Test-TestEnvironment: verify the seeded estate against the seed data

[fadwen]

What

One exported command, Test-TestEnvironment, dispatching to Test-<Provider>Environment for all six providers. It compares what the connected directory holds with the seed files:

• every seeded user, group and other named object present, found the way teardown finds them (Get-<Provider>SeededObject, Select-ADTestOwnedObject), and nothing the module owns that the data does not describe;
• every name equal to the data by codepoint ([string]::Equals(..., Ordinal), never -eq, which calls a decomposed and a precomposed name equal);
• every membership the data lists, or its rules define, in place. Memberships are judged on what is missing only, because dynamic groups, AD group rules and FreeIPA automember rules add members the data never lists;
• licence-gated and many-to-one object types counted without a verdict.

One result object for every provider (Provider, Target, VerifiedOn, Checks, Failed, Passed), each check with Name, Kind, Expected, Found, Missing, Unexpected, Passed and the full lists. -SkipMembership skips the expensive reads; -Quiet returns the object alone.

Verify/Invoke-LiveCycle.ps1 runs seed, verify, teardown, re-verify through the exported commands and exits non-zero on any finding. Nothing under Verify/ ships; the rehearsal confirms it.

Live results

Provider	After seed	After teardown
AD	all 6 checks passed (311 users, 25 service accounts, 688 computers, 90 groups, 5,687 memberships)	nothing found
Authentik	all 5 checks passed (330 users, 98 groups, 9 apps, 3,886 memberships)	nothing found
FreeIPA	all 8 checks passed (355 + 1 staged + 1 preserved users, 102 groups, 413 hosts, 3,917 + 817 memberships)	nothing found
PingOne	all 8 checks passed (330 users, 4 populations, 11 groups, 6 apps, 2 resources, 464 memberships)	nothing found
Entra	honest: users, groups, apps, memberships all present and every name matching; 694 devices refused by the tenant (Authorization_RequestDenied on device create, pre-existing), 1 of 4 guests	3 custom role definitions kept by design (no P2 to read eligibilities), otherwise clean after Graph's read lag

The first FreeIPA run caught a real verifier bug (logins prefixed where the seed never prefixes them: 355 missing, 355 unexpected against a correct realm). Fixed, and the per-provider suites now build their fixtures from the seed files by the seed's own rules so that class of drift fails in CI.

Gates

• Unit suite: 2,586 passed on Windows PowerShell 5.1, 2,585 passed shuffled on PowerShell 7 (1 skipped, Windows-only ACL test), 0 failed.
• ScriptAnalyzer clean across the repository. MAML rebuilt. Publish-Module.ps1 -WhatIf passes.

Also

• Docs page, index entry, about topic, README, provider READMEs, Tests/README and CLAUDE.md invariant.
• New suites: the Core check/verification helpers, the dispatcher (with a contract that every provider folder implements Test-<Provider>Environment), and one per provider verifier.