Verifying an MSI door-to-door: from download to live process

The verification chain

1. File: Get-FileHash .\app.msi -Algorithm SHA256 against the published value. (See the full ritual.)
2. Install: msiexec /i app.msi /l*v install.log — the log flag guarantees a transcript exists even on silent runs.
3. Log reads: search for WriteRegistryValues and InstallFiles actions; confirm only expected roots (HKCU, %LOCALAPPDATA%\Programs) appear.
4. Process audit: after install, Task Manager → Details → right-click column “Elevated” — a per-user launcher runs entirely unelevated.

What to reject mid-install

• Unrequested UAC prompts during MSI flow — an unsigned per-user MSI installs under the user's token, asking once for the UI itself at most.
• Log lines showing writes to HKLM from a PerUser package — scope violation within evidence sightlines.
• Uninstall failing: for a preview evaluation, all product claims die the day its own uninstaller refuses. Log it, roll back, report.

Every ProofTune candidate passes its own full-log install in a gated pipeline — the runbook is part of what our preview docs share, so you know what a passing log looks like before your own run.

ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.