windows/installer/oem/SetupComplete.cmd

@@ -33,5 +33,10 @@ if exist "C:\Program Files\SilverOS\Welcome\SilverOS.Welcome.App.exe" (
   powershell -NoProfile -ExecutionPolicy Bypass -File "%HARD%\Invoke-Hardening.ps1" >> "%LOG%" 2>&1
 )
 
+REM Plaintext-password hygiene: delete the cached answer file that holds the
+REM local account password in clear text. Runs as SYSTEM after accounts exist.
+del /f /q "%WINDIR%\Panther\unattend.xml" 2>nul
+del /f /q "%WINDIR%\Panther\Unattend\unattend.xml" 2>nul
+
 echo [%DATE% %TIME%] SilverMetal first-boot done >> "%LOG%"
 exit /b 0

windows/tests/Assert-IsoStructure.ps1

@@ -56,6 +56,20 @@ try {
             }
         } finally { Dismount-WindowsImage -Path $mount -Discard | Out-Null }
     }
+
+    # boot.wim must carry the WinPE collector + winpeshl (the pre-config front-end).
+    $bootwim = "$drive\sources\boot.wim"
+    Assert 'boot.wim present' (Test-Path $bootwim)
+    if (Test-Path $bootwim) {
+        $bmount = Join-Path $env:TEMP ('sm-assert-boot-' + [guid]::NewGuid().ToString('N'))
+        New-Item -ItemType Directory -Force $bmount | Out-Null
+        Mount-WindowsImage -ImagePath $bootwim -Index 2 -Path $bmount -ReadOnly | Out-Null
+        try {
+            Assert 'collector staged in boot.wim' (Test-Path (Join-Path $bmount 'sm\Collector.ps1'))
+            Assert 'winpeshl.ini set'             (Test-Path (Join-Path $bmount 'Windows\System32\winpeshl.ini'))
+            Assert 'answer-file generator staged' (Test-Path (Join-Path $bmount 'sm\New-SmAnswerFile.ps1'))
+        } finally { Dismount-WindowsImage -Path $bmount -Discard | Out-Null; Remove-Item $bmount -Recurse -Force -EA SilentlyContinue }
+    }
 } finally {
     Dismount-DiskImage -ImagePath $IsoPath | Out-Null
     Remove-Item $mount -Recurse -Force -EA SilentlyContinue