G7 증명과 G8 clean-head 승격 준비

scripts/install-public-runtime-task.ps1

@@ -1,5 +1,6 @@
 param(
-  [string]$Workspace = "D:\workspace\vignette",
+  [Parameter(Mandatory = $true)]
+  [string]$StableSourceRoot,
   [string]$TaskName = "VignettePublicRuntimeWatchdog",
   [int]$IntervalMinutes = 5,
   [string[]]$AdditionalPublicHealthUrls = @(),
@@ -14,11 +15,72 @@ if ($IntervalMinutes -lt 1) {
   throw "IntervalMinutes must be 1 or greater"
 }
 
-$watchScript = Join-Path $Workspace "scripts\watch-public-runtime.ps1"
-if (!(Test-Path $watchScript)) {
-  throw "Watchdog script not found at $watchScript"
+$resolvedSourceRoot = (Resolve-Path -LiteralPath $StableSourceRoot).Path
+$installerScript = Join-Path $resolvedSourceRoot "scripts\install-public-runtime-task.ps1"
+$watchScript = Join-Path $resolvedSourceRoot "scripts\watch-public-runtime.ps1"
+$startScript = Join-Path $resolvedSourceRoot "scripts\start-public-runtime.ps1"
+
+function Invoke-GitText {
+  param([string[]]$Arguments)
+
+  $value = & git.exe -C $resolvedSourceRoot @Arguments
+  if ($LASTEXITCODE -ne 0) {
+    throw "Stable source Git command failed (exit=$LASTEXITCODE): git $($Arguments -join ' ')"
+  }
+  return (@($value) -join [Environment]::NewLine).Trim()
 }
 
+foreach ($requiredScript in @($installerScript, $watchScript, $startScript)) {
+  if (!(Test-Path -LiteralPath $requiredScript -PathType Leaf)) {
+    throw "Public runtime script not found at $requiredScript"
+  }
+}
+
+$runningInstaller = (Resolve-Path -LiteralPath $PSCommandPath).Path
+if (-not [string]::Equals(
+    $runningInstaller,
+    (Resolve-Path -LiteralPath $installerScript).Path,
+    [System.StringComparison]::OrdinalIgnoreCase
+)) {
+  throw "Watchdog installer is not executing from the pinned stable source root"
+}
+
+$gitRoot = Invoke-GitText -Arguments @("rev-parse", "--show-toplevel")
+$resolvedGitRoot = (Resolve-Path -LiteralPath $gitRoot).Path
+if (-not [string]::Equals(
+    $resolvedGitRoot,
+    $resolvedSourceRoot,
+    [System.StringComparison]::OrdinalIgnoreCase
+)) {
+  throw "Stable source root does not match its Git toplevel"
+}
+
+$symbolicHead = & git.exe -C $resolvedSourceRoot symbolic-ref --quiet HEAD
+$symbolicHeadExit = $LASTEXITCODE
+if ($symbolicHeadExit -eq 0) {
+  throw "Stable source must be a detached HEAD, not branch $symbolicHead"
+}
+if ($symbolicHeadExit -ne 1) {
+  throw "Could not prove detached HEAD (git exit=$symbolicHeadExit)"
+}
+
+$dirty = Invoke-GitText -Arguments @("status", "--porcelain=v1", "--untracked-files=normal")
+if ($dirty) {
+  throw "Stable source is not clean; refusing watchdog installation"
+}
+foreach ($relativePath in @(
+  "scripts/install-public-runtime-task.ps1",
+  "scripts/watch-public-runtime.ps1",
+  "scripts/start-public-runtime.ps1"
+)) {
+  Invoke-GitText -Arguments @("ls-files", "--error-unmatch", "--", $relativePath) | Out-Null
+}
+
+$sourceCommit = Invoke-GitText -Arguments @("rev-parse", "--verify", "HEAD")
+$sourceTree = Invoke-GitText -Arguments @("rev-parse", "--verify", "HEAD^{tree}")
+$watchdogSha256 = (Get-FileHash -LiteralPath $watchScript -Algorithm SHA256).Hash.ToLowerInvariant()
+$startScriptSha256 = (Get-FileHash -LiteralPath $startScript -Algorithm SHA256).Hash.ToLowerInvariant()
+
 $powershell = (Get-Command powershell.exe).Source
 $userId = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
 
@@ -26,7 +88,11 @@ $actionArguments = @(
   "-NoProfile",
   "-ExecutionPolicy Bypass",
   "-File `"$watchScript`"",
-  "-Workspace `"$Workspace`""
+  "-StableSourceRoot `"$resolvedSourceRoot`"",
+  "-ExpectedSourceCommit $sourceCommit",
+  "-ExpectedSourceTree $sourceTree",
+  "-ExpectedWatchdogSha256 $watchdogSha256",
+  "-ExpectedStartScriptSha256 $startScriptSha256"
 )
 if ($SkipPublicHealth) {
   $actionArguments += "-SkipPublicHealth"
@@ -42,7 +108,7 @@ if ($AdditionalPublicHealthUrls.Count -gt 0) {
 $action = New-ScheduledTaskAction `
   -Execute $powershell `
   -Argument ($actionArguments -join " ") `
-  -WorkingDirectory $Workspace
+  -WorkingDirectory $resolvedSourceRoot
 
 $logonTrigger = New-ScheduledTaskTrigger -AtLogOn -User $userId
 $repeatTrigger = New-ScheduledTaskTrigger `
@@ -65,7 +131,7 @@ $principal = New-ScheduledTaskPrincipal `
   -LogonType Interactive `
   -RunLevel Limited
 
-$description = "Runs Vignette public runtime watchdog as $userId. Secrets stay in the user profile and apps/api/.env; the task command stores no secrets."
+$description = "Runs Vignette public runtime watchdog as $userId from detached clean commit $sourceCommit. Secrets stay in the user profile and apps/api/.env; the task command stores no secrets."
 $task = New-ScheduledTask `
   -Action $action `
   -Trigger @($logonTrigger, $repeatTrigger) `
@@ -77,6 +143,8 @@ Register-ScheduledTask -TaskName $TaskName -InputObject $task -Force | Out-Null
 
 Write-Output "Installed scheduled task '$TaskName' for $userId"
 Write-Output "Action: $powershell $($actionArguments -join ' ')"
+Write-Output "Pinned source: root=$resolvedSourceRoot commit=$sourceCommit tree=$sourceTree"
+Write-Output "Pinned scripts: watchdog_sha256=$watchdogSha256 start_sha256=$startScriptSha256"
 Write-Output "Interval: every $IntervalMinutes minute(s), plus at user logon"
 if ($AdditionalPublicHealthUrls.Count -gt 0) {
   Write-Output "Additional public health URLs: $($AdditionalPublicHealthUrls -join ', ')"