아바타 저장소 승격 계약을 완성

scripts/install-public-runtime-task.ps1

@@ -3,9 +3,23 @@ param(
   [string]$StableSourceRoot,
   [string]$TaskName = "VignettePublicRuntimeWatchdog",
   [int]$IntervalMinutes = 5,
+  [string]$Python = "$env:LOCALAPPDATA\Programs\Python\Python311\python.exe",
+  [Parameter(Mandatory = $true)]
+  [string]$UserUploadDir,
+  [Parameter(Mandatory = $true)]
+  [string]$UserUploadManifestPath,
+  [Parameter(Mandatory = $true)]
+  [ValidatePattern("^[0-9a-f]{64}$")]
+  [string]$ExpectedUserUploadManifestSha256,
+  [Parameter(Mandatory = $true)]
+  [string]$UserUploadWriteFreezePath,
   [string[]]$AdditionalPublicHealthUrls = @(),
   [switch]$SkipPublicHealth,
   [switch]$SkipCloudflaredRestart,
+  [string]$Cloudflared = "$env:LOCALAPPDATA\Microsoft\WinGet\Links\cloudflared.exe",
+  [string]$CloudflaredConfig = "$env:USERPROFILE\.cloudflared\vignette-config.yml",
+  [string]$PublicHealthUrl = "https://api-vignette.chanpaca.net/health",
+  [switch]$InitiallyDisabled,
   [switch]$RunNow
 )
 
@@ -14,6 +28,9 @@ $ErrorActionPreference = "Stop"
 if ($IntervalMinutes -lt 1) {
   throw "IntervalMinutes must be 1 or greater"
 }
+if ($InitiallyDisabled -and $RunNow) {
+  throw "InitiallyDisabled and RunNow cannot be combined"
+}
 
 $resolvedSourceRoot = (Resolve-Path -LiteralPath $StableSourceRoot).Path
 $installerScript = Join-Path $resolvedSourceRoot "scripts\install-public-runtime-task.ps1"
@@ -21,6 +38,10 @@ $watchScript = Join-Path $resolvedSourceRoot "scripts\watch-public-runtime.ps1"
 $startScript = Join-Path $resolvedSourceRoot "scripts\start-public-runtime.ps1"
 $voiceSidecarProbe = Join-Path $resolvedSourceRoot "scripts\probe-public-voice-sidecars.py"
 $taskLauncher = Join-Path $resolvedSourceRoot "scripts\watch-public-runtime-task.vbs"
+$uploadRootContract = Join-Path $resolvedSourceRoot "scripts\public-runtime-upload-root.ps1"
+$uploadRootProbe = Join-Path $resolvedSourceRoot "scripts\probe-public-runtime-upload-root.py"
+$uploadManifestProbe = Join-Path $resolvedSourceRoot "scripts\validate-public-runtime-upload-manifest.py"
+$databaseIdentityHelper = Join-Path $resolvedSourceRoot "scripts\public_runtime_database_identity.py"
 
 function Invoke-GitText {
   param([string[]]$Arguments)
@@ -32,7 +53,17 @@ function Invoke-GitText {
   return (@($value) -join [Environment]::NewLine).Trim()
 }
 
-foreach ($requiredScript in @($installerScript, $watchScript, $startScript, $voiceSidecarProbe, $taskLauncher)) {
+foreach ($requiredScript in @(
+  $installerScript,
+  $watchScript,
+  $startScript,
+  $voiceSidecarProbe,
+  $taskLauncher,
+    $uploadRootContract,
+    $uploadRootProbe,
+    $uploadManifestProbe,
+    $databaseIdentityHelper
+)) {
   if (!(Test-Path -LiteralPath $requiredScript -PathType Leaf)) {
     throw "Public runtime script not found at $requiredScript"
   }
@@ -75,7 +106,13 @@ foreach ($relativePath in @(
     "scripts/watch-public-runtime.ps1",
     "scripts/start-public-runtime.ps1",
     "scripts/probe-public-voice-sidecars.py",
-    "scripts/watch-public-runtime-task.vbs"
+    "scripts/watch-public-runtime-task.vbs",
+    "scripts/public-runtime-upload-root.ps1",
+    "scripts/probe-public-runtime-upload-root.py",
+    "scripts/validate-public-runtime-upload-manifest.py",
+    "scripts/public_runtime_database_identity.py",
+    "apps/api/app/upload_storage.py",
+    "apps/api/app/upload_runtime.py"
 )) {
   Invoke-GitText -Arguments @("ls-files", "--error-unmatch", "--", $relativePath) | Out-Null
 }
@@ -84,6 +121,36 @@ $sourceCommit = Invoke-GitText -Arguments @("rev-parse", "--verify", "HEAD")
 $sourceTree = Invoke-GitText -Arguments @("rev-parse", "--verify", "HEAD^{tree}")
 $watchdogSha256 = (Get-FileHash -LiteralPath $watchScript -Algorithm SHA256).Hash.ToLowerInvariant()
 $startScriptSha256 = (Get-FileHash -LiteralPath $startScript -Algorithm SHA256).Hash.ToLowerInvariant()
+$resolvedPython = (Resolve-Path -LiteralPath $Python).Path
+$resolvedCloudflared = (Resolve-Path -LiteralPath $Cloudflared).Path
+$resolvedCloudflaredConfig = (Resolve-Path -LiteralPath $CloudflaredConfig).Path
+$pythonSha256 = (Get-FileHash -LiteralPath $resolvedPython -Algorithm SHA256).Hash.ToLowerInvariant()
+$cloudflaredSha256 = (Get-FileHash -LiteralPath $resolvedCloudflared -Algorithm SHA256).Hash.ToLowerInvariant()
+$cloudflaredConfigSha256 = (Get-FileHash -LiteralPath $resolvedCloudflaredConfig -Algorithm SHA256).Hash.ToLowerInvariant()
+. $uploadRootContract
+$resolvedUserUploadDir = Resolve-PublicRuntimeUploadRoot `
+  -SourceRoot $resolvedSourceRoot `
+  -UploadRoot $UserUploadDir `
+  -ProbeWritable
+$resolvedUserUploadManifestPath = Resolve-PublicRuntimePrivateStatePath `
+  -SourceRoot $resolvedSourceRoot `
+  -UploadRoot $resolvedUserUploadDir `
+  -StatePath $UserUploadManifestPath `
+  -RequireFile
+$resolvedUserUploadWriteFreezePath = Resolve-PublicRuntimePrivateStatePath `
+  -SourceRoot $resolvedSourceRoot `
+  -UploadRoot $resolvedUserUploadDir `
+  -StatePath $UserUploadWriteFreezePath
+$uploadManifestProof = Test-PublicRuntimeUploadManifest `
+  -PythonPath $Python `
+  -ProbePath $uploadManifestProbe `
+  -UploadRoot $resolvedUserUploadDir `
+  -ManifestPath $resolvedUserUploadManifestPath `
+  -ExpectedManifestSha256 $ExpectedUserUploadManifestSha256 `
+  -ExpectedWriteFreezePath $resolvedUserUploadWriteFreezePath
+if (-not $uploadManifestProof.Ok) {
+  throw "Refusing task installation: public upload migration receipt or current DB inventory is invalid"
+}
 
 $wscript = Join-Path $env:SystemRoot "System32\wscript.exe"
 if (!(Test-Path -LiteralPath $wscript -PathType Leaf)) {
@@ -100,7 +167,18 @@ $actionArguments = @(
   "-ExpectedSourceCommit $sourceCommit",
   "-ExpectedSourceTree $sourceTree",
   "-ExpectedWatchdogSha256 $watchdogSha256",
-  "-ExpectedStartScriptSha256 $startScriptSha256"
+  "-ExpectedStartScriptSha256 $startScriptSha256",
+  "-ExpectedPythonSha256 $pythonSha256",
+  "-ExpectedCloudflaredSha256 $cloudflaredSha256",
+  "-ExpectedCloudflaredConfigSha256 $cloudflaredConfigSha256",
+  "-Python `"$resolvedPython`"",
+  "-Cloudflared `"$resolvedCloudflared`"",
+  "-CloudflaredConfig `"$resolvedCloudflaredConfig`"",
+  "-UserUploadDir `"$resolvedUserUploadDir`"",
+  "-UserUploadManifestPath `"$resolvedUserUploadManifestPath`"",
+  "-ExpectedUserUploadManifestSha256 $ExpectedUserUploadManifestSha256",
+  "-UserUploadWriteFreezePath `"$resolvedUserUploadWriteFreezePath`"",
+  "-PublicHealthUrl `"$PublicHealthUrl`""
 )
 if ($SkipPublicHealth) {
   $actionArguments += "-SkipPublicHealth"
@@ -125,6 +203,7 @@ $repeatTrigger = New-ScheduledTaskTrigger `
   -RepetitionInterval (New-TimeSpan -Minutes $IntervalMinutes)
 
 $settings = New-ScheduledTaskSettingsSet `
+  -Disable:$InitiallyDisabled `
   -AllowStartIfOnBatteries `
   -DontStopIfGoingOnBatteries `
   -ExecutionTimeLimit (New-TimeSpan -Minutes 60) `
@@ -145,18 +224,31 @@ $task = New-ScheduledTask `
   -Principal $principal `
   -Description $description
 
-Register-ScheduledTask -TaskName $TaskName -InputObject $task -Force | Out-Null
+Register-ScheduledTask `
+  -TaskName $TaskName `
+  -TaskPath "\" `
+  -InputObject $task `
+  -Force `
+  | Out-Null
+
+if ($InitiallyDisabled) {
+  $registered = Get-ScheduledTask -TaskName $TaskName -TaskPath "\" -ErrorAction Stop
+  if ([bool]$registered.Settings.Enabled -or [string]$registered.State -eq "Running") {
+    throw "New watchdog task did not remain disabled and idle"
+  }
+}
 
 Write-Output "Installed scheduled task '$TaskName' for $userId"
 Write-Output "Action: $wscript `"$taskLauncher`" $($actionArguments -join ' ')"
 Write-Output "Pinned source: root=$resolvedSourceRoot commit=$sourceCommit tree=$sourceTree"
 Write-Output "Pinned scripts: watchdog_sha256=$watchdogSha256 start_sha256=$startScriptSha256"
+Write-Output "Pinned user upload root: $resolvedUserUploadDir"
 Write-Output "Interval: every $IntervalMinutes minute(s), plus at user logon"
 if ($AdditionalPublicHealthUrls.Count -gt 0) {
   Write-Output "Additional public health URLs: $($AdditionalPublicHealthUrls -join ', ')"
 }
 
 if ($RunNow) {
-  Start-ScheduledTask -TaskName $TaskName
+  Start-ScheduledTask -TaskName $TaskName -TaskPath "\"
   Write-Output "Started scheduled task '$TaskName'"
 }