Run operator-gated warm on-prem Windows remoting acceptance

[AlsoBeltrix]

Status and authority

Follow-up to #28. This issue tracks the missing E1 acceptance evidence; it does not authorize a live probe by itself.

Do not connect to any endpoint until the owner separately identifies an approved host, authentication path, account/identity, allowed command surface, and cleanup authority. Do not install software, change remote configuration or business data, mutate third-party state, change TrustedHosts, enable CredSSP, bypass certificate/host-key validation, or pass secrets through MCP arguments or retained output. Teardown of temporary sessions/runspaces created by this authorized probe is permitted and required.

If the endpoint is unexpectedly production, repeated authentication fails, or any step requires an action outside the approved host/identity/command/cleanup scope, stop, clean up what this run created, and report. Do not substitute another host, credential, authentication mode, or command surface.

Target

Prove or disprove the provisional #28 recommendation that the existing five-tool PTK surface supports a warm on-premises Windows PowerShell remoting workflow without a new MCP schema. The primary target is an approved WSMan/WinRM endpoint using OS-integrated Kerberos/Negotiate where available, such as a non-production or explicitly approved on-prem Exchange Microsoft.Exchange endpoint. Exchange Online modern REST/module authentication is a separate acceptance path and must not be represented by this implicit-remoting probe.

Acceptance run

1. Record exact PTK commit/package identity, local OS/PowerShell versions, remote endpoint type/version, and approved authentication mechanism without recording credential material.
2. Open two PTK named sessions: one remote-bearing session and one independent sibling.
3. In the remote-bearing worker, create one real PSSession; prove a benign remote variable/session identity persists across at least two later ptk_invoke calls.
4. Import only an explicitly approved read-only -CommandName allowlist (for example approved Get-* commands), record that allowlist, and prove the proxies remain usable across PTK calls. Do not import the endpoint's full command surface.
5. Exercise synthetic or de-identified deserialized selected/note properties plus terminating error, warning, progress, verbose, and information streams. Errors and warnings must remain first-class; record the observed treatment of progress, verbose, and information, and create a separate review finding for any non-first-class result rather than silently accepting it. Confirm active/lazy/script members are not evaluated implicitly and reconcile any gap with issue Object shaper drops script/lazy/COM members as [active member not evaluated] (EXO & Outlook COM) #8.
6. Record cold connect/import latency and repeated-call latency. Observe endpoint idle-timeout, quota, and Broken/Disconnected behavior without inducing disruption unless separately authorized.
7. If an induced WSMan/channel disconnect is separately authorized, require a server-side runspace/quota cleanup check afterward. A closed channel is never proof that remote work stopped.
8. Reset or lose the remote-bearing PTK worker. Prove no command is replayed, local remote state/proxies are reported lost, and the sibling worker remains warm and usable.
9. Account for and close every temporary local and remote session/process that can still be reached. Report anything not provably cleaned up.

Required semantics

• Before private worker-pipe write, only proved not_started is eligible for a caller-chosen new invocation.
• At or after write, transport/worker ambiguity is outcome_unknown and is never automatically replayed.
• PTK local containment does not contain or prove termination of remote work.
• PTK session names are not security principals; OS identity, endpoint policy, host identity, and upstream RBAC remain authoritative.
• Interactive/device-code/browser authentication must remain explicitly operator-driven and must not wedge an unattended worker.
• Never place passwords, tokens, private keys, serialized credentials, or secret command output in issue comments, logs, fixtures, MCP arguments, or ptk_output artifacts.

Definition of done

Post one self-contained result here with timings, stream/object observations, failure classification, cleanup proof, and a final ruling on recommendation A versus a separately planned B/C. Redact secrets, host/domain identifiers, account or principal names, internal URIs/SPNs, and real user/mailbox/directory values; use synthetic or de-identified objects and preserve only the structure/property names needed as evidence. Update .agents/state.md; record every confirmed defect separately under .agents/review/findings/. Do not implement a helper or public MCP change without the repository plan workflow and owner approval.