Feature/v8 orchestration engine

CERTIFICATION.md

@@ -1,5 +1,10 @@
 # PrinterToolkit v5.0.1 — Production Certification Report
 
+> **⚠️ HISTORICAL DOCUMENT — v5.0.1 (not current)**
+> This certification applies to **PrinterToolkit v5.0.1 only**.
+> The current release is **v8.2.0-rc1** — see `Certification/` and `docs/v8.2/` for current certification status.
+> **This document does not describe the current codebase.** Do not infer any runtime success for v8.x from this report.
+
 **Date:** 2026-07-14
 **Version:** 5.0.1
 
@@ -187,6 +192,6 @@
 | CI/CD | 5% | 5/5 | GitHub Actions with test/build/release pipeline, no redundant installs |
 | Release Readiness | 5% | 5/5 | ZIP + SHA-256 + release notes + migration guide + bootstrap |
 
-**Verdict: ✅ CERTIFIED — PrinterToolkit v5.0.1 Stable**
+**Verdict: ✅ CERTIFIED — PrinterToolkit v5.0.1 Stable (historical — does not apply to v8.x)**
 
-17 of 21 independent adversarial audit findings resolved. 4 documented as intentional design choices (M7, L2) or environment limitations (known limitations 1, 3-5). No critical or high issues remain open.
+17 of 21 independent adversarial audit findings resolved. 4 documented as intentional design choices (M7, L2) or environment limitations (known limitations 1, 3-5). No critical or high issues remain open at time of v5.0.1 release.

CHANGELOG.md

@@ -1,5 +1,72 @@
 # Changelog
 
+## [8.0.0] - 2026-07-14
+
+### Added
+- **Orchestration Engine** (`Orchestration`): declarative Task model with dependencies, prerequisites, retry policy, and rollback
+- DAG resolver (`Get-TopologicalTaskOrder`) with cycle detection for deterministic execution order
+- Event Bus for structured, subscribable deployment events (`Subscribe-OrchestrationEvent`, `Publish-OrchestrationEvent`, `Get-OrchestrationEventLog`)
+- State Manager tracking subsystem health (`Set-SubsystemState`, `Get-SubsystemState`, `Get-OrchestrationStateReport`, `Reset-OrchestrationState`)
+- Transaction Engine recording per-task state transitions (`Start-OrchestrationTransaction`, `Record-TaskTransaction`, `Get-OrchestrationTransactionLog`)
+- Desired-State model (`Get-DefaultDesiredState`, `Get-DesiredState`) with Configuration Providers (Service, Firewall, Network, Sharing, IPP, Registry, Driver, Printer)
+- Orchestrator (`Invoke-Orchestrator`) executing the dependency graph with skip/retry/rollback/recovery semantics
+- Recovery Engine (`Invoke-RecoveryEngine`) and consolidated reporting (`Get-OrchestrationReport`)
+- Orchestration module added to manifest `NestedModules` and `FunctionsToExport`
+
+### Changed
+- `Start-ZeroTouchDeployment` refactored to build a deployment DAG and run through `Invoke-Orchestrator`; public signature and return shape preserved
+- Version unified to 8.0.0 across all source files (manifest, loader, installer, utilities, rollback, docs, tests)
+
+## [7.0.0] - 2026-07-14
+
+### Added
+- **Zero-Touch Deployment Engine** (`ZeroTouch`): Single-action print server deployment following the lifecycle Detect → Analyze → Backup → Configure → Validate → Rollback → Report
+- `Start-ZeroTouchDeployment`: one-click deployment of a connected USB printer as a shared print server
+- `Invoke-GuidedRecovery`: repairs only the failing validation layers (driver, queue, spooler, share, firewall, network discovery, IPP, SMB, client access) without repeating successful steps
+- `Get-DeploymentHealth` / `Get-ZeroTouchDashboard`: color-coded health score and live system status across printer, driver, share, firewall, IPP, SMB, network, and services
+- `Get-ClientConnectionInfo`: per-OS connection strings (Windows SMB, macOS, Android/Mopria, Linux CUPS) with prerequisites and QR payloads
+- Per-deployment transaction log: separate Operation, Change, Repair, Validation, and Rollback logs under `$env:TEMP\PrinterToolkit_ZeroTouch`
+- `Test-DriverSignature`: validates driver digital signature, signer, and status via `Get-AuthenticodeSignature`
+- Dashboard menu entry `[Z] Zero-Touch Deployment`
+
+### Changed
+- Version unified to 7.0.0 across all source files (manifest, loader, installer, utilities, rollback, docs, tests)
+- New ZeroTouch module added to manifest `NestedModules` and `FunctionsToExport`
+
+## [6.0.0] - 2026-07-14
+
+### Added
+- Complete transformation from Printer Repair Toolkit to Automated Windows Print Server Deployment Platform
+- **Print Server Wizard** (`SetupWizard`): 11-step guided wizard — USB detection → driver install → Windows features → registry → firewall → network → sharing → IPP → SMB → validation → test page + connection info
+- **Validation Dashboard** (`Validation`): End-to-end PASS/FAIL dashboard checking printer, driver, queue, port, spooler, services, registry, firewall, sharing, SMB, IPP, network, Android compatibility, and test page
+- **Detection Engine** (`Detection`): USB printer detection with VID, PID, Hardware IDs, Compatible IDs, manufacturer, model, and connection protocol
+- **Configuration Intelligence Engine** (`Configuration`): Windows Features, Services, Registry, and Firewall inspection with expected-vs-actual comparison
+- **Driver Intelligence Engine** (`Drivers`): Full driver detection — VID/PID, Hardware IDs, Compatible IDs, manufacturer, model, driver store package, driver version, Type 3/4, architecture, WHQL status, signature verification
+- **Automatic Repair Engine** (`Repair`): Complete repair cycle — Issue → Root Cause → Backup → Repair → Validate → Success or Rollback. Never leaves partial repairs
+- **Rollback Engine** (`Rollback`): Full configuration rollback — registry, services, printers, and network restore points with one-command restore
+- **Networking Module** (`Networking`): Network profile management, firewall rule management, IPP/WSD/File & Printer Sharing rule configuration
+- **SMB Configuration Module** (`SMB`): SMB 1.0/2/3 protocol configuration, SMB server settings, printer share enumeration
+- **Client Connectivity** (`Android`): Connection strings for Windows (`\\ComputerName\Share`), SMB, IPP (`ipp://hostname/printers/Printer`), HTTP (`http://hostname:631/printers/Printer`), with QR code content generation
+- **Get-ConnectionInfo**: Generates structured connection information for all shared printers
+- **New-ConnectionQRCode**: Generates IPP URL, Setup Guide, and Troubleshooting Guide QR code content
+- **Markdown report format** in `New-PrinterReport -Format Markdown`
+- 18 specialized submodules (up from 11)
+- 66+ exported functions (up from 55)
+
+### Changed
+- Version unified to 6.0.0 across all source files
+- Module manifest updated with new module paths and v6.0 description
+- Root module (`PrinterToolkit.psm1`) restructured menu with Print Server Wizard, Validation Dashboard, Connection Info sections
+- Repair module rewritten with `Invoke-RepairCycle` for atomic issue→rootcause→backup→repair→validate→rollback
+- Reporting module enhanced with Markdown format and validation dashboard integration
+- Driver module enhanced with `Get-DriverIntelligence` for comprehensive driver detection
+- Android module enhanced with `Get-ConnectionInfo` and `New-ConnectionQRCode`
+- Bundle module enhanced with validation dashboard collection
+- Logging module enhanced with component tracking
+- Core module enhanced with `Get-PrinterWmiDetail`
+- Test suite expanded to cover all 18 modules and 66+ functions
+- README completely rewritten for v6.0 print server platform focus
+
 ## [5.0.2] - 2026-07-14
 
 ### Fixed

CI/build.ps1

@@ -1,6 +1,6 @@
 <#
 .SYNOPSIS
-    CI build script for PrinterToolkit v5.0.1.
+    CI build script for PrinterToolkit.
 
 .DESCRIPTION
     Runs linting, Pester tests, module analysis, and packaging.
@@ -32,6 +32,16 @@ param(
 $ModuleRoot = Split-Path -Parent $PSScriptRoot
 $Timestamp = Get-Date -Format 'yyyyMMdd_HHmmss'
 
+$buildFailed = $false
+$toolkitVersion = '8.2.0'
+$manifestPath = Join-Path -Path $ModuleRoot -ChildPath 'PrinterToolkit.psd1'
+if (Test-Path -Path $manifestPath) {
+    $manifestData = Import-PowerShellDataFile -Path $manifestPath -ErrorAction SilentlyContinue
+    if ($manifestData -and $manifestData.ModuleVersion) {
+        $toolkitVersion = $manifestData.ModuleVersion.ToString()
+    }
+}
+
 function Write-Step {
     param([string]$Message, [string]$Status = 'INFO')
     $color = switch ($Status) {
@@ -42,17 +52,20 @@ function Write-Step {
 }
 
 Write-Host '========================================' -ForegroundColor Cyan
-Write-Host '  PrinterToolkit v5.0.1 Build Script' -ForegroundColor White
+Write-Host "  PrinterToolkit v$toolkitVersion Build Script" -ForegroundColor White
 Write-Host '  Configuration: ' -NoNewline; Write-Host $Configuration -ForegroundColor Yellow
 Write-Host '========================================' -ForegroundColor Cyan
 Write-Host ''
 
 # Step 1: Validate module structure
 Write-Step 'Validating module structure...'
 $expectedDirs = @(
-    'Modules\Core', 'Modules\IPP', 'Modules\Logging', 'Modules\Utilities',
-    'Modules\Android', 'Modules\Diagnostics', 'Modules\Repair',
-    'Modules\Drivers', 'Modules\Sharing', 'Modules\Reporting', 'Modules\Bundle'
+    'Modules\Core', 'Modules\Detection', 'Modules\Configuration', 'Modules\Drivers',
+    'Modules\Networking', 'Modules\IPP', 'Modules\SMB', 'Modules\Sharing',
+    'Modules\Android', 'Modules\Diagnostics', 'Modules\Repair', 'Modules\Rollback',
+    'Modules\Validation', 'Modules\SetupWizard', 'Modules\Reporting', 'Modules\Logging',
+    'Modules\Utilities', 'Modules\Bundle', 'Modules\ZeroTouch', 'Modules\Orchestration',
+    'Modules\Providers'
 )
 $missingDirs = @()
 foreach ($dir in $expectedDirs) {
@@ -61,6 +74,7 @@ foreach ($dir in $expectedDirs) {
 }
 if ($missingDirs.Count -gt 0) {
     Write-Step "Missing directories: $($missingDirs -join ', ')" 'FAIL'
+    $buildFailed = $true
 } else {
     Write-Step 'All module directories present' 'OK'
 }
@@ -74,6 +88,7 @@ foreach ($f in $expectedFiles) {
 }
 if ($missingFiles.Count -gt 0) {
     Write-Step "Missing files: $($missingFiles -join ', ')" 'FAIL'
+    $buildFailed = $true
 } else {
     Write-Step 'Core module files present' 'OK'
 }
@@ -91,7 +106,6 @@ foreach ($script in $allScripts) {
         $syntaxErrors += $script.Name
     }
 }
-$buildFailed = $false
 if ($syntaxErrors.Count -gt 0) {
     Write-Step "Syntax errors in: $($syntaxErrors -join ', ')" 'FAIL'
     $buildFailed = $true
@@ -153,7 +167,7 @@ try {
 
 # Step 6: Package
 if (-not $OutputDir) {
-    $OutputDir = Join-Path -Path $ModuleRoot -ChildPath "artifacts\PrinterToolkit_v5.0.1_$Timestamp"
+    $OutputDir = Join-Path -Path $ModuleRoot -ChildPath "artifacts\PrinterToolkit_v$toolkitVersion_$Timestamp"
 }
 $null = New-Item -ItemType Directory -Force -Path $OutputDir
 
@@ -173,7 +187,7 @@ try {
 
     # Generate manifest
     $buildManifest = @{
-        Version       = '5.0.1'
+        Version       = $toolkitVersion
         BuildDate     = (Get-Date -Format 'yyyy-MM-dd HH:mm:ss')
         Configuration = $Configuration
         TotalScripts  = $allScripts.Count

CI/package.ps1

@@ -1,6 +1,6 @@
 <#
 .SYNOPSIS
-    Release packaging script for PrinterToolkit v5.0.1.
+    Release packaging script for PrinterToolkit.
 
 .DESCRIPTION
     Creates a clean release ZIP archive from the built artifacts,
@@ -10,21 +10,21 @@
     Path to the build output (from build.ps1).
 
 .PARAMETER Version
-    Version string for the release. Default: 5.0.1.
+    Version string for the release. Default: from manifest.
 
 .PARAMETER OutputDir
     Where to place the final release ZIP.
 
 .EXAMPLE
-    .\CI\package.ps1 -ArtifactPath .\artifacts\PrinterToolkit_v5.0.1_20260714 -Version 5.0.1
+    .\CI\package.ps1 -ArtifactPath .\artifacts\PrinterToolkit_v8.2.0_20260714 -Version 8.2.0
 #>
 
 [CmdletBinding()]
 param(
     [Parameter(Mandatory = $true)]
     [ValidateScript({ Test-Path $_ })]
     [string]$ArtifactPath,
-    [string]$Version = '5.0.1',
+    [string]$Version = '8.2.0',
     [string]$OutputDir
 )
 
@@ -72,28 +72,19 @@ $releaseNotes = @"
 Enterprise Windows printer troubleshooting and management toolkit.
 
 ## What's New
-- Production-quality error handling with structured result objects
-- Comprehensive logging framework (file, console, rotating)
-- Type 4 driver detection and migration recommendations
-- IPP class driver detection
-- Android Mopria compatibility analysis
-- Spooler integrity validation (files, registry, services)
-- WSD printer discovery
-- SMB 1.0/2.0/3.0 protocol detection
-- 8-step automatic share repair with backup/rollback
-- Professional HTML/JSON/CSV reporting with compliance checks
-- Diagnostic bundle (ZIP archive of all system data)
-- Driver export/restore with INF extraction
-- Share permission management
-- Transport switching: SMB, IPP, WSD
+- v8.2.0-rc1: Dependency-aware DAG orchestration engine with event bus, state manager, transaction log, and recovery
+- v8.1: Native Windows Integration Layer (NetSecurity, CIM, DISM — no netsh/rundll32/pnputil)
+- v8.0: Declarative task model with retry/timeout/elevation; configuration providers (Service, Firewall, Network, Sharing, IPP, Registry, Driver, Printer)
+- v7.0: Zero-Touch one-click deployment with transaction logging and guided recovery
+- v6.0: Print Server Platform with USB detection, driver intelligence, sharing, IPP, SMB, validation, rollback, QR codes
 
 ## Files
 | File | Description |
 |------|-------------|
 | PrinterToolkit.psd1 | Module manifest |
 | PrinterToolkit.psm1 | Root module |
 | launcher.ps1 | Standalone entry point |
-| Modules/ | 11 submodules |
+| Modules/ | 21 submodules |
 
 ## Installation
 Import the module or run launcher.ps1.

Certification/01-VALIDATION_GUIDE.md

@@ -0,0 +1,66 @@
+# PrinterToolkit v8.2.0-rc1 — External QA Validation Guide
+
+## Purpose
+
+This guide provides third-party testers with the instructions and context
+needed to independently validate PrinterToolkit on a Windows host. The
+release is a **Release Candidate** — runtime evidence has not been
+collected on any Windows target. Static certification is complete.
+
+## Scope
+
+- **Target OS:** Windows 10 22H2, Windows 11 23H2, Windows 11 24H2
+- **PowerShell:** 5.1 (built-in), 7.x (any 7.x)
+- **Printer types:** USB (real), Network (real), None (validation-only)
+- **Validation phases:** Module import, provider certification, runtime
+  validation, failure injection, performance benchmarks
+
+## Prerequisites
+
+1. A Windows machine matching one of the target OS versions.
+2. PowerShell 5.1+ (7.x recommended for richer output).
+3. Administrator access.
+4. Pester module installed (`Install-Module Pester -Force -Scope CurrentUser`).
+5. (Optional) A USB printer and/or network printer for end-to-end tests.
+6. (Optional) A second LAN client to verify connectivity.
+
+## Getting Started
+
+```powershell
+# 1. Clone or extract the repository
+cd PrinterToolkit
+
+# 2. Run the certification harness (elevated)
+.\Start-Certification.ps1
+```
+
+The harness will:
+- Verify prerequisites
+- Execute all validation scripts in sequence
+- Collect evidence into a timestamped directory
+- Generate HTML/MD/JSON summary reports
+- Package everything into a ZIP archive
+
+## What is Tested
+
+| Phase | Script | What it validates |
+|-------|--------|-------------------|
+| 1 | `Tests\PrinterToolkit.Tests.ps1` | Module loading, exported functions, parameter contracts |
+| 2 | `Tests\v8.2.ProviderCert.Tests.ps1` | All 8 configuration providers (Service, Firewall, Network, Sharing, IPP, Registry, Driver, Printer) |
+| 3 | `Tests\v8.2.RuntimeValidation.ps1` | Module import, diagnostics, validation, reporting, sharing, IPP, SMB, client connectivity |
+| 4 | `Tests\v8.2.FailureInjection.ps1` | Recovery from: missing printer, firewall blocked, spooler stopped, driver issues, network problems |
+| 5 | `Tests\v8.2.Benchmark.ps1` | Import time, validation, diagnostics, reporting, orchestration, zero-touch (5 iterations) |
+
+## What is NOT Tested (Out of Scope)
+
+- Cross-platform (non-Windows) execution
+- Android ADB connectivity (requires physical device)
+- Print server clustering / load balancing
+- Active Directory integration
+- Direct TCP/IP port printing
+- Third-party driver signing authorities
+- ARM64 Windows
+
+## Reporting Issues
+
+Use the template in `Certification/06-ISSUE_REPORTING_TEMPLATE.md`.

Certification/02-TEST_PLAN.md

@@ -0,0 +1,78 @@
+# PrinterToolkit v8.2.0-rc1 — Master Test Plan
+
+## Configuration Matrix
+
+| ID | OS | PowerShell | Printer | Environment |
+|----|----|-----------|---------|-------------|
+| C1 | Windows 10 22H2 | 5.1 | None | VM or bare metal |
+| C2 | Windows 10 22H2 | 7.x | None | VM or bare metal |
+| C3 | Windows 11 23H2 | 5.1 | None | VM or bare metal |
+| C4 | Windows 11 23H2 | 7.x | None | VM or bare metal |
+| C5 | Windows 11 24H2 | 5.1 | None | VM or bare metal |
+| C6 | Windows 11 24H2 | 7.x | None | VM or bare metal |
+| C7 | Windows 11 24H2 | 7.x | USB printer | Physical machine |
+| C8 | Windows 11 24H2 | 7.x | Network printer | Physical machine |
+
+## Test Phases
+
+### Phase 1 — Module Import & Sanity
+
+| Test | Expected | Evidence |
+|------|----------|----------|
+| Module imports without errors | `Get-Module` shows PrinterToolkit | Transcript |
+| All 21 submodules load | `Get-ToolkitStatus` reports 21 modules | JSON |
+| Version matches 8.2.0 | `(Get-Module PrinterToolkit).Version` = 8.2.0 | JSON |
+| All exported functions present | 81+ functions available | Pester XML |
+
+### Phase 2 — Provider Certification
+
+| Test | Expected | Evidence |
+|------|----------|----------|
+| Service provider — all 6 phases | GetCurrent, GetDesired, Plan, Apply, Validate, Rollback all succeed | Pester XML |
+| Firewall provider — all 6 phases | Same | Pester XML |
+| Network provider — all 6 phases | Same | Pester XML |
+| Sharing provider — all 6 phases | Same | Pester XML |
+| IPP provider — all 6 phases | Same | Pester XML |
+| Registry provider — all 6 phases | Same | Pester XML |
+| Driver provider — all 6 phases | Same | Pester XML |
+| Printer provider — all 6 phases | Same | Pester XML |
+
+### Phase 3 — Runtime Validation
+
+| Test | Expected | Evidence |
+|------|----------|----------|
+| Diagnostics run without errors | `Get-NetworkValidation` completes | JSON |
+| Validation dashboard renders | `Invoke-EndToEndValidation` returns checks | JSON |
+| Report generation (HTML/JSON/MD) | Files created | File listing |
+| Connection info returns data | `Get-ConnectionInfo` has entries | JSON |
+| SMB configuration queryable | `Get-SmbConfiguration` succeeds | JSON |
+
+### Phase 4 — Failure Injection
+
+| Scenario | Injection | Expected Recovery |
+|----------|-----------|-------------------|
+| Missing printer | Remove printer device | Graceful failure + report |
+| Firewall blocked | Disable print sharing rules | Repair re-enables |
+| Spooler stopped | Stop-Service Spooler | Recovery restarts |
+| Driver issues | Remove printer driver | Detection reports missing |
+| Network problems | Set profile to Public | Detection + recommendation |
+
+### Phase 5 — Performance Benchmarks
+
+| Metric | Target | Measurement |
+|--------|--------|-------------|
+| Module import time | < 5s | Average of 5 runs |
+| Validation run | < 30s | Average of 5 runs |
+| Diagnostics | < 15s | Average of 5 runs |
+| Reporting | < 10s | Average of 5 runs |
+| Orchestration | < 45s | Average of 5 runs |
+| Zero-touch deployment | < 120s | Average of 5 runs |
+
+## Exit Criteria
+
+- [ ] All 6 OS×PS configurations pass Phase 1 (0 import errors)
+- [ ] All 8 providers pass Phase 2 (0 Pester failures)
+- [ ] Phase 3 completes on at least 2 configurations
+- [ ] Phase 4 scenarios pass on at least 1 configuration
+- [ ] Phase 5 benchmarks collected on at least 1 configuration
+- [ ] No Critical or High severity defects remain open