SiteKings Legacy Windows First-Iteration Lab Kit

Use this kit only on Windows 7 SP1 and Windows Server 2008 R2 SP1 lab endpoints.

Transfer verification:
1. Keep legacy-windows-lab-kit.zip, legacy-windows-lab-kit.zip.sha256, legacy-windows-lab-kit-verify.py, and legacy-windows-lab-kit-verify.py.sha256 together.
2. All checksum sidecars must contain exactly two tokens: <sha256> <artifact-filename>.
3. Missing filenames, filename mismatches, or extra tokens are not valid retained evidence.
4. Verify the ZIP hash before extraction.
5. If Python is available on the receiving machine, keep legacy-windows-lab-kit-verify.py and legacy-windows-lab-kit-verify.py.sha256 beside the ZIP and run: python legacy-windows-lab-kit-verify.py --kit legacy-windows-lab-kit.zip --require-verifier-sidecar
6. Otherwise on Windows 7, run: certutil -hashfile legacy-windows-lab-kit.zip SHA256
7. Compare the SHA256 output with legacy-windows-lab-kit.zip.sha256 before extraction.

Endpoint evidence capture:
1. Extract the ZIP on the lab endpoint.
2. Open an elevated PowerShell prompt from the extracted folder.
3. Run: powershell.exe -NoProfile -ExecutionPolicy Bypass -File payload\client\legacy-windows-lab-run.ps1 -ExercisePeerRecover -ExerciseSelfRescue -ApiKey <test-org-key>
4. Confirm operator-context.json exists; it must prove the runner used an elevated PowerShell session.
5. Confirm operator-context.json computer_name must match the retained bundle hostname.
6. Confirm legacy-windows-lab-smoke.json reports process:sk-agent-legacy, process:sk-tray, watchdog.log, peer_recover, self_rescue, and os_kind.
7. Confirm legacy-windows-lab-smoke.json and legacy-windows-lab-collector-manifest.json os_kind values must match: windows_7_sp1 for Windows 7 SP1, or server_2008_r2 for Windows Server 2008 R2 SP1.
8. Confirm legacy-windows-lab-collector-manifest.json build_manifest_sha256 must match the retained build manifest.
9. Confirm legacy-windows-lab-collector-manifest.json reports collector_exit: 0 and smoke_exit: 0.
10. Copy the entire legacy-windows-lab-evidence-* folder back to Mac-Studio 10.0.10.41.

Mac-Studio retained evidence finalization:
1. Copy both the Windows 7 SP1 folder and the Windows Server 2008 R2 SP1 folder to Mac-Studio.
2. From the release root, run:
   scripts/legacy-windows-first-iteration-finalize.py --win7-collect-root <win7-folder> --server-2008-r2-collect-root <server-2008-r2-folder> --build-manifest bin/legacy-windows-first-iteration-build-manifest.json --output-dir retained-legacy-windows-evidence --require-mac-studio
3. Retain both ZIPs plus legacy-windows-first-iteration-final-summary.json, legacy-windows-first-iteration-final-summary.json.sha256, legacy-windows-first-iteration-pilot-checklist.json, and legacy-windows-first-iteration-pilot-checklist.json.sha256.
4. Runbook reminder: verify the final summary and pilot checklist hash sidecars before customer pilot approval.
5. After customer approval is recorded, run scripts\legacy-windows-first-iteration-pilot-approval.py to write legacy-windows-first-iteration-pilot-approval.json and legacy-windows-first-iteration-pilot-approval.json.sha256.
6. Before touching the doctor-office endpoint, run scripts\legacy-windows-first-iteration-pilot-readiness.py --approval retained-legacy-windows-evidence\legacy-windows-first-iteration-pilot-approval.json.

Windows 10 bridge:
Run the Windows 10 bridge only on a sacrificial Windows 7 SP1 machine after backup, rollback, vendor software, and clinical equipment approvals are recorded.
The bridge form/command must include non-empty evidence notes for backup evidence, rollback plan, vendor software review, and clinical equipment review.
Retain win10_upgrade.log and confirm it contains Operator acknowledgements recorded and Operator evidence notes recorded.
Do not run the Windows 10 bridge on Windows Server 2008 R2 SP1 for this first iteration.
