Zulu NetDiag Windows client 0.1.1  (commit eaabed4, built 2026-07-24T16:21:19Z)
=====================================================================

WHAT THIS IS
  Network path diagnostic client. Measures this workstation's path to the
  Zulu diagnostic server over the public internet, the Juniper SRX
  site-to-site VPN, and OpenVPN — and uploads results for comparison.
  It never collects patient data, credentials, keys, or Wi-Fi passwords.

VERIFY BEFORE USE
  1. Check the package hash against SHA256SUMS.txt provided separately:
       Get-FileHash .\ZuluNetDiag-0.1.1.zip -Algorithm SHA256
  2. This package is checksum-verifiable but NOT code-signed. After
     download, clear Mark-of-the-Web once the hash matches:
       Unblock-File .\ZuluNetDiag-0.1.1.zip   (before extracting)

SETUP (once per workstation)
  1. Extract to C:\ZuluNetDiag (or any local folder).
  2. Edit config.json — replace every placeholder value. The client
     REFUSES to run while placeholders remain.
  3. Store the ingest token (provided by your administrator, shown once):
       powershell -NoProfile -ExecutionPolicy Bypass -File .\Invoke-ZuluNetPathTest.ps1 -SetIngestToken

RUN
  Double-click Run-ZuluNetPathTest.cmd and pick the profile, or:
    powershell -NoProfile -ExecutionPolicy Bypass -File .\Invoke-ZuluNetPathTest.ps1 `
      -Profile PUBLIC_UNDERLAY -Mode Standard -ComparisonId PILOT-01
  No administrator rights are required. The script shows the planned
  traffic volume and asks before transferring anything.

EXECUTION POLICY
  The launcher uses a process-scoped "-ExecutionPolicy Bypass -File ..."
  invocation, the standard mechanism for approved unsigned internal
  scripts; it changes no machine or user policy. Organizations that
  require signed scripts should sign the .ps1/.psm1 files with their
  code-signing certificate and use their normal AllSigned policy.

NETWORK DESTINATIONS USED
  - https://<PublicTestFqdn>:443   (public path test + result upload)
  - https://<PrivateTestFqdn>:443  (private path test, via VPN)
  - <PrivateTestIp>:5201 TCP/UDP   (optional iperf3, private only)
  - ICMP to the local gateway, test endpoints, datacenter edge, reference

APPROXIMATE TRAFFIC PER RUN
  Quick ~40 MB | Standard ~220 MB | Deep ~500 MB | Scheduled-Light ~6 MB
  (shown exactly, per run, before you confirm)

SUPPORT
  docs/WINDOWS-RUNBOOK.md in the source repository, or your Zulu contact.
