XFESystem

[CmdletBinding()]
param(
    [Parameter(Mandatory=$true)][string]$ImagePath,
    [Parameter(Mandatory=$true)][string]$VerifiedBootResult,
    [string]$QemuPath,
    [string]$ToolsRoot,
    [ValidateSet('gtk','sdl')][string]$DisplayBackend='gtk',
    [switch]$FitToWindow,
    [switch]$NativePixels,
    [switch]$TraceConsoleRefresh,
    [switch]$Fullscreen,
    [switch]$PlanOnly,
    [switch]$ValidateOnly
)
$ErrorActionPreference='Stop'
if($FitToWindow -and $NativePixels){throw 'FitToWindow and NativePixels are mutually exclusive viewport policies.'}
if($DisplayBackend -eq 'sdl' -and $NativePixels){throw 'SDL uses automatic window scaling; NativePixels requires GTK.'}
$taskRoot=[IO.Path]::GetFullPath((Join-Path $PSScriptRoot '../..'))
function Get-IndependentHash([string]$Path) {
    (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash.ToLowerInvariant()
}
function Read-IndependentJson([string]$Path) {
    Get-Content -LiteralPath $Path -Raw -Encoding UTF8 | ConvertFrom-Json
}
function Get-IndependentFile([string]$Root,[string]$Relative) {
    if([IO.Path]::IsPathRooted($Relative)) { throw ('Expected a relative artifact path: '+$Relative) }
    $prefix=[IO.Path]::GetFullPath($Root).TrimEnd([char]'\',[char]'/')+[IO.Path]::DirectorySeparatorChar
    $path=[IO.Path]::GetFullPath((Join-Path $Root $Relative))
    if(!$path.StartsWith($prefix,[StringComparison]::OrdinalIgnoreCase) -or !(Test-Path -LiteralPath $path -PathType Leaf)) {
        throw ('Artifact is missing or outside its root: '+$Relative)
    }
    return $path
}
function Assert-IndependentHash([string]$Path,[string]$Expected,[string]$Label) {
    if($Expected -cnotmatch '^[0-9a-f]{64}$' -or (Get-IndependentHash $Path) -cne $Expected) {
        throw ('SHA256 verification failed: '+$Label)
    }
}
function Assert-IndependentSourceMap($Map,[string]$Root,[string]$Label) {
    if(!$Map -or @($Map.PSObject.Properties).Count -eq 0) { throw ('Empty source map: '+$Label) }
    foreach($entry in $Map.PSObject.Properties) {
        Assert-IndependentHash (Get-IndependentFile $Root $entry.Name) ([string]$entry.Value) ($Label+': '+$entry.Name)
    }
}
function Assert-IndependentSourceSubset($Expected,$Actual,[string]$Label) {
    if(!$Expected -or !$Actual) { throw ('Missing source binding: '+$Label) }
    foreach($entry in $Expected.PSObject.Properties) {
        $bound=$Actual.PSObject.Properties[$entry.Name]
        if(!$bound -or [string]$bound.Value -cne [string]$entry.Value) { throw ('Source binding differs: '+$Label+': '+$entry.Name) }
    }
}
$sourceImage=(Resolve-Path -LiteralPath $ImagePath).Path
$bootPath=(Resolve-Path -LiteralPath $VerifiedBootResult).Path
$boot=Read-IndependentJson $bootPath
if($boot.Kind -cne 'XfeIndependentKernelBootProof' -or $boot.Passed -ne $true -or
   $boot.ManagedRuntimeAcceptancePassed -ne $true -or $boot.DesktopAcceptanceRequired -ne $true -or
   $boot.DesktopAcceptancePassed -ne $true -or $boot.ContainsCosmos -ne $false -or
   $boot.BrowserAcceptanceRequired -ne $true -or $boot.BrowserAcceptancePassed -ne $true -or
   $boot.DocumentAcceptanceRequired -ne $true -or $boot.DocumentAcceptancePassed -ne $true -or
   $boot.BingAcceptanceRequired -ne $true -or $boot.BingAcceptancePassed -ne $true -or
   $boot.RamOnly -ne $true -or $boot.StorageEnabled -ne $false -or $boot.ExecutingCpus -ne 1 -or
   $boot.ImageUnchanged -ne $true -or $null -eq $boot.QemuExitCode -or $boot.QemuExitCode -ne 0 -or $boot.ForcedCleanup) {
    throw 'A passing, cleaned-up independent managed desktop AppBoot proof including documents, Monaco and actual native HTTPS Bing is required.'
}
$desktopInput=$boot.DesktopInputProof
if(!$desktopInput -or $desktopInput.MouseCreatedEditor -ne $true -or $desktopInput.KeyboardSavedRamFile -ne $true -or
   $desktopInput.AltF4ClosedEditor -ne $true -or $desktopInput.StartMenuKeyboardNavigation -ne $true -or
   $desktopInput.JavaScriptDomResult -cne 'JavaScript ready: 12') { throw 'The proof lacks actual desktop PS/2 input and browser DOM acceptance.' }
if($desktopInput.NoRenderFailures -ne $true){throw 'Actual desktop rendering must complete without a browser paint failure; older model-ready-only proofs are insufficient.'}
$terminalWorkflow=$desktopInput.TerminalWorkflowProof
if(!$terminalWorkflow -or $terminalWorkflow.Kind -cne 'XfeIndependentClassicTerminalWorkflow' -or
   $terminalWorkflow.Passed -ne $true -or $terminalWorkflow.Input -cne 'Actual QMP PS2 keyboard packets only' -or
   $terminalWorkflow.HostCommandExecution -ne $false -or $terminalWorkflow.HostWorkspaceReads -ne $false) {
    throw 'The desktop requires the actual native classic terminal command workflow.'
}
foreach($stage in @('HelpPassed','RamDirectoryCreateWriteReadPassed','HistoryBeyondPreviousPassed','HistoryDraftRestorePassed',
    'CaretDeleteInsertEditingPassed','HistoryListingPassed','NoDemoOnlyTerminalContent')) {
    if($terminalWorkflow.PSObject.Properties[$stage].Value -ne $true){throw ('Actual terminal acceptance is incomplete: '+$stage)}
}
$terminalCommands=@($terminalWorkflow.Commands)
$expectedTerminalCount=if($boot.GpuDiscoveryEvidence){10}else{9}
if($terminalCommands.Count -ne $expectedTerminalCount -or @($terminalCommands | Where-Object {$_.Passed -ne $true -or $_.Busy -ne $false}).Count -or
   $terminalCommands[4].Command -cne 'cat CliProof/Command.txt' -or @($terminalCommands[4].PostCommandOutput) -cnotcontains 'NativeTerminalReady' -or
   $terminalCommands[5].Command -cne 'write CliProof/Command.txt NativeTerminalReady' -or
   $terminalCommands[6].Command -cne 'echo draft' -or @($terminalCommands[6].PostCommandOutput) -cnotcontains 'draft' -or
   $terminalCommands[7].Command -cne 'echo abd' -or @($terminalCommands[7].PostCommandOutput) -cnotcontains 'abd') {
    throw 'Actual terminal file reads, history or edited command output differs from its exact submitted command.'
}
$documentWorkflow=$desktopInput.DocumentWorkflowProof
if(!$documentWorkflow -or $documentWorkflow.Kind -cne 'XfeIndependentDesktopDocumentWorkflow' -or
   $documentWorkflow.Passed -ne $true -or $documentWorkflow.NoRenderFailures -ne $true -or
   $documentWorkflow.Input -cne 'Actual QMP PS2 keyboard/mouse packets only' -or !$documentWorkflow.Screenshots) {
    throw 'The independent desktop requires actual document workflow acceptance through PS/2 input and native framebuffer evidence.'
}
foreach($stage in @('DefaultPreview','FlatPreview','Edit','Split','Save','Reopen','LongScroll','SourceFallback')) {
    $evidence=$documentWorkflow.PSObject.Properties[$stage]
    if(!$evidence -or $evidence.Value.Passed -ne $true){throw ('Document workflow acceptance is incomplete: '+$stage)}
}
foreach($capture in @('Documents-DefaultPreview.png','Documents-Edit.png','Documents-Split.png','Documents-Split-Edited.png',
    'Documents-Reopened.png','Documents-Long-Before.png','Documents-Long-After.png','Documents-Source-Fallback.png')) {
    if(!$documentWorkflow.Screenshots.PSObject.Properties[$capture]){throw ('Document workflow framebuffer evidence is absent: '+$capture)}
}
if($boot.BrowserAcceptanceRequired -eq $true){
    $monacoPaint=$desktopInput.MonacoRasterPaintCompleted
    $monacoEdited=$desktopInput.MonacoKeyboardEditedModel
    if($monacoPaint -ne $true -or $monacoEdited -ne $true){throw 'Monaco must actually complete raster painting and change its model through real PS/2 keyboard input.'}
}
$arguments=@($boot.QemuArguments)
$nativeNetdev='user,id=NativeNet,net=10.0.2.0/24,host=10.0.2.2,dns=10.0.2.3,dhcpstart=10.0.2.15'
$nativeNic='e1000,netdev=NativeNet'
foreach($required in @(@('-machine','q35'),@('-accel','tcg'),@('-cpu','max'),@('-m','1024M'),@('-rtc','base=utc'),
    @('-netdev',$nativeNetdev),@('-device',$nativeNic))) {
    $index=[Array]::IndexOf($arguments,[string]$required[0])
    if($index -lt 0 -or $index+1 -ge $arguments.Count -or $arguments[$index+1] -cne $required[1] -or
       @($arguments | Where-Object {$_ -ceq $required[0]}).Count -ne 1) {
        throw ('Unsupported or missing verified QEMU profile: '+($required -join ' '))
    }
}
if(@($arguments | Where-Object {$_ -in @('-net','-nic')}).Count){throw 'A native Bing proof cannot add another network backend or an offline network override.'}
$network=$boot.NativeNetworkProfile
if(!$network -or $network.Kind -cne 'XfeIndependentNativeNetworkProfile' -or $network.Enabled -ne $true -or
   $network.Backend -cne 'QEMU user NAT' -or $network.Device -cne 'e1000' -or $network.PciVendorDevice -cne '8086:100e' -or
   $network.GuestAddress -cne '10.0.2.15' -or $network.Gateway -cne '10.0.2.2' -or $network.DnsServer -cne '10.0.2.3' -or
   $network.AddressConfiguration -cne 'Static' -or $network.NetdevArgument -cne $nativeNetdev -or $network.DeviceArgument -cne $nativeNic -or
   $network.HostProxy -ne $false -or $network.HostForwarding -ne $false -or $network.Rtc -cne 'base=utc' -or $network.Cpu -cne 'max') {
    throw 'The receipt does not bind the actual native e1000/static IPv4/user NAT/UTC/CPU profile.'
}
Assert-IndependentHash $sourceImage $boot.ImageSha256 'verified image'
$imageManifestPath=$sourceImage+'.json'
$imageManifest=Read-IndependentJson $imageManifestPath
if($imageManifest.Kind -cne 'CSharpGptFat32Image' -or $imageManifest.KernelImplementation -cne 'XFESystem independent kernel' -or
   $imageManifest.FullImageReadback -ne $true -or $imageManifest.ImageSha256 -cne $boot.ImageSha256 -or
   $imageManifest.KernelSha256 -cne $boot.KernelSha256 -or (Get-Item -LiteralPath $sourceImage).Length -ne $imageManifest.ImageBytes) {
    throw 'The image manifest must identify the exact verified independent kernel image.'
}
$packaged=$false
$packageManifestPath=Join-Path $taskRoot 'Manifest.json'
if(Test-Path -LiteralPath $packageManifestPath -PathType Leaf) {
    $packageManifest=Read-IndependentJson $packageManifestPath
    if($packageManifest.Kind -ceq 'XfeIndependentRamDesktopPackage') {
        $packaged=$true
        if($packageManifest.GuestAcceptancePassed -ne $true -or $packageManifest.HostAcceptancePassed -ne $true -or
           $packageManifest.NoRenderFailures -ne $true -or $packageManifest.MonacoRasterPaintCompleted -ne $true -or
           $packageManifest.MonacoKeyboardEditedModel -ne $true -or
           $packageManifest.DocumentWorkflowPassed -ne $true -or
           $packageManifest.ContainsCosmos -ne $false -or !$packageManifest.Files) { throw 'Invalid independent package manifest.' }
        foreach($entry in $packageManifest.Files) {
            $path=Get-IndependentFile $taskRoot ([string]$entry.Path)
            Assert-IndependentHash $path ([string]$entry.Sha256) ('packaged '+$entry.Path)
            if((Get-Item -LiteralPath $path).Length -ne $entry.Bytes) { throw ('Packaged file length changed: '+$entry.Path) }
        }
        if($packageManifest.ImageSha256 -cne $boot.ImageSha256 -or $packageManifest.BootReceiptSha256 -cne (Get-IndependentHash $bootPath) -or
           $packageManifest.SourceSnapshotSha256 -cne $boot.SourceSnapshotSha256) { throw 'Package and AppBoot proof bindings differ.' }
    }
}
$sourceRoot=if($packaged){Join-Path $taskRoot 'SourceSnapshot'}else{$taskRoot}
$guestEvidenceRoot=if($packaged){Join-Path $taskRoot 'Validation/Guest'}else{Split-Path -Parent $bootPath}
if($boot.GpuDiscoveryEvidence) {
    $gpuBinding=$boot.GpuDiscoveryEvidence
    $gpuEvidencePath=Get-IndependentFile $guestEvidenceRoot 'GpuDiscoveryEvidence.json'
    Assert-IndependentHash $gpuEvidencePath $gpuBinding.Sha256 'read-only native GPU discovery evidence'
    $gpuEvidence=Read-IndependentJson $gpuEvidencePath
    if($gpuBinding.Passed -ne $true -or $gpuBinding.GuestCudaVerified -ne $false -or $gpuBinding.GpuRasterizationVerified -ne $false -or
        $gpuEvidence.Kind -cne 'XfeIndependentReadOnlyGpuDiscoveryEvidence' -or $gpuEvidence.Passed -ne $true -or
        $gpuEvidence.ExpectedNvidiaAbsent -ne $true -or $gpuEvidence.NvidiaDeviceCount -ne 0 -or
        $gpuEvidence.GpuExecutionVerified -ne $false -or $gpuEvidence.CudaExecutionVerified -ne $false -or
        $gpuEvidence.GpuRasterizationVerified -ne $false -or $gpuEvidence.ActualNvidiaDeviceExecution -ne $false -or
        $gpuEvidence.FirmwareHandoff.Valid -cne '1' -or $gpuEvidence.FirmwareHandoff.Count -cne '0') {
        throw 'The no-NVIDIA QEMU proof must never qualify native CUDA or GPU rendering.'
    }
    if($terminalWorkflow.NativeGpuDiagnosticRamFileReadbackPassed -ne $true -or
        $terminalCommands[9].Command -cne 'cat /System/Diagnostics/Gpu.txt') {throw 'Missing actual native GPU diagnostic file readback.'}
    foreach($line in @('Scope: XFESystemGuest','CUDA: unavailable','GPU rasterization: unavailable',
        'Discovery state: 2; devices: 0','GB202 boot probe state: 1; FSP scratch 0x00000000')) {
        if(@($terminalCommands[9].PostCommandOutput) -cnotcontains $line) {throw ('Native GPU diagnostic file omitted '+$line)}
    }
    Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $terminalWorkflow.GpuDiagnosticScreenshot.Path) $terminalWorkflow.GpuDiagnosticScreenshot.Sha256 'native GPU diagnostic framebuffer'
}
Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $terminalWorkflow.RawGuestEvidence.Path) $terminalWorkflow.RawGuestEvidence.Sha256 'actual rendered terminal command snapshots'
Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $terminalWorkflow.Screenshot.Path) $terminalWorkflow.Screenshot.Sha256 'actual classic terminal framebuffer'
if($terminalWorkflow.RawGuestEvidence.SelectedRenderedSnapshots -ne $expectedTerminalCount -or
   $terminalWorkflow.Screenshot.Sha256 -ceq $desktopInput.Screenshots.ConsoleDemo) {throw 'Actual terminal command snapshot/framebuffer evidence is incomplete.'}
$bingBinding=$desktopInput.BingEvidence
if(!$bingBinding -or $bingBinding.Path -cne 'BingEvidence.json' -or $bingBinding.Passed -ne $true -or $bingBinding.NativeHttpsBingLoaded -ne $true) {
    throw 'The boot proof lacks its actual native Bing evidence file binding.'
}
$bingEvidencePath=Get-IndependentFile $guestEvidenceRoot $bingBinding.Path
Assert-IndependentHash $bingEvidencePath $bingBinding.Sha256 'actual native Bing evidence'
$bingEvidence=Read-IndependentJson $bingEvidencePath
if($bingEvidence.Kind -cne 'XfeIndependentNativeBingEvidence' -or $bingEvidence.Passed -ne $true -or
   $bingEvidence.NativeHttpsBingLoaded -ne $true -or $bingEvidence.AllUserRequirementsMet -ne $false -or
   $bingEvidence.FullCssParityVerified -ne $false -or $bingEvidence.CompleteJavaScriptCompatibility -ne $false -or
   $bingEvidence.HostHttpRequests -ne $false -or $bingEvidence.HostBrowserScreenshots -ne $false -or
   $bingEvidence.HostJavaScriptInjection -ne $false -or $bingEvidence.VmStartedByThisTool -ne $false -or
   $bingEvidence.RequestedUrl -cne 'https://www.bing.com/' -or !$bingEvidence.Responses -or !$bingEvidence.Screenshots) {
    throw 'Actual guest HTTPS Bing acceptance is incomplete or claims unverified browser parity.'
}
foreach($response in $bingEvidence.Responses) {
    if($response.NativeTransport -ne $true -or $response.CertificateValidated -ne $true) {throw 'Every actual HTTPS Bing hop requires native transport and validated TLS.'}
}
$bingFinal=@($bingEvidence.Responses)[-1]
$bingPage=$bingEvidence.RemotePage
if($bingFinal.StatusCode -ne 200 -or $bingFinal.HasHtml -ne $true -or $bingFinal.HasHead -ne $true -or
   $bingFinal.BodyBytes -lt 128 -or $bingFinal.BodySha256 -cnotmatch '^[0-9a-fA-F]{64}$' -or
   !$bingPage -or $bingPage.CertificateValidated -ne $true -or $bingPage.BodySha256 -cne $bingFinal.BodySha256 -or
   $bingPage.Address -cne $bingFinal.ResponseUri -or $bingPage.SnapshotSequence -le 0 -or
   $bingEvidence.Presentation.SnapshotSequence -ne $bingPage.SnapshotSequence) {
    throw 'Actual Bing HTML, immutable DOM snapshot and native presentation are not bound.'
}
Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $bingEvidence.RawGuestEvidence.Path) $bingEvidence.RawGuestEvidence.Sha256 'actual Bing protocol and presentation log'
if($bingEvidence.RawGuestEvidence.Packets -lt 2 -or $bingEvidence.RawGuestEvidence.PresentationMarkers -lt 1) {throw 'Actual Bing protocol and presentation receipts are absent.'}
$bingPainted=$false
foreach($capture in $bingEvidence.Screenshots) {
    Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $capture.Path) $capture.Sha256 'actual Bing native framebuffer'
    $correlation=$capture.PresentationCorrelation
    if($capture.BodySha256 -cne $bingPage.BodySha256 -or !$correlation -or $correlation.StableSnapshot -ne $true) {throw 'Bing screenshot does not bind its actual HTTP body and stable presentation.'}
    foreach($field in @('WindowId','Generation','Address','SnapshotSequence','ScrollY')) {
        if(!$correlation.Before.PSObject.Properties[$field] -or !$correlation.After.PSObject.Properties[$field] -or
           $correlation.Before.PSObject.Properties[$field].Value -cne $correlation.After.PSObject.Properties[$field].Value) {throw ('Bing changed during framebuffer capture: '+$field)}
    }
    if($correlation.Before.SnapshotSequence -ne $bingPage.SnapshotSequence -or $correlation.Before.Address -cne $bingPage.Address -or
       $correlation.Before.WindowId -ne $bingEvidence.Presentation.WindowId -or $correlation.Before.PresentationSequence -le 0 -or
       $correlation.Before.PresentationTicks -le 0 -or $correlation.After.PresentationSequence -lt $correlation.Before.PresentationSequence -or
       $correlation.After.PresentationTicks -lt $correlation.Before.PresentationTicks) {throw 'Bing screenshot presentation identity/counters are invalid.'}
    if($capture.TextPixels.Passed -eq $true){$bingPainted=$true}
}
if(!$bingPainted){throw 'No actual Bing native framebuffer contains the corresponding remote text glyphs.'}
foreach($capture in $documentWorkflow.Screenshots.PSObject.Properties) {
    Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $capture.Name) ([string]$capture.Value) ('actual document workflow '+$capture.Name)
}
Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot 'Frame.png') $boot.ScreenshotSha256 'actual guest framebuffer evidence'
foreach($capture in @(@('Files','Desktop-Files.png'),@('EditorSaved','Desktop-Editor-Saved.png'),@('Browser','Browser-JavaScript.png'))) {
    Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $capture[1]) ([string]$desktopInput.Screenshots.PSObject.Properties[$capture[0]].Value) ('actual desktop input '+$capture[0])
}
if($boot.BrowserAcceptanceRequired -eq $true){
    if($boot.BrowserAcceptancePassed -ne $true -or $desktopInput.OfficialMonacoReady -ne $true){throw 'Required real Monaco acceptance is incomplete.'}
    Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot 'Browser-Monaco.png') $desktopInput.Screenshots.Monaco 'actual Monaco framebuffer evidence'
}
foreach($capture in @(@('ConsoleIL','Terminal-ConsoleIL.png'),@('ConsoleDemo','Terminal-Console-Demo.png'))) {
    $boundCapture=$desktopInput.Screenshots.PSObject.Properties[$capture[0]]
    if($boundCapture){Assert-IndependentHash (Get-IndependentFile $guestEvidenceRoot $capture[1]) ([string]$boundCapture.Value) ('actual terminal '+$capture[0])}
}
$snapshotPath=if($packaged){Get-IndependentFile $taskRoot 'Validation/SourceSnapshot.json'}else{(Resolve-Path -LiteralPath $boot.SourceSnapshotPath).Path}
$buildPath=if($packaged){Get-IndependentFile $taskRoot 'Validation/BuildReceipt.json'}else{(Resolve-Path -LiteralPath $boot.BuildReceipt).Path}
Assert-IndependentHash $snapshotPath $boot.SourceSnapshotSha256 'compiled source snapshot'
Assert-IndependentHash $buildPath $boot.BuildReceiptSha256 'independent kernel build receipt'
$snapshot=Read-IndependentJson $snapshotPath
$build=Read-IndependentJson $buildPath
if($build.Kind -cne 'XfeIndependentKernelBuild' -or $build.Passed -ne $true -or $build.BootstrapOnly -ne $false -or
   $build.ManagedRuntimeLinked -ne $true -or $build.ContainsCosmos -ne $false -or $build.Target -cne 'x86_64-none' -or
   $build.KernelSha256 -cne $boot.KernelSha256 -or
   !$build.SourceSha256.PSObject.Properties['Source/XFESystem.NativeRuntime/Application/NativeApplication.csproj']) {
    throw 'A complete NativeApplication kernel build is required; a diagnostic probe cannot be launched as the desktop.'
}
$kernelPath=if($packaged){Get-IndependentFile $taskRoot 'Kernel.elf'}else{(Resolve-Path -LiteralPath $build.KernelPath).Path}
Assert-IndependentHash $kernelPath $boot.KernelSha256 'compiled kernel'
Assert-IndependentSourceMap $snapshot $sourceRoot 'compiled snapshot'
Assert-IndependentSourceMap $build.SourceSha256 $sourceRoot 'kernel build'
Assert-IndependentSourceSubset $build.SourceSha256 $snapshot 'kernel to snapshot'
Assert-IndependentSourceSubset $imageManifest.BootShimSourceSha256 $snapshot 'EFI to snapshot'
Assert-IndependentSourceSubset $boot.ImageVerification.BootShimSourceSha256 $imageManifest.BootShimSourceSha256 'verified EFI to image manifest'
Assert-IndependentSourceSubset $imageManifest.BootShimSourceSha256 $boot.ImageVerification.BootShimSourceSha256 'image manifest to verified EFI'
Assert-IndependentSourceSubset $build.SourceSha256 $imageManifest.IndependentKernelBuild.SourceSha256 'kernel to image manifest'
Assert-IndependentSourceSubset $imageManifest.IndependentKernelBuild.SourceSha256 $build.SourceSha256 'image manifest to kernel'
if($imageManifest.IndependentKernelBuild.Passed -ne $true -or $imageManifest.IndependentKernelBuild.BootstrapOnly -ne $false -or
   $imageManifest.IndependentKernelBuild.ManagedRuntimeLinked -ne $true -or $imageManifest.IndependentKernelBuild.ContainsCosmos -ne $false -or
   $imageManifest.IndependentKernelBuild.KernelSha256 -cne $boot.KernelSha256 -or
   $boot.ImageVerification.Files.'System/Kernel.elf' -cne $boot.KernelSha256 -or
   $boot.ImageVerification.Files.'EFI/BOOT/BOOTX64.EFI' -cne $imageManifest.BootloaderSha256 -or
   $boot.ImageVerification.Files.'EFI/XFE/Limine.efi' -cne $imageManifest.ChainloaderSha256 -or
   $boot.ImageVerification.GptPrimaryAndBackupVerified -ne $true -or $boot.ImageVerification.FatMirrorsVerified -ne $true) {
    throw 'Embedded kernel, EFI and GPT/FAT verification bindings are incomplete.'
}
if(!$ToolsRoot){$ToolsRoot=Join-Path $taskRoot '.tools'}
$firmwareRoot=if($packaged){Join-Path $taskRoot 'Firmware'}else{Join-Path $ToolsRoot 'firmware'}
$firmwareLockPath=if($packaged){Get-IndependentFile $taskRoot 'Validation/Firmware.json'}else{Get-IndependentFile $taskRoot 'Tools/CSharpBoot/Dependencies.json'}
$firmwareLock=Read-IndependentJson $firmwareLockPath
$firmwareCode=Get-IndependentFile $firmwareRoot 'edk2-x86_64-code.fd'
$firmwareVars=Get-IndependentFile $firmwareRoot 'edk2-i386-vars.fd'
foreach($firmware in @($firmwareCode,$firmwareVars)) {
    Assert-IndependentHash $firmware ([string]$firmwareLock.Firmware.PSObject.Properties[[IO.Path]::GetFileName($firmware)].Value) ('pinned firmware '+[IO.Path]::GetFileName($firmware))
}
$verified=[pscustomobject]@{ImagePath=$sourceImage;BootPath=$bootPath;Boot=$boot;ImageManifestPath=$imageManifestPath;
    ImageManifest=$imageManifest;BuildPath=$buildPath;Build=$build;KernelPath=$kernelPath;
    SnapshotPath=$snapshotPath;Snapshot=$snapshot;SourceRoot=$sourceRoot;Packaged=$packaged;
    FirmwareCode=$firmwareCode;FirmwareVars=$firmwareVars;FirmwareLock=$firmwareLock;
    NoRenderFailures=$desktopInput.NoRenderFailures;MonacoRasterPaintCompleted=$monacoPaint;MonacoKeyboardEditedModel=$monacoEdited;
    DocumentWorkflowPassed=$documentWorkflow.Passed;TerminalWorkflowPassed=$terminalWorkflow.Passed;NativeNetworkProfile=$network;BingNativeHttpsPassed=$true;
    BingEvidencePath=$bingEvidencePath;BingEvidenceSha256=$bingBinding.Sha256;BingEvidence=$bingEvidence}
if($ValidateOnly){return $verified}
if(!$QemuPath){
    $localQemu=Join-Path $ToolsRoot 'qemu/qemu-system-x86_64.exe'
    if(Test-Path -LiteralPath $localQemu -PathType Leaf){$QemuPath=$localQemu}
    else{$command=Get-Command qemu-system-x86_64.exe -ErrorAction SilentlyContinue;if(!$command){throw 'Pass -QemuPath for an installed x86_64 QEMU.'};$QemuPath=$command.Source}
}
$QemuPath=(Resolve-Path -LiteralPath $QemuPath).Path
$runId='Interactive-'+[DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()+'-'+[Guid]::NewGuid().ToString('N').Substring(0,8)
$runRoot=Join-Path $taskRoot ('build/IndependentKernel/'+$runId)
[void][IO.Directory]::CreateDirectory($runRoot)
$runImage=Join-Path $runRoot 'System.img'
$runVars=Join-Path $runRoot 'FirmwareVars.fd'
$serialLog=Join-Path $runRoot 'Serial.log'
Copy-Item -LiteralPath $sourceImage -Destination $runImage
Copy-Item -LiteralPath $firmwareVars -Destination $runVars
Assert-IndependentHash $runImage $boot.ImageSha256 'private interactive image copy'
Assert-IndependentHash $runVars (Get-IndependentHash $firmwareVars) 'private firmware variable copy'
$display=if($DisplayBackend -eq 'gtk'){'gtk,zoom-to-fit='+$(if($NativePixels){'off'}else{'on'})}else{'sdl,gl=off'}
$consoleRefreshTrace=if($TraceConsoleRefresh){Join-Path $runRoot 'ConsoleRefresh.log'}else{$null}
$qemuArguments=@('-name','XFESystem | XFEstudio - Independent RAM experiment','-machine','q35','-accel','tcg','-cpu','max',
    '-smp','1','-m','1024M','-vga','std','-global','VGA.vgamem_mb=64','-display',$display,
    '-netdev',$nativeNetdev,'-device',$nativeNic,'-rtc','base=utc',
    '-drive',('if=pflash,format=raw,readonly=on,file='+$firmwareCode.Replace(',',',,')),
    '-drive',('if=pflash,format=raw,file='+$runVars.Replace(',',',,')),
    '-drive',('file='+$runImage.Replace(',',',,')+',format=raw,if=ide,snapshot=on'),
    '-serial',('file:'+$serialLog),'-monitor','none','-no-reboot')
if($Fullscreen){$qemuArguments+='-full-screen'}
if($TraceConsoleRefresh){$qemuArguments+=@('-trace','enable=console_refresh','-D',$consoleRefreshTrace)}
$launch=[ordered]@{Kind='XfeIndependentKernelInteractiveLaunch';AppBootReceiptSha256=(Get-IndependentHash $bootPath);
    ImageSha256=$boot.ImageSha256;KernelSha256=$boot.KernelSha256;SourceSnapshotSha256=$boot.SourceSnapshotSha256;
    RunDirectory=$runRoot;SerialLog=$serialLog;QemuPath=$QemuPath;QemuArguments=$qemuArguments;
    Acceleration='tcg';Cpu='max';Machine='q35';MemoryMiB=1024;VirtualCpus=1;ExecutingCpus=1;NativeNetworkProfile=$network;
    BingNativeHttpsPassed=$true;BingEvidenceSha256=$bingBinding.Sha256;FullCssParityVerified=$false;CompleteJavaScriptCompatibility=$false;
    InputDevices='Q35 built-in i8042 PS/2 keyboard and mouse';Rtc='UTC';RamOnly=$true;StorageEnabled=$false;
    ViewportPolicy=$(if($NativePixels){'NativePixelsMayClip'}else{'FitCompleteDesktop'});
    ConsoleRefreshTrace=[ordered]@{Enabled=[bool]$TraceConsoleRefresh;TracePath=$consoleRefreshTrace;
        Meaning='QEMU configured GUI poll interval announcements; actual frame cadence and physical display refresh are not measured';
        ActualVisibleFramesPerSecond=$null;PhysicalRefreshHz=$null};
    ContainsCosmos=$false;InteractiveStarted=$false;InteractiveAcceptancePassed=$false;PlanOnly=[bool]$PlanOnly}
$launch.DocumentWorkflowPassed=[bool]$verified.DocumentWorkflowPassed
$launch.TerminalWorkflowPassed=[bool]$verified.TerminalWorkflowPassed
$launchPath=Join-Path $runRoot 'Launch.json'
try {
    if(!$PlanOnly){
        $quoted=@($qemuArguments | ForEach-Object {if($_.Contains('"')){throw 'Unexpected quote in QEMU argument.'};'"'+($_ -replace '(\\+)$','$1$1')+'"'})
        $process=Start-Process -FilePath $QemuPath -ArgumentList ($quoted -join ' ') -WorkingDirectory $runRoot -WindowStyle Normal -PassThru
        $launch.ProcessId=$process.Id;$launch.InteractiveStarted=$true
    }
} catch {$launch.Error=$_.Exception.Message;throw}
finally {$launch | ConvertTo-Json -Depth 7 | Set-Content -LiteralPath $launchPath -Encoding UTF8}
Write-Host ('Independent RAM experiment '+$(if($PlanOnly){'launch plan'}else{'interactive window'})+': '+$runRoot)
Write-Host ('Serial log: '+$serialLog)
return [pscustomobject]$launch