Earlier fix (commit 047125b) filtered the infisical CLI's
"A new release of infisical is available" upgrade banner from
captured output via regex matching. That worked but coupled the
filter to specific banner-pattern strings — a future banner shape
("Update available" / "New version detected" / a localized
message) would slip through and break NTLM Type1 auth again.
The principled fix is to stop capturing stderr at all.
PowerShell's call operator (`&`) keeps stdout and stderr on
separate streams unless explicitly merged; the previous code's
`2>&1` was the actual mistake. Without it, the banner stays in
the error stream (visible on the console for diagnostics) and
the captured `$value` contains only the script's stdout — which
for `Get-Secret.ps1` is just the secret value from `infisical
secrets get --plain`.
Verified: live re-run of F54 (lmx_write_complete_live) passes
post-change with `MX_TEST_DOMAIN='DESKTOP-6JL3KKO'` clean and
the banner visibly logged to console (stderr) above each [SET]
line. No regex coupling to a specific banner-pattern remains.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three doc fixes pinned by re-running today's full live-test sweep:
1. Bump status header from 2026-05-06 to "re-run 2026-05-07" with a
note that all 5 steps still pass against the live AVEVA install.
The first run of step 1 + step 5 today failed with
`Error::Status { detail: 5 }` (DCE/RPC fault 0x00000005) traced
to MX_TEST_DOMAIN being polluted with the infisical CLI's
"A new release of infisical is available" upgrade banner. The
banner was being concatenated onto the domain string by
Setup-LiveProbeEnv.ps1's `2>&1` capture, causing NTLM Type1 to
send a malformed domain field that NmxSvc rejected.
2. Fix tools/Setup-LiveProbeEnv.ps1 — Get-InfisicalSecret now splits
captured output on newlines, filters lines matching the
"^A new release of infisical is available" / "^Please upgrade"
banner patterns, and returns the last non-empty line (the actual
secret value from `infisical secrets get --plain`). Robust to
future banner messages of similar shape.
3. Fix two drifted line citations in docs/M6-live-verification.md:
`recover_connection_core (session.rs:1428-...)` is now at line
1374 after F56/F45/F47 edits — strip the line number, keep the
function name (`Session::recover_connection_core`). Same for
`Session::unsubscribe (session.rs:2261)`.
4. Add "Workspace gate (no live infra needed)" subsection to the
"Reproducing locally" recipe so a fresh contributor sees the
full V1 verification recipe (live + workspace gate) in one place.
All 5 live tests pass post-fix:
- F36 buffered subscribe (drained 1 raw NMX message; no scan
activity on TestChangingInt today, matches 5/6 baseline)
- F45 buffered recovery replay (2 pre + 2 post DataUpdate frames)
- F47 buffered unsubscribe skip (returned Ok)
- F40 metrics smoke (4 expected metric names present)
- F54 OnWriteComplete (status detail 9 = WRITE_COMPLETE_OK)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Joseph Doherty