
   $boot.ManagedRuntimeAcceptancePassed -ne $true -or $boot.DesktopAcceptanceRequired -ne $true -or
   $boot.DesktopAcceptancePassed -ne $true -or $boot.ContainsCosmos -ne $false -or
   $boot.BrowserAcceptanceRequired -ne $true -or $boot.BrowserAcceptancePassed -ne $true -or
   $boot.DocumentAcceptanceRequired -ne $true -or $boot.DocumentAcceptancePassed -ne $true -or
   $boot.BingAcceptanceRequired -ne $true -or $boot.BingAcceptancePassed -ne $true -or
   $boot.RamOnly -ne $true -or $boot.StorageEnabled -ne $false -or $boot.ExecutingCpus -ne 1 -or
   $boot.ImageUnchanged -ne $true -or $null -eq $boot.QemuExitCode -or $boot.QemuExitCode -ne 0 -or $boot.ForcedCleanup) {
    throw 'A passing, cleaned-up independent managed desktop AppBoot proof including documents, Monaco and actual native HTTPS Bing is required.'
}
$desktopInput=$boot.DesktopInputProof
if(!$desktopInput -or $desktopInput.MouseCreatedEditor -ne $true -or $desktopInput.KeyboardSavedRamFile -ne $true -or
   $desktopInput.AltF4ClosedEditor -ne $true -or $desktopInput.StartMenuKeyboardNavigation -ne $true -or
   $desktopInput.JavaScriptDomResult -cne 'JavaScript ready: 12') { throw 'The proof lacks actual desktop PS/2 input and browser DOM acceptance.' }
if($desktopInput.NoRenderFailures -ne $true){throw 'Actual desktop rendering must complete without a browser paint failure; older model-ready-only proofs are insufficient.'}
$terminalWorkflow=$desktopInput.TerminalWorkflowProof
if(!$terminalWorkflow -or $terminalWorkflow.Kind -cne 'XfeIndependentClassicTerminalWorkflow' -or
   $terminalWorkflow.Passed -ne $true -or $terminalWorkflow.Input -cne 'Actual QMP PS2 keyboard packets only' -or
   $terminalWorkflow.HostCommandExecution -ne $false -or $terminalWorkflow.HostWorkspaceReads -ne $false) {
    throw 'The desktop requires the actual native classic terminal command workflow.'
}
foreach($stage in @('HelpPassed','RamDirectoryCreateWriteReadPassed','HistoryBeyondPreviousPassed','HistoryDraftRestorePassed',
    'CaretDeleteInsertEditingPassed','HistoryListingPassed','NoDemoOnlyTerminalContent')) {
    if($terminalWorkflow.PSObject.Properties[$stage].Value -ne $true){throw ('Actual terminal acceptance is incomplete: '+$stage)}
}
$terminalCommands=@($terminalWorkflow.Commands)
$expectedTerminalCount=if($boot.GpuDiscoveryEvidence){10}else{9}
if($terminalCommands.Count -ne $expectedTerminalCount -or @($terminalCommands | Where-Object {$_.Passed -ne $true -or $_.Busy -ne $false}).Count -or
   $terminalCommands[4].Command -cne 'cat CliProof/Command.txt' -or @($terminalCommands[4].PostCommandOutput) -cnotcontains 'NativeTerminalReady' -or
   $terminalCommands[5].Command -cne 'write CliProof/Command.txt NativeTerminalReady' -or
   $terminalCommands[6].Command -cne 'echo draft' -or @($terminalCommands[6].PostCommandOutput) -cnotcontains 'draft' -or
   $terminalCommands[7].Command -cne 'echo abd' -or @($terminalCommands[7].PostCommandOutput) -cnotcontains 'abd') {
    throw 'Actual terminal file reads, history or edited command output differs from its exact submitted command.'
}
$documentWorkflow=$desktopInput.DocumentWorkflowProof
if(!$documentWorkflow -or $documentWorkflow.Kind -cne 'XfeIndependentDesktopDocumentWorkflow' -or
   $documentWorkflow.Passed -ne $true -or $documentWorkflow.NoRenderFailures -ne $true -or
   $documentWorkflow.Input -cne 'Actual QMP PS2 keyboard/mouse packets only' -or !$documentWorkflow.Screenshots) {
    throw 'The independent desktop requires actual document workflow acceptance through PS/2 input and native framebuffer evidence.'
}
foreach($stage in @('DefaultPreview','FlatPreview','Edit','Split','Save','Reopen','LongScroll','SourceFallback')) {
    $evidence=$documentWorkflow.PSObject.Properties[$stage]
    if(!$evidence -or $evidence.Value.Passed -ne $true){throw ('Document workflow acceptance is incomplete: '+$stage)}
}
foreach($capture in @('Documents-DefaultPreview.png','Documents-Edit.png','Documents-Split.png','Documents-Split-Edited.png',
    'Documents-Reopened.png','Documents-Long-Before.png','Documents-Long-After.png','Documents-Source-Fallback.png')) {
    if(!$documentWorkflow.Screenshots.PSObject.Properties[$capture]){throw ('Document workflow framebuffer evidence is absent: '+$capture)}
}
if($boot.BrowserAcceptanceRequired -eq $true){
    $monacoPaint=$desktopInput.MonacoRasterPaintCompleted
    $monacoEdited=$desktopInput.MonacoKeyboardEditedModel
    if($monacoPaint -ne $true -or $monacoEdited -ne $true){throw 'Monaco must actually complete raster painting and change its model through real PS/2 keyboard input.'}
}
} else {
    $consoleInput=$boot.ConsoleInputProof
    if($boot.ConsoleAcceptanceRequired -ne $true -or $boot.ConsoleAcceptancePassed -ne $true -or $boot.SourcesUnchanged -ne $true -or
       $boot.DesktopAcceptanceRequired -eq $true -or $boot.BrowserAcceptanceRequired -eq $true -or
       $boot.DocumentAcceptanceRequired -eq $true -or $boot.BingAcceptanceRequired -eq $true -or
       !$consoleInput -or $consoleInput.Kind -cne 'XfeIndependentConsoleWorkflow' -or $consoleInput.Passed -ne $true -or
       $consoleInput.Input -cne 'Actual QMP PS2 keyboard packets only' -or
       $consoleInput.HostCommandExecution -ne $false -or $consoleInput.HostWorkspaceReads -ne $false) {
        throw 'The console edition requires actual standalone console keyboard and framebuffer acceptance.'
    }
    foreach($stage in @('HelpPassed','RamDirectoryCreateWriteReadPassed','HistoryBeyondPreviousPassed','HistoryDraftRestorePassed',
        'CaretDeleteInsertEditingPassed','HistoryListingPassed','NoDemoOnlyTerminalContent','ManagedSamplePassed','NoDesktopOrBrowserInitialization')) {
        if($consoleInput.PSObject.Properties[$stage].Value -ne $true){throw ('Actual console acceptance is incomplete: '+$stage)}
    }
    $consoleCommands=@($consoleInput.Commands)
    $expectedConsoleCommands=@('help','md CliProof','mf CliProof/Command.txt','write CliProof/Command.txt NativeConsoleReady',
        'cat CliProof/Command.txt','write CliProof/Command.txt NativeConsoleReady','echo draft','echo abd','history','run ManagedHello.dll')
    if($consoleCommands.Count -ne $expectedConsoleCommands.Count -or @($consoleCommands | Where-Object {$_.Passed -ne $true -or $_.Busy -ne $false}).Count) {
        throw 'Actual console command execution evidence is incomplete.'
    }
    for($commandIndex=0;$commandIndex -lt $expectedConsoleCommands.Count;$commandIndex++) {
        if($consoleCommands[$commandIndex].Command -cne $expectedConsoleCommands[$commandIndex]) {throw 'Actual console command identities differ from the required workflow.'}
    }
    if(@($consoleCommands[4].PostCommandOutput) -cnotcontains 'NativeConsoleReady' -or
       @($consoleCommands[6].PostCommandOutput) -cnotcontains 'draft' -or @($consoleCommands[7].PostCommandOutput) -cnotcontains 'abd' -or
       @($consoleCommands[9].PostCommandOutput) -cnotcontains 'Managed ConsoleIL exit: 0' -or
       @($consoleCommands[9].PostCommandOutput | Where-Object {$_ -cmatch 'XFE_MANAGED_APP_OK'}).Count -eq 0 -or
       @($consoleCommands[9].PostCommandOutput | Where-Object {$_ -cmatch 'XFE_MANAGED_XFECONSOLE_OK'}).Count -eq 0) {
        throw 'Actual console file, editing or managed sample output is incomplete.'
    }
    $terminalWorkflow=$consoleInput
}
$arguments=@($boot.QemuArguments)
$nativeNetdev='user,id=NativeNet,net=10.0.2.0/24,host=10.0.2.2,dns=10.0.2.3,dhcpstart=10.0.2.15'
$nativeNic='e1000,netdev=NativeNet'
$requiredProfile=@(@('-machine','q35'),@('-accel','tcg'),@('-cpu','max'),@('-m','1024M'),@('-rtc','base=utc'))
if($Edition -eq 'Desktop'){$requiredProfile+=@(@('-netdev',$nativeNetdev),@('-device',$nativeNic))}
else{$requiredProfile+=,@('-net','none')}
foreach($required in $requiredProfile) {
    $index=[Array]::IndexOf($arguments,[string]$required[0])
    if($index -lt 0 -or $index+1 -ge $arguments.Count -or $arguments[$index+1] -cne $required[1] -or
       @($arguments | Where-Object {$_ -ceq $required[0]}).Count -ne 1) {
        throw ('Unsupported or missing verified QEMU profile: '+($required -join ' '))
    }
}
$network=$boot.NativeNetworkProfile
if($Edition -eq 'Desktop') {
if(@($arguments | Where-Object {$_ -in @('-net','-nic')}).Count){throw 'A native Bing proof cannot add another network backend or an offline network override.'}
if(!$network -or $network.Kind -cne 'XfeIndependentNativeNetworkProfile' -or $network.Enabled -ne $true -or
   $network.Backend -cne 'QEMU user NAT' -or $network.Device -cne 'e1000' -or $network.PciVendorDevice -cne '8086:100e' -or
   $network.GuestAddress -cne '10.0.2.15' -or $network.Gateway -cne '10.0.2.2' -or $network.DnsServer -cne '10.0.2.3' -or
   $network.AddressConfiguration -cne 'Static' -or $network.NetdevArgument -cne $nativeNetdev -or $network.DeviceArgument -cne $nativeNic -or
   $network.HostProxy -ne $false -or $network.HostForwarding -ne $false -or $network.Rtc -cne 'base=utc' -or $network.Cpu -cne 'max') {
    throw 'The receipt does not bind the actual native e1000/static IPv4/user NAT/UTC/CPU profile.'
}
} elseif(!$network -or $network.Kind -cne 'XfeIndependentNativeNetworkProfile' -or $network.Enabled -ne $false -or
    $network.Backend -cne 'None' -or $network.Device -or $network.NetdevArgument -or $network.DeviceArgument -or
    $network.HostProxy -ne $false -or $network.HostForwarding -ne $false -or $network.Rtc -cne 'base=utc' -or $network.Cpu -cne 'max' -or
    @($arguments | Where-Object {$_ -in @('-netdev','-device','-nic')}).Count) {
    throw 'The console receipt must bind the offline QEMU profile.'
}
Assert-IndependentHash $sourceImage $boot.ImageSha256 'verified image'
$imageManifestPath=$sourceImage+'.json'
$imageManifest=Read-IndependentJson $imageManifestPath
$kernelImagePath=if($boot.KernelImagePath){[string]$boot.KernelImagePath}else{'System/Kernel.elf'}
if($kernelImagePath -cnotin @('System/Kernel.elf','System/Console.elf') -or
   ($kernelImagePath -ceq 'System/Console.elf' -and ($Edition -cne 'Console' -or $imageManifest.Edition -cne 'Dual'))) {
    throw 'The boot proof selects an unsupported kernel image entry.'
}
$selectedImageBuild=if($kernelImagePath -ceq 'System/Console.elf'){$imageManifest.IndependentConsoleKernelBuild}else{$imageManifest.IndependentKernelBuild}
$selectedKernelSha256=if($kernelImagePath -ceq 'System/Console.elf'){$imageManifest.ConsoleKernelSha256}else{$imageManifest.KernelSha256}
if($imageManifest.Kind -cne 'CSharpGptFat32Image' -or $imageManifest.KernelImplementation -cne 'XFESystem independent kernel' -or
   $imageManifest.FullImageReadback -ne $true -or $imageManifest.ImageSha256 -cne $boot.ImageSha256 -or
   $selectedKernelSha256 -cne $boot.KernelSha256 -or (Get-Item -LiteralPath $sourceImage).Length -ne $imageManifest.ImageBytes) {
    throw 'The image manifest must identify the exact verified independent kernel image.'
}
$packaged=$false
$packageManifestPath=Join-Path $taskRoot 'Manifest.json'
if(Test-Path -LiteralPath $packageManifestPath -PathType Leaf) {
    $packageManifest=Read-IndependentJson $packageManifestPath
    if($packageManifest.Kind -cin @('XfeIndependentRamDesktopPackage','XfeIndependentRamConsolePackage')) {
        $packaged=$true
        $packageEdition=if($packageManifest.Edition){[string]$packageManifest.Edition}else{'Desktop'}
        if($packageEdition -cne $Edition){throw 'Package edition and boot proof differ.'}
        if($packageManifest.GuestAcceptancePassed -ne $true -or $packageManifest.HostAcceptancePassed -ne $true -or
           $packageManifest.ContainsCosmos -ne $false -or !$packageManifest.Files) { throw 'Invalid independent package manifest.' }
        if($Edition -eq 'Desktop' -and ($packageManifest.NoRenderFailures -ne $true -or $packageManifest.MonacoRasterPaintCompleted -ne $true -or
           $packageManifest.MonacoKeyboardEditedModel -ne $true -or $packageManifest.DocumentWorkflowPassed -ne $true)) {throw 'Invalid desktop package acceptance.'}
        if($Edition -eq 'Console' -and ($packageManifest.ConsoleAcceptancePassed -ne $true -or $packageManifest.TerminalWorkflowPassed -ne $true)) {throw 'Invalid console package acceptance.'}
        foreach($entry in $packageManifest.Files) {
            $path=Get-IndependentFile $taskRoot ([string]$entry.Path)
            Assert-IndependentHash $path ([string]$entry.Sha256) ('packaged '+$entry.Path)
            if((Get-Item -LiteralPath $path).Length -ne $entry.Bytes) { throw ('Packaged file length changed: '+$entry.Path) }
        }
        if($packageManifest.ImageSha256 -cne $boot.ImageSha256 -or $packageManifest.BootReceiptSha256 -cne (Get-IndependentHash $bootPath) -or
           $packageManifest.SourceSnapshotSha256 -cne $boot.SourceSnapshotSha256) { throw 'Package and AppBoot proof bindings differ.' }
    }
}
$sourceRoot=if($packaged){Join-Path $taskRoot 'SourceSnapshot'}else{$taskRoot}
$guestEvidenceRoot=if($packaged){Join-Path $taskRoot 'Validation/Guest'}else{Split-Path -Parent $bootPath}
if($boot.GpuDiscoveryEvidence) {
    $gpuBinding=$boot.GpuDiscoveryEvidence
    $gpuEvidencePath=Get-IndependentFile $guestEvidenceRoot 'GpuDiscoveryEvidence.json'
    Assert-IndependentHash $gpuEvidencePath $gpuBinding.Sha256 'read-only native GPU discovery evidence'
    $gpuEvidence=Read-IndependentJson $gpuEvidencePath
    if($gpuBinding.Passed -ne $true -or $gpuBinding.GuestCudaVerified -ne $false -or $gpuBinding.GpuRasterizationVerified -ne $false -or
        $gpuEvidence.Kind -cne 'XfeIndependentReadOnlyGpuDiscoveryEvidence' -or $gpuEvidence.Passed -ne $true -or
        $gpuEvidence.ExpectedNvidiaAbsent -ne $true -or $gpuEvidence.NvidiaDeviceCount -ne 0 -or
        $gpuEvidence.GpuExecutionVerified -ne $false -or $gpuEvidence.CudaExecutionVerified -ne $false -or
        $gpuEvidence.GpuRasterizationVerified -ne $false -or $gpuEvidence.ActualNvidiaDeviceExecution -ne $false -or
        $gpuEvidence.FirmwareHandoff.Valid -cne '1' -or $gpuEvidence.FirmwareHandoff.Count -cne '0') {
        throw 'The no-NVIDIA QEMU proof must never qualify native CUDA or GPU rendering.'
    }
    if($Edition -eq 'Desktop') {
    if($terminalWorkflow.NativeGpuDiagnosticRamFileReadbackPassed -ne $true -or
        $terminalCommands[9].Command -cne 'cat /System/Diagnostics/Gpu.txt') {throw 'Missing actual native GPU diagnostic file readback.'}
    foreach($line in @('Scope: XFESystemGuest','CUDA: unavailable','GPU rasterization: unavailable',
        'Discovery state: 2; devices: 0','GB202 boot probe state: 1; FSP scratch 0x00000000')) {
        if(@($terminalCommands[9].PostCommandOutput) -cnotcontains $line) {throw ('Native GPU diagnostic file omitted '+$line)}
    }
    Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $terminalWorkflow.GpuDiagnosticScreenshot.Path) $terminalWorkflow.GpuDiagnosticScreenshot.Sha256 'native GPU diagnostic framebuffer'
    }
}
if($Edition -eq 'Desktop') {

Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $terminalWorkflow.RawGuestEvidence.Path) $terminalWorkflow.RawGuestEvidence.Sha256 'actual rendered terminal command snapshots'
Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $terminalWorkflow.Screenshot.Path) $terminalWorkflow.Screenshot.Sha256 'actual classic terminal framebuffer'
if($terminalWorkflow.RawGuestEvidence.SelectedRenderedSnapshots -ne $expectedTerminalCount -or
   $terminalWorkflow.Screenshot.Sha256 -ceq $desktopInput.Screenshots.ConsoleDemo) {throw 'Actual terminal command snapshot/framebuffer evidence is incomplete.'}
$bingBinding=$desktopInput.BingEvidence
if(!$bingBinding -or $bingBinding.Path -cne 'BingEvidence.json' -or $bingBinding.Passed -ne $true -or $bingBinding.NativeHttpsBingLoaded -ne $true) {
    throw 'The boot proof lacks its actual native Bing evidence file binding.'
}
$bingEvidencePath=Get-IndependentFile $guestEvidenceRoot $bingBinding.Path
Assert-IndependentHash $bingEvidencePath $bingBinding.Sha256 'actual native Bing evidence'
$bingEvidence=Read-IndependentJson $bingEvidencePath
if($bingEvidence.Kind -cne 'XfeIndependentNativeBingEvidence' -or $bingEvidence.Passed -ne $true -or
   $bingEvidence.NativeHttpsBingLoaded -ne $true -or $bingEvidence.AllUserRequirementsMet -ne $false -or
   $bingEvidence.FullCssParityVerified -ne $false -or $bingEvidence.CompleteJavaScriptCompatibility -ne $false -or
   $bingEvidence.HostHttpRequests -ne $false -or $bingEvidence.HostBrowserScreenshots -ne $false -or
   $bingEvidence.HostJavaScriptInjection -ne $false -or $bingEvidence.VmStartedByThisTool -ne $false -or
   $bingEvidence.RequestedUrl -cne 'https://www.bing.com/' -or !$bingEvidence.Responses -or !$bingEvidence.Screenshots) {
    throw 'Actual guest HTTPS Bing acceptance is incomplete or claims unverified browser parity.'
}
foreach($response in $bingEvidence.Responses) {
    if($response.NativeTransport -ne $true -or $response.CertificateValidated -ne $true) {throw 'Every actual HTTPS Bing hop requires native transport and validated TLS.'}
}
$bingFinal=@($bingEvidence.Responses)[-1]
$bingPage=$bingEvidence.RemotePage
if($bingFinal.StatusCode -ne 200 -or $bingFinal.HasHtml -ne $true -or $bingFinal.HasHead -ne $true -or
   $bingFinal.BodyBytes -lt 128 -or $bingFinal.BodySha256 -cnotmatch '^[0-9a-fA-F]{64}$' -or
   !$bingPage -or $bingPage.CertificateValidated -ne $true -or $bingPage.BodySha256 -cne $bingFinal.BodySha256 -or
   $bingPage.Address -cne $bingFinal.ResponseUri -or $bingPage.SnapshotSequence -le 0 -or
   $bingEvidence.Presentation.SnapshotSequence -ne $bingPage.SnapshotSequence) {
    throw 'Actual Bing HTML, immutable DOM snapshot and native presentation are not bound.'
}
Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $bingEvidence.RawGuestEvidence.Path) $bingEvidence.RawGuestEvidence.Sha256 'actual Bing protocol and presentation log'
if($bingEvidence.RawGuestEvidence.Packets -lt 2 -or $bingEvidence.RawGuestEvidence.PresentationMarkers -lt 1) {throw 'Actual Bing protocol and presentation receipts are absent.'}
$bingPainted=$false
foreach($capture in $bingEvidence.Screenshots) {
    Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $capture.Path) $capture.Sha256 'actual Bing native framebuffer'
    $correlation=$capture.PresentationCorrelation
    if($capture.BodySha256 -cne $bingPage.BodySha256 -or !$correlation -or $correlation.StableSnapshot -ne $true) {throw 'Bing screenshot does not bind its actual HTTP body and stable presentation.'}
    foreach($field in @('WindowId','Generation','Address','SnapshotSequence','ScrollY')) {
        if(!$correlation.Before.PSObject.Properties[$field] -or !$correlation.After.PSObject.Properties[$field] -or
           $correlation.Before.PSObject.Properties[$field].Value -cne $correlation.After.PSObject.Properties[$field].Value) {throw ('Bing changed during framebuffer capture: '+$field)}
    }
    if($correlation.Before.SnapshotSequence -ne $bingPage.SnapshotSequence -or $correlation.Before.Address -cne $bingPage.Address -or
       $correlation.Before.WindowId -ne $bingEvidence.Presentation.WindowId -or $correlation.Before.PresentationSequence -le 0 -or
       $correlation.Before.PresentationTicks -le 0 -or $correlation.After.PresentationSequence -lt $correlation.Before.PresentationSequence -or
       $correlation.After.PresentationTicks -lt $correlation.Before.PresentationTicks) {throw 'Bing screenshot presentation identity/counters are invalid.'}
    if($capture.TextPixels.Passed -eq $true){$bingPainted=$true}
}
if(!$bingPainted){throw 'No actual Bing native framebuffer contains the corresponding remote text glyphs.'}
foreach($capture in $documentWorkflow.Screenshots.PSObject.Properties) {
    Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $capture.Name) ([string]$capture.Value) ('actual document workflow '+$capture.Name)
}
Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot 'Frame.png') $boot.ScreenshotSha256 'actual guest framebuffer evidence'
foreach($capture in @(@('Files','Desktop-Files.png'),@('EditorSaved','Desktop-Editor-Saved.png'),@('Browser','Browser-JavaScript.png'))) {
    Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $capture[1]) ([string]$desktopInput.Screenshots.PSObject.Properties[$capture[0]].Value) ('actual desktop input '+$capture[0])
}
if($boot.BrowserAcceptanceRequired -eq $true){
    if($boot.BrowserAcceptancePassed -ne $true -or $desktopInput.OfficialMonacoReady -ne $true){throw 'Required real Monaco acceptance is incomplete.'}
    Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot 'Browser-Monaco.png') $desktopInput.Screenshots.Monaco 'actual Monaco framebuffer evidence'
}
foreach($capture in @(@('ConsoleIL','Terminal-ConsoleIL.png'),@('ConsoleDemo','Terminal-Console-Demo.png'))) {
    $boundCapture=$desktopInput.Screenshots.PSObject.Properties[$capture[0]]
    if($boundCapture){Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $capture[1]) ([string]$boundCapture.Value) ('actual terminal '+$capture[0])}
}
} else {
    $consoleRawPath=Get-IndependentFile $guestEvidenceRoot $consoleInput.RawGuestEvidence.Path
    Assert-IndependentHash $consoleRawPath $consoleInput.RawGuestEvidence.Sha256 'actual console rendered command snapshots'
    $renderedSnapshots=[regex]::Matches([IO.File]::ReadAllText($consoleRawPath),'(?s)XFE_CONSOLE_SNAPSHOT_BEGIN\r?\n(.*?)\r?\nXFE_CONSOLE_SNAPSHOT_END')
    if($renderedSnapshots.Count -ne $consoleCommands.Count){throw 'Actual console rendered snapshot count differs from the command receipt.'}
    for($snapshotIndex=0;$snapshotIndex -lt $consoleCommands.Count;$snapshotIndex++) {
        $rendered=$renderedSnapshots[$snapshotIndex].Groups[1].Value | ConvertFrom-Json
        $command=$consoleCommands[$snapshotIndex]
        if($rendered.Busy -ne $false -or $rendered.Input -cne '' -or $rendered.LastCommand -cne $command.Command -or
           !$rendered.Version -or !$rendered.Prompt -or !$rendered.Prompt.EndsWith('> ')) {throw 'Actual console rendered snapshot does not identify a completed exact command.'}
        $renderedLines=@($rendered.Text.Replace("`r",'').Split([char]10) | ForEach-Object {$_.TrimEnd()})
        $echoIndex=-1
        for($lineIndex=0;$lineIndex -lt $renderedLines.Count;$lineIndex++) {
            if($renderedLines[$lineIndex] -ceq ($rendered.Prompt+$command.Command)){$echoIndex=$lineIndex}
        }
        if($echoIndex -lt 0){throw 'Actual console rendered command echo is absent.'}
        $renderedOutput=@()
        if($echoIndex+1 -lt $renderedLines.Count){$renderedOutput=@($renderedLines[($echoIndex+1)..($renderedLines.Count-1)])}
        while($renderedOutput.Count -and $renderedOutput[-1] -ceq '') {
            if($renderedOutput.Count -eq 1){$renderedOutput=@()}else{$renderedOutput=@($renderedOutput[0..($renderedOutput.Count-2)])}
        }
        if((ConvertTo-Json -InputObject @($renderedOutput) -Compress) -cne
           (ConvertTo-Json -InputObject @($command.PostCommandOutput) -Compress)) {throw 'Actual console rendered output differs from the command receipt.'}
    }
    Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $consoleInput.Screenshot.Path) $consoleInput.Screenshot.Sha256 'actual standalone console framebuffer'
    Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $consoleInput.BootScreenshot.Path) $consoleInput.BootScreenshot.Sha256 'actual standalone console initial framebuffer'
    if($consoleInput.RawGuestEvidence.SelectedRenderedSnapshots -ne $consoleCommands.Count -or
       $consoleInput.Screenshot.Sha256 -ceq $consoleInput.BootScreenshot.Sha256) {throw 'Actual console snapshots or changed framebuffer evidence are incomplete.'}
    $serialEvidencePath=Get-IndependentFile $guestEvidenceRoot $boot.SerialEvidence.Path
    Assert-IndependentHash $serialEvidencePath $boot.SerialEvidence.Sha256 'actual console guest serial isolation evidence'
    $consoleSerial=[IO.File]::ReadAllText($serialEvidencePath)
    foreach($requiredMarker in @('XFE_SYSTEM_EDITION|Console','XFE_INDEPENDENT_CONSOLE_FIRST_FRAME','XFE_APPLICATION_RUNTIME_CHECK_OK',
        'XFE_INDEPENDENT_CONSOLE_IL_OK')) {
        if(!$consoleSerial.Contains($requiredMarker)){throw ('Actual console guest marker is absent: '+$requiredMarker)}
    }
    foreach($forbiddenMarker in @('XFE_SYSTEM_EDITION|Desktop','XFE_INDEPENDENT_DESKTOP_FIRST_FRAME','XFE_DESKTOP_','XFE_WINDOW_',
        'XFE_BROWSER_','XFE_EDITOR_BACKGROUND|','XFE_MONACO_','XFE_NATIVE_FAIL','XFE_NATIVE_EXCEPTION','XFE_RUNTIME_FATAL',
        'XFE_ZERO_FAILFAST','XFE_INDEPENDENT_APPLICATION_FAILED','XFE_INDEPENDENT_CONSOLE_FAILED')) {
        if($consoleSerial.Contains($forbiddenMarker)){throw ('Actual console guest entered an invalid path: '+$forbiddenMarker)}
    }
    Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot 'Frame.png') $boot.ScreenshotSha256 'actual guest framebuffer evidence'
}
$snapshotPath=if($packaged){Get-IndependentFile $taskRoot 'Validation/SourceSnapshot.json'}else{(Resolve-Path -LiteralPath $boot.SourceSnapshotPath).Path}
$buildPath=if($packaged){Get-IndependentFile $taskRoot 'Validation/BuildReceipt.json'}else{(Resolve-Path -LiteralPath $boot.BuildReceipt).Path}
Assert-IndependentHash $snapshotPath $boot.SourceSnapshotSha256 'compiled source snapshot'
Assert-IndependentHash $buildPath $boot.BuildReceiptSha256 'independent kernel build receipt'
$snapshot=Read-IndependentJson $snapshotPath
$build=Read-IndependentJson $buildPath
$applicationProject=if($Edition -eq 'Console'){'Source/XFESystem.NativeRuntime/ConsoleApplication/ConsoleApplication.csproj'}else{'Source/XFESystem.NativeRuntime/Application/NativeApplication.csproj'}
$buildEdition=if($build.Edition){[string]$build.Edition}else{'Desktop'}
if($build.Kind -cne 'XfeIndependentKernelBuild' -or $build.Passed -ne $true -or $build.BootstrapOnly -ne $false -or
   $build.ManagedRuntimeLinked -ne $true -or $build.ContainsCosmos -ne $false -or $build.Target -cne 'x86_64-none' -or
   $build.KernelSha256 -cne $boot.KernelSha256 -or $buildEdition -cne $Edition -or
   !$build.SourceSha256.PSObject.Properties[$applicationProject]) {
    throw 'A complete source-bound build of the selected edition is required; diagnostic probes cannot be launched as a system edition.'
}
$kernelPath=if($packaged){Get-IndependentFile $taskRoot 'Kernel.elf'}else{(Resolve-Path -LiteralPath $build.KernelPath).Path}
Assert-IndependentHash $kernelPath $boot.KernelSha256 'compiled kernel'
Assert-IndependentSourceMap $snapshot $sourceRoot 'compiled snapshot'
Assert-IndependentSourceMap $build.SourceSha256 $sourceRoot 'kernel build'
Assert-IndependentSourceSubset $build.SourceSha256 $snapshot 'kernel to snapshot'
Assert-IndependentSourceSubset $imageManifest.BootShimSourceSha256 $snapshot 'EFI to snapshot'
Assert-IndependentSourceSubset $boot.ImageVerification.BootShimSourceSha256 $imageManifest.BootShimSourceSha256 'verified EFI to image manifest'
Assert-IndependentSourceSubset $imageManifest.BootShimSourceSha256 $boot.ImageVerification.BootShimSourceSha256 'image manifest to verified EFI'
Assert-IndependentSourceSubset $build.SourceSha256 $selectedImageBuild.SourceSha256 'kernel to image manifest'
Assert-IndependentSourceSubset $selectedImageBuild.SourceSha256 $build.SourceSha256 'image manifest to kernel'
if($build.SourceSha256.PSObject.Properties['Source/XFESystem.NativeKernel/BootSplash.cs']) {
    $bootVisual=$boot.BootVisualProof
    if($boot.BootVisualAcceptanceRequired -ne $true -or $boot.BootVisualAcceptancePassed -ne $true -or
       !$bootVisual -or $bootVisual.Kind -cne 'XfeActualBrandedBootAnimation' -or $bootVisual.Passed -ne $true -or
       $bootVisual.ProductWordmark -cne 'XFESystem' -or $bootVisual.OnlyBrandAndLoaderDuringInitialization -ne $true -or
       $bootVisual.IntroMinimumMilliseconds -ne 2400 -or $bootVisual.ReleaseElapsedMilliseconds -lt 2400 -or
       $bootVisual.ApplicationFrameReadyBeforeRelease -ne $true -or @($bootVisual.FrameCaptures).Count -lt 2) {
        throw 'The new boot visual requires actual branded framebuffer animation and first-frame readiness acceptance.'
    }
    if(!$snapshot.PSObject.Properties['Tools/IndependentKernel/BootAnimationEvidence.py']) {
        throw 'The actual boot animation capture verifier must be bound to the guest source snapshot.'
    }
    foreach($capture in $bootVisual.FrameCaptures) {
        if($capture.OutsideNonBlackPixels -ne 0){throw 'The boot visual contains pixels outside its black branded region.'}
        Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $capture.Path) $capture.Sha256 'actual boot animation framebuffer'
    }
    if(@($bootVisual.FrameCaptures | Where-Object {$_.WordmarkPixels -gt 20}).Count -lt 1){throw 'The actual XFESystem boot wordmark is absent.'}
}
if($selectedImageBuild.Passed -ne $true -or $selectedImageBuild.BootstrapOnly -ne $false -or
   $selectedImageBuild.ManagedRuntimeLinked -ne $true -or $selectedImageBuild.ContainsCosmos -ne $false -or
   $selectedImageBuild.KernelSha256 -cne $boot.KernelSha256 -or
   $boot.ImageVerification.Files.PSObject.Properties[$kernelImagePath].Value -cne $boot.KernelSha256 -or
   $boot.ImageVerification.Files.'EFI/BOOT/BOOTX64.EFI' -cne $imageManifest.BootloaderSha256 -or
   $boot.ImageVerification.Files.'EFI/XFE/Limine.efi' -cne $imageManifest.ChainloaderSha256 -or
   $boot.ImageVerification.GptPrimaryAndBackupVerified -ne $true -or $boot.ImageVerification.FatMirrorsVerified -ne $true) {
    throw 'Embedded kernel, EFI and GPT/FAT verification bindings are incomplete.'
}
if(!$ToolsRoot){$ToolsRoot=Join-Path $taskRoot '.tools'}
$firmwareRoot=if($packaged){Join-Path $taskRoot 'Firmware'}else{Join-Path $ToolsRoot 'firmware'}
$firmwareLockPath=if($packaged){Get-IndependentFile $taskRoot 'Validation/Firmware.json'}else{Get-IndependentFile $taskRoot 'Tools/CSharpBoot/Dependencies.json'}
$firmwareLock=Read-IndependentJson $firmwareLockPath
$firmwareCode=Get-IndependentFile $firmwareRoot 'edk2-x86_64-code.fd'
$firmwareVars=Get-IndependentFile $firmwareRoot 'edk2-i386-vars.fd'
foreach($firmware in @($firmwareCode,$firmwareVars)) {
    Assert-IndependentHash $firmware ([string]$firmwareLock.Firmware.PSObject.Properties[[IO.Path]::GetFileName($firmware)].Value) ('pinned firmware '+[IO.Path]::GetFileName($firmware))
}
$verified=[pscustomobject]@{Edition=$Edition;KernelImagePath=$kernelImagePath;ImagePath=$sourceImage;BootPath=$bootPath;Boot=$boot;ImageManifestPath=$imageManifestPath;
    ImageManifest=$imageManifest;BuildPath=$buildPath;Build=$build;KernelPath=$kernelPath;
    SnapshotPath=$snapshotPath;Snapshot=$snapshot;SourceRoot=$sourceRoot;Packaged=$packaged;
    FirmwareCode=$firmwareCode;FirmwareVars=$firmwareVars;FirmwareLock=$firmwareLock;
    NoRenderFailures=$desktopInput.NoRenderFailures;MonacoRasterPaintCompleted=$monacoPaint;MonacoKeyboardEditedModel=$monacoEdited;
    DocumentWorkflowPassed=$documentWorkflow.Passed;TerminalWorkflowPassed=$terminalWorkflow.Passed;ConsoleWorkflowPassed=($Edition -eq 'Console' -and $terminalWorkflow.Passed -eq $true);ConsoleAcceptancePassed=($Edition -eq 'Console');NativeNetworkProfile=$network;BingNativeHttpsPassed=($Edition -eq 'Desktop');
    BingEvidencePath=$bingEvidencePath;BingEvidenceSha256=$bingBinding.Sha256;BingEvidence=$bingEvidence}
if($ValidateOnly){return $verified}
if($imageManifest.Edition -ceq 'Dual') {
    throw 'Interactive launch and launch plans require a single-edition image. Use the Console or Desktop package Start.ps1; the shared USB image provides its own Desktop/Console boot menu. Dual images support -ValidateOnly here.'
}
if(!$QemuPath){
    $localQemu=Join-Path $ToolsRoot 'qemu/qemu-system-x86_64.exe'
    if(Test-Path -LiteralPath $localQemu -PathType Leaf){$QemuPath=$localQemu}
    else{$command=Get-Command qemu-system-x86_64.exe -ErrorAction SilentlyContinue;if(!$command){throw 'Pass -QemuPath for an installed x86_64 QEMU.'};$QemuPath=$command.Source}
}
$QemuPath=(Resolve-Path -LiteralPath $QemuPath).Path
$runId='Interactive-'+$Edition+'-'+[DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()+'-'+[Guid]::NewGuid().ToString('N').Substring(0,8)
$runRoot=Join-Path $taskRoot ('build/IndependentKernel/'+$runId)
[void][IO.Directory]::CreateDirectory($runRoot)
$runImage=Join-Path $runRoot 'System.img'
$runVars=Join-Path $runRoot 'FirmwareVars.fd'
$serialLog=Join-Path $runRoot 'Serial.log'
Copy-Item -LiteralPath $sourceImage -Destination $runImage
Copy-Item -LiteralPath $firmwareVars -Destination $runVars
Assert-IndependentHash $runImage $boot.ImageSha256 'private interactive image copy'
Assert-IndependentHash $runVars (Get-IndependentHash $firmwareVars) 'private firmware variable copy'
$display=if($DisplayBackend -eq 'gtk'){'gtk,zoom-to-fit='+$(if($NativePixels){'off'}else{'on'})}else{'sdl,gl=off'}
$consoleRefreshTrace=if($TraceConsoleRefresh){Join-Path $runRoot 'ConsoleRefresh.log'}else{$null}
$qemuArguments=@('-name',('XFESystem '+$Edition+' | XFEstudio - Independent RAM experiment'),'-machine','q35','-accel','tcg','-cpu','max',
    '-smp','1','-m','1024M','-vga','std','-global','VGA.vgamem_mb=64','-display',$display,
    '-rtc','base=utc',
    '-drive',('if=pflash,format=raw,readonly=on,file='+$firmwareCode.Replace(',',',,')),
    '-drive',('if=pflash,format=raw,file='+$runVars.Replace(',',',,')),
    '-drive',('file='+$runImage.Replace(',',',,')+',format=raw,if=ide,snapshot=on'),
    '-serial',('file:'+$serialLog),'-monitor','none','-no-reboot')
if($Edition -eq 'Desktop'){$qemuArguments+=@('-netdev',$nativeNetdev,'-device',$nativeNic)}else{$qemuArguments+=@('-net','none')}
if($Fullscreen){$qemuArguments+='-full-screen'}
if($TraceConsoleRefresh){$qemuArguments+=@('-trace','enable=console_refresh','-D',$consoleRefreshTrace)}
$launch=[ordered]@{Kind='XfeIndependentKernelInteractiveLaunch';Edition=$Edition;KernelImagePath=$kernelImagePath;AppBootReceiptSha256=(Get-IndependentHash $bootPath);
    ImageSha256=$boot.ImageSha256;KernelSha256=$boot.KernelSha256;SourceSnapshotSha256=$boot.SourceSnapshotSha256;
    RunDirectory=$runRoot;SerialLog=$serialLog;QemuPath=$QemuPath;QemuArguments=$qemuArguments;
    Acceleration='tcg';Cpu='max';Machine='q35';MemoryMiB=1024;VirtualCpus=1;ExecutingCpus=1;NativeNetworkProfile=$network;
    BingNativeHttpsPassed=($Edition -eq 'Desktop');BingEvidenceSha256=$bingBinding.Sha256;FullCssParityVerified=$false;CompleteJavaScriptCompatibility=$false;
    InputDevices='Q35 built-in i8042 PS/2 keyboard and mouse';Rtc='UTC';RamOnly=$true;StorageEnabled=$false;
    ViewportPolicy=$(if($NativePixels){'NativePixelsMayClip'}else{'FitCompleteDesktop'});
    ConsoleRefreshTrace=[ordered]@{Enabled=[bool]$TraceConsoleRefresh;TracePath=$consoleRefreshTrace;
        Meaning='QEMU configured GUI poll interval announcements; actual frame cadence and physical display refresh are not measured';
        ActualVisibleFramesPerSecond=$null;PhysicalRefreshHz=$null};
    ContainsCosmos=$false;InteractiveStarted=$false;InteractiveAcceptancePassed=$false;PlanOnly=[bool]$PlanOnly}
$launch.DocumentWorkflowPassed=[bool]$verified.DocumentWorkflowPassed
$launch.TerminalWorkflowPassed=[bool]$verified.TerminalWorkflowPassed
$launch.ConsoleAcceptancePassed=[bool]$verified.ConsoleAcceptancePassed
$launchPath=Join-Path $runRoot 'Launch.json'
try {
    if(!$PlanOnly){
        $quoted=@($qemuArguments | ForEach-Object {if($_.Contains('"')){throw 'Unexpected quote in QEMU argument.'};'"'+($_ -replace '(\\+)$','$1$1')+'"'})
        $process=Start-Process -FilePath $QemuPath -ArgumentList ($quoted -join ' ') -WorkingDirectory $runRoot -WindowStyle Normal -PassThru
        $launch.ProcessId=$process.Id;$launch.InteractiveStarted=$true
    }
} catch {$launch.Error=$_.Exception.Message;throw}
finally {$launch | ConvertTo-Json -Depth 7 | Set-Content -LiteralPath $launchPath -Encoding UTF8}
Write-Host ('Independent RAM experiment '+$(if($PlanOnly){'launch plan'}else{'interactive window'})+': '+$runRoot)
Write-Host ('Serial log: '+$serialLog)
return [pscustomobject]$launch