refactor(§7.5): rinomina Setup-* Install-CIToolchain-* (WinBuild2025/2022/Linux2404)

- template/Setup-WinBuild2025.ps1 Install-CIToolchain-WinBuild2025.ps1 - template/Setup-WinBuild2022.ps1 Install-CIToolchain-WinBuild2022.ps1 - template/Setup-LinuxBuild2404.sh Install-CIToolchain-Linux2404.sh Aggiornati tutti i riferimenti in: Prepare-WinBuild2025/2022, Prepare-LinuxBuild2404, Deploy-WinBuild2025/2022/LinuxBuild2404, Validate-DeployState, Validate-SetupState, README.md, TODO.md, docs/WINDOWS-TEMPLATE-SETUP.md, docs/LINUX-TEMPLATE-SETUP.md, docs/TEST-PLAN-v1.3-to-HEAD.md, gitea/actions/local-ci-build/action.yml. §7 chiuso (5/5 done).
2026-05-11 22:48:33 +02:00
parent 6511d47a9a
commit 4758fbc519
17 changed files with 158 additions and 134 deletions
@@ -1,4 +1,4 @@
-# Local CI/CD System
+# Local CI/CD System

 Sistema CI/CD self-hosted su Windows per build isolati in VM efimere VMware.

@@ -87,10 +87,10 @@ Variante **Windows Server 2022**: usare i corrispettivi `*WinBuild2022.ps1` e VM
 │   ├── autounattend.template.xml  # Template XML per installazione Windows unattended
 │   ├── Deploy-WinBuild2025.ps1   # Deploy VM + install Windows 2025 unattended (HOST)
 │   ├── Prepare-WinBuild2025.ps1  # Provisioning toolchain 2025 via WinRM (HOST-side)
-│   ├── Setup-WinBuild2025.ps1    # Toolchain CI 2025 nella VM (GUEST-side)
+│   ├── Install-CIToolchain-WinBuild2025.ps1    # Toolchain CI 2025 nella VM (GUEST-side)
 │   ├── Deploy-WinBuild2022.ps1   # Deploy VM + install Windows 2022 unattended (HOST)
 │   ├── Prepare-WinBuild2022.ps1  # Provisioning toolchain 2022 via WinRM (HOST-side)
-│   ├── Setup-WinBuild2022.ps1    # Toolchain CI 2022 nella VM (GUEST-side)
+│   ├── Install-CIToolchain-WinBuild2022.ps1    # Toolchain CI 2022 nella VM (GUEST-side)
 │   ├── Validate-DeployState.ps1  # Validazione stato post-Deploy (2025 e 2022)
 │   └── Validate-SetupState.ps1   # Validazione stato post-Setup (pre-snapshot)
 │
@@ -242,3 +242,4 @@ WinRM usa **HTTPS/5986** con certificato self-signed e Basic auth.
 Per ambienti condivisi o di produzione, usare un certificato CA valida e rimuovere `-SkipCACheck`.
 Vedi [docs/BEST-PRACTICES.md](docs/BEST-PRACTICES.md).

+
@@ -1,16 +1,17 @@
-# TODO — Local CI/CD System
+# TODO — Local CI/CD System

-<!-- Last updated: 2026-05-11 — Sprint 14: §6.4+§6.5 DONE (build-nsis.yml matrix windows+linux via composite action; ExtraGuestEnv chain Invoke-CIJob→Invoke-RemoteBuild, Windows session inject + Linux export prefix) -->
+<!-- Last updated: 2026-05-11 — Sprint 15: §7.5 DONE (Rinomina Setup-* → Install-CIToolchain-*: WinBuild2025/2022/Linux2404; tutti i riferimenti aggiornati in Prepare/Deploy/docs/README/TODO/action.yml) -->
+<!-- Sprint 14: §6.4+§6.5 DONE (build-nsis.yml matrix windows+linux via composite action; ExtraGuestEnv chain Invoke-CIJob→Invoke-RemoteBuild, Windows session inject + Linux export prefix) -->
 <!-- Sprint 13: §6.2 Composite Action DONE (gitea/actions/local-ci-build/action.yml — inputs: build-command/artifact-source/submodules/guest-os/use-git-clone) -->
 <!-- Sprint 12: §6.1 Linux Build VM DONE (Deploy/Prepare/Setup/Transport/e2e 4xPASS — nsis7z.dll 2272 KB parity Windows) -->
-<!-- Sprint 11: §6.6 Tier-2 Toolchain DONE (Pwsh7/NSIS/CMake/Node.js/WiX/gh CLI/Sysinternals/vcpkg — Step 12 in Setup-WinBuild2025) -->
+<!-- Sprint 11: §6.6 Tier-2 Toolchain DONE (Pwsh7/NSIS/CMake/Node.js/WiX/gh CLI/Sysinternals/vcpkg — Step 12 in Install-CIToolchain-WinBuild2025) -->

 > Documento unico di lavoro: roadmap, audit trail dei task completati, e backlog post-v1.0
 > con priorità e razionale. Le voci aperte sono raggruppate per area e marcate **P0..P3**:
 >
 > **Doc di setup operativi**:
 > - [docs/HOST-SETUP.md](docs/HOST-SETUP.md) — bootstrap macchina host (Setup-Host.ps1)
-> - [docs/WINDOWS-TEMPLATE-SETUP.md](docs/WINDOWS-TEMPLATE-SETUP.md) — provisioning template Windows (Deploy + Prepare + Setup-WinBuild2025)
+> - [docs/WINDOWS-TEMPLATE-SETUP.md](docs/WINDOWS-TEMPLATE-SETUP.md) — provisioning template Windows (Deploy + Prepare + Install-CIToolchain-WinBuild2025)
 > - [docs/LINUX-TEMPLATE-SETUP.md](docs/LINUX-TEMPLATE-SETUP.md) — provisioning template Linux Ubuntu 24.04 (implementato)
 >
 > - **P0** — sicurezza o affidabilità: affrontare prima di estendere il sistema
@@ -21,9 +22,9 @@
 ---
 ## Summary

-_Last updated: 2026-05-11 (post Sprint 14: §6.4+§6.5 DONE — build-nsis.yml matrix windows+linux, ExtraGuestEnv chain in Invoke-CIJob/Invoke-RemoteBuild, job-id-suffix/repo-url/extra-guest-env-json inputs in action.yml; post Sprint 13: §6.2 DONE)_
+_Last updated: 2026-05-11 (post Sprint 15: §7.5 DONE — Rinomina Setup-* → Install-CIToolchain-* (WinBuild2025/2022/Linux2404); post Sprint 14: §6.4+§6.5 DONE)_

-**Stato generale**: §1, §2, §4, §5 chiusi. §3 completo. §6 quasi chiuso: 6.1-6.2 DONE, 6.3 deferred, 6.4+6.5 DONE, 6.6 DONE. Prossimi: Test Plan validation con VM reali + §7.5 (optional).
+**Stato generale**: §1, §2, §4, §5, §7 chiusi. §3 completo. §6 chiuso: 6.1-6.2 DONE, 6.3 deferred, 6.4-6.6 DONE. Prossimi: Test Plan validation con VM reali.

 | Stato | Area                            | Done | Open | Note                                                               |
 | ----- | ------------------------------- | ---: | ---: | ------------------------------------------------------------------ |
@@ -38,7 +39,7 @@ _Last updated: 2026-05-11 (post Sprint 14: §6.4+§6.5 DONE — build-nsis.yml m
 | [x]   | §4 Osservabilità & manutenzione |    3 |    0 | 4.1/4.3/4.4 done (4.2 Prometheus, 4.5 Dashboard rimossi)           |
 | [x]   | §5 Qualità codice & test        |    5 |    0 | 5.1/5.2/5.3/5.4/5.5 done                                           |
 | [x]   | §6 Scalabilità & estensioni     |    5 |    0 | 6.1-6.2 done, 6.3 deferred (home lab), 6.4-6.5 done, 6.6 done      |
-| [ ]   | §7 Refactor Deploy ↔ Setup      |    4 |    1 | 7.1/7.2/7.3/7.4 done; 7.5 (rinomina) opzionale                     |
+| [x]   | §7 Refactor Deploy ↔ Setup      |    5 |    0 | 7.1-7.5 done; Setup-* → Install-CIToolchain-* (2026-05-11)          |
 | [x]   | In-VM Git Clone (§3.3)          |    4 |    0 | COMPLETATO 2026-05-10 — e2e PASS: 34s/25.7% vs baseline            |
 | [x]   | Linux Build VM (§6.1)           |    5 |    0 | Deploy/Prepare/Setup/Transport + doc + e2e PASS nsis7z.dll 2272 KB |

@@ -47,6 +48,7 @@ _Last updated: 2026-05-11 (post Sprint 14: §6.4+§6.5 DONE — build-nsis.yml m
 2. **Test Plan** — validazione con VM reali (§2.1 IP race, §3.1 shared cache, §3.6 benchmark, §4.1 JSONL) — prossima priorità
 3. **Security** — Rifiori se condizioni cambiano; vedi sezione "Deferred (Home Lab)"
 4. **§3.5** — vCPU/RAM tuning per workload (P2, deferred — home lab optimization)
+5. **Validate-SetupState.ps1** — update riferimento a `Install-CIToolchain-*` se compare il vecchio nome

 ---
 ## Setup & Infrastructure
@@ -119,13 +121,13 @@ _Last updated: 2026-05-11 (post Sprint 14: §6.4+§6.5 DONE — build-nsis.yml m
        ```
        Installa: WinRM config, utente `ci_build`, .NET SDK 10.0, VS Build Tools 2026, Python 3.13.3.
        Lo script esegue validazione automatica ad ogni passaggio (`Assert-Step`):
-        - Pre-flight: IP ottetti 0-255, TCP/5986 raggiungibile, Setup-WinBuild2025.ps1 presente
+        - Pre-flight: IP ottetti 0-255, TCP/5986 raggiungibile, Install-CIToolchain-WinBuild2025.ps1 presente
        - Host WinRM: AllowUnencrypted, TrustedHosts
        - Guest prep: `C:\CI` esiste, file copiato, size match
        - Post-setup remoto (9 check): WinRM, user+admin, UAC, firewall, .NET, Python, MSBuild, CI dirs
        Se qualsiasi check fallisce → script termina con errore → **non prendere lo snapshot**.
  - [x] Setup completato con successo (VS Build Tools 2026 exit code 0).
-  - [x] `Setup-WinBuild2025.ps1` ora esegue validazione `Assert-Step` dopo ogni step interno
+  - [x] `Install-CIToolchain-WinBuild2025.ps1` ora esegue validazione `Assert-Step` dopo ogni step interno
        (WinRM, Firewall, User, UAC, Dirs, Defender, .NET, Python, VS Build Tools, Toolchain,
        Cleanup, Final pre-snapshot gate) — throws se qualsiasi check fallisce (2026-05-09)

@@ -188,7 +190,7 @@ _Last updated: 2026-05-11 (post Sprint 14: §6.4+§6.5 DONE — build-nsis.yml m
 **Azioni**:
 - [x] Generare cert self-signed nel template *prima* dello snapshot (già in Deploy post-install.ps1).
 - [x] Sostituire `New-PSSession -ComputerName $ip` con `-UseSSL -Port 5986 -Authentication Basic` in `Invoke-RemoteBuild.ps1`, `Get-BuildArtifacts.ps1`, `Prepare-WinBuild2025.ps1`, `Validate-*.ps1`.
- [x] Rimuovere `AllowUnencrypted=true` da Deploy post-install.ps1 e Setup-WinBuild2025.ps1 (assertion → false).
+- [x] Rimuovere `AllowUnencrypted=true` da Deploy post-install.ps1 e Install-CIToolchain-WinBuild2025.ps1 (assertion → false).
 - [x] `-SkipCACheck`/`-SkipCNCheck`/`-SkipRevocationCheck` mantenuti nei `New-PSSessionOption` e `New-WSManSessionOption` (cert lab self-signed — documentato inline).
 - [x] Regola firewall `WinRM-HTTPS` in Deploy ristretta a `RemoteAddress '192.168.79.0/24'`.
 - [x] `Wait-VMReady.ps1` usa `New-WSManSessionOption` + `Test-WSMan -Port 5986 -UseSSL`.
@@ -530,8 +532,8 @@ Usage dal workflow:
    extra-guest-env-json: '{"SIGN_PASS":"${{ secrets.SIGN_PASS }}","CERT_THUMBPRINT":"${{ secrets.CERT_THUMBPRINT }}"}'
 ```

-### 6.6 [P2] [x] Toolchain Tier-1 + Tier-2 in Setup-WinBuild2025
-File: [template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1),
+### 6.6 [P2] [x] Toolchain Tier-1 + Tier-2 in Install-CIToolchain-WinBuild2025
+File: [template/Install-CIToolchain-WinBuild2025.ps1](template/Install-CIToolchain-WinBuild2025.ps1),
 [template/Prepare-WinBuild2025.ps1](template/Prepare-WinBuild2025.ps1).

 **Status**: COMPLETATO 2026-05-11 — Step 11 (Tier-1: Git + 7-Zip) + Step 12 (Tier-2: 8 tools) implementati.
@@ -598,7 +600,7 @@ OOBE telemetry, WU services disable — entrambi gli script li toccano.

 ### 7.1 [P1] [x] Spostare base OS hardening da Setup a Deploy
 File: [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1),
-[template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1).
+[template/Install-CIToolchain-WinBuild2025.ps1](template/Install-CIToolchain-WinBuild2025.ps1).

 - [x] Aggiungere `Set-NetFirewallProfile -Enabled False` (tutti i profili) in Deploy post-install.ps1
 - [x] Aggiungere `MaxMemoryPerShellMB=2048`, `IdleTimeOut=7200000`, `MaxProcessesPerShell=25`, `StartupType=Automatic` in Deploy dopo Enable-PSRemoting
@@ -613,7 +615,7 @@ File: [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1),

 ### 7.2 [P1] [x] WU lifecycle — strategia B (Deploy: GPO + Manual; Setup: lifecycle)
 File: [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1),
-[template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1).
+[template/Install-CIToolchain-WinBuild2025.ps1](template/Install-CIToolchain-WinBuild2025.ps1).

 Strategia B: Deploy lascia servizi WU `start=demand` (Manual, default Windows) e scrive solo
 GPO `NoAutoUpdate=1` + `DisableWindowsUpdateAccess=1`. Setup Step 6 clears i GPO locks (Step A),
@@ -629,7 +631,7 @@ avvia WU via SchTask SYSTEM, poi Step 6b disabilita servizi permanentemente post
 ### 7.3 [P2] [x] Update header docs di entrambi gli script

 - [x] [template/Deploy-WinBuild2025.ps1](template/Deploy-WinBuild2025.ps1) `.DESCRIPTION`: aggiornato con tutte le hardening voci (firewall, WinRM tuning, WU GPO strategy B, lock screen, SM, OOBE)
- [x] [template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1) `.DESCRIPTION`: Steps 1/3/4b/5b/5c marcati "validation-only — set by Deploy"; step ordering rationale aggiornato
+- [x] [template/Install-CIToolchain-WinBuild2025.ps1](template/Install-CIToolchain-WinBuild2025.ps1) `.DESCRIPTION`: Steps 1/3/4b/5b/5c marcati "validation-only — set by Deploy"; step ordering rationale aggiornato
 - [x] [docs/WINDOWS-TEMPLATE-SETUP.md](docs/WINDOWS-TEMPLATE-SETUP.md): architettura "tre script", VMX path `WinBuild2025.vmx`, Fase C step list + razionale + tabella validazioni aggiornati

 ### 7.4 [P2] [x] Test e2e refactor — COMPLETATO 2026-05-10
@@ -645,11 +647,16 @@ avvia WU via SchTask SYSTEM, poi Step 6b disabilita servizi permanentemente post
 - Deploy + Setup: autologin Administrator (`AutoAdminLogon=1`) aggiunto in post-install.ps1 e validato in Assert-Step 5c
 - Nuovi script: `template/Validate-DeployState.ps1`, `template/Validate-SetupState.ps1`

-### 7.5 [P3] [ ] Rinomina Setup → Setup-CITools (opzionale, futuro)
-Una volta che Setup fa solo build customization, nome `Setup-WinBuild2025` è impreciso —
-non setup-a la build VM, **estende** un template OS già pronto con toolchain CI.
-Rinominare in `Setup-CITools.ps1` o `Install-CIToolchain.ps1` rifletterebbe meglio la
-responsabilità ridotta. Tracciare in TODO post-7.1/7.2.
+### 7.5 [P3] [x] Rinomina Setup-* → Install-CIToolchain-* (2026-05-11)
+Rinominati i tre script guest-side:
+- `template/Setup-WinBuild2025.ps1` → `template/Install-CIToolchain-WinBuild2025.ps1`
+- `template/Setup-WinBuild2022.ps1` → `template/Install-CIToolchain-WinBuild2022.ps1`
+- `template/Setup-LinuxBuild2404.sh` → `template/Install-CIToolchain-Linux2404.sh`
+
+Tutti i riferimenti aggiornati in: Prepare-WinBuild2025/2022.ps1, Prepare-LinuxBuild2404.ps1,
+Deploy-WinBuild2025/2022.ps1, Deploy-LinuxBuild2404.ps1, README.md, TODO.md,
+docs/WINDOWS-TEMPLATE-SETUP.md, docs/LINUX-TEMPLATE-SETUP.md, docs/TEST-PLAN-v1.3-to-HEAD.md,
+gitea/actions/local-ci-build/action.yml.

 ---

@@ -672,7 +679,7 @@ VM avviata  →  WinRM: git clone --recurse-submodules https://<token>@gitea/...
 **Punti chiave:**
 - Il PAT **non deve essere nello snapshot** — viene iniettato a runtime come env var via WinRM
  (`git clone https://Simone:<pat>@gitea.emulab.it/<repo>.git`) e non viene mai persistito
- Git deve essere installato nel template (`Setup-WinBuild2025.ps1`) — ora è assente per design
+- Git deve essere installato nel template (`Install-CIToolchain-WinBuild2025.ps1`) — ora è assente per design
 - L'implementazione deve essere **non-breaking**: nuovo switch opt-in `-UseGitClone` in `Invoke-CIJob.ps1`
 - Si perde il parallelismo parziale (clone host avviene mentre VM boota), ma si elimina
  tutto l'overhead di zip/transfer (rilevante su repo grandi o con molti submoduli)
@@ -682,7 +689,7 @@ VM avviata  →  WinRM: git clone --recurse-submodules https://<token>@gitea/...

 - [x] **Tool prerequisiti nel template** — implementati in §6.6 (Tier-1 Toolchain):
  - Git for Windows + 7-Zip + gh CLI installati con hash pinning e `Assert-Step`
-  - Rimuovere il commento "Git is NOT installed" dal docblock di Setup-WinBuild2025.ps1
+  - Rimuovere il commento "Git is NOT installed" dal docblock di Install-CIToolchain-WinBuild2025.ps1
    una volta applicato §6.6
  - curl.exe: già presente in Windows Server 2025 — verificare con `where.exe curl`

@@ -721,7 +728,7 @@ Supporto build su Linux aggiunto con le seguenti fasi completate:

 - [x] **Template VM Linux** — script di provisioning per Ubuntu Server 24.04 LTS
  - [x] `template/Deploy-LinuxBuild2404.ps1` — crea VM da cloud VMDK, cloud-init, SSH wait
-  - [x] `template/Setup-LinuxBuild2404.sh` — installa toolchain CI (GCC, Clang, CMake, Python 3, git, 7z), hardening SSH, swap off, timer apt off
+  - [x] `template/Install-CIToolchain-Linux2404.sh` — installa toolchain CI (GCC, Clang, CMake, Python 3, git, 7z), hardening SSH, swap off, timer apt off
  - [x] `template/Prepare-LinuxBuild2404.ps1` — SCP script, esegue via SSH, valida, snapshot `BaseClean-Linux`

 - [x] **Invoke-CIJob.ps1 — branch Linux**
@@ -762,7 +769,7 @@ per `192.168.79.*` instead of `*`. Attualmente impostato a `*` durante setup tem
 **Rifiori se**: Host esposto a LAN / internet.

 ### 1.3 [P0] [ ] Pinning hash SHA256 degli installer
-File: [template/Setup-WinBuild2025.ps1](template/Setup-WinBuild2025.ps1).
+File: [template/Install-CIToolchain-WinBuild2025.ps1](template/Install-CIToolchain-WinBuild2025.ps1).

 SHA256 hash per dotnet-install.ps1, Python installer, vs_buildtools.exe.

@@ -850,3 +857,4 @@ alla successiva.
 | Build VM subnet           | `192.168.79.0/24` (VMnet8 — NAT, internet access per build)  |
 | Credential Manager target | `BuildVMGuest`                                               |
 | Guest username            | `ci_build` — configurato e verificato                        |
+
@@ -11,7 +11,7 @@
 | ------------------------------------- | ---------------- | --------------------------------------------------------------------------- |
 | `template/Deploy-LinuxBuild2404.ps1`  | **Host** (PS)    | Crea VM da cloud image VMDK, genera seed ISO cloud-init, avvia, aspetta SSH |
 | `template/Prepare-LinuxBuild2404.ps1` | **Host** (PS)    | Copia + esegue setup via SSH, valida stato, prende snapshot                 |
-| `template/Setup-LinuxBuild2404.sh`    | **Guest** (Bash) | Installa toolchain CI, dirs, hardening, gate finale                         |
+| `template/Install-CIToolchain-Linux2404.sh`    | **Guest** (Bash) | Installa toolchain CI, dirs, hardening, gate finale                         |
 | `scripts/_Transport.psm1`             | **Host** (PS)    | Funzioni SSH-only per il branch Linux (WinRM esistente invariato per ora)   |

 Perche tre script separati (non tutto-in-uno): cloud-init copre solo il bootstrap OS
@@ -107,7 +107,7 @@ Non richiede installazione OS  parte dal cloud VMDK pre-built.
      `ssh_authorized_keys` con contenuto di `ci_linux.pub`
    - Nessun `packages`, nessun `package_update`, nessun `runcmd`:
      tutto il provisioning (apt, toolchain, SSH hardening, swap) e' delegato a
-      `Prepare-LinuxBuild2404.ps1` via `Setup-LinuxBuild2404.sh`
+      `Prepare-LinuxBuild2404.ps1` via `Install-CIToolchain-Linux2404.sh`
    - Nessun `power_state`: il reboot non e' necessario, cloud-init completa tutto al primo boot

 - [x] **Step 3  Costruisce seed ISO nocloud** via IMAPI2FS COM
@@ -181,18 +181,18 @@ Equivalente di `Prepare-WinBuild2025.ps1` con SSH al posto di WinRM.
  ```
  Solo al primo run; idempotente se gia presente.

- [x] **Step 4  Copia Setup-LinuxBuild2404.sh in VM**
+- [x] **Step 4  Copia Install-CIToolchain-Linux2404.sh in VM**
  ```powershell
  scp -i F:\CI\keys\ci_linux `
-      "$PSScriptRoot\Setup-LinuxBuild2404.sh" `
-      "ci_build@${IP}:/tmp/Setup-LinuxBuild2404.sh"
+      "$PSScriptRoot\Install-CIToolchain-Linux2404.sh" `
+      "ci_build@${IP}:/tmp/Install-CIToolchain-Linux2404.sh"
  ```
  Valida: confronta size locale vs remota via `ssh ... stat -c %s /tmp/...`

 - [x] **Step 5  Esegui setup script** nel guest
  ```powershell
  ssh -i F:\CI\keys\ci_linux ci_build@$IP `
-      "chmod +x /tmp/Setup-LinuxBuild2404.sh && sudo /tmp/Setup-LinuxBuild2404.sh"
+      "chmod +x /tmp/Install-CIToolchain-Linux2404.sh && sudo /tmp/Install-CIToolchain-Linux2404.sh"
  # Cattura exit code; != 0 => abort con errore leggibile
  ```
  Flag opzionali passabili: `--skip-update`, `--dotnet`, `--mingw`
@@ -221,7 +221,7 @@ Equivalente di `Prepare-WinBuild2025.ps1` con SSH al posto di WinRM.

 ---

-## Fase C  Setup-LinuxBuild2404.sh
+## Fase C  Install-CIToolchain-Linux2404.sh

 Script guest-side (Bash). Installazione toolchain CI e hardening.
 Eseguito da Prepare via SSH come `ci_build` con sudo.
@@ -424,3 +424,4 @@ Helper `assert_step()`: stampa `[OK] [Step N] desc` su successo, `exit 1` su fal
 - [CI-FLOW.md](CI-FLOW.md)  flusso pipeline (aggiornare Step 0 prerequisites)
 - [HOST-SETUP.md](HOST-SETUP.md)  Setup-Host.ps1 (aggiungere step generazione SSH key)
 - [TODO.md §6.1](../TODO.md)  tracking implementazione
+
@@ -1,4 +1,4 @@
-# Test Plan: v1.3 → HEAD
+# Test Plan: v1.3 → HEAD

 Complete validation of all features added since v1.3 tag (2026-05-10).
 Organized by sprint area with pre-requisites, test steps, and pass/fail criteria.
@@ -29,7 +29,7 @@ Organized by sprint area with pre-requisites, test steps, and pass/fail criteria
 - [x] Gitea available at `http://10.10.20.11:3100` or `https://gitea.emulab.it`
 - [x] PowerShell ≥5.1, Pester v5 installed (`Install-Module Pester -MinimumVersion 5.0 -Force`) (Pester 5.7.1 installed 2026-05-10)
 - [x] CredentialManager module installed (`Install-Module CredentialManager`) (verified 2026-05-10)
- [x] **[NEW 2026-05-10]** Template includes §6.6 Tier-1 Toolchain: Git for Windows + 7-Zip (Step 11 in Setup-WinBuild2025.ps1)
+- [x] **[NEW 2026-05-10]** Template includes §6.6 Tier-1 Toolchain: Git for Windows + 7-Zip (Step 11 in Install-CIToolchain-WinBuild2025.ps1)

 ---

@@ -711,14 +711,14 @@ if (Test-Path 'C:\Program Files\7-Zip\7z.exe') {

 ## §6.6 Tier-1 Toolchain (Git + 7-Zip)

-**What changed**: Step 11 added to Setup-WinBuild2025.ps1 to install Git for Windows and
+**What changed**: Step 11 added to Install-CIToolchain-WinBuild2025.ps1 to install Git for Windows and
 7-Zip in the template VM. Critical for §3.3 (In-VM Git clone) and cross-platform builds.

 **Files affected**:
- `template/Setup-WinBuild2025.ps1` (Step 11: Git + 7-Zip installation)
+- `template/Install-CIToolchain-WinBuild2025.ps1` (Step 11: Git + 7-Zip installation)
 - `runner/config.yaml` (updated GITEA_CI_TEMPLATE_PATH)

-**Test Steps** (run after template is provisioned with Setup-WinBuild2025.ps1):
+**Test Steps** (run after template is provisioned with Install-CIToolchain-WinBuild2025.ps1):

 ```powershell
 # 1. Verify Git is installed and in PATH
@@ -751,7 +751,7 @@ Test-Path 'C:\Temp\test-extract\test-7z.txt'
 ```

 **Pass Criteria**:
- [x] Step 11 executes without errors in Setup-WinBuild2025.ps1
+- [x] Step 11 executes without errors in Install-CIToolchain-WinBuild2025.ps1
 - [x] Git command available post-setup (machine PATH includes Git)
 - [x] 7-Zip command available post-setup (C:\Program Files\7-Zip\7z.exe)
 - [x] Final pre-snapshot gate includes git + 7z validation
@@ -840,3 +840,4 @@ After validating new features, run one full end-to-end build to ensure nothing b
 # Expected: Build completes successfully, artifact created, JSONL log present, no errors
 ```

+
@@ -1,4 +1,4 @@
-# Windows Template VM Setup
+# Windows Template VM Setup

 Procedura di provisioning della template VM **Windows Server 2025** che alimenta i linked
 clone usati per ogni job CI. Il template viene creato **una volta**; lo snapshot
@@ -15,18 +15,18 @@ credenziali archiviate, ISO Windows Server presente).
 | ----------------------------------- | ------------- | -------------------------------------------------------------------- |
 | `template/Deploy-WinBuild2025.ps1`  | **Host**      | Opzionale: crea VM e installa Windows Server 2025 unattended da ISO  |
 | `template/Prepare-WinBuild2025.ps1` | **Host**      | Orchestratore: copia + esegue Setup nel guest via WinRM (2025)       |
-| `template/Setup-WinBuild2025.ps1`   | **Dentro VM** | CI toolchain (user, .NET, Python, VS) + validazione hardening Deploy |
+| `template/Install-CIToolchain-WinBuild2025.ps1`   | **Dentro VM** | CI toolchain (user, .NET, Python, VS) + validazione hardening Deploy |
 | `template/Deploy-WinBuild2022.ps1`  | **Host**      | Opzionale: crea VM e installa Windows Server 2022 unattended da ISO  |
 | `template/Prepare-WinBuild2022.ps1` | **Host**      | Orchestratore: copia + esegue Setup nel guest via WinRM (2022)       |
-| `template/Setup-WinBuild2022.ps1`   | **Dentro VM** | CI toolchain per Windows Server 2022 (stesso flusso del 2025)        |
+| `template/Install-CIToolchain-WinBuild2022.ps1`   | **Dentro VM** | CI toolchain per Windows Server 2022 (stesso flusso del 2025)        |
 | `template/Validate-DeployState.ps1` | **Host**      | Valida stato post-Deploy prima di eseguire Prepare (2025 e 2022)     |
 | `template/Validate-SetupState.ps1`  | **Host**      | Valida stato post-Setup (Deploy + Setup) prima dello snapshot        |

 **Confine Deploy / Setup** (refactor §7, 2026-05-10):
 - `Deploy-WinBuild2025.ps1` si occupa dell'**OS hardening** (Firewall, WinRM, UAC, Defender, UX tweaks, autologin Administrator, WU GPO locks). Se usato, Setup valida questi come Assert-Step senza re-applicarli.
- `Setup-WinBuild2025.ps1` si occupa della **CI customization** (utente `ci_build`, cartelle `C:\CI`, toolchain .NET/Python/VS, Windows Update lifecycle, cleanup, final gate).
+- `Install-CIToolchain-WinBuild2025.ps1` si occupa della **CI customization** (utente `ci_build`, cartelle `C:\CI`, toolchain .NET/Python/VS, Windows Update lifecycle, cleanup, final gate).

-`Prepare-WinBuild2025.ps1` apre una WinRM session, copia `Setup-WinBuild2025.ps1` in
+`Prepare-WinBuild2025.ps1` apre una WinRM session, copia `Install-CIToolchain-WinBuild2025.ps1` in
 `C:\CI\`, lo esegue, raccoglie l'exit code, valida lo stato del guest.

 ---
@@ -114,15 +114,15 @@ cd N:\Code\Workspace\Local-CI-CD-System\template

 Ogni step ha validazione `Assert-Step` (throw on failure, `[OK]` su pass):

-1. **Pre-flight**: script dir presente, `Setup-WinBuild2025.ps1` presente, IP ottetti 0-255, TCP/5986 reachable
+1. **Pre-flight**: script dir presente, `Install-CIToolchain-WinBuild2025.ps1` presente, IP ottetti 0-255, TCP/5986 reachable
 2. **Configura host WinRM client**: aggiunge `$VMIPAddress` ai `TrustedHosts` (no `AllowUnencrypted` — HTTPS non lo richiede)
   - Salva valore precedente, ripristinato nel `finally` (host posture invariata)
 3. **Validazione host WinRM**: `TrustedHosts` include IP
 4. **Test connettività**: `Test-WSMan -Port 5986 -UseSSL -Authentication Basic` con credenziali admin
 5. **Apre PSSession** `-UseSSL -Port 5986` verso la VM
 6. **Crea `C:\CI`** in guest, valida creazione
-7. **Copia `Setup-WinBuild2025.ps1`** in `C:\CI\Setup-WinBuild2025.ps1`, valida size match
-8. **Esegue `Setup-WinBuild2025.ps1`** dentro la VM (vedi Fase C)
+7. **Copia `Install-CIToolchain-WinBuild2025.ps1`** in `C:\CI\Install-CIToolchain-WinBuild2025.ps1`, valida size match
+8. **Esegue `Install-CIToolchain-WinBuild2025.ps1`** dentro la VM (vedi Fase C)
 9. **Gestisce reboot 3010**: se WU richiede reboot, riavvia VM e suggerisce re-run con `-SkipWindowsUpdate`
 10. **Post-setup remote validation** (9 check via singola `Invoke-Command`):
    - WinRM Running
@@ -145,13 +145,13 @@ Ogni step ha validazione `Assert-Step` (throw on failure, `[OK]` su pass):
 | `-BuildPassword`     | (prompt)      | Password per `ci_build` — mai hard-codare                                     |
 | `-BuildUsername`     | ci_build      | Account CI dentro la VM                                                       |
 | `-DotNetSdkVersion`  | 10.0          | Channel .NET SDK                                                              |
-| `-SkipWindowsUpdate` | (off)         | Pass-through a Setup-WinBuild2025.ps1                                         |
+| `-SkipWindowsUpdate` | (off)         | Pass-through a Install-CIToolchain-WinBuild2025.ps1                                         |
 | `-StoreCredential`   | (off)         | Registra `BuildUsername`/`BuildPassword` in Windows Credential Manager        |
 | `-CredentialTarget`  | BuildVMGuest  | Target Credential Manager (deve corrispondere a quanto usato da Invoke-CIJob) |

 ---

-## Fase C — Cosa fa `Setup-WinBuild2025.ps1` (dentro la VM)
+## Fase C — Cosa fa `Install-CIToolchain-WinBuild2025.ps1` (dentro la VM)

 Eseguito automaticamente da Prepare in Fase B. Steps 1/2/3/4b/5b/5c sono
 **validation-only** — verificano che Deploy abbia già applicato l'hardening OS.
@@ -295,7 +295,7 @@ toolchain (.NET, VS Build Tools, Python).
 | Sintomo                                        | Diagnosi / Fix                                                                                            |
 | ---------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
 | `Cannot reach $VMIPAddress via WinRM`          | VM non avviata, WinRM non abilitato, IP errato — verifica con ipconfig                                    |
-| `Setup-WinBuild2025.ps1 exited with code 3010` | Reboot richiesto post-WU. Re-run con `-SkipWindowsUpdate`                                                 |
+| `Install-CIToolchain-WinBuild2025.ps1 exited with code 3010` | Reboot richiesto post-WU. Re-run con `-SkipWindowsUpdate`                                                 |
 | `[Defender] Validation failed: GPO key`        | Defender riattivato da Windows Update — disabilita via gpedit + reboot                                    |
 | `VS Build Tools installation timed out`        | Network slow o cache corrotta. Re-run con cache pulita (`C:\ProgramData\Microsoft\VisualStudio\Packages`) |
 | `Python version match` fail                    | `$PythonVersion` ≠ versione installata. Aggiorna param o reinstalla                                       |
@@ -312,3 +312,4 @@ toolchain (.NET, VS Build Tools, Python).
 - **§2.5 [P1]** Snapshot versionato `BaseClean_<yyyyMMdd>` (rollback in caso di refresh rotto)
 - **§2.6 [P2]** Backup automatico VMDK template pre-snapshot
 - **In-VM Git Clone** — installare Git for Windows + 7-Zip nel template per ottimizzare flusso
+
@@ -1,4 +1,4 @@
-# .gitea/actions/local-ci-build/action.yml
+# .gitea/actions/local-ci-build/action.yml
 #
 # Reusable composite action — Local CI/CD System
 #
@@ -63,7 +63,7 @@ inputs:
    description: >
      Set to "true" to clone the repository inside the VM rather than
      transferring a zip from the host. Requires Git in the template (see
-      Setup-WinBuild2025.ps1 Step 12 / Setup-LinuxBuild2404.sh).
+      Install-CIToolchain-WinBuild2025.ps1 Step 12 / Install-CIToolchain-Linux2404.sh).
      Preferred for repositories larger than ~200 MB.
    required: false
    default: 'false'
@@ -243,3 +243,4 @@ runs:
        path: ${{ steps.invoke-ci.outputs.artifact-path }}\*.log
        retention-days: 3
        if-no-files-found: ignore
+
@@ -1,4 +1,4 @@
-#Requires -Version 5.1
+#Requires -Version 5.1
 <#
 .SYNOPSIS
    Deploys an Ubuntu 24.04 LTS build VM on VMware Workstation using a cloud
@@ -24,7 +24,7 @@
      both files and creates the $CloudUser account with the SSH public key.
      No packages are installed and no runcmd runs: all provisioning (apt,
      toolchain, SSH hardening, swap) is handled by Prepare-LinuxBuild2404.ps1
-      via Setup-LinuxBuild2404.sh. Step 9 waits for
+      via Install-CIToolchain-Linux2404.sh. Step 9 waits for
      /var/lib/cloud/instance/boot-finished before proceeding.

    NIC:
@@ -676,3 +676,4 @@ Write-Host "  Next steps (from template\ dir):"
 Write-Host "    .\Prepare-LinuxBuild2404.ps1 -VMXPath '$VMXPath' -VMIPAddress $guestIP"
 Write-Host ""
 Write-Host "  VM is powered on. cloud-init provisioning complete." -ForegroundColor Green
+
@@ -1,4 +1,4 @@
-#Requires -RunAsAdministrator
+#Requires -RunAsAdministrator
 #Requires -Version 5.1
 <#
 .SYNOPSIS
@@ -39,7 +39,7 @@
      - Defender real-time protection off + DisableAntiSpyware=1 GPO
      - DiagTrack/Telemetry off
      - Windows Update GPO locks (NoAutoUpdate=1, DisableWindowsUpdateAccess=1);
-        services remain Manual — Setup-WinBuild2022 Step 6b permanently disables
+        services remain Manual — Install-CIToolchain-WinBuild2022 Step 6b permanently disables
        them after applying updates (§7.2 Strategy B)
      - Windows Firewall all profiles disabled (VMnet8 NAT lab; Setup Step 1 validates)
      - RDP enabled (no NLA, lab only) + firewall rules for RDP/ICMP/WinRM-HTTPS
@@ -48,7 +48,7 @@
      - ICMPv4 inbound allowed
      - Lock screen disabled, Server Manager (policy + HKLM + task + HKCU + Default hive),
        DisableCAD (Policies\System + Winlogon), OOBE/telemetry suppressed;
-        Setup-WinBuild2022 Step 5b/5c validate all of these
+        Install-CIToolchain-WinBuild2022 Step 5b/5c validate all of these
      - Taskbar search bar hidden, Task View button hidden
      - Windows Terminal set as default terminal (DelegationConsole/Terminal HKCU + Default hive)
      - Azure Arc auto-start, scheduled tasks, and himds service disabled
@@ -580,9 +580,9 @@ reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v Enab
 reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f | Out-Null
 L 'UAC disabled'

-# ── Defender disabled (lab only) — Setup-WinBuild2022 skips Defender step ─
+# ── Defender disabled (lab only) — Install-CIToolchain-WinBuild2022 skips Defender step ─
 # RTP off + tamper-protect GPO. With Defender fully off, exclusion paths
-# become moot (no scanner to exclude from), so Setup-WinBuild2022 has been
+# become moot (no scanner to exclude from), so Install-CIToolchain-WinBuild2022 has been
 # stripped of its Defender step.
 try { Set-MpPreference -DisableRealtimeMonitoring `$true -ErrorAction Stop; L 'Defender RTP off' }
 catch { L "Defender RTP off failed: `$(`$_.Exception.Message)" }
@@ -608,7 +608,7 @@ L 'Windows Update GPO locks set + wuauserv/UsoSvc Manual (Setup Step 6b permanen
 # ── Firewall: all profiles disabled + allow RDP + ICMP + WinRM HTTPS ─────
 # Disabling all profiles removes any block on subsequent WinRM config and WU
 # downloads. This VM lives on VMnet8 NAT behind the VMware NAT gateway — no
-# inbound exposure from outside the host. Setup-WinBuild2022 Step 1 validates.
+# inbound exposure from outside the host. Install-CIToolchain-WinBuild2022 Step 1 validates.
 Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled False
 L 'Windows Firewall disabled on all profiles'
 reg add 'HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server' /v fDenyTSConnections /t REG_DWORD /d 0 /f | Out-Null
@@ -650,7 +650,7 @@ reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v Disa
 # OOBE privacy experience suppressed
 reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE' /v DisablePrivacyExperience /t REG_DWORD /d 1 /f | Out-Null
 L 'Server Manager + WAC + CAD + OOBE prompts disabled'
-# Supplemental UX hardening validated by Setup-WinBuild2022 Step 5c:
+# Supplemental UX hardening validated by Install-CIToolchain-WinBuild2022 Step 5c:
 # Lock screen: suppress at CI console sessions (no interactive user ever logs in)
 reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization' /v NoLockScreen /t REG_DWORD /d 1 /f | Out-Null
 # Server Manager GPO policy key (authoritative path on WS2022; HKLM key above is not always honoured)
@@ -1114,3 +1114,4 @@ Write-Host "    .\Validate-DeployState.ps1 -VMIPAddress $guestIP"
 Write-Host "    .\Prepare-WinBuild2022.ps1 -VMIPAddress $guestIP [-SkipWindowsUpdate]"
 Write-Host ""
 Write-Host "  VM is powered on with vmxnet3 + DHCP. Snapshot '$SnapshotName' taken." -ForegroundColor Green
+
@@ -1,4 +1,4 @@
-#Requires -RunAsAdministrator
+#Requires -RunAsAdministrator
 #Requires -Version 5.1
 <#
 .SYNOPSIS
@@ -39,7 +39,7 @@
      - Defender real-time protection off + DisableAntiSpyware=1 GPO
      - DiagTrack/Telemetry off
      - Windows Update GPO locks (NoAutoUpdate=1, DisableWindowsUpdateAccess=1);
-        services remain Manual — Setup-WinBuild2025 Step 6b permanently disables
+        services remain Manual — Install-CIToolchain-WinBuild2025 Step 6b permanently disables
        them after applying updates (§7.2 Strategy B)
      - Windows Firewall all profiles disabled (VMnet8 NAT lab; Setup Step 1 validates)
      - RDP enabled (no NLA, lab only) + firewall rules for RDP/ICMP/WinRM-HTTPS
@@ -48,7 +48,7 @@
      - ICMPv4 inbound allowed
      - Lock screen disabled, Server Manager (policy + HKLM + task + HKCU + Default hive),
        DisableCAD (Policies\System + Winlogon), OOBE/telemetry suppressed;
-        Setup-WinBuild2025 Step 5b/5c validate all of these
+        Install-CIToolchain-WinBuild2025 Step 5b/5c validate all of these
      - Taskbar search bar hidden, Task View button hidden
      - Windows Terminal set as default terminal (DelegationConsole/Terminal HKCU + Default hive)
      - Azure Arc auto-start, scheduled tasks, and himds service disabled
@@ -580,9 +580,9 @@ reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v Enab
 reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f | Out-Null
 L 'UAC disabled'

-# ── Defender disabled (lab only) — Setup-WinBuild2025 skips Defender step ─
+# ── Defender disabled (lab only) — Install-CIToolchain-WinBuild2025 skips Defender step ─
 # RTP off + tamper-protect GPO. With Defender fully off, exclusion paths
-# become moot (no scanner to exclude from), so Setup-WinBuild2025 has been
+# become moot (no scanner to exclude from), so Install-CIToolchain-WinBuild2025 has been
 # stripped of its Defender step.
 try { Set-MpPreference -DisableRealtimeMonitoring `$true -ErrorAction Stop; L 'Defender RTP off' }
 catch { L "Defender RTP off failed: `$(`$_.Exception.Message)" }
@@ -608,7 +608,7 @@ L 'Windows Update GPO locks set + wuauserv/UsoSvc Manual (Setup Step 6b permanen
 # ── Firewall: all profiles disabled + allow RDP + ICMP + WinRM HTTPS ─────
 # Disabling all profiles removes any block on subsequent WinRM config and WU
 # downloads. This VM lives on VMnet8 NAT behind the VMware NAT gateway — no
-# inbound exposure from outside the host. Setup-WinBuild2025 Step 1 validates.
+# inbound exposure from outside the host. Install-CIToolchain-WinBuild2025 Step 1 validates.
 Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled False
 L 'Windows Firewall disabled on all profiles'
 reg add 'HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server' /v fDenyTSConnections /t REG_DWORD /d 0 /f | Out-Null
@@ -650,7 +650,7 @@ reg add 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System' /v Disa
 # OOBE privacy experience suppressed
 reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\OOBE' /v DisablePrivacyExperience /t REG_DWORD /d 1 /f | Out-Null
 L 'Server Manager + WAC + CAD + OOBE prompts disabled'
-# Supplemental UX hardening validated by Setup-WinBuild2025 Step 5c:
+# Supplemental UX hardening validated by Install-CIToolchain-WinBuild2025 Step 5c:
 # Lock screen: suppress at CI console sessions (no interactive user ever logs in)
 reg add 'HKLM\SOFTWARE\Policies\Microsoft\Windows\Personalization' /v NoLockScreen /t REG_DWORD /d 1 /f | Out-Null
 # Server Manager GPO policy key (authoritative path on WS2025; HKLM key above is not always honoured)
@@ -1114,3 +1114,4 @@ Write-Host "    .\Validate-DeployState.ps1 -VMIPAddress $guestIP"
 Write-Host "    .\Prepare-WinBuild2025.ps1 -VMIPAddress $guestIP [-SkipWindowsUpdate]"
 Write-Host ""
 Write-Host "  VM is powered on with vmxnet3 + DHCP. Snapshot '$SnapshotName' taken." -ForegroundColor Green
+
@@ -1,11 +1,11 @@
 #!/usr/bin/env bash
-# Setup-LinuxBuild2404.sh
+# Install-CIToolchain-Linux2404.sh
 # Guest-side CI toolchain setup for Ubuntu 24.04 LTS build template.
-# Run as ci_build (passwordless sudo) via: sudo /tmp/Setup-LinuxBuild2404.sh
+# Run as ci_build (passwordless sudo) via: sudo /tmp/Install-CIToolchain-Linux2404.sh
 # Called by: template/Prepare-LinuxBuild2404.ps1 (host-side)
 #
 # Usage:
-#   sudo /tmp/Setup-LinuxBuild2404.sh [--skip-update] [--dotnet] [--mingw]
+#   sudo /tmp/Install-CIToolchain-Linux2404.sh [--skip-update] [--dotnet] [--mingw]
 #
 # Options:
 #   --skip-update   Skip apt update + upgrade (faster re-runs)
@@ -265,6 +265,7 @@ assert_step "/tmp writable" bash -c 'touch /tmp/.ci_tmpcheck && rm /tmp/.ci_tmpc
 assert_step "ci-report-ip.service enabled" systemctl is-enabled ci-report-ip.service

 echo ""
-echo "=== Setup-LinuxBuild2404.sh complete ==="
+echo "=== Install-CIToolchain-Linux2404.sh complete ==="
 echo "    All steps passed. VM is ready for BaseClean-Linux snapshot."
 echo "    Run Prepare-LinuxBuild2404.ps1 --Step7Shutdown + snapshot from host."
+
@@ -1,4 +1,4 @@
-#Requires -RunAsAdministrator
+#Requires -RunAsAdministrator
 #Requires -Version 5.1
 <#
 .SYNOPSIS
@@ -121,7 +121,7 @@
    Invoke via Prepare-WinBuild2022.ps1 from the HOST (recommended), or
    run manually from an elevated PowerShell session INSIDE the VM:
      Set-ExecutionPolicy Bypass -Scope Process -Force
-      .\Setup-WinBuild2022.ps1 -BuildPassword 'YourPassword'
+      .\Install-CIToolchain-WinBuild2022.ps1 -BuildPassword 'YourPassword'
 #>
 [CmdletBinding()]
 param(
@@ -1715,8 +1715,9 @@ Write-Host "All pre-snapshot checks passed." -ForegroundColor Green

 # ── Done ──────────────────────────────────────────────────────────────────────
 Write-Host ""
-Write-Host "Setup-WinBuild2022.ps1 complete. All Assert-Step checks passed." -ForegroundColor Green
+Write-Host "Install-CIToolchain-WinBuild2022.ps1 complete. All Assert-Step checks passed." -ForegroundColor Green
 # Full next-steps banner is printed by Prepare-WinBuild2022.ps1 on the host.
 # If running this script standalone (manually inside the VM), follow the steps
 # in docs/WINDOWS-TEMPLATE-SETUP.md (shut down → snapshot BaseClean → power off).
 Write-Host ""
+
@@ -1,4 +1,4 @@
-#Requires -RunAsAdministrator
+#Requires -RunAsAdministrator
 #Requires -Version 5.1
 <#
 .SYNOPSIS
@@ -121,7 +121,7 @@
    Invoke via Prepare-WinBuild2025.ps1 from the HOST (recommended), or
    run manually from an elevated PowerShell session INSIDE the VM:
      Set-ExecutionPolicy Bypass -Scope Process -Force
-      .\Setup-WinBuild2025.ps1 -BuildPassword 'YourPassword'
+      .\Install-CIToolchain-WinBuild2025.ps1 -BuildPassword 'YourPassword'
 #>
 [CmdletBinding()]
 param(
@@ -1715,8 +1715,9 @@ Write-Host "All pre-snapshot checks passed." -ForegroundColor Green

 # ── Done ──────────────────────────────────────────────────────────────────────
 Write-Host ""
-Write-Host "Setup-WinBuild2025.ps1 complete. All Assert-Step checks passed." -ForegroundColor Green
+Write-Host "Install-CIToolchain-WinBuild2025.ps1 complete. All Assert-Step checks passed." -ForegroundColor Green
 # Full next-steps banner is printed by Prepare-WinBuild2025.ps1 on the host.
 # If running this script standalone (manually inside the VM), follow the steps
 # in docs/WINDOWS-TEMPLATE-SETUP.md (shut down → snapshot BaseClean → power off).
 Write-Host ""
+
@@ -1,7 +1,7 @@
-#Requires -Version 5.1
+#Requires -Version 5.1
 <#
 .SYNOPSIS
-    HOST-side script: delivers and runs Setup-LinuxBuild2404.sh inside the Linux template VM.
+    HOST-side script: delivers and runs Install-CIToolchain-Linux2404.sh inside the Linux template VM.

 .DESCRIPTION
    Automates provisioning of the Ubuntu 24.04 template VM from the host machine via SSH/SCP:
@@ -9,8 +9,8 @@
         IPv4 address valid, TCP/22 reachable
      2. Auto power-on + guest IP detection via vmrun getGuestIPAddress (when -VMXPath provided)
      3. Add host key to known_hosts (idempotent, uses StrictHostKeyChecking=accept-new)
-      4. Copy Setup-LinuxBuild2404.sh to /tmp on guest via scp + validate file size
-      5. Execute Setup-LinuxBuild2404.sh via SSH (stdout/stderr streamed to host console)
+      4. Copy Install-CIToolchain-Linux2404.sh to /tmp on guest via scp + validate file size
+      5. Execute Install-CIToolchain-Linux2404.sh via SSH (stdout/stderr streamed to host console)
      6. Post-setup remote validation batch check (user, sudo, tools, CI dirs, swap, sshd)
      7. Graceful shutdown + vmrun snapshot (when -TakeSnapshot or -VMXPath provided)
      Final: print summary
@@ -56,13 +56,13 @@
    Must match the snapshot name used in New-BuildVM.ps1.

 .PARAMETER SkipUpdate
-    Pass --skip-update to Setup-LinuxBuild2404.sh (skips apt-get upgrade).
+    Pass --skip-update to Install-CIToolchain-Linux2404.sh (skips apt-get upgrade).

 .PARAMETER InstallDotNet
-    Pass --dotnet to Setup-LinuxBuild2404.sh (installs .NET SDK).
+    Pass --dotnet to Install-CIToolchain-Linux2404.sh (installs .NET SDK).

 .PARAMETER NoMingw
-    Pass --no-mingw to Setup-LinuxBuild2404.sh (skips MinGW cross-compiler).
+    Pass --no-mingw to Install-CIToolchain-Linux2404.sh (skips MinGW cross-compiler).
    MinGW is installed by default; use this only to skip it.

 .PARAMETER TakeSnapshot
@@ -278,26 +278,26 @@ if ($LASTEXITCODE -ne 0) {
 }
 Write-Host "  [OK] SSH connectivity confirmed, host key added."

-# ── Step 5 — Copy Setup-LinuxBuild2404.sh into VM ────────────────────────────
-Write-Host "[Prepare] Step 5 — Copying Setup-LinuxBuild2404.sh to guest..."
+# ── Step 5 — Copy Install-CIToolchain-Linux2404.sh into VM ────────────────────────────
+Write-Host "[Prepare] Step 5 — Copying Install-CIToolchain-Linux2404.sh to guest..."

 $scriptDir   = Split-Path -Parent $MyInvocation.MyCommand.Path
-$setupScript = Join-Path $scriptDir 'Setup-LinuxBuild2404.sh'
-$guestScript = '/tmp/Setup-LinuxBuild2404.sh'
+$setupScript = Join-Path $scriptDir 'Install-CIToolchain-Linux2404.sh'
+$guestScript = '/tmp/Install-CIToolchain-Linux2404.sh'

 if (-not (Test-Path $setupScript -PathType Leaf)) {
-    throw "[Prepare Step 5] Setup-LinuxBuild2404.sh not found alongside this script: $setupScript"
+    throw "[Prepare Step 5] Install-CIToolchain-Linux2404.sh not found alongside this script: $setupScript"
 }

 # Strip UTF-8 BOM and normalize CRLF→LF before copying.
 # PS 5.1 / VS Code on Windows may save .sh files with BOM or CRLF; both break bash.
 $shBytes = [System.IO.File]::ReadAllBytes($setupScript)
 if ($shBytes.Length -ge 3 -and $shBytes[0] -eq 0xEF -and $shBytes[1] -eq 0xBB -and $shBytes[2] -eq 0xBF) {
-    Write-Host "  [WARN] UTF-8 BOM detected in Setup-LinuxBuild2404.sh — stripping before copy"
+    Write-Host "  [WARN] UTF-8 BOM detected in Install-CIToolchain-Linux2404.sh — stripping before copy"
    $shBytes = $shBytes[3..($shBytes.Length - 1)]
 }
 $shText    = [System.Text.Encoding]::UTF8.GetString($shBytes) -replace "`r`n", "`n" -replace "`r", "`n"
-$tmpScript = Join-Path $env:TEMP 'Setup-LinuxBuild2404-ci.sh'
+$tmpScript = Join-Path $env:TEMP 'Install-CIToolchain-Linux2404-ci.sh'
 [System.IO.File]::WriteAllText($tmpScript, $shText, [System.Text.UTF8Encoding]::new($false))
 $setupScript = $tmpScript

@@ -322,7 +322,7 @@ Assert-Step 'FileCopy' "guest script size matches local ($localSize bytes, remot
 }

 # ── Step 6 — Execute setup script ────────────────────────────────────────────
-Write-Host "[Prepare] Step 6 — Running Setup-LinuxBuild2404.sh in guest (may take several minutes)..."
+Write-Host "[Prepare] Step 6 — Running Install-CIToolchain-Linux2404.sh in guest (may take several minutes)..."

 $setupFlags = [System.Collections.Generic.List[string]]::new()
 if ($SkipUpdate)    { $setupFlags.Add('--skip-update') }
@@ -340,7 +340,7 @@ $setupExitCode = $LASTEXITCODE

 Write-Host "------------------------------------------------------------"
 if ($setupExitCode -ne 0) {
-    throw "[Prepare Step 6] Setup-LinuxBuild2404.sh exited $setupExitCode — see output above."
+    throw "[Prepare Step 6] Install-CIToolchain-Linux2404.sh exited $setupExitCode — see output above."
 }
 Write-Host "[Prepare] Setup script completed (exit 0)." -ForegroundColor Green

@@ -435,3 +435,4 @@ if ($TakeSnapshot -or $VMXPath -ne '') {
 } else {
    Write-Host "  Snapshot:  not taken — run manually then use -SnapshotName '$SnapshotName'"
 }
+
@@ -1,7 +1,7 @@
-#Requires -Version 5.1
+#Requires -Version 5.1
 <#
 .SYNOPSIS
-    HOST-side script: delivers and runs Setup-WinBuild2022.ps1 inside the template VM.
+    HOST-side script: delivers and runs Install-CIToolchain-WinBuild2022.ps1 inside the template VM.

 .DESCRIPTION
    Automates the template VM provisioning from the host machine:
@@ -12,8 +12,8 @@
         (PS 5.1 Test-WSMan has no -SessionOption, so PSSession is used as the connectivity probe)
      5. PSSession open — step 4 and 5 are now merged
      6. Ensures C:\CI exists on guest; validates creation
-      7. Copies Setup-WinBuild2022.ps1 into the VM; validates file present + size match
-      8. Runs Setup-WinBuild2022.ps1 inside the VM with the given parameters
+      7. Copies Install-CIToolchain-WinBuild2022.ps1 into the VM; validates file present + size match
+      8. Runs Install-CIToolchain-WinBuild2022.ps1 inside the VM with the given parameters
         (Setup performs per-step validation internally — aborts on any failure)
      9. Handles the reboot-required case (exit 3010) and optionally re-runs
     10. Post-setup remote validation: 9 guest-state checks via a single Invoke-Command
@@ -68,13 +68,13 @@

 .PARAMETER BuildUsername
    Local username for the CI build account inside the VM. Default: ci_build.
-    Passed through to Setup-WinBuild2022.ps1 and used in post-setup validation.
+    Passed through to Install-CIToolchain-WinBuild2022.ps1 and used in post-setup validation.

 .PARAMETER DotNetSdkVersion
    .NET SDK channel to install in the VM. Default: 10.0 (matches host SDK).

 .PARAMETER SkipWindowsUpdate
-    Pass through to Setup-WinBuild2022.ps1 to skip the Windows Update step.
+    Pass through to Install-CIToolchain-WinBuild2022.ps1 to skip the Windows Update step.

 .PARAMETER SnapshotName
    Name of the snapshot to create. Default: BaseClean (case-sensitive — used by New-BuildVM.ps1).
@@ -132,7 +132,7 @@ param(

    [string] $DotNetSdkVersion = '10.0',

-    # Tier-2 Toolchain version pins — forwarded as-is to Setup-WinBuild2022.ps1
+    # Tier-2 Toolchain version pins — forwarded as-is to Install-CIToolchain-WinBuild2022.ps1
    [string] $Pwsh7Version   = '7.6.1',
    [string] $NSISVersion    = '3.12',
    [string] $CMakeVersion   = '3.31.6',
@@ -141,7 +141,7 @@ param(
    [string] $GhCliVersion   = '2.92.0',
    [string] $VcpkgRef       = '',

-    # Skip Tier-2 Toolchain — forwarded to Setup-WinBuild2022.ps1 -SkipTier2
+    # Skip Tier-2 Toolchain — forwarded to Install-CIToolchain-WinBuild2022.ps1 -SkipTier2
    [switch] $SkipTier2,

    [switch] $SkipWindowsUpdate,
@@ -231,8 +231,8 @@ $scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path

 # Pre-flight validation
 Assert-Step 'PreFlight' 'script directory resolved' { Test-Path $scriptDir -PathType Container }
-Assert-Step 'PreFlight' 'Setup-WinBuild2022.ps1 present alongside this script' {
-    Test-Path (Join-Path $scriptDir 'Setup-WinBuild2022.ps1') -PathType Leaf
+Assert-Step 'PreFlight' 'Install-CIToolchain-WinBuild2022.ps1 present alongside this script' {
+    Test-Path (Join-Path $scriptDir 'Install-CIToolchain-WinBuild2022.ps1') -PathType Leaf
 }
 Assert-Step 'PreFlight' "VMIPAddress octets in 0..255" {
    $parts = $VMIPAddress.Split('.') | ForEach-Object { [int]$_ }
@@ -330,9 +330,9 @@ Error: $_
 }

 try {
-    # ── Copy Setup-WinBuild2022.ps1 into the VM ───────────────────────────────
-    $setupScript     = Join-Path $scriptDir 'Setup-WinBuild2022.ps1'
-    $guestScriptPath = 'C:\CI\Setup-WinBuild2022.ps1'
+    # ── Copy Install-CIToolchain-WinBuild2022.ps1 into the VM ───────────────────────────────
+    $setupScript     = Join-Path $scriptDir 'Install-CIToolchain-WinBuild2022.ps1'
+    $guestScriptPath = 'C:\CI\Install-CIToolchain-WinBuild2022.ps1'

    Write-Host "[Prepare] Ensuring C:\CI exists on guest..."
    Invoke-Command -Session $session -ScriptBlock {
@@ -344,7 +344,7 @@ try {
        Invoke-Command -Session $session -ScriptBlock { Test-Path 'C:\CI' -PathType Container }
    }

-    Write-Host "[Prepare] Copying Setup-WinBuild2022.ps1 -> guest $guestScriptPath (UTF-8 BOM)..."
+    Write-Host "[Prepare] Copying Install-CIToolchain-WinBuild2022.ps1 -> guest $guestScriptPath (UTF-8 BOM)..."
    # Do NOT use Copy-Item -ToSession: it binary-copies the file.
    # If the source file has no UTF-8 BOM, PowerShell 5.1 on the guest reads it as
    # Windows-1252, misinterpreting multi-byte UTF-8 sequences (e.g. em dash U+2014
@@ -374,7 +374,7 @@ try {
        [int64]$remoteSize -ge ([int64]$hostSize - 6) -and [int64]$remoteSize -le ([int64]$hostSize + 6)
    }

-    # ── Build argument list for Setup-WinBuild2022.ps1 ───────────────────────
+    # ── Build argument list for Install-CIToolchain-WinBuild2022.ps1 ───────────────────────
    $setupArgs = @{
        BuildPassword      = $BuildPassword
        BuildUsername      = $BuildUsername
@@ -392,7 +392,7 @@ try {
    if ($SkipCleanup)       { $setupArgs['SkipCleanup']       = $true }
    if ($SkipTier2)         { $setupArgs['SkipTier2']         = $true }

-    # ── Run Setup-WinBuild2022.ps1 inside the VM ──────────────────────────────
+    # ── Run Install-CIToolchain-WinBuild2022.ps1 inside the VM ──────────────────────────────
    # Setup may return exit 3010 (ERROR_SUCCESS_REBOOT_REQUIRED) when Windows
    # Update applied patches that need a reboot. We loop: reboot guest, wait for
    # WinRM, reopen session, re-invoke Setup. Steps 1-5 are idempotent (~30 s);
@@ -441,7 +441,7 @@ try {
        return $false
    }

-    Write-Host "[Prepare] Running Setup-WinBuild2022.ps1 inside VM (this will take a while)..."
+    Write-Host "[Prepare] Running Install-CIToolchain-WinBuild2022.ps1 inside VM (this will take a while)..."

    for ($iter = 1; $iter -le $maxWuIterations; $iter++) {
        Write-Host "[Prepare] Setup iteration $iter/$maxWuIterations"
@@ -466,7 +466,7 @@ try {
        if ($result -eq 0) { break }

        if ($result -ne 3010) {
-            throw "Setup-WinBuild2022.ps1 exited with code $result"
+            throw "Install-CIToolchain-WinBuild2022.ps1 exited with code $result"
        }

        # exit 3010 (or transport error treated as 3010) → WU needs reboot.
@@ -721,3 +721,5 @@ finally {
    }
    Write-Host "[Prepare] Host TrustedHosts restored."
 }
+
+
@@ -1,7 +1,7 @@
-#Requires -Version 5.1
+#Requires -Version 5.1
 <#
 .SYNOPSIS
-    HOST-side script: delivers and runs Setup-WinBuild2025.ps1 inside the template VM.
+    HOST-side script: delivers and runs Install-CIToolchain-WinBuild2025.ps1 inside the template VM.

 .DESCRIPTION
    Automates the template VM provisioning from the host machine:
@@ -12,8 +12,8 @@
         (PS 5.1 Test-WSMan has no -SessionOption, so PSSession is used as the connectivity probe)
      5. PSSession open — step 4 and 5 are now merged
      6. Ensures C:\CI exists on guest; validates creation
-      7. Copies Setup-WinBuild2025.ps1 into the VM; validates file present + size match
-      8. Runs Setup-WinBuild2025.ps1 inside the VM with the given parameters
+      7. Copies Install-CIToolchain-WinBuild2025.ps1 into the VM; validates file present + size match
+      8. Runs Install-CIToolchain-WinBuild2025.ps1 inside the VM with the given parameters
         (Setup performs per-step validation internally — aborts on any failure)
      9. Handles the reboot-required case (exit 3010) and optionally re-runs
     10. Post-setup remote validation: 9 guest-state checks via a single Invoke-Command
@@ -68,13 +68,13 @@

 .PARAMETER BuildUsername
    Local username for the CI build account inside the VM. Default: ci_build.
-    Passed through to Setup-WinBuild2025.ps1 and used in post-setup validation.
+    Passed through to Install-CIToolchain-WinBuild2025.ps1 and used in post-setup validation.

 .PARAMETER DotNetSdkVersion
    .NET SDK channel to install in the VM. Default: 10.0 (matches host SDK).

 .PARAMETER SkipWindowsUpdate
-    Pass through to Setup-WinBuild2025.ps1 to skip the Windows Update step.
+    Pass through to Install-CIToolchain-WinBuild2025.ps1 to skip the Windows Update step.

 .PARAMETER SnapshotName
    Name of the snapshot to create. Default: BaseClean (case-sensitive — used by New-BuildVM.ps1).
@@ -132,7 +132,7 @@ param(

    [string] $DotNetSdkVersion = '10.0',

-    # Tier-2 Toolchain version pins — forwarded as-is to Setup-WinBuild2025.ps1
+    # Tier-2 Toolchain version pins — forwarded as-is to Install-CIToolchain-WinBuild2025.ps1
    [string] $Pwsh7Version   = '7.6.1',
    [string] $NSISVersion    = '3.12',
    [string] $CMakeVersion   = '3.31.6',
@@ -141,7 +141,7 @@ param(
    [string] $GhCliVersion   = '2.92.0',
    [string] $VcpkgRef       = '',

-    # Skip Tier-2 Toolchain — forwarded to Setup-WinBuild2025.ps1 -SkipTier2
+    # Skip Tier-2 Toolchain — forwarded to Install-CIToolchain-WinBuild2025.ps1 -SkipTier2
    [switch] $SkipTier2,

    [switch] $SkipWindowsUpdate,
@@ -231,8 +231,8 @@ $scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path

 # Pre-flight validation
 Assert-Step 'PreFlight' 'script directory resolved' { Test-Path $scriptDir -PathType Container }
-Assert-Step 'PreFlight' 'Setup-WinBuild2025.ps1 present alongside this script' {
-    Test-Path (Join-Path $scriptDir 'Setup-WinBuild2025.ps1') -PathType Leaf
+Assert-Step 'PreFlight' 'Install-CIToolchain-WinBuild2025.ps1 present alongside this script' {
+    Test-Path (Join-Path $scriptDir 'Install-CIToolchain-WinBuild2025.ps1') -PathType Leaf
 }
 Assert-Step 'PreFlight' "VMIPAddress octets in 0..255" {
    $parts = $VMIPAddress.Split('.') | ForEach-Object { [int]$_ }
@@ -330,9 +330,9 @@ Error: $_
 }

 try {
-    # ── Copy Setup-WinBuild2025.ps1 into the VM ───────────────────────────────
-    $setupScript     = Join-Path $scriptDir 'Setup-WinBuild2025.ps1'
-    $guestScriptPath = 'C:\CI\Setup-WinBuild2025.ps1'
+    # ── Copy Install-CIToolchain-WinBuild2025.ps1 into the VM ───────────────────────────────
+    $setupScript     = Join-Path $scriptDir 'Install-CIToolchain-WinBuild2025.ps1'
+    $guestScriptPath = 'C:\CI\Install-CIToolchain-WinBuild2025.ps1'

    Write-Host "[Prepare] Ensuring C:\CI exists on guest..."
    Invoke-Command -Session $session -ScriptBlock {
@@ -344,7 +344,7 @@ try {
        Invoke-Command -Session $session -ScriptBlock { Test-Path 'C:\CI' -PathType Container }
    }

-    Write-Host "[Prepare] Copying Setup-WinBuild2025.ps1 -> guest $guestScriptPath (UTF-8 BOM)..."
+    Write-Host "[Prepare] Copying Install-CIToolchain-WinBuild2025.ps1 -> guest $guestScriptPath (UTF-8 BOM)..."
    # Do NOT use Copy-Item -ToSession: it binary-copies the file.
    # If the source file has no UTF-8 BOM, PowerShell 5.1 on the guest reads it as
    # Windows-1252, misinterpreting multi-byte UTF-8 sequences (e.g. em dash U+2014
@@ -374,7 +374,7 @@ try {
        [int64]$remoteSize -ge ([int64]$hostSize - 6) -and [int64]$remoteSize -le ([int64]$hostSize + 6)
    }

-    # ── Build argument list for Setup-WinBuild2025.ps1 ───────────────────────
+    # ── Build argument list for Install-CIToolchain-WinBuild2025.ps1 ───────────────────────
    $setupArgs = @{
        BuildPassword      = $BuildPassword
        BuildUsername      = $BuildUsername
@@ -392,7 +392,7 @@ try {
    if ($SkipCleanup)       { $setupArgs['SkipCleanup']       = $true }
    if ($SkipTier2)         { $setupArgs['SkipTier2']         = $true }

-    # ── Run Setup-WinBuild2025.ps1 inside the VM ──────────────────────────────
+    # ── Run Install-CIToolchain-WinBuild2025.ps1 inside the VM ──────────────────────────────
    # Setup may return exit 3010 (ERROR_SUCCESS_REBOOT_REQUIRED) when Windows
    # Update applied patches that need a reboot. We loop: reboot guest, wait for
    # WinRM, reopen session, re-invoke Setup. Steps 1-5 are idempotent (~30 s);
@@ -441,7 +441,7 @@ try {
        return $false
    }

-    Write-Host "[Prepare] Running Setup-WinBuild2025.ps1 inside VM (this will take a while)..."
+    Write-Host "[Prepare] Running Install-CIToolchain-WinBuild2025.ps1 inside VM (this will take a while)..."

    for ($iter = 1; $iter -le $maxWuIterations; $iter++) {
        Write-Host "[Prepare] Setup iteration $iter/$maxWuIterations"
@@ -466,7 +466,7 @@ try {
        if ($result -eq 0) { break }

        if ($result -ne 3010) {
-            throw "Setup-WinBuild2025.ps1 exited with code $result"
+            throw "Install-CIToolchain-WinBuild2025.ps1 exited with code $result"
        }

        # exit 3010 (or transport error treated as 3010) → WU needs reboot.
@@ -721,3 +721,5 @@ finally {
    }
    Write-Host "[Prepare] Host TrustedHosts restored."
 }
+
+
@@ -5,8 +5,8 @@

 .DESCRIPTION
    Connects to the VM via WinRM (HTTP/Basic) and runs all checks that
-    Setup-WinBuild2025.ps1 Steps 1/2/3/4b/5b/5c assert as validation-only.
-    Use this after Deploy completes and before running Prepare/Setup.
+    Install-CIToolchain-WinBuild2025.ps1 Steps 1/2/3/4b/5b/5c assert as validation-only.
+    Use this after Deploy completes and before running Prepare/Install-CIToolchain.

 .PARAMETER VMIPAddress
    IP address of the guest VM on VMnet8 (e.g. 192.168.79.129).
@@ -47,7 +47,7 @@ param(
    [string] $PythonVersion  = '3.13.3',
    [switch] $Remediate,

-    # Skip Tier-2 Toolchain checks (mirrors -SkipTier2 in Setup-WinBuild2025.ps1)
+    # Skip Tier-2 Toolchain checks (mirrors -SkipTier2 in Install-CIToolchain-WinBuild2025.ps1)
    [switch] $SkipTier2
 )