From 8c6a5974255c3acc81e7bde8b0242aa3bb7a4f41 Mon Sep 17 00:00:00 2001
From: Shirofune-Security
 <43838376+Shirofune-Security@users.noreply.github.com>
Date: Mon, 21 Sep 2026 17:55:25 +0900
Subject: [PATCH] Cover CIS recovery paths and bound retained native evidence

---
 .github/workflows/firewall-logging-recovery.yml | 8 +++++++-
 tests/FirewallLoggingRecovery.Tests.ps1         | 7 +++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/firewall-logging-recovery.yml b/.github/workflows/firewall-logging-recovery.yml
index 13d69d21..b6a7749f 100644
--- a/.github/workflows/firewall-logging-recovery.yml
+++ b/.github/workflows/firewall-logging-recovery.yml
@@ -42,6 +42,12 @@ jobs:
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
           name: firewall-recovery-${{ matrix.os }}-${{ matrix.engine }}
-          path: ${{ runner.temp }}/wela-firewall-recovery-*/
+          path: |
+            ${{ runner.temp }}/wela-firewall-recovery-*/*.json
+            ${{ runner.temp }}/wela-firewall-recovery-*/cli-*.txt
+            ${{ runner.temp }}/wela-firewall-recovery-*/configure-backup/
+            ${{ runner.temp }}/wela-firewall-recovery-*/plan/
+            ${{ runner.temp }}/wela-firewall-recovery-*/restore/
+            ${{ runner.temp }}/wela-firewall-recovery-*/again/
           if-no-files-found: warn
           retention-days: 7
diff --git a/tests/FirewallLoggingRecovery.Tests.ps1 b/tests/FirewallLoggingRecovery.Tests.ps1
index da19f0ee..0d1ef01a 100644
--- a/tests/FirewallLoggingRecovery.Tests.ps1
+++ b/tests/FirewallLoggingRecovery.Tests.ps1
@@ -59,6 +59,13 @@ try {
     Reset
     $e=Read-WelaFirewallRecoveryEvidence $journal $results Domain TEST
     Assert ($e.RecoverTo.LogMaxSizeKilobytes -eq 4096 -and $e.Expected.LogAllowed -ceq 'True') 'Exact typed local recovery tuple'
+    if([Environment]::OSVersion.Platform -eq [PlatformID]::Win32NT){
+        $entry.Desired.PathMode='CisV4';$entry.Desired.LogFileName='%SystemRoot%\System32\LogFiles\Firewall\domainfw.log';$row.Desired=Copy-Fixture $entry.Desired
+        $row.After.Local.LogFileName=$entry.Desired.LogFileName;$row.After.Effective.LogFileName=$entry.Desired.LogFileName;Save
+        $migration=Read-WelaFirewallRecoveryEvidence $journal $results Domain TEST
+        Assert ($migration.RecoverTo.LogFileName -ceq 'C:\Logs\Domain.log' -and $migration.Expected.LogFileName -ceq $entry.Desired.LogFileName) 'CIS migration preserves the exact original local recovery path'
+        Reset
+    }
     foreach($bad in @('NotConfigured','true','1')){$v=Copy-Fixture $e.RecoverTo;$v.LogAllowed=$bad;Throws {ConvertTo-WelaFirewallRecoveryTuple $v} 'True/False'}
     foreach($bad in @('4096',0,32768,$true,1.5)){$v=Copy-Fixture $e.RecoverTo;$v.LogMaxSizeKilobytes=$bad;Throws {ConvertTo-WelaFirewallRecoveryTuple $v} 'integer'}
     foreach($path in @('\\host\share\log','C:\Logs\..\other.log','C:\Logs\log:stream','C:\Logs\*.log','%TEMP%\log','C:relative.log','C:\Logs\')){Throws {Resolve-WelaFirewallRecoveryLogPath $path} 'path|unsupported|streams'}