StorVaultOS DoorKing Urbana protocol 3 - transparent review package

This ZIP does not auto-run. Extract it before review.

EXISTING DESKTOP-TASK INSTALLATION (Urbana's current configuration)
- Do not use install.ps1, the service updaters, or the desktop-host conversion.
- Verify-TransparentPackage.ps1 checks the complete nested runtime inventory.
- Have the existing task owner put Helper into maintenance and wait for a fresh
  maintenance status, with no controller operation or unresolved updatedk CSV.
- Run Update-Protocol3DesktopRuntime.ps1 as that same task owner/elevated user.
  Without switches it performs preflight only and makes no runtime/task changes.
- After reviewing that result, -ConfirmDesktopRuntimeUpdate updates all runtime
  files together, including both hosts and dependencies. It keeps the existing
  task identity, action, triggers and settings; it does not convert hosts.
- The service stays stopped/disabled. Enrollment, provider configuration,
  command history, unresolved results and DoorKing data are not rewritten.
- The updater verifies an offline synthetic test before and after replacement,
  exact hashes and old ACLs, then fresh zero-operation maintenance readiness.
- Rollback restores replaced files and removes only newly introduced files.
  On failure the runtime remains stopped/locked for review. No auto-retry or
  automatic gate-write unlock is performed. Keep the protected rollback folder.
- Test the actual Urbana task lifecycle under maintenance before approving any
  new gate send. Offline package tests do not prove controller acceptance.

The procedures below are for FRESH or WINDOWS-SERVICE installations only.

1. Run Verify-TransparentPackage.ps1. It only reads files and checks SHA-256.
2. Review install.ps1 and source/HelperService.cs before approving installation.
3. Confirm profile.txt says Urbana.
   The package accepts only facility 3, gate system 2, and ACCT0000.
4. Keep the verified protocol-2 rollback backup.
5. If a protected migration handoff does not already exist, run the included
   New-EnrollmentHandoff.ps1 as administrator with a new directory under
   C:\ProgramData\StorVaultOS. It creates a machine-protected private key and a
   public-key.json file; it does not request or store an enrollment code.
6. For an existing Urbana protocol-2 helper, use Upgrade-Protocol2To3.ps1 with
   the protected enrollment-handoff directory. It creates another hashed local
   rollback copy before stopping anything and restores protocol 2 on failure.
7. For an already installed Urbana protocol-3 helper, use
   Update-Protocol3Readback.ps1. It verifies and updates the service host,
   readback, command worker, provider protocol, and evidence waiter; preserves
   their hashes and the exact prior ACLs in a new rollback; refuses any pending
   updatedk file; and restores every changed file and ACL on failure. Stop the
   StorVaultOSGateHelper service and confirm its provider worker has exited
   before running the updater; the updater refuses a running service.
8. While the helper is command-locked, use
   Update-Protocol3CommandVerification.ps1 to install the reviewed rule that
   requires fresh transaction evidence and a matching resident readback before
   any command is confirmed. It atomically installs the command worker,
   provider protocol, and evidence reader as one hash- and ACL-verified set.
   If one UNKNOWN import is stranded, -AllowPreservedUnknownImport records and
   preserves it byte-for-byte while the runtime is updated and remains locked.
9. Quarantine-Protocol3UnknownImport.ps1 is a separate, explicit recovery for
   exactly one stranded UNKNOWN ADD. It requires an empty local readback, moves
   the exact file atomically into a SYSTEM/Administrators-only rollback directory
   on the same drive, protects it immediately, and never contacts
   DoorKing or changes the hosted command. The original ACL is retained only as
   protected rollback metadata. The command remains UNKNOWN; an
   unchanged empty local file is not described as proof that the code is absent.
10. Activate-Protocol3Writes.ps1 is the separate, explicit normal-write
   activation. Never run it until the owner has reviewed a current empty
   readback and the exact queued work.
11. Resume-Protocol3Writes.ps1 is only for the first-command UNKNOWN recovery
   after Quarantine-Protocol3UnknownImport.ps1 has succeeded. First authorize
   continuation of that exact held run in the signed-in StorVaultOS Owner UI;
   the server will not lease the remaining commands before that durable review.
   Then run the resume script as administrator with the exact protected
   quarantine directory, its separately reviewed held-file SHA-256, and
   -ConfirmReviewedContinuation. It requires the already-activated operation
   list, current empty readback, no pending imports, closed DoorKing programs,
   current Urbana cloud binding, and unchanged protected quarantine evidence.
   It removes only the maintenance lock and never retries or resolves the UNKNOWN
   command. Any failure restores the verified lock and running helper.

Important:
- Verification does not stop or replace the existing helper.
- Only public-key.json may leave the handoff computer. private-key.dpapi must
  remain in its protected local directory and must never be displayed or copied.
- An older status.json is diagnostic only and may omit newer fields. Do not
  reject this update solely because that stopped helper's old status schema is
  incomplete. Update-Protocol3Readback.ps1 verifies the protected live binding
  first, then requires a fresh post-start status with every safety field.
- install.ps1 remains fresh-install-only. Existing Urbana installations must
  use Upgrade-Protocol2To3.ps1; do not manually delete the existing helper.
- DoorKing writes remain disabled until Urbana readback, facility isolation,
  rollback, and provider evidence checks pass.
- The updater grants the StorVaultOSGateHelper service SID directory-only file
  creation/read access plus Modify on seven named DoorKing evidence files and
  the Urbana ACCT0000 operational-data directory. It does not grant inherited
  Modify access to DoorKing32.exe or other program files. Every prior ACL is
  rollback-protected, and the service-context probe opens the resident and log
  files for write access without changing their contents.
- Fresh installation, migration, and update leave
  C:\ProgramData\StorVaultOS\GateHelper\command-polling.lock in place after
  readiness succeeds. Readback continues, but no command can be leased until
  an administrator explicitly removes that lock for a separately reviewed
  Urbana acceptance test.
- A failed update remains command-locked and stopped. It never restarts an old
  helper automatically; recovery and unlocking require a separate review.
- Never add a Defender exclusion or bypass a malware warning for this package.
