diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index 2f78e84..b4eeab7 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -32,3 +32,11 @@ jobs: - name: Test run: dotnet test AppLensDesktop.sln --configuration Release --no-restore + - name: Test Windows initial snapshot + shell: powershell + run: .\tests\Script.Tests\Test-AppLensSnapshot.ps1 + + - name: Check Store configuration without packaging + shell: powershell + run: .\tests\Script.Tests\Test-StoreConfiguration.ps1 + diff --git a/.gitignore b/.gitignore index ce80da0..ab58c1a 100644 --- a/.gitignore +++ b/.gitignore @@ -4,6 +4,24 @@ artifacts/ src/AppLens.Desktop/BundleArtifacts/ .vs/ TestResults/ +.env +.env.* +!.env.example +!.env.template +.claude/ +.claude/settings.local.json +.vercel/ +.wrangler/ +*.log +*.db +*.db-journal +*.sqlite +*.sqlite3 *.user *.suo desktop.ini + +# Local report exports +/AppLens-*.md +/AppLens-*.json +/AppLens-*.html diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..4e55599 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,71 @@ +# AppLens Agent Instructions + +Installed (formerly AppLens) v1 is a lightweight Windows client for guided screen-share sessions: +scan -> review/filter apps and storage -> approve supported uninstalls -> verify +results -> save a local report. Keep communication concise and plain-English. + +The Store product is Installed (9PBPFLL6JVVV). Keep AppLens repository, namespaces, +legacy storage paths and DPAPI purpose identifiers stable; renaming those can +break history compatibility. AppLens-Tune remains a separate deferred component. + +## Product scope + +- Target Windows 11 x64 and Microsoft Store distribution. Users should install + from the AppLens website/Store and open the installed app from an icon, including + a desktop shortcut, without developer tools or manual runtime/certificate setup. +- Follow [Product Vision](docs/AppLens-Product-Vision.md). Keep the silver/metallic + interface focused on the v1 flow; scan, table, history and reports share one model. +- Preserve deferred Tune in `future/AppLens-Tune/`. Core v1 must have no build, + runtime or background-probe dependency on it; keep needed shared backend services. +- Scans are read-only. System changes require explicit confirmation, supported + mechanisms and recorded outcomes. Preserve Windows approval/policy controls; + do not add automatic remediation, forced deletion or automatic restarts. +- Keep the approved local-only privacy design: no accounts, telemetry or uploads; + Windows current-user protection for new history without plaintext duplicates; + readable reports redacted by default. Preserve legacy evidence unchanged. + +## Working rules + +- One agent; no subagents. Keep changes within the agreed v1 scope. +- Default to under 120 words, lead with the result, and use plain English. + Summarize verification once. Create reports, plans, handoffs or documentation + files only when explicitly requested. +- Active working copy: `C:\Users\codyl\Desktop\csiOS\Projects\AppLens-clean`, + branch `codex/applens-clean`. The original checkout and worktrees are preserved. +- The [handoff](docs/AppLens-v1-Handoff.md) contains historical release evidence; + its worktree path and issue status are historical. Verify current state before + release work. Remote: + `https://github.com/CSI-Platform/AppLens.git` (main product, not SSH or LLM). +- Honor recorded approvals; do not request them again. Keep native Windows + approvals with the owner. Local builds do not authorize hosting changes, merge, + Store submission or publication; consult the handoff for each action's scope. +- Reuse recorded validation; rerun checks for changed behavior/builds, changed + environments or unresolved failures. Preserve raw evidence and saved reports. +- Keep current status and evidence in Linear and the handoff. This file holds + durable rules. Distinguish local tests from installed, clean-PC and Store results. + +## Shared engineering standards + +Read the relevant shared standards before acting; keep project-specific scope and +approval rules above intact. Flag inaccessible references rather than guessing. + +- [Testing](C:/Users/codyl/Desktop/csiOS/STANDARDS/rules/testing.md): behavioral coverage and evidence. +- [Safety](C:/Users/codyl/Desktop/csiOS/STANDARDS/rules/safety.md): data, access, secrets and recovery. +- [Quality](C:/Users/codyl/Desktop/csiOS/STANDARDS/rules/quality.md): acceptance, builds, usability and review. +- [Release](C:/Users/codyl/Desktop/csiOS/STANDARDS/rules/release.md): CI and authorized delivery. + +## Development and release references + +```powershell +dotnet restore AppLensDesktop.sln +dotnet build AppLensDesktop.sln -c Release +dotnet test AppLensDesktop.sln -c Release --no-build +``` + +Use [desktop build guidance](docs/AppLensDesktop-Build.md) for launch commands and +focused checks. `tools/Build-StoreCandidate.ps1` builds a local unsigned candidate; +use the handoff's recorded packaging authorization. A candidate is not a release. + +Before release work, read [validation](docs/AppLens-Release-Validation.md), +[Store readiness](docs/Store-Readiness-Checklist.md) and the +[submission plan](docs/AppLens-Store-Submission-Plan.md). diff --git a/AppLens.ps1 b/AppLens.ps1 index 67c9e7b..88ee4c3 100644 --- a/AppLens.ps1 +++ b/AppLens.ps1 @@ -3,11 +3,14 @@ .SYNOPSIS AppLens — Pre-Audit App Scanner for CSI AI Workflow Audits .DESCRIPTION - Scans installed desktop apps (Win32) and Microsoft Store apps without - requiring admin rights. Outputs a clean, categorized text file suitable - for pasting into an AI prompt alongside a workflow audit transcript. + Captures hardware, RAM usage, local disk utilization, + installed desktop apps (Win32), and Microsoft Store apps without admin rights. + Read-only: writes a new local text report without changing system settings. #> +[CmdletBinding()] +param([string]$OutputPath) + # ── Configuration ────────────────────────────────────────────────────────────── function Get-DesktopFilePath { @@ -28,7 +31,12 @@ function Get-DesktopFilePath { return Join-Path $desktopPath $FileName } -$OutputPath = Get-DesktopFilePath -FileName "AppLens_Results_$env:COMPUTERNAME.txt" +if ([string]::IsNullOrWhiteSpace($OutputPath)) { + $OutputPath = Get-DesktopFilePath -FileName "AppLens_Results_$($env:COMPUTERNAME)_$(Get-Date -Format 'yyyyMMdd-HHmmss-fff').txt" +} +if (Test-Path -LiteralPath $OutputPath) { + throw 'The report path already exists. Choose a new OutputPath to preserve previous evidence.' +} # Patterns for apps that should be filtered into the "Runtimes & Frameworks" section $RuntimePatterns = @( @@ -387,13 +395,116 @@ function Format-AppLine { return $line } +function Get-WorkstationSnapshot { + $snapshot = @{ Issues = @() } + $queries = [ordered]@{ + Win32_ComputerSystem = @('Manufacturer', 'Model') + Win32_OperatingSystem = @('Caption', 'Version', 'BuildNumber', 'OSArchitecture', 'TotalVisibleMemorySize', 'FreePhysicalMemory', 'LastBootUpTime') + Win32_Processor = @('Name', 'NumberOfCores', 'NumberOfLogicalProcessors') + Win32_VideoController = @('Name', 'DriverVersion') + Win32_LogicalDisk = @('DeviceID', 'FileSystem', 'Size', 'FreeSpace') + } + foreach ($className in $queries.Keys) { + $parameters = @{ + ClassName = $className + Property = $queries[$className] + OperationTimeoutSec = 5 + ErrorAction = 'Stop' + } + if ($className -eq 'Win32_LogicalDisk') { $parameters.Filter = 'DriveType = 3' } + try { + $snapshot[$className] = @(Get-CimInstance @parameters) + if ($snapshot[$className].Count -eq 0) { $snapshot.Issues += "${className}: Unavailable (no data returned)." } + } catch { + $snapshot[$className] = @() + $snapshot.Issues += "${className}: Unavailable (query failed or timed out)." + } + } + return $snapshot +} + +function Format-WorkstationSnapshot { + param([Parameter(Mandatory = $true)]$Snapshot) + + $lines = @('', '--- Workstation Summary ---') + $attention = @() + $system = $Snapshot.Win32_ComputerSystem | Select-Object -First 1 + $os = $Snapshot.Win32_OperatingSystem | Select-Object -First 1 + if ($system) { $lines += "Machine: $($system.Manufacturer) $($system.Model)" } + else { $lines += 'Machine: Unavailable' } + if ($os) { + $lines += "OS: $($os.Caption) $($os.OSArchitecture) (version $($os.Version), build $($os.BuildNumber))" + if ($os.LastBootUpTime) { + $uptime = (Get-Date) - $os.LastBootUpTime + $lines += "Uptime: $($uptime.Days)d $($uptime.Hours)h $($uptime.Minutes)m (since last Windows boot)" + } else { $lines += 'Uptime: Unavailable' } + } else { $lines += 'OS: Unavailable'; $lines += 'Uptime: Unavailable' } + $processors = @($Snapshot.Win32_Processor) + if ($processors.Count -gt 0) { + foreach ($cpu in $processors) { + $lines += "CPU: $($cpu.Name) | $($cpu.NumberOfCores) cores / $($cpu.NumberOfLogicalProcessors) logical processors" + } + } else { $lines += 'CPU: Unavailable' } + $gpus = @($Snapshot.Win32_VideoController) + if ($gpus.Count -gt 0) { + foreach ($gpu in $gpus) { $lines += "GPU: $($gpu.Name) | Driver: $($gpu.DriverVersion)" } + } else { $lines += 'GPU: Unavailable' } + + if ($os -and $os.TotalVisibleMemorySize -gt 0 -and $null -ne $os.FreePhysicalMemory -and + $os.FreePhysicalMemory -ge 0 -and $os.FreePhysicalMemory -le $os.TotalVisibleMemorySize) { + $usedMemory = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory + $memoryPercent = 100.0 * $usedMemory / $os.TotalVisibleMemorySize + $lines += 'RAM: {0:N1} / {1:N1} GiB used ({2:N1}%); {3:N1} GiB available to Windows' -f + ($usedMemory / 1MB), ($os.TotalVisibleMemorySize / 1MB), $memoryPercent, ($os.FreePhysicalMemory / 1MB) + if ($memoryPercent -ge 85) { $attention += '- High RAM usage: {0:N1}% used at capture time (threshold: 85%).' -f $memoryPercent } + } else { $lines += 'RAM: Unavailable' } + + $lines += '', '--- Local Disk Utilization ---' + $lines += 'Drive | File system | Total GiB | Used GiB | Free GiB | Used % | Free %' + $disks = @($Snapshot.Win32_LogicalDisk | Sort-Object DeviceID) + if ($disks.Count -eq 0) { $lines += 'Unavailable (no local fixed-disk readings).' } + foreach ($disk in $disks) { + if ($disk.Size -le 0 -or $null -eq $disk.FreeSpace -or $disk.FreeSpace -lt 0 -or $disk.FreeSpace -gt $disk.Size) { + $lines += "$($disk.DeviceID) | Unavailable (capacity or free space not reported)." + continue + } + $used = $disk.Size - $disk.FreeSpace + $freePercent = 100.0 * $disk.FreeSpace / $disk.Size + $lines += '{0} | {1} | {2:N1} | {3:N1} | {4:N1} | {5:N1}% | {6:N1}%' -f + $disk.DeviceID, $disk.FileSystem, ($disk.Size / 1GB), ($used / 1GB), ($disk.FreeSpace / 1GB), (100 - $freePercent), $freePercent + if ($freePercent -lt 10) { + $attention += '- Low disk space on {0} - {1:N1} GiB free ({2:N1}%; threshold: below 10%).' -f + $disk.DeviceID, ($disk.FreeSpace / 1GB), $freePercent + } + } + $lines += 'Scope: mounted local fixed disks with drive letters. GiB = 1,073,741,824 bytes.' + + $lines += '', '--- Attention Items ---' + if ($attention.Count) { $lines += $attention } + else { $lines += 'No low-disk/high-RAM thresholds triggered in the available readings.' } + $lines += '', '--- Snapshot Collection Notes ---' + if ($Snapshot.Issues.Count) { $lines += $Snapshot.Issues } + else { $lines += 'All workstation probes returned data.' } + $lines += 'Point-in-time resource snapshot; no folder-size traversal or Tune runtime probes.' + return $lines +} + +function Save-ScanReport { + param([Parameter(Mandatory = $true)][string]$Path, [Parameter(Mandatory = $true)][string]$Text) + $Text | Out-File -LiteralPath $Path -Encoding UTF8 -NoClobber -ErrorAction Stop +} + # ── Main ─────────────────────────────────────────────────────────────────────── Write-Host "" Write-Host "AppLens - Pre-Audit App Scanner" -ForegroundColor Cyan -Write-Host "Scanning installed applications..." -ForegroundColor Gray +Write-Host "Capturing workstation resources and installed applications..." -ForegroundColor Gray Write-Host "" +$scanStarted = Get-Date +$scanTimer = [Diagnostics.Stopwatch]::StartNew() +$workstation = Get-WorkstationSnapshot + # Collect Win32 apps $win32Apps = Get-Win32Apps @@ -421,14 +532,22 @@ foreach ($app in $win32Apps) { } # Collect Store apps -$storeApps = Get-StoreApps +$storeApps = @(Get-StoreApps) +$scanTimer.Stop() # Build output $output = @() $output += "=== AppLens Scan Results ===" $output += "Computer: $env:COMPUTERNAME" $output += "User: $env:USERNAME" -$output += "Scan Date: $(Get-Date -Format 'yyyy-MM-dd')" +$output += "Scan Date: $($scanStarted.ToString('yyyy-MM-dd HH:mm:ss zzz'))" +$output += 'Mode: Audit (read-only)' +$output += 'Collection duration: {0:N1} seconds' -f $scanTimer.Elapsed.TotalSeconds +$output += Format-WorkstationSnapshot -Snapshot $workstation +$output += '' +$output += '--- App Inventory Summary ---' +$output += "Desktop entries: $($desktopApps.Count + $m365Apps.Count) | Store entries: $($storeApps.Count) | Runtimes/frameworks: $($runtimes.Count)" +$output += 'Scope: registered desktop apps and current-user Store apps after filtering; portable/unregistered apps may be absent.' $output += "" $output += "--- Desktop Applications ---" @@ -473,7 +592,7 @@ if ($runtimes.Count -eq 0) { # Write to file $outputText = $output -join "`r`n" -$outputText | Out-File -FilePath $OutputPath -Encoding UTF8 +Save-ScanReport -Path $OutputPath -Text $outputText # Display results Write-Host $outputText diff --git a/README.md b/README.md index 4abef3a..262c38a 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,5 @@

- AppLens logo + AppLens logo

AppLens

@@ -11,13 +11,22 @@

Desktop CI Status - Platform + Store client platform

## Overview AppLens is CSI's mobile-OS-inspired local control board. It gives a workstation one place to see apps, agents, evidence, proposed actions, and operator approvals. +The first Store release is now centered on a quick client-session workflow: +install AppLens, scan, review a sortable app table, approve supported uninstalls, +and verify the result. Its approved launch target is **Windows 11 x64**; Windows 10 +and native ARM64 support are deferred. The scripts/platform work below has a +broader scope than this Store client. See [Product Vision](docs/AppLens-Product-Vision.md) for the +current product direction and proposed client design. The broader platform below +describes existing infrastructure and future possibilities, not requirements for +the first-release interface. + The platform is organized around apps/modules that publish state into CSI's proprietary blackboard layer: - **Scanner**: local workstation inventory and readiness evidence. @@ -26,7 +35,9 @@ The platform is organized around apps/modules that publish state into CSI's prop - **Planner**: operator planning for multi-step local work. - **Future modules**: Fleet, RAG, MCP, and Gov. -The current desktop app is the platform shell. It already hosts local scans, Tune diagnostics, dashboard read models, module status, exports, and blackboard-backed events. +The active desktop client runs the core inventory scan and report download. +Existing Tune diagnostics and the old window are preserved in +[future/AppLens-Tune](future/AppLens-Tune/README.md), outside the v1 build. ## Safety Model @@ -41,7 +52,11 @@ AppLens is local-first and operator-controlled: ## AppLens-desktop -AppLens-desktop is the WinUI 3 platform shell. It provides the local dashboard, machine summary, Scanner results, Tune diagnostics, module status, blackboard event views, and export options for JSON, Markdown, and local HTML reports. +AppLens is the WinUI 3 inventory client. It provides storage and device readings, +a searchable/sortable app table, confirmed Windows/vendor uninstall routes, +verification, local action history, and full JSON/Markdown/HTML downloads. +See the [uninstall route contract](docs/AppLens-Uninstall-Routes.md) and +[Store readiness](docs/Store-Readiness-Checklist.md) for verification limits. Tune actions are modeled as proposals, approvals, executions, and verification records. System-changing behavior must remain explicit, reversible where practical, and blackboard-recorded. @@ -59,7 +74,7 @@ Run locally: .\tools\Run-AppLensDesktop.ps1 ``` -Package smoke build: +Distribution candidate build (requires explicit authorization): ```powershell .\tools\Build-StoreCandidate.ps1 @@ -83,44 +98,71 @@ Double-click: ```text Run-AppLens.bat -Run-AppLens-Tune.bat +future\AppLens-Tune\Run-AppLens-Tune.bat ``` PowerShell: ```powershell powershell -ExecutionPolicy Bypass -File AppLens.ps1 -powershell -ExecutionPolicy Bypass -File AppLens-Tune.ps1 +powershell -ExecutionPolicy Bypass -File future\AppLens-Tune\AppLens-Tune.ps1 ``` ### macOS and Linux ```sh -chmod +x Run-AppLens.sh Run-AppLens-Tune.sh +chmod +x Run-AppLens.sh future/AppLens-Tune/Run-AppLens-Tune.sh ./Run-AppLens.sh -./Run-AppLens-Tune.sh +./future/AppLens-Tune/Run-AppLens-Tune.sh ``` Or run Python directly: ```sh python3 AppLens.py -python3 AppLens-Tune.py +python3 future/AppLens-Tune/AppLens-Tune.py ``` ## Outputs Script reports are written to the user's Desktop: -- `AppLens_Results_.txt` +- Windows Scanner: `AppLens_Results__.txt` +- macOS/Linux Scanner: `AppLens_Results_.txt` - `AppLens_Tune_Results_.txt` +The Windows initial scan includes machine/OS/CPU/GPU details, uptime, RAM usage, +total/used/free space and utilization for each local fixed disk, +low-disk/high-RAM flags, and the categorized app inventory. +Unavailable workstation readings are labeled explicitly. It uses lightweight +local queries without recursive folder scans or starting the Tune runtime probes. + +Windows scans preserve previous reports. An optional `-OutputPath` selects a new +report path; existing files are rejected. Script text reports contain local +computer/user identifiers; desktop-app export redaction is a separate feature. + +Run the Windows snapshot regression checks: + +```powershell +powershell -NoProfile -ExecutionPolicy Bypass -File tests\Script.Tests\Test-AppLensSnapshot.ps1 +``` + The desktop app exports: - JSON - Markdown - local HTML +After a scan, **Download report** (the download icon beside Scan this PC) saves the +selected Markdown, JSON or HTML report through the Windows picker, starting in +Downloads. Exports contain the full scan even when table filters hide rows. +The person can send that file for review; AppLens does not upload it. Personal +identifiers are redacted by default unless explicitly included. Alt+S starts a +scan and Alt+D downloads. See [client verification](docs/AppLens-Client-Verification.md) +and the [continuation handoff](docs/AppLens-v1-Handoff.md). +The [release validation review](docs/AppLens-Release-Validation.md) separates +completed checks from final installation, platform and Store work. + ## Repository Layout ```text @@ -133,4 +175,4 @@ assets/ Placeholder branding ## Project Status -AppLens is in preview. Scanner and Tune scripts are usable now. AppLens-desktop builds locally, has a package smoke build, and is being reframed as the CSI platform shell. Store submission still needs production branding, Partner Center identity, screenshots, a hosted privacy policy URL, and Windows App Certification Kit validation. +AppLens v1 is a local preview. The core client builds independently of the preserved Tune work. Store release still requires the remaining installed/clean-PC checks, owner-reviewed materials, Partner Center identity, published privacy/support URLs, and certification. Local builds do not establish Store availability. diff --git a/docs/AppLens-Client-Verification.md b/docs/AppLens-Client-Verification.md new file mode 100644 index 0000000..799b5da --- /dev/null +++ b/docs/AppLens-Client-Verification.md @@ -0,0 +1,65 @@ +# AppLens client verification — COP-239 + +Verified locally on 2026-09-13, Windows 11 Home build 26200, x64. +This closes the client/table scope of COP-239. Final installed release acceptance +remains COP-241; this is not Store certification or a clean-PC result. + +Evidence root (local only, excluded from Git): +`artifacts/cop239-client-26922a8cb41d482db372f2590b9c386e/`. +These local artifacts may contain workstation details; they are not public Store screenshots. + +## Changes and observed results + +| Check | Result and evidence | +| --- | --- | +| Silver client, disk summary, table and secondary panels | Live scan displayed 433 entries, with 158 ordinary apps in the default view. Latest completion was 0.52 s on this developer PC, not a performance guarantee. See `final-client.png` and `zero-visible-before-export.png`. | +| Duplicate names, suites and unknown sizes | Real Copilot entries remained separate by installation/type/scope. Largest-first placed the 2.31 GiB desktop entry ahead of unknown Store sizes; the suite entry remained distinct. See `duplicate-names.png`, `largest-unknown-last.png`. Presentation tests cover stable ordering, both size directions and combined publisher/scope/type/removal filters without mutating inventory. | +| Keyboard navigation | Tab/Shift+Tab reached controls and row actions; sorting/scope selection worked by keyboard. Alt+S scanned; Alt+D opened the picker; Enter opened the owned fixture confirmation; Escape cancelled. Focused off-screen actions scrolled into view. See `keyboard-row-action.png`, `night-sky225-confirmation.png`, `keyboard-cancel-verification.json`. | +| Text scaling and resizing | At 225% text size, opening details originally consumed the table viewport. A bounded virtualized list and scrollable page now keep results and both panels reachable. Wrapped headers use the same column widths as rows. Live retest included 1280×880 and 960×760 windows, expanded details/history, horizontal and vertical scrolling. Before/after evidence: `text225-*.png`. | +| High contrast | Windows Night sky and Desert themes tested at 225%, including selection, focus, scrolling and cancellation. System contrast resources remained readable. See `night-sky225-*.png`, `desert225-selection.png`. | +| Accessible names | Live UI Automation originally exposed the class name for a row. Rows now expose app name, version, publisher, scope, type, size and status; action names also distinguish version/scope/type. A regression failed before the fix. See `final-accessibility-tree.txt` and the 12 passing presentation tests. Audio with an actual screen reader remains a release check. | +| Download and cancellation | Picker opens in the current user's Downloads folder. Escape retained results. Enter saved a new JSON report with zero visible rows; all 433 entries and seven actions remained in the report, matching the ledger, with user/computer identifiers redacted. See `picker-downloads-after-fix.png`, `picker-cancel-results-retained.png`, `report-saved-zero-visible.png`, `final-report-verification.json`. | +| Restoration and cleanup | Original Custom theme restored, high contrast off, text size 100%. The owned registry-only fixture was checked present after cancellation and then removed; it had no payload. No working app was removed during this review. See `display-restored.json`, `ui-fixture-cleanup.json`. | + +The picker uses the installed App SDK 1.8's +[SuggestedFolder](https://learn.microsoft.com/en-us/windows/windows-app-sdk/api/winrt/microsoft.windows.storage.pickers.filesavepicker.suggestedfolder?view=windows-app-sdk-1.8) +with [UserDataPaths.Downloads](https://learn.microsoft.com/en-us/uwp/api/windows.storage.userdatapaths.downloads?view=winrt-26100). +The location suggestion alone retained Windows' previously visited folder during +testing; the explicit known-folder path opened Downloads. No SDK upgrade was needed. + +## Build and report evidence + +- Final x64 and ARM64 desktop builds: zero warnings/errors. ARM64 was compiled, + not run on ARM64 hardware. +- Core tests: 94 passed, comprising 82 backend and 12 presentation tests. + Separate TRX files are in `final-tests/`; earlier red-test evidence remains in `tests/`. +- Saved report: `C:\Users\codyl\Downloads\AppLens-20260913-174908-731.json`. + Evidence copy: `client-export-zero-visible.json`. +- SHA-256: `97D83ADEEC9B505041910DECEFBE10F1C7DA9BA62D609F352948A2164044F4B4`. +- Seven recorded outcomes: four Removed, three Cancelled. The extra cancellation + came from this review's disposable fixture. Earlier records were not rewritten. +- Earlier COP-240 evidence covers real packaged Store/MSI/vendor flows, native + UAC denial/approval, independent absence verification and history reload. + +## Later computer-use checks — COP-241 + +Computer use initially stopped at the user's request, then resumed with explicit +permission on 2026-09-14. The [release validation](AppLens-Release-Validation.md) +records the new lifecycle checks and current package-installation boundary. +Do not repeat completed checks unless a new package, changed behavior or a +failure warrants it. + +1. On the final installed candidate, verify scan → filter → exact-target removal + → refresh → download/read report on a clean standard-user Windows PC, including + offline operation. Downloads now passed in the fresh installed development + package on 2026-09-14; retain a final-candidate spot check. +2. Use an actual screen reader to check announcements, row/action names and modal + focus recovery. Recheck text/contrast/layout on the final package as needed. +3. A genuine managed-policy denial remains. NoRemove protection, real failed/slow + uninstallers and app closure/reopening passed on 2026-09-14 with owned fixtures. + Native administrator prompts require the user. +4. Run the claimed Windows 10 and ARM64 configurations on appropriate systems, + measure installation/launch/footprint, and perform final certification checks. + +See the [reviewed continuation handoff](AppLens-v1-Handoff.md) for release inputs, +authorization boundaries, commands and the complete next-step order. diff --git a/docs/AppLens-Platform-Scope.md b/docs/AppLens-Platform-Scope.md index cd0d635..8c21775 100644 --- a/docs/AppLens-Platform-Scope.md +++ b/docs/AppLens-Platform-Scope.md @@ -2,6 +2,16 @@ ## Position +The first Store release follows [Product Vision](AppLens-Product-Vision.md): quick +inventory, a sortable app table, explicit supported uninstall actions, and result +verification during a client screen-share session. The platform architecture +below supports that flow; its module catalog is not the first-release UI scope. + +The existing AppLens-Tune is intentionally deferred to `future/AppLens-Tune/`. +Core v1 must build and run independently of it; shared infrastructure needed by +inventory, uninstall, or export remains in the normal backend. The product vision +defines the separation-first delivery sequence and verification requirements. + AppLens is CSI's local control board for workstation apps and agents. It borrows from mobile operating systems: a shell hosts focused apps, each app declares capabilities, and shared services handle state, permissions, evidence, and handoffs. The differentiator is CSI's proprietary blackboard technology. Scanner, Tune, Planner, and future modules do not pass around ad hoc files or hidden state. They publish evidence, status, proposed actions, approvals, and verification records into a local blackboard that can be indexed, audited, redacted, and exported. @@ -10,7 +20,8 @@ The differentiator is CSI's proprietary blackboard technology. Scanner, Tune, Pl - **Platform shell**: WinUI desktop control board for local modules, operator decisions, and exports. - **Scanner**: local evidence collection for installed apps, runtime state, tooling, storage, and readiness. -- **Tune**: diagnostic plan, approval-gated action path, execution records, and verification. +- **AppLens-Tune (deferred)**: preserved deeper diagnostics and optimization work; + not part of the v1 launch, scan, uninstall, or export dependency path. - **Blackboard**: local append-only event layer backed by JSONL and SQLite indexing. - **Planner**: planning surface for multi-step work across local modules. - **Future modules**: Fleet, RAG, MCP, and Gov. @@ -41,4 +52,8 @@ Module detection and module execution are separate states. A module can be confi ## Distribution -Microsoft Store packaging remains a distribution track for the Windows shell. It is not the product strategy. Store readiness should prove that the shell is installable, transparent, local-first, and operator-controlled. +Microsoft Store installation is central to the first-release customer journey. +Store readiness must prove that the client is lightweight, installable, +transparent, local-first, and operator-controlled. Availability in the Store and +capability approval must be verified through Partner Center, not inferred from a +successful local package build. diff --git a/docs/AppLens-Privacy-Draft.md b/docs/AppLens-Privacy-Draft.md new file mode 100644 index 0000000..f77d860 --- /dev/null +++ b/docs/AppLens-Privacy-Draft.md @@ -0,0 +1,58 @@ +# Installed privacy policy — publication draft + +Installed collects information locally when you start a scan. This includes installed +app names, versions, publishers, installation identities and locations, reported +sizes, removal information, local disk capacity and usage, Windows/device details, +processor and graphics names, memory usage, uptime, computer name and Windows username. + +Installed v1 does not collect top-process rankings or run the deferred AppLens-Tune +diagnostics. It does not include accounts, telemetry, automatic uploads, cloud +analysis, background monitoring, or automatic report sharing. + +Uninstall actions require your confirmation. Windows or the app vendor may request +additional approval. Installed records the selected installation, mechanism, +timestamps, outcome, verification and observed disk readings in local action +history under the current user's local application data (the internal AppLens folder name is retained). Closing Installed before +completion can leave an unknown outcome; review it in Windows and run a fresh scan. +Uninstalling an app can delete that app's data. Installed does not provide an undo +facility for third-party uninstalls. + +Reports are saved only when you choose a local destination. They contain the full +captured inventory and recorded actions, including entries hidden by display +filters. Computer/user identifiers and profile paths are redacted by default. +You can explicitly include personal identifiers. Redaction is not a guarantee +that a report contains no sensitive information; review it before sharing. +Installed does not send the report to a consultant or AI service. Any sharing you +perform afterward is your choice and is subject to the recipient's practices. + +Local history and saved reports remain on your device until removed by you or by +Windows' applicable app-data handling. Exported files are separate from the app. +Windows, Microsoft Store and third-party uninstallers have their own policies. + +Installed encrypts new action-history records using Windows data protection tied +to your current Windows user. It does not create a separate plaintext history +index. Recovery depends on the Windows profile that protected the records; copying +the file to another account or losing that profile may make it unreadable. This +protection does not prevent software running as your Windows user from reading +the history. If history cannot be read or safely extended, Installed reports the +problem and cannot start a new uninstall that requires recording approval. + +Reports you explicitly save are ordinary readable files, not encrypted by +AppLens. Default report redaction applies to exported content, not to the +underlying history while it is being processed. Review reports before sharing +and use appropriate Windows access permissions and device protection. + +If you used a pre-release development build, its older JSON Lines history and +SQLite index remain unchanged and unencrypted. The new client can read that +history but does not automatically migrate, rewrite or delete it. New records +are written separately with Windows protection. Existing reports also remain +unchanged. + +Before publication, the owner must add the verified publisher/legal identity, +contact channel, effective date, and any applicable jurisdiction-specific text. +This draft has not been published and is not a substitute for legal review. +The owner delegated the privacy design and local release preparation on 2026-09-16; +the protection described above is implemented and locally tested. Complete the +final installed-profile and retention checks in the +[submission preparation packet](AppLens-Store-Submission-Plan.md) before publication. +Do not promise automatic history deletion on uninstall without supporting evidence. diff --git a/docs/AppLens-Product-Vision.md b/docs/AppLens-Product-Vision.md new file mode 100644 index 0000000..76c838a --- /dev/null +++ b/docs/AppLens-Product-Vision.md @@ -0,0 +1,198 @@ +# AppLens v1: executable task list + +Build a lightweight Microsoft Store app for a guided screen-share session: +**scan -> review apps and storage -> approve removals -> download results for AI review.** + +## AppLens v1 implementation boundary + +- Ship the first Store release for Windows 11 x64; defer Windows 10 and native ARM64. +- Keep C#/.NET and WinUI 3. Reuse the existing scanner, reports, and shared services. +- Use one scan record for the table and exports. Do not parse the PowerShell text + report. Preserve distinct installation identities, including duplicate app names. +- Aim for about one second to first useful results; measure it. Show partial results + and unavailable readings honestly. No fixed delay before enabling actions. +- Use a silver, restrained metallic client with crisp edges, matte-black type, + one main app table, and secondary device details/action history. +- Keep scans read-only and local. No accounts, telemetry, automatic uploads, + automatic remediation, forced deletion, or automatic restarts. +- Preserve existing AppLens-Tune in `future/AppLens-Tune/`; core v1 must have no + runtime or build dependency on it. Keep shared infrastructure in the backend. + Defer startup/service optimization, top-process rankings, deeper diagnostics, + and recursive app-folder sizing. Do not redesign Tune or move the inventory + scripts into a legacy folder. + +### Customer installation and distribution + +The owner confirmed Microsoft Store distribution on 2026-09-18. Keep the AppLens +website as an entry point with an installation button linked to the Store; a +separate direct-download installer is outside the current release plan. + +The owner and prospective clients need a normal installed app: click Install, +then open AppLens from its icon, including a desktop shortcut. Complete and verify +that experience without requiring terminal commands, developer tools, Developer +Mode, manual certificate trust or manual runtime installation. Desktop-shortcut +creation is an acceptance requirement, not an assumed default of Store installation. +Verify reopening, updating and removing AppLens, with accurate history/report +retention behavior. See the [submission plan](AppLens-Store-Submission-Plan.md) for +the website installer option and its eligibility limits; pricing remains undecided. + +### Data and download requirements + +| Area | Required content | +| --- | --- | +| Summary | Disk total/used/free and percentages, app count, capture time, scan coverage | +| App table | Name, publisher/version, reported size, scope, app type, removal status, action | +| App details | Stable identity, size source, relevant install location, restriction evidence, reliable install/servicing date | +| Device details | Windows version, CPU/GPU, RAM capacity/utilization, uptime | +| Action history | Confirmed target, mechanism, timestamps, outcome, verification, observed disk change | + +Missing sizes display as **Unknown**, sort after known sizes, and never imply zero. +Reported size is not guaranteed recoverable space. Scope labels are **This user**, +**All users**, or **Unknown**; scope does not prove who installed an app. +Classify runtimes, updates, drivers, and protected components separately from +ordinary apps. Display groups are not uninstall targets; servicing dates are not +last-used dates. + +Keep a visible download icon labeled **Download report**. Save locally through the +Windows picker: Markdown by default, with existing JSON/HTML options retained. +Export the complete captured inventory despite display filters, including unknown +values and action outcomes. Redact personal identifiers/profile paths by default, +with explicit raw-detail opt-in. Export a consistent snapshot and protect existing +reports from silent overwrite. The person sends the file to the consultant. + +## Uninstall behavior and Microsoft requirements + +Support ordinary MSI, vendor-uninstaller, and eligible Store/MSIX apps, including +admin-required apps. Revalidate the exact local target, confirm the action, use +supported Windows/vendor mechanisms, and preserve UAC and organization controls. +Validate executable paths/arguments; never run commands from imported reports or +interpret arbitrary registry text through a shell. + +Show confirmed or possible administrator requirements, managed/protected status, +and unsupported routes truthfully. Enable a row only after its identity and route +are resolved and implemented. Explain relevant data-loss/restart requirements. +Offer cancellation only when supported; opening Windows Installed Apps is a +handoff, not successful removal. Verify removal and show observed disk change. + +Use these references during task 3 and recheck requirements for the release: +[Store policies](https://learn.microsoft.com/en-us/windows/apps/publish/store-policies), +[package removal](https://learn.microsoft.com/en-us/uwp/api/windows.management.deployment.packagemanager.removepackageasync?view=winrt-26100), +[capabilities](https://learn.microsoft.com/en-us/windows/apps/package-and-deploy/app-capability-declarations), +[packaging/process model](https://learn.microsoft.com/en-us/windows/apps/get-started/intro-pack-dep-proc), +[installer metadata](https://learn.microsoft.com/en-us/windows/win32/msi/uninstall-registry-key), +[Windows Settings](https://learn.microsoft.com/en-us/windows/apps/develop/launch/launch-settings). +Do not assume changing language grants permissions, add restricted capabilities +without establishing a need, or claim Store approval from local tests. + +## Ordered tasks for Linear + +Create **one issue per task below only when the user requests the Linear upload**. +Execute in order, with each issue depending on the previous one. One agent owns +the work; **no subagents**. Shared requirements above apply to every issue. + +### 1. Separate and preserve AppLens-Tune + +- [ ] Map core/shared/Tune dependencies before moving files. +- [ ] Move Tune-specific code, tests, and supporting docs into + `future/AppLens-Tune/`; update references and preserve shared services. +- [ ] Add a README with entry points, dependencies, verified/unfinished state, + reason for deferral, and resumption instructions. + +**Done when:** the core builds, launches, scans, and exports with Tune unavailable; +no background Tune work runs, and all relocated work is accounted for. + +**Start in:** `AuditService.cs`, `TuneCollector.cs`, `Models.cs`, desktop bindings, +reports, and project references. + +### 2. Connect the quick scan to the table and reports + +- [ ] Extend the shared scan record with the data requirements above. +- [ ] Collect app metadata and disk/device readings without deep diagnostics; + keep useful results if an optional reading fails. +- [ ] Bind a basic table and existing report writers to that record; keep the + download control, redaction, and capture state working. + +**Done when:** a native scan produces matching rows and saved reports; distinct +identities and unknown values survive; cancellation/partial results work; actual +first-results and completion timings are recorded. + +**Start in:** `Models.cs`, `InventoryCollector.cs`, `AuditService.cs`, +`ReportWriter.cs`, `RedactionService.cs`, and `MainWindow.xaml.cs`. + +### 3. Verify the Windows uninstall routes + +- [ ] Check the current manifest and Microsoft requirements for MSI, vendor-EXE, + and current-user MSIX removal. +- [ ] Use a small development-package test with disposable apps to establish + supported routes and administrator/UAC behavior before building the full UI. +- [ ] Record the chosen routes, evidence, restrictions, and required capabilities + for task 5. Resolve unsupported requirements before dependent work proceeds. + +**Done when:** task 5 has a concrete mechanism and evidence for each proposed route; +untested cases and any required external approval are explicit. + +**Start in:** `Package.appxmanifest`, `AppLens.Desktop.csproj`, existing action +services, and the Microsoft references above. Use an authorized test environment; +do not remove the user's working apps. + +### 4. Finish the client and results table + +- [ ] Apply the silver/metallic design, compact disk summary, main table, and + secondary device/action panels. +- [ ] Add search by app/publisher, name/size/publisher sorting, scope/type/removal + filters, supporting details, and clear scan/action states. +- [ ] Finish the download interaction and prepare the confirmation/status UI + using task 3 findings; keep unfinished removal actions disabled. + +**Done when:** duplicate names, suites, unknown sizes, and large inventories display +correctly; filtering leaves full exports intact; save/cancel, resizing, keyboard +navigation, text scaling, and high contrast work. + +**Start in:** `MainWindow.xaml`, `MainWindow.xaml.cs`, and presentation tests. + +### 5. Implement removals and update their results + +- [ ] Connect the verified routes to exact-target confirmation, appropriate + Windows approval, and local action recording. +- [ ] Handle denied approval, cancellation, restrictions, missing uninstallers, + failure, and restart-required results without breaking the scan. +- [ ] Verify removal, refresh disk readings, and update the row, action history, + and downloadable report from the same outcome. + +**Done when:** real disposable-app removals are verified; admin cases are exercised; +the UI and report agree on outcomes. Distinguish live tests from simulated cases. + +**Start in:** the shared action services/`BlackboardStore.cs`, desktop handlers, +and `ReportWriter.cs`; keep Tune dependencies excluded. + +### 6. Validate the complete app and prepare the Store release + +- [ ] Finish and verify the install/open experience, including a desktop shortcut, + reopening after installation and an update that preserves history and launch + access. Prepare the website's Store installation entry point; verify actual + Store delivery only after authorized publication. +- [ ] Run the full relevant tests and the installed flow on a clean standard-user + Windows PC: scan -> filter -> uninstall -> verify -> download/read report. + Include failure states and confirm Tune independence. +- [ ] Measure launch/scan speed, package and installed size, prerequisites, and + supported architectures; fix failures and retest affected behavior. +- [ ] Prepare final identity/assets, screenshots, privacy/support URLs, capability + justification, and certification evidence using the Store readiness checklist. + +**Done when:** the customer flow has recorded evidence and release materials are +ready; unresolved requirements are listed. Use the handoff's recorded local +packaging authorization; hosting, submission and publication remain separate +approval gates. Local tests do not establish certification; Store installation +is verified after publication. + +**Start in:** solution tests, desktop run/build guidance, and +[Store readiness checklist](Store-Readiness-Checklist.md). + +## Working rules + +- Run focused checks with each change; perform the comprehensive review in task 6. + Do not repeat the full release review after every task. +- When Linear work begins, record progress, decisions, and test evidence there; + keep this document as scope and acceptance criteria, not a duplicate status log. +- Resolve consequential uncertainty before relying on it. Do not expand scope, + silently drop required functionality, or request approval for every routine step. diff --git a/docs/AppLens-Release-Validation.md b/docs/AppLens-Release-Validation.md new file mode 100644 index 0000000..87a9adf --- /dev/null +++ b/docs/AppLens-Release-Validation.md @@ -0,0 +1,308 @@ +# AppLens release validation — COP-241 + +## Installed name and Store identity — 2026-09-23 + +The owner reserved Installed and approved applying the name and official identity. +Partner Center showed the MSIX/PWA product In draft; nothing was submitted. + +- Store ID: 9PBPFLL6JVVV. +- Package name: CopperStateIntelligence.Installed. +- Publisher: CN=EF287C88-DDD2-4A49-8AC9-E4AE3A998DED. +- Publisher display name: Copper State Intelligence. +- Package family: CopperStateIntelligence.Installed_s3n4tkq635xf8. + +Updated the window/header, removal messages, report titles/default filenames, +manifest and publication drafts. Repository/project/assembly names, storage paths, +DPAPI purpose and legacy event identifiers remain AppLens for compatibility. +No existing history or reports were rewritten. Tune remains deferred. + +Build-StoreCandidate.ps1 passed: 104 core tests (92 backend, 12 presentation) +and Windows 11 x64 configuration check. Actual nested package manifest matches +all three Partner Center identity values, Installed display name, x64, minimum +Windows build 22000 and runFullTrust. WACK was found but not run. + +Unsigned candidate: artifacts/store-candidate-20260923-141404-0177375/install/ +AppLens.Desktop_0.1.0.0_x64.msixbundle; 48,568,595 bytes; SHA-256 +07C8B0B93F2C7F35223C7C668CD3977B04C93AA3A27D4FD0580E323E3C6E2738. +The internal artifact filename does not determine the Store display name. +Test TRXs are in that candidate directory. Earlier lifecycle evidence is retained; +no install/uninstall test was repeated and no Store upload occurred. + +Remaining: replace/review the old angular-A artwork; clean-PC installed checks, +shortcut/reopen/update, accessibility, protected-history retention/cross-user, +managed-policy denial and final WACK; pricing/markets/IARC, approved screenshots, +and published privacy/support destinations. The new Store identity is not an +in-place update of the earlier placeholder/test packages; test history/launch +behavior explicitly. Submission, publication, hosting and merge remain held. + + +Updated 2026-09-18. This document separates completed source checks from the +remaining installed-app checks. The initial source review used no desktop control. +The owner subsequently authorized resuming AppLens computer-use tests, with +native approval prompts reserved for their return. + +## Distribution decision and added acceptance detail — 2026-09-18 + +The owner confirmed continuing with Microsoft Store distribution, with the website +as an installation entry point. The final customer experience must include simple +installation, a desktop shortcut and double-click launch. These are requirements, +not new test results. Add shortcut/reopening and controlled same-identity upgrade +checks to the final-candidate session, including preservation of history and launch +access. Verify actual website/Store delivery after authorized publication and +Store updates when an approved update is available. The +[submission plan](AppLens-Store-Submission-Plan.md) covers the conditional website +installer and undecided pricing; no separate direct-download channel is planned. + +This was a documentation-only pass; retained 2026-09-16 checks below were not rerun. +No release approval, installed result or certification result changed. + +## Latest privacy and packaging verification — 2026-09-16 + +The owner delegated privacy and local authorization/preparation decisions after +the Windows 11 x64 change was pushed as `425c934`. Implemented Windows current-user +DPAPI for new removal-history records, no plaintext index, read-only compatibility +with preserved legacy logs, and explicit unavailable-history UI/report coverage. +Accounts, telemetry, uploads and removal-approval behavior remain unchanged. +See the [privacy/storage decision](AppLens-Store-Submission-Plan.md#privacy-and-authorization-decision--implemented-2026-09-16). + +| Check | Observed result | +| --- | --- | +| Privacy regression | Failed against the previous plaintext store, then passed against protected storage. New tests cover round-trip/no plaintext copies, legacy log/index preservation, latest completed outcome/querying, unknown/damaged/tampered data, missing terminal newline, approval-persistence failure preventing execution and reopened action/report consistency. | +| Full core suite | 104 passed: 92 backend, 12 presentation. Ten new privacy cases plus the retained 94 tests. | +| Preserved Tune suite | 58 passed after the shared query helper extraction; Tune remains deferred and outside the v1 package. | +| Separate-process recovery | A synthetic record written by one process reopened under the same Windows user in another process. No plaintext fixture string or secondary file was present. This is not a cross-user or packaged-profile test. | +| Existing history | Read-only default `RemovalService` recovered eleven actions. Hashes of every existing runtime file before/after matched; no protected file was created by reading. | +| Dependencies | After adding ProtectedData 10.0.12, NuGet reports no known vulnerabilities for the four core projects from the configured source. | +| Build/tooling | Store configuration check and candidate script passed. Fixed discovery of installed `mspdbcmf.exe` and WACK; symbol conversion now runs without the prior warning. WACK was found but not run. Test results are retained per candidate. | +| Final compilation | Publish after the reviewed history-warning UI adjustment passed without warnings/errors. The UI warning is source/build verified; native rendering/speech remains part of the final installed check. | +| Actual bundle inspection | One x64 application package, minimum Windows 10.0.22000.0, .NET runtime and ProtectedData assembly included, compiled resources present, only runFullTrust capability. Windows App Runtime 1.8 remains a framework dependency (minimum 8000.836.2153.0). No deferred Tune, probe, ledger, database evidence or raw report paths. | + +The final local unsigned candidate uses placeholder identity `CSI.AppLensDesktop` +/ `CN=CSI`, version `0.1.0.0`. It is **not ready for Store upload**: + +- Directory: `artifacts/store-candidate-20260916-011555-3476646/install/`. +- Bundle: `AppLens.Desktop_0.1.0.0_x64.msixbundle`, 48,761,419 bytes. +- SHA-256: `B65A7A56C6B03DC2552B71BBBFB10944D4B7E1E3351E12D285BC16D3C75591B6`. +- Inner package: 257 entries, 124,283,361 uncompressed entry bytes. This is archive + content size, not measured installed footprint or Store download size; shared + framework prerequisites are separate. + +Evidence: `artifacts/cop241-privacy-20260916-010513/` contains pre/post privacy logs, +Tune TRX, separate-process and legacy checks, dependency audit, packaging logs, +`candidate-inspection.json` and `package-entries.json`. All 104 core-test TRXs are +under `artifacts/store-candidate-20260916-011102-4248971/test-results/`. Failed and +superseded attempts are retained. The final UI adjustment only changes warning +propagation when history loading finishes after a scan; the final publish compiled +it without rerunning unrelated lifecycle tests. + +Existing plaintext development history was not retroactively encrypted; no raw +evidence or report was rewritten. The previously successful installed/uninstall +lifecycle evidence below is reused. No native prompt, live removal, installation, +certificate trust, policy change, WACK, hosting or Store action was performed. +Final installed-profile recovery/cross-user denial and retention remain open, +alongside clean-PC/Narrator/focus/managed-policy and Partner Center gates. + +## Earlier unattended scope preparation — 2026-09-16 + +- Verified the existing worktree is `Projects\.worktrees\AppLens\codex-applens-v1-quick-client` + (the continuation prompt omitted the separator before `.worktrees`). It started + clean on the requested branch; local and GitHub both pointed to + `9be420b50b3ce42d3196eada91834b24773427bd` in `CSI-Platform/AppLens`. +- Linear COP-241 is In Progress; COP-240 is Done. GitHub reported no PR and no + workflow runs for this branch. The workflow currently triggers on main pushes + or PRs to main, so the retained tests are local evidence, not a CI pass. +- Source/tools/tests have not changed since `5230228`; `9be420b` changed three + evidence documents only. Reused the installed/uninstall lifecycle results. + Both the original installed JSON export and its local evidence copy still match + the recorded SHA-256. Retained TRXs contain 82 backend + 12 presentation passes, + zero failures. Initially reused without rerunning; the later approved target + change below justified a new build/test pass. +- Refreshed the time-sensitive NuGet advisory check with + `dotnet list AppLensDesktop.sln package --vulnerable --include-transitive --no-restore`: + no vulnerable packages reported for the four solution projects by the configured + NuGet source. No dependency version change or package generation was performed. +- Verified dimensions of the five original AppLens PNG assets and that WACK + 10.0.26100.7705 is installed. Neither result establishes final package acceptance. +- Prepared the [submission packet](AppLens-Store-Submission-Plan.md), reconciled + stale paused-control/picker/test checklist items, and added factual storage + disclosure to the privacy draft. Tune remains deferred. + +### Owner-approved Windows 11 x64 launch scope + +The owner selected **Windows 11 x64 first** on 2026-09-16 and then requested all +remaining unattended work while they sleep. Updated the desktop target framework +and minimum OS to build 22000, the manifest minimum to match, and project/runtime/ +bundle architectures to x64 only. Updated the launcher path and current build/ +listing documentation. Existing Windows App SDK and build-tool package versions +are unchanged; shared backend/test API targets remain at 19041. + +The Store configuration check first failed for the old multi-architecture bundle, +then separately for the old Windows minimum. It now passes for the evaluated +Windows 11 x64 configuration, including bundled .NET and Store-managed Windows App +SDK frameworks. Restore and x64 Release build passed with zero warnings/errors; +all 94 core tests passed again (82 backend, 12 presentation). This rerun was needed +because the desktop target changed. See `windows11-*-before.log`, +`windows11-scope-after.log`, `windows11-restore.log`, `windows11-build.log` and +`windows11-tests/` under the evidence directory below. +The post-restore advisory query again reports no known vulnerable packages. +Evaluated package content/project references contain no deferred Tune, removal +probe or raw report paths. The launcher parses successfully; it was not launched. + +Windows 10 and native ARM64 runtime acceptance are now deferred by the owner, +not passed. x64 emulation on ARM64 is not validated; check final Store device +availability before submission. The new target has not been installed or tested +interactively. Retain the prior lifecycle evidence and perform the planned final- +candidate spot check. No native prompt, installed-client replacement, distribution +package, hosting action or Store action was started while the owner was away. + +Evidence: `artifacts/cop241-submission-prep-20260916-003337/`, including +`evidence-reuse.json`, `artwork-dimensions.json` and `dependency-audit.log`. +Existing reports, raw evidence, installed apps and system settings were untouched. +The current tool session does not expose native desktop control. Narrator/focus +tests need owner operation or a later native-control session; native approvals +remain the owner's responsibility. + +## Retained source verification — 2026-09-14 + +| Evidence | Result | +| --- | --- | +| Release builds | x64 and ARM64 compile with zero warnings/errors. Compilation alone does not validate ARM64 hardware. | +| Core tests | 94 pass: 82 backend, 12 presentation. Covers partial/cancelled scans, filters/identity, protected routes, literal uninstaller arguments, approval recording, changed-target rejection, independent removal verification, failure outcomes and history recovery. | +| Preserved Tune | 58 tests pass. All 24 preservation-manifest destinations exist; 18 hashes are unchanged and six have the documented separation adaptations. | +| Windows snapshot | All five script check groups pass, including unknown readings and refusal to overwrite evidence. | +| Dependencies | NuGet reports no known vulnerabilities for the four core solution projects at review time. | +| Read-only backend smoke | 433 entries, 198 reported sizes, one disk, complete coverage; first results 0.523 s and completion 0.524 s on the developer PC. JSON/Markdown/HTML written locally. This is not an offline or clean-PC result and does not reload desktop action history. | +| Package input review | Evaluated desktop content/project references exclude deferred Tune, removal probes and local reports. Only runFullTrust is declared. | +| Runtime configuration regression | Initially failed because the Store settings required a separate .NET installation. Packaged builds now bundle .NET while using Store-managed Windows App SDK framework dependencies. The evaluated x64/ARM64 checks pass; actual installed delivery remains unverified. | +| Git destination | Main product repository `https://github.com/CSI-Platform/AppLens.git`; existing branch `codex/applens-v1-quick-client`. No AppLens-SSH/AppLens-LLM repository is involved. | + +Local evidence is under `artifacts/cop241-source-20260914-1e406cb1/`. +Logs, scan reports, screenshots, runtime payloads and other machine evidence stay +out of Git. See [client verification](AppLens-Client-Verification.md) for the +earlier live UI evidence and the [handoff](AppLens-v1-Handoff.md) for continuation. + +The new `tests/Script.Tests/Test-StoreConfiguration.ps1` evaluates actual MSBuild +properties without building a package. It is configured to run in CI and before +the separately authorized Store-candidate builder. The builder starts from x64; +the 2026-09-16 scope change above now restricts the project/bundle to x64. + +## Remaining hands-on checks for owner review + +### Live lifecycle checks completed on 2026-09-14 + +The current x64 Release client was exercised on the developer PC using four +owned, per-user registry fixtures and a bounded executable that only logged its +start/exit and returned code 13. No working application was removed. + +| Check | Observed result | +| --- | --- | +| Declared protection | NoRemove=1 appeared as Removal restricted with a disabled action. This is not a managed-PC policy-denial test. | +| Real failed process | The fixture exited with code 13; AppLens showed Failed, retained the entry and recorded StillInstalled=true. | +| Real slow process | After the production three-minute timeout, AppLens showed Still running, retained the entry and blocked a retry. The helper exited naturally after 200 seconds; its log confirms only one launch. Scan/export stayed disabled during execution, including Alt+S. | +| Closure during execution | AppLens was closed while the 90-second helper remained running. Reopening restored Outcome unknown with rescan/review guidance; it did not claim removal. The helper subsequently exited naturally. | +| Download after reopening | The client saved JSON to Downloads with all 437 entries (433 baseline plus four fixtures) and all ten actions. Failed, Still running and Outcome unknown matched the UI and ledger; personal identifiers were redacted. | +| Cleanup | All four exact registry keys were ownership-checked and removed; no helper remained running. Text size 100%, Custom theme and high contrast off were unchanged. Evidence and ledger history were preserved. | + +Local evidence: `artifacts/cop241-live-63a8a7fdb352457da74b8b70569b5fb3/`. +See `live-verification.json`, process logs, `reopened-history.png`, +`fixture-ledger-final.json` and `reopened-client-export.json`. +The original report is `C:\Users\codyl\Downloads\AppLens-20260914-190036-670.json`, +SHA-256 `8AE94CA15B171A6FAD909FA19CCC5CCE00B3E6980242EB4D469353D1B83D1EDC`. + +A fresh disposable development client and package fixture were built and hash- +checked under `artifacts/removal-preflight-d51377dddcd24574bab23311c5b823dd/`. +The compiled-resource identity check passed. The owner approved the native +Windows prompt and both packages installed. The client launched from WindowsApps, +scanned 435 entries in 0.60 s, filtered to its two packages, disabled its own +uninstall action, and removed the exact different-publisher disposable package. +Independent package enumeration confirmed absence; the table refreshed to 434 entries. + +The installed picker opened Downloads; Escape retained results, and saving JSON +retained all 434 entries and eleven actions despite the table showing one row. +The new Removed record matched independent absence and the history; personal +identifiers were redacted. See `installed-verification.json`, `installed-*.png` +and `installed-client-export.json`. Original Downloads report: +`AppLens-20260914-190622-706.json`, SHA-256 +`097C83A99C831671BA8209A24167436334A4CACE0C8CFB1232080740638FDE1D`. + +After the usage interruption, a fresh check confirmed that hash, all eleven +ledger correlations, fixture absence and unchanged display settings. No client +or fixture process was running. The development client remains installed for +later review; the disposable package is removed. See `post-reset-verification.json`. +This is a development identity with bundled runtimes, not final Store framework +delivery, clean-PC or certification evidence. Spoken screen-reader behavior was +not tested. The automation tool returned no accessibility tree for this installed +identity; this alone does not establish whether Narrator can read it. A packaged +keyboard/focus check should include reopening the picker after cancellation: +one automated Alt+D attempt did not open it, while clicking Download worked. + +### Reduced remaining checks + +These are recommendations for launch confidence, not claims that Microsoft +mandates this exact internal test list. Do not silently mark a skipped test passed. + +| Check | Recommendation | Smallest useful pass / what can be reduced | +| --- | --- | --- | +| Clean-PC installed customer flow | Keep before launch | One clean standard-user Windows PC or VM: install, launch, scan, filter, remove an owned fixture, verify, save/read a report, close/reopen. Confirm no manual .NET setup. Include AppLens's own Windows uninstall and reinstall behavior. | +| Offline operation and final picker | Combine with the clean-PC pass | Disconnect networking in the test environment after installation; scan/export. Check Downloads and cancel/save in the final package. No separate repeated desktop session needed. | +| Managed-PC policy denial | Keep in an appropriate test environment | Failed/slow processes, NoRemove protection and close/reopen now have live evidence above. A genuine Windows policy denial still needs a managed test environment; do not change the working PC's security policy just to manufacture it. | +| Administrator prompts | Reuse completed COP-240 evidence unless package behavior changes | Native UAC denial and approval already passed on the developer PC. A fresh standard-user credential handoff can be folded into the clean-PC test. The user must handle any prompt. | +| Actual screen reader | Keep a short pass | Scan/status announcements, one row and its action, confirmation/cancel and focus recovery. UI Automation names were checked; spoken behavior was not. | +| Full keyboard/text/contrast matrix again | Defer the full repeat | The 100%/225%, Night sky/Desert, resize and keyboard checks passed in COP-239. Recheck only affected behavior or one final-package spot check if unchanged. | +| Windows 10 and native ARM64 | Deferred by owner on 2026-09-16 | Windows 11 x64-first scope is applied to project, manifest and listing. Do not claim these deferred runtimes passed. Confirm Store availability because Windows 11 ARM64 can emulate x64. | +| Windows App Certification Kit | Keep for final candidate | Although command-line driven, WACK needs an active user session and administrator context and may launch the app. Schedule it with the hands-on work. No final-package WACK result exists yet. | +| Store screenshots | Owner review; combine with final client session | Capture only the needed listing views using non-private data. Existing internal screenshots should not be published automatically. | +| Store download/install | After authorized publication | Confirm the real customer delivery path. This cannot be honestly marked complete before the app is published. | + +The remaining plan is one coordinated final-package session on a clean Windows 11 +x64 test environment, plus the managed-policy denial environment. Do not widen +launch support or waive another recorded gap without the owner's decision. + +## Microsoft requirements reviewed + +Policy/submission guidance refreshed on 2026-09-16; runtime references below retain +the 2026-09-14 review. Certification remains Microsoft's decision. +The [7.19 archive](https://learn.microsoft.com/windows/apps/publish/store-policy-archive/store-policy-7-19) +is effective from 2025-10-14. The main policy page now shows 7.20, published +2026-09-15 and effective 2026-10-22. Both were reviewed; recheck the applicable +version at submission. See the [change history](https://learn.microsoft.com/windows/apps/publish/store-policies-change-history). + +| Source | AppLens implication | +| --- | --- | +| [Store policies](https://learn.microsoft.com/windows/apps/publish/store-policies), 10.1, 10.2.7–8, 10.4 | Describe capabilities and limitations accurately, use supported mechanisms with consent, remain responsive, and support the advertised devices. AppLens itself must be removable. | +| Same policies, 10.5.1 and 10.6 | A Win32/Desktop Bridge app needs a privacy policy even with local-only processing. Declare capabilities tied to real functionality and preserve Windows permission checks. | +| Same policies, 10.5.4 and 10.14 | Resolve protection of personal information in local storage; do not infer compliance from default export redaction. Confirm the appropriate publisher account and business/support details. | +| [Capability declarations](https://learn.microsoft.com/windows/apps/package-and-deploy/app-capability-declarations) | Medium-integrity packaged desktop apps declare runFullTrust. It does not turn the process into an administrator or waive removal restrictions. | +| [Self-contained deployment](https://learn.microsoft.com/windows/apps/package-and-deploy/self-contained-deploy/deploy-self-contained-apps) and [deployment overview](https://learn.microsoft.com/windows/apps/package-and-deploy/deploy-overview) | .NET and Windows App SDK deployment settings are separate. Bundling .NET avoids a manual .NET prerequisite; Store-managed Windows App SDK frameworks remain a dependency whose installation must be tested. Ship .NET servicing fixes through app updates. | +| [Windows App Certification Kit](https://learn.microsoft.com/windows/uwp/debug-test-perf/windows-app-certification-kit) | Command-line execution still needs an active user session and admin context. A development build or local test pass is not certification. | + +The initial review found plaintext JSONL/SQLite action history. The owner's later +privacy delegation authorized the current-user protection implemented and tested +above. New history is encrypted without a plaintext index; legacy development +evidence is preserved and explicitly disclosed. Reports remain ordinary +user-selected files. Complete final-profile and retention checks and assess the +accurate final disclosures against policy 10.5.4 before submission. Local tests +and this policy review do not establish legal compliance or certification. + +## Prepared materials and remaining owner inputs + +Listing, privacy and support drafts already exist. The listing now includes a +reviewer walkthrough and the supported removal mechanisms; the privacy draft +describes local inventory/history, redaction and voluntary sharing. Before release, +the owner must supply/approve: + +- Reserved AppLens name and exact Partner Center package/publisher identity. +- Pricing/category/markets and questionnaire answers. Launch scope is decided: + Windows 11 x64 first. +- Publisher/contact details and the destination for public privacy/support pages. +- Artwork and screenshots, followed by hosting/submission/publication authorization. + +The [submission packet](AppLens-Store-Submission-Plan.md) names the exact identity +fields, proposed listing choices, test environments, native approvals and manual +publication-hold setting. It is ready for owner review, not for Store upload. + +The privacy design and local candidate preparation are delegated and completed. +Remaining account/contact facts cannot be invented; remaining native tests need +the environments and approvals listed in the packet. No hosting change, public +report upload, final identity, certification result or Store publication is +implied by the source push or the unsigned local candidate. diff --git a/docs/AppLens-Scanner.md b/docs/AppLens-Scanner.md index 0f93b62..ca9e43d 100644 --- a/docs/AppLens-Scanner.md +++ b/docs/AppLens-Scanner.md @@ -2,7 +2,12 @@ ## Responsibility -Scanner captures workstation evidence for CSI reviews. It answers what is installed, what is running, what starts automatically, what tooling is present, where storage is concentrated, and where local development work lives. +The AppLens v1 scanner captures installed-app inventory, reported sizes, disk +utilization, removal information, and secondary device details for CSI reviews. +Startup, services, performance analysis, local AI/tooling, and repo diagnostics +belong to the existing AppLens-Tune, which is intentionally deferred. The core +scanner must operate independently of that feature; see the +[v1 implementation boundary](AppLens-Product-Vision.md#applens-v1-implementation-boundary). ## Boundary @@ -11,9 +16,19 @@ Scanner is evidence-only. It does not tune the machine, uninstall software, chan ## Current Status - Cross-platform scripts exist for Windows, macOS, and Linux. +- The Windows initial script includes hardware/OS, uptime, RAM utilization, + capacity/used/free space for local fixed disks and app counts. + Attention flags use below 10% disk free and at least 85% RAM used; these are + snapshot thresholds, not a hardware health diagnosis. +- Each Windows script run writes a timestamped report and refuses to overwrite + an existing output path. Failed/empty workstation probes are labeled unavailable. + The initial scan does not recurse through folders or invoke Tune runtime probes. +- The initial Windows script does not enumerate or rank running processes. The + proposed client scan/table contract is in [Product Vision](AppLens-Product-Vision.md). - The desktop shell includes native C# collectors. - Reports export to JSON, Markdown, local HTML, and script text output. -- Default exports redact user, machine, and profile-path details. +- Default desktop-app exports redact user, machine, and profile-path details; + standalone script text reports retain local identifiers. - Scan completion can be represented as blackboard evidence. ## Next Moves diff --git a/docs/AppLens-Store-Submission-Plan.md b/docs/AppLens-Store-Submission-Plan.md new file mode 100644 index 0000000..f09f627 --- /dev/null +++ b/docs/AppLens-Store-Submission-Plan.md @@ -0,0 +1,282 @@ +# AppLens Store submission preparation + +## Installed name and Store identity — 2026-09-23 + +The owner reserved Installed and approved applying the name and official identity. +Partner Center showed the MSIX/PWA product In draft; nothing was submitted. + +- Store ID: 9PBPFLL6JVVV. +- Package name: CopperStateIntelligence.Installed. +- Publisher: CN=EF287C88-DDD2-4A49-8AC9-E4AE3A998DED. +- Publisher display name: Copper State Intelligence. +- Package family: CopperStateIntelligence.Installed_s3n4tkq635xf8. + +Updated the window/header, removal messages, report titles/default filenames, +manifest and publication drafts. Repository/project/assembly names, storage paths, +DPAPI purpose and legacy event identifiers remain AppLens for compatibility. +No existing history or reports were rewritten. Tune remains deferred. + +Build-StoreCandidate.ps1 passed: 104 core tests (92 backend, 12 presentation) +and Windows 11 x64 configuration check. Actual nested package manifest matches +all three Partner Center identity values, Installed display name, x64, minimum +Windows build 22000 and runFullTrust. WACK was found but not run. + +Unsigned candidate: artifacts/store-candidate-20260923-141404-0177375/install/ +AppLens.Desktop_0.1.0.0_x64.msixbundle; 48,568,595 bytes; SHA-256 +07C8B0B93F2C7F35223C7C668CD3977B04C93AA3A27D4FD0580E323E3C6E2738. +The internal artifact filename does not determine the Store display name. +Test TRXs are in that candidate directory. Earlier lifecycle evidence is retained; +no install/uninstall test was repeated and no Store upload occurred. + +Remaining: replace/review the old angular-A artwork; clean-PC installed checks, +shortcut/reopen/update, accessibility, protected-history retention/cross-user, +managed-policy denial and final WACK; pricing/markets/IARC, approved screenshots, +and published privacy/support destinations. The new Store identity is not an +in-place update of the earlier placeholder/test packages; test history/launch +behavior explicitly. Submission, publication, hosting and merge remain held. + + +Updated 2026-09-18 for COP-241. This is a local review packet, not a submitted +Store draft. The [release validation](AppLens-Release-Validation.md) retains the +completed tests. The owner approved Windows 11 x64 first and then delegated +privacy and local release-preparation decisions. The local candidate now builds; +final Partner Center identity is still needed. Submission/publication remain held. + +## Confirmed distribution and customer experience + +On 2026-09-18 the owner confirmed continuing with the Microsoft Store. The AppLens +website should provide the installation entry point; do not start a separate +direct-download installer/signing/update channel for this release. + +The required experience is: website/Store install -> open AppLens -> later +double-click its desktop icon. Customers must not need terminal commands, +developer tools, Developer Mode, manual certificate trust or manual runtime setup. +Desktop-shortcut creation and its behavior after an update still need implementation +review and installed verification. A Start-menu entry alone does not demonstrate +the requested desktop-icon experience; do not mark this complete from package +generation or assume the Store creates a desktop shortcut automatically. + +Preferred website integration, if AppLens is released free and meets Microsoft's +eligibility rules: use the official Store badge in Direct mode, which downloads a +small Microsoft-generated installer backed by the published Store app. Otherwise +link the installation button to the Store listing. Pricing has not been decided. +See [Microsoft Store Web Installer](https://learn.microsoft.com/en-us/windows/apps/distribute-through-store/how-to-use-store-web-installer-for-distribution) +(eligibility and flow reviewed 2026-09-18). Final Store ID and authorized publication +are prerequisites for real customer delivery; the website integration is not built +or deployed yet. Keep this installation button distinct from the app's **Download +report** control. + +This decision authorizes continuing Store preparation and documentation. Existing +approval for local builds/commit/push remains; the original holds on hosting, +merge, Store submission and publication remain in force. + +## Decisions and materials needed from the owner + +| Input | Prepared position / exact value needed | +| --- | --- | +| Launch platforms — decided | Windows 11 x64 first, approved 2026-09-16. Desktop project, manifest, bundle settings, configuration check and listing now require build 22000+ and x64. Windows 10/native ARM64 runtime checks are deferred; their old cross-builds remain historical evidence. | +| Distribution — decided | Microsoft Store, reaffirmed 2026-09-18, with the website as an installation entry point. Complete the simple install/desktop-icon/update experience. No separate direct-download distribution channel is planned. | +| Partner Center identity | From AppLens → Product management → Product identity: Package/Identity/Name, Package/Identity/Publisher, Package/Properties/PublisherDisplayName, plus reserved display name and Store ID. These are identifiers, not account credentials. Current CSI.AppLensDesktop / CN=CSI / CSI are placeholders. | +| Publisher account | Confirm the publishing entity and account verification. For the CSI business release, review the company-account requirement in policy 10.14; do not invent legal details or assume the account is verified. | +| Version and commercial settings | Approve initial version (source is 0.1.0.0), free/paid price, markets and release timing. Utilities & tools is the proposed category; en-US is the current package language. Complete the actual IARC questionnaire; do not invent an age rating. | +| Privacy design — decided | Current-user Windows protection for new history; no plaintext index; readable, redacted-by-default exports; no accounts, telemetry or uploads. Preserve earlier development evidence. Implemented under the owner's 2026-09-16 delegation; see verification below. | +| Privacy and support facts | Supply verified public publisher/contact details and approved hosting destinations for the [privacy](AppLens-Privacy-Draft.md) and [support](AppLens-Support-Draft.md) drafts. Set the effective date when publication is authorized. Final-profile recovery and retention tests remain. | +| Artwork and screenshots | Review the original [AppLens artwork](../src/AppLens.Desktop/Assets/AppLens-Artwork.md), and capture the views below on a test machine with no private data. No existing internal screenshot is approved for publication. | +| Local package preparation — authorized | The privacy/auth delegation covers local candidate builds; no renewed build approval is needed. The inspected unsigned package still uses a placeholder identity. Supply final identity and agree the test PC's signing/trust setup before installation. The development probe installer is not a final-package installer. | +| External actions | Hosting, Partner Center changes/uploads, certification submission and publication each remain outside this preparation. If later authorized to submit but not publish, use the manual publishing hold described below. | + +Microsoft documents the three manifest identity values in +[Product identity](https://learn.microsoft.com/windows/apps/publish/view-app-identity-details). +MSIX Store submissions do not require buying a CA signing certificate; Microsoft +re-signs them for publication. Local test installation has separate signing/trust +requirements. See [package requirements](https://learn.microsoft.com/windows/apps/publish/publish-your-app/msix/app-package-requirements). + +## Submission fields already drafted + +Use [Store-Listing-Draft.md](Store-Listing-Draft.md) for the description, features, +limitations, runFullTrust explanation and reviewer steps. No account or server is +needed to use AppLens. Reports may be shared by the user; the app does not perform +AI analysis, transmit a report or generate AI content. + +Proposed search phrases: app inventory; installed apps; disk usage; uninstall; +local report. Review them with the final listing. Do not advertise universal scan +timings, recovered-space guarantees, optimization, or untested platform support. + +Partner Center normally publishes after certification. To preserve a separate +publication decision, select **Don't publish this submission until I select +Publish now** in a later authorized submission. Verify the saved setting before +submitting. No Partner Center setting has been changed by this preparation. +See [submission options](https://learn.microsoft.com/windows/apps/publish/publish-your-app/msix/manage-submission-options). + +## Artwork and screenshot capture sheet + +The five current AppLens PNGs have verified dimensions: Store 50×50, small icon +88×88, tile 300×300, wide tile 620×300 and splash 1240×600. The existing +`AppLensSquare150.scale-200.png` is a candidate for the recommended 300×300 listing +icon, subject to owner review. Package asset dimensions are not WACK approval. + +Capture real app views with an owned disposable fixture and a non-private test +account. Use PNG, at least 1366×768, under 50 MB each. One Desktop screenshot is +the submission minimum; the proposed four below explain this app's flow. Captions +are under 200 characters. See [Microsoft's image guidance](https://learn.microsoft.com/windows/apps/publish/publish-your-app/msix/screenshots-and-images). + +| View | Proposed caption | +| --- | --- | +| Completed scan and main table | Review installed apps and local disk usage in one table. | +| Largest-first table with a filter | Find apps by name or publisher and compare reported sizes. | +| Confirmation for the owned fixture | Review the exact installation before approving a supported uninstall. | +| Verified fixture result and report controls | Check the recorded result and save a complete local report. | + +Before accepting each capture, inspect device/user labels, paths, app names, +history, account details and notifications. Do not fabricate app results or reuse +developer captures merely because report redaction passed. Keep rejected/internal +captures local; record the approved asset filenames and hashes separately. + +## One coordinated final-candidate test session + +Supply a clean PC or persistent VM with a standard-user account, no AppLens data, +and no development SDK or manually installed .NET runtime. Record pre-existing +Windows App SDK/VC runtime frameworks and Windows build/architecture. Have an +administrator available for native prompts. Use a separate managed test system +for genuine policy denial; do not modify this workstation's security policies. +Windows 10/native ARM64 test systems are no longer first-release prerequisites. +An x64 package can run under emulation on Windows 11 ARM64; this does not establish +AppLens compatibility. Review Partner Center's actual device availability before +submission, and do not make an ARM support claim. See Microsoft's +[Windows on Arm guidance](https://learn.microsoft.com/windows/arm/faq). + +Native desktop control is not exposed by this Codex session's computer-use tool. +The owner must operate the Windows/Narrator steps, or resume them in a session +with native control. Secure-desktop approvals always require the owner. + +1. **Freeze the candidate.** Once final identity is supplied, use the already + authorized `tools/Build-StoreCandidate.ps1`. Record Git commit, package + version, architectures, SHA-256, dependency manifests and build logs in a new + `artifacts/` directory. Inspect actual bundle contents; project properties alone + do not prove that only x64 was packaged. Never upload a development + ClientTest identity or raw machine reports. +2. **Install and launch normally.** Use the approved test installation method; + record any native approval and every prerequisite obtained. Confirm launch + without installing .NET manually. Record installation method honestly: sideload + delivery does not establish Store dependency acquisition. Keep the developer + PC's working client and historical evidence untouched. + Verify the intended desktop-shortcut creation flow and launch by double-click; + close and reopen normally without a terminal. Verify an update between controlled + test versions with the same identity preserves launch access and readable history. + These local checks do not establish actual Store update delivery. +3. **Complete the customer flow.** Scan → search/filter → cancel a fixture removal + → approve the exact owned fixture → independently check its absence → inspect + refreshed table/history → save and read a redacted JSON report with matching + full inventory/actions → close/reopen and check history. Download Markdown and + HTML once for final-package readability. Confirm only protected records are + newly written and no private plaintext index is created. In a separate test + account, a copy of the protected test file must fail to decrypt; retain the + original and verify same-user reopening. Use unique filenames throughout. +4. **Go offline in the test environment.** Disconnect its network after installation + and repeat scan/export. Record coverage, errors and results. Restore its network + afterward. Do not disconnect the user's working workstation remotely. +5. **Check Narrator and focus.** Hear scan/completion status, a row and its action, + confirmation/cancel, and report controls. Escape from the picker, verify visible + focus, then reopen with keyboard navigation and Alt+D. The earlier automated + Alt+D failure remains unresolved until observed here; UI names alone are not a + spoken-output result. Reuse COP-239's full text/contrast matrix unless changed. +6. **Check remaining permission behavior.** Reuse COP-240 UAC denial/approval + evidence; add a standard-user administrator credential handoff in this clean + session. On the managed system, identify the actual enforcing policy, attempt + only an owned fixture, and record Windows denial, retained installation and + honest app/report outcome. NoRemove and simulated failure are not this test. +7. **Check AppLens removal and retention.** Uninstall AppLens through Windows, + verify package absence, inspect which local history remains, confirm exported + reports remain, then reinstall and record history behavior. Use only test data. + Resolve the support/privacy retention wording from these observations. +8. **Run WACK on the exact candidate.** The local kit exists at + `C:\Program Files (x86)\Windows Kits\10\App Certification Kit\appcert.exe` + (observed version 10.0.26100.7705). Use the appropriate installed kit on the test + system. Run from an approved elevated active user session; preserve any previous + WACK reports before resetting kit state. Save fresh XML/HTML and inspect every + failure/skipped test. Do not equate an exit code or a local pass with certification. + +After authorized publication, verify the website installation button and real Store +download/install path on the clean test system. Confirm Store-delivered updates +when an approved update is available; do not claim that result from a local upgrade. + +After the test package is installed, the documented WACK command sequence is: + +```powershell +# Prepared instructions only; not executed in this review. +# Replace placeholders with the exact tested identity and a new report path. +& 'C:\Program Files (x86)\Windows Kits\10\App Certification Kit\appcert.exe' reset +& 'C:\Program Files (x86)\Windows Kits\10\App Certification Kit\appcert.exe' test -packagefullname '' -reportoutputpath '' +``` + +Microsoft's [WACK command-line instructions](https://learn.microsoft.com/windows/uwp/debug-test-perf/windows-app-certification-kit) +require administrator rights and an active user session. WACK may launch the app. +The owner approves native installation, administrator credential/UAC and WACK +elevation prompts; the agent must not approve them or retry a cancelled prompt. + +For each platform, record launch-to-usable time, first-results/completion time, +inventory count/coverage, package bytes, separately downloaded prerequisites, +installed app payload and local data bytes. Label logical versus allocated disk +size and whether framework sizes are shared. Measure actual Store download and +installation only after authorized publication. Keep the developer package's +86.89 MiB figure labeled as historical development evidence. + +## Privacy and authorization decision — implemented 2026-09-16 + +The owner asked the agent to decide privacy and authorization preparation on +their behalf. That satisfies AGENTS.md's privacy-change/local-packaging approval +requirement for this work. It does not remove Windows approvals or the owner's +explicit hold on merge, publication and Store submission. + +`RemovalService` now defaults to `ProtectedRemovalHistoryStore`. It protects each +complete action record with Windows +[current-user data protection](https://learn.microsoft.com/dotnet/api/system.security.cryptography.dataprotectionscope?view=windowsdesktop-10.0) +and stores a versioned ciphertext envelope at +`AppLensRuntimeStorage.Root/history/events.dpapi-v1.jsonl`. No plaintext SQLite +index, metadata summary or backup is created for these records. Queries decrypt +in memory. Protection uses the Windows profile; AppLens adds no account, password, +key service, network dependency or sign-in screen. See Microsoft's +[ProtectedData documentation](https://learn.microsoft.com/dotnet/api/system.security.cryptography.protecteddata?view=windowsdesktop-10.0). + +An approval must be durably recorded before starting an uninstall. Damaged, +unsupported or undecryptable protected records fail explicitly; they are not +silently discarded or appended to. The client exposes unavailable history in its +history panel and report coverage. Existing removal confirmation, target recheck, +administrator handoff and native UAC requirements remain in force. + +Legacy pre-release JSONL and SQLite evidence is deliberately left unchanged and +unencrypted. The new client reads legacy removal events without modifying those +files, then combines them with new protected events in memory. There is no +automatic migration or deletion. This is an initial Store release, so fresh +customers have no legacy files. Existing development users must not mistake this +change for retroactive protection of their older files. Explicit report exports +remain readable files with default redaction and voluntary-sharing disclosure. + +All ten new protection tests pass, along with the 94 existing core tests and 58 +preserved Tune tests. A separate process reopened a synthetic protected record +under the same Windows user. Read-only use of the default history service found +all eleven real legacy actions with every existing runtime file unchanged. +Package inspection confirms the Windows protection assembly is included. Evidence: +`artifacts/cop241-privacy-20260916-010513/`. + +Windows current-user protection does not protect against software running as +that user. Loss of the original Windows profile can prevent recovery; do not +promise portability from a file copy alone. Cross-user and final installed-profile +recovery, Windows uninstall/reinstall retention and clean-PC operation still need +the test environment above. Policy 10.5.4 alignment must be assessed with those +results and accurate final disclosures; this implementation is not a certification +or legal-compliance verdict. + +## Review date and release gate + +Policy 7.19 became effective 2025-10-14. Version 7.20 was published 2026-09-15 +but becomes effective 2026-10-22. This review checked both; use the version in +effect on submission day and recheck changes. The upcoming revision also makes +ongoing age-rating updates explicit. Sources: [7.19](https://learn.microsoft.com/windows/apps/publish/store-policy-archive/store-policy-7-19), +[7.20](https://learn.microsoft.com/windows/apps/publish/store-policies), and +[change history](https://learn.microsoft.com/windows/apps/publish/store-policies-change-history). + +COP-241 stays In Progress until the unresolved acceptance work and release +materials are resolved. Local preparation/builds are authorized; hosting changes, +submission, publication and merge remain held. Store customer-delivery verification +is a later gate, after explicit publication approval. diff --git a/docs/AppLens-Support-Draft.md b/docs/AppLens-Support-Draft.md new file mode 100644 index 0000000..6b3319a --- /dev/null +++ b/docs/AppLens-Support-Draft.md @@ -0,0 +1,51 @@ +# Installed support — publication draft + +Installed v1 is a local Windows app for inventory, storage review, supported removal +actions and report download. It is not a background optimizer. + +## Using Installed +1. Select Scan this PC. +2. Review storage and the app table. Search or filter the rows as needed. +3. Review the exact app and scope before confirming an uninstall. Complete any + Windows or vendor approval dialog. +4. Check action history and refresh results. A Settings handoff or process exit + alone is not proof of removal. +5. Select Download report and choose Markdown, JSON or HTML. The complete capture + is included even when table filters are active. + +Unknown size means the installer did not report a usable value. It does not mean +zero space. Observed disk changes can include other activity. + +If a scan is partial, inspect the coverage details in the client/report and retry. +If Windows denies removal, contact the device's administrator. Installed does not +override management or protected-component restrictions. Do not manually delete +application directories as a substitute for the supported uninstaller. + +Before sending a report for help, review it for private information. Leave +personal identifiers disabled unless they are specifically needed. + +## Removing Installed +Close Installed, open Windows Settings → Apps → Installed apps, find Installed, and +choose Uninstall. Installed does not uninstall itself from its running table. +Reports you saved elsewhere are separate files; remove them yourself if no +longer needed. Final-package local-history retention must be confirmed before +publishing detailed retention/removal promises. + +## Action history unavailable +New history is protected for the Windows user who recorded it. Use the original +Windows profile when reopening Installed. If the history is damaged or the profile +is unavailable, keep the file and any profile backup for recovery; copying only +the history file to a new account may not restore access. Do not delete or edit +history to bypass an error. Installed must save approval before it starts an +uninstaller. Scans and report export remain available, with missing history +reported in coverage. + +Pre-release development logs and indexes are preserved in their old plaintext +format; the new client reads them without rewriting them. New history is separate +and encrypted. User-saved reports remain readable files with redaction enabled +by default; preserve anything you need before removing local data. + +## Publication requirements +The owner must provide and verify a real support contact and hosted URL before +Store submission. Include the app version, Windows version, relevant error and +the steps that led to it; do not send passwords or other secrets. diff --git a/docs/AppLens-Tune-App.md b/docs/AppLens-Tune-App.md index b7872db..c74af47 100644 --- a/docs/AppLens-Tune-App.md +++ b/docs/AppLens-Tune-App.md @@ -1,5 +1,19 @@ # AppLens Tune +## Release Boundary + +AppLens-Tune refers to the existing scripts and native Tune functionality. It is +intentionally deferred until the core AppLens v1 flow is complete. The agreed +implementation plan separates Tune-specific code into `future/AppLens-Tune/`, +preserves relevant tests/docs and resumption instructions, and removes its +dependencies from core launch, scan, uninstall, and export. Shared infrastructure +needed by v1 stays in the normal backend. See +[Product Vision](AppLens-Product-Vision.md#applens-v1-implementation-boundary). + +The implementation has been relocated. See the +[preservation and resumption README](../future/AppLens-Tune/README.md). +Existing behavior below describes that deferred work, not the active v1 client. + ## Responsibility Tune turns workstation evidence into a prioritized plan. It identifies startup load, service noise, storage hotspots, repo placement risk, local AI readiness, and developer tooling issues. @@ -16,7 +30,11 @@ Tune can propose work. Execution must remain approval-gated, recorded, and rever - The action executor remains the low-level runtime. - The platform loop is the intended path for approval-gated execution. -## Next Moves +## When AppLens-Tune Development Resumes + +Resume only after core v1 is complete, using the deferred implementation's README +and verification evidence to establish its actual state. Do not treat these +items as first-release AppLens requirements. - Route desktop Tune execution through the platform loop. - Record every proposed, approved, executed, blocked, failed, or verified action in the blackboard. diff --git a/docs/AppLens-Uninstall-Routes.md b/docs/AppLens-Uninstall-Routes.md new file mode 100644 index 0000000..9efacc1 --- /dev/null +++ b/docs/AppLens-Uninstall-Routes.md @@ -0,0 +1,61 @@ +# AppLens v1 uninstall routes + +The core remains a packaged WinUI 3 desktop application at medium integrity with +`runFullTrust`. It does not elevate itself or add `packageManagement` or +`allowElevation`. A language rewrite would not change Windows permissions. + +## Mechanisms + +| Target | Mechanism | Boundary | +| --- | --- | --- | +| MSI | Windows System32 msiexec.exe /x with a validated product GUID, interactive UI and /norestart | Revalidate registry identity and product registration; preserve Windows approval. Explicit administrator handoff launches Windows Installer, not an elevated AppLens. | +| Vendor app | Registered, validated absolute local EXE path and arguments | No shell interpretation, PATH search, script hosts, arbitrary DLL execution, quiet-string substitution, or inferred switches. Ambiguous/missing paths use Windows Installed Apps. | +| Current-user MSIX | PackageManager.RemovePackageAsync(exact PackageFullName) | Revalidate current-user identity and exclude frameworks/resources/system packages and AppLens itself. No all-user removal. Cannot cancel once started; Windows can close the target app and remove its local data. | +| Unsupported/restricted | Explain the evidence; offer Windows Installed Apps where appropriate | A Settings handoff is not a successful uninstall. Never override NoRemove, management policy, protected components, or UAC. | + +Registry machine scope alone does not establish an administrator requirement. +MSI registrations can appear under HKLM even for a current-user installation. +Use MsiEnumProductsEx with the current-user/machine contexts to resolve MSI scope; +ambiguous or unavailable contexts hand off to Windows. Multiple contexts for one +product GUID are not safe to select through a bare msiexec /x GUID command. +Show “May require administrator approval” unless stronger evidence exists. +NoRemove is installer restriction evidence, not proof of organization management. +MSI exit 1602 and UAC error 1223 are cancellation/denial; 3010 means restart +required, not permission to restart. Verify installation identity after execution; +a process exit alone does not prove removal. Record observed disk change with +capture times; other activity and shared data prevent exact attribution. + +## Development evidence, 2026-09-13 + +Generated, disposable fixtures only. Windows 11 Home build 26200; ordinary +unelevated caller (`Administrator=false`). Both test MSIX packages declared only +runFullTrust and used different publishers. Windows approved installation of the +unsigned development packages; no certificate trust or Developer Mode change. + +Evidence directory: `artifacts/removal-preflight-203d4975e60841d4a10834aeb0e0ee35/`. +The installation plan records package hashes and exact identities. Results are in +`fixtures/results.json`; setup and MSI logs preserve observed outcomes. + +- Current-user different-publisher MSIX: API completed, exact package absent. +- Vendor EXE child: exit 0, disposable registration absent. +- Per-user MSI: installation state 5, removal exit 0, state -1 afterward. +- Explicit runas handoff to Windows Installer: exit 0, MSI state -1 afterward. +- Separate unpackaged fixture validation: install/remove exit 0, marker absent. + +This establishes route feasibility, not arbitrary vendor compatibility, managed +device permission, all-user MSI behavior, denied-UAC behavior, Windows 10 +compatibility, or Store approval. Exercise these cases in task 5/6 and distinguish +live evidence from simulations. The test package is not a distribution artifact. + +## Microsoft references checked + +- [Package removal requirements and current-user behavior](https://learn.microsoft.com/en-us/uwp/api/windows.management.deployment.packagemanager.removepackageasync?view=winrt-26100) +- [Capabilities, including runFullTrust and allowElevation](https://learn.microsoft.com/windows/apps/package-and-deploy/app-capability-declarations) +- [ShellExecute runas and Windows approval](https://learn.microsoft.com/windows/win32/shell/launch) +- [Windows Installer command line](https://learn.microsoft.com/windows/win32/msi/command-line-options) +- [Microsoft Store policies](https://learn.microsoft.com/windows/apps/publish/store-policies) +- [Unsigned Windows 11 development packages](https://learn.microsoft.com/windows/msix/package/unsigned-package) + +Store review must accurately describe removal, data loss, administrator approval, +local reports and their privacy controls, and justify runFullTrust. Local API +success does not grant certification or permission to bypass restrictions. diff --git a/docs/AppLens-v1-Handoff.md b/docs/AppLens-v1-Handoff.md new file mode 100644 index 0000000..e7009f4 --- /dev/null +++ b/docs/AppLens-v1-Handoff.md @@ -0,0 +1,415 @@ +# AppLens v1 handoff to COP-241 — updated 2026-09-18 + +## Current release preparation — 2026-11-04 + +The owner reviewed the redesigned local client and requested GitHub delivery, +with Microsoft Store publication when ready. Earlier holds below describe prior +sessions; native Windows approvals still belong to the owner. + +The combined redesign and removal-reliability work is in `codex/applens-clean`. +The latest maintenance fix refreshes inventory when a fast uninstall is first +observed absent and defers the refresh while another scan is active. The Release +build and 137 tests passed (118 backend, 19 desktop); a read-only local preview +scan completed with 444 entries. These are local results, not Store acceptance. +The pre-maintenance working files are preserved in +`artifacts/maintenance-baseline-20261103-150704/`. + +Store delivery still requires a current candidate, final-package/WACK and clean-PC +acceptance, and completion of the Partner Center submission. The prior draft and +candidate status below remain historical until rechecked. + +## Current local preview — 2026-11-02 + +Active checkout: `C:\Users\codyl\Desktop\csiOS\Projects\AppLens-clean`, branch +`codex/applens-clean`. Older worktree paths below are historical. + +Desktop and Start menu Installed shortcuts now target +`%LOCALAPPDATA%\Programs\Installed\preview-20261102-maintenance\AppLens.Desktop.exe`. +Reopen the app to use this self-contained maintenance build; the previous preview +is preserved. Null action-history records now fail closed without rewriting +evidence. Release build and all 132 core tests passed, including the new regression. + +During this chat's release preparation, Store draft Submission 1 gained free +pricing, Utilities + tools, privacy text and `notes@copperstateit.com` support. +Package upload was approved but did not complete; IARC acceptance remained pending. +WACK stopped when native Windows approval was cancelled. Nothing was submitted +for certification or published. Recheck Partner Center before continuing. + +The preserved candidate at `artifacts/store-candidate-20261102-0f735eb2/` predates +the history fix; rebuild it before submission. Clean-PC and installed-package +acceptance remain open. The local preview is not a Store installation. + +## Installed name and Store identity — 2026-09-23 + +The owner reserved Installed and approved applying the name and official identity. +Partner Center showed the MSIX/PWA product In draft; nothing was submitted. + +- Store ID: 9PBPFLL6JVVV. +- Package name: CopperStateIntelligence.Installed. +- Publisher: CN=EF287C88-DDD2-4A49-8AC9-E4AE3A998DED. +- Publisher display name: Copper State Intelligence. +- Package family: CopperStateIntelligence.Installed_s3n4tkq635xf8. + +Updated the window/header, removal messages, report titles/default filenames, +manifest and publication drafts. Repository/project/assembly names, storage paths, +DPAPI purpose and legacy event identifiers remain AppLens for compatibility. +No existing history or reports were rewritten. Tune remains deferred. + +Build-StoreCandidate.ps1 passed: 104 core tests (92 backend, 12 presentation) +and Windows 11 x64 configuration check. Actual nested package manifest matches +all three Partner Center identity values, Installed display name, x64, minimum +Windows build 22000 and runFullTrust. WACK was found but not run. + +Unsigned candidate: artifacts/store-candidate-20260923-141404-0177375/install/ +AppLens.Desktop_0.1.0.0_x64.msixbundle; 48,568,595 bytes; SHA-256 +07C8B0B93F2C7F35223C7C668CD3977B04C93AA3A27D4FD0580E323E3C6E2738. +The internal artifact filename does not determine the Store display name. +Test TRXs are in that candidate directory. Earlier lifecycle evidence is retained; +no install/uninstall test was repeated and no Store upload occurred. + +Remaining: replace/review the old angular-A artwork; clean-PC installed checks, +shortcut/reopen/update, accessibility, protected-history retention/cross-user, +managed-policy denial and final WACK; pricing/markets/IARC, approved screenshots, +and published privacy/support destinations. The new Store identity is not an +in-place update of the earlier placeholder/test packages; test history/launch +behavior explicitly. Submission, publication, hosting and merge remain held. + + +## Start here + +Continue in this existing worktree: +`C:\Users\codyl\Desktop\csiOS\Projects\.worktrees\AppLens\codex-applens-v1-quick-client` + +Branch: `codex/applens-v1-quick-client`, based on `33be555`. The user authorized +commit and push on 2026-09-14, specifically to `CSI-Platform/AppLens`. Check the +branch log/upstream for the saved revision and `git status` for any later edits. +That push authorization does not authorize merge or Store publication. The later +2026-09-16 delegation below separately authorizes privacy work and local packaging. +The original AppLens checkout and its 13 pre-existing changed/untracked +files were preserved and carried into this worktree before implementation. +Do not switch to the original checkout or discard its work. Use one agent; +no subagents. Read this worktree's AGENTS.md before continuing. + +[Linear project](https://linear.app/csi-platform/project/applens-platform-final-push-bda8c2d44ddf) +· [Approved six-task plan](https://linear.app/csi-platform/document/applens-v1-approved-six-task-delivery-plan-fafa6b12136a). +COP-236/237/238/239/240 are Done; COP-241 remains In Progress. + +## Latest: Store direction confirmed — 2026-09-18 + +The owner chose to continue with Microsoft Store distribution after considering +a separate website download. The website should be the installation entry point; +customers must be able to install and then open AppLens from an icon, including +double-clicking a desktop shortcut, without developer tools or manual setup. +The [product scope](AppLens-Product-Vision.md), [Store checklist](Store-Readiness-Checklist.md) +and [submission plan](AppLens-Store-Submission-Plan.md) now make that acceptance +requirement explicit. The approved six-task plan in Linear is updated to match. + +Keep Microsoft Store as the release channel. If pricing is free and the app is +eligible, prefer Microsoft's website installer through the official Direct-mode +badge; otherwise link the website button to the Store listing. Pricing is still +undecided. No separate direct-download installer, signing service or update +infrastructure is planned. Website installation, desktop-shortcut behavior and +updates are not yet verified. Do not confuse the website install button with +the client's Download report control. + +Next work remains under COP-241: + +1. Obtain exact Partner Center app/publisher identity and verified contact/listing + facts; replace placeholder values before freezing a final candidate. +2. Review/complete desktop-shortcut creation and test install -> open -> close -> + double-click icon, plus a same-identity update preserving history/launch access. +3. Complete the existing clean Windows 11 x64, offline, accessibility, history + retention/cross-user and managed-policy checks; run WACK on the final candidate. +4. Finalize privacy/support pages, screenshots and website installation integration. + Verify actual Store installation and updates after authorized publication. + +Reviewed and shortened AGENTS.md: removed broad legacy platform context, the +obsolete main-branch inventory note, completed Tune-separation instructions, +duplicated restrictions and unrelated starting points. It now holds durable v1 +scope, customer simplicity, privacy/evidence rules, one-agent workflow and focused +references; active branch, approvals and evidence stay here and in Linear. + +This pass changes documentation only. It started clean at `ff5cf0d`, matching the +remote; COP-241 was verified In Progress. Existing source/package/lifecycle +evidence below is reused; no build or installed test was repeated. The Store +decision continues preparation, not submission/publication. Local builds and +branch commit/push remain authorized; hosting changes, merge, Store submission +and publication remain held. Owner-operated native approvals are still required. + +## Retained privacy and local packaging verification — 2026-09-16 + +After Windows 11 x64 preparation was pushed as `425c934`, the owner delegated +privacy and authorization decisions: "for privacy and auth can you do those for +me? ... i'll let you decide what's best". Proceed without asking again about this +privacy design or local candidate builds. Keep merge, hosting, Store submission +and publication held; native Windows prompts still require the owner. AppLens +remains account-free, local-only and explicit about uninstall approval. + +Implemented current-user Windows DPAPI protection for every new v1 history +record, with a separate versioned encrypted log and no plaintext SQLite index. +The shared/deferred Blackboard implementation stays available; legacy evidence +is read-only, combined in memory and never migrated or deleted. Existing plaintext +development logs and reports are not retroactively encrypted. Corrupt protected +history fails explicitly and prevents the approval write/uninstaller start. +The client carries unavailable-history warnings into history and report coverage, +including when history loading finishes after a scan. + +Verification: all **104 core tests** passed (92 backend, 12 presentation), including +ten new privacy cases; **58 preserved Tune tests** passed. The privacy regression +first failed against plaintext storage. Separate processes wrote/recovered a +synthetic protected record under the same Windows account. Read-only default +history loading recovered all eleven real legacy actions; hashes of every existing +runtime file remained unchanged. The dependency audit reports no known vulnerable +packages. No installed lifecycle test was repeated. + +`Build-StoreCandidate.ps1` passed and now finds the installed symbol conversion +tool and WACK correctly; it saves test TRXs in each candidate directory. A final +publish compiled the reviewed UI change without warnings/errors. The inspected +candidate is `artifacts/store-candidate-20260916-011555-3476646/install/`: +`AppLens.Desktop_0.1.0.0_x64.msixbundle`, **48,761,419 bytes**, SHA-256 +`B65A7A56C6B03DC2552B71BBBFB10944D4B7E1E3351E12D285BC16D3C75591B6`. +Actual bundle contents are x64 only, Windows minimum 22000, bundled .NET and +Windows protection assembly, compiled resources, and Windows App Runtime 1.8 +framework dependency. No deferred Tune, probe or raw evidence paths are packaged. +Identity remains `CSI.AppLensDesktop` / `CN=CSI`, version `0.1.0.0`; unsigned, +not installed or submitted. Do not upload it as the final Store package. + +Evidence: `artifacts/cop241-privacy-20260916-010513/`; final core TRXs are in +`artifacts/store-candidate-20260916-011102-4248971/test-results/`. Earlier attempts +and evidence remain intact. Privacy/support/checklist and +[submission packet](AppLens-Store-Submission-Plan.md) reflect the implementation. + +Remaining: exact Partner Center identity/account and listing facts, verified +contact/hosting destinations, screenshots/artwork review, a clean standard-user +Windows 11 x64 environment for final install/offline/Narrator/focus/retention and +cross-user protection checks, and a managed-policy denial environment. Owner +operates native installation/UAC/WACK approvals. No prompt, certificate trust, +system-policy change or installed-client replacement was attempted while away. +COP-241 remains In Progress. The earlier privacy/build-approval gaps below are +historical and superseded; final installed evidence and external release approval +remain open. + +## Earlier scope preparation — 2026-09-16 + +The owner again authorized local completion, Linear/handoff updates, commit and +push to this existing branch; no merge, publication or Store submission. The path +in that prompt was missing the separator before `.worktrees`; Git verified the +existing path above, branch and remote. Starting local/remote SHA was `9be420b`, +working tree clean. COP-241 was verified In Progress and COP-240 Done. No GitHub PR +or branch CI run exists; source tests remain local evidence. + +Unattended preparation is complete for this pass. Read the new +[Store submission packet](AppLens-Store-Submission-Plan.md) for exact Partner +Center inputs, screenshot plan and a coordinated final-candidate test sequence. +The checklist now reuses successful installed/lifecycle checks instead of listing +them as wholly pending. Current advisory query reports no known vulnerable NuGet +packages for the four solution projects. The original installed report and local +copy match the recorded hash; retained core TRXs confirm 94 passes. No completed +installed/uninstall lifecycle test was repeated. WACK and existing artwork +dimensions were inspected only. +Evidence: `artifacts/cop241-submission-prep-20260916-003337/`. + +Microsoft policy 7.19 remains effective until the published 7.20 takes effect on +2026-10-22; both were reviewed. This phase found plaintext local history and +proposed current-user protection; the later delegation and implementation above +resolve that design/build-approval gap. Final-package retention remains open. + +The owner then chose **Windows 11 x64 first**, followed by "I'm going to sleep; +do as much as you can without me." Applied build 22000 minimum to the desktop +project/manifest, x64-only runtime/bundle targets, matching launcher/build paths +and listing text. The existing configuration check rejected old architecture and +Windows minimum settings separately, then passed. Fresh restore/x64 Release build +passed with zero warnings/errors; 94 core tests passed. The new target justified +this rerun. Windows App SDK/SQLite versions, core behavior and deferred Tune are unchanged. +The newer configuration has not had an installed/live pass; retain prior lifecycle +evidence and the final-candidate spot-check requirement. + +Native Windows control is not exposed in this session; the owner must operate +Narrator/focus tests or resume with native control. Do not trigger secure-desktop +prompts while the owner is away. Remaining inputs: clean Windows 11 x64 and managed +test systems, final identity/account details, commercial/listing choices, privacy/ +support contact and hosting destinations, and artwork/screenshot review. The +later delegation resolves privacy-design and candidate-build authorization. Windows 10/native +ARM64 runtime tests are deferred, not passed. x64 emulation on ARM64 is untested; +verify actual Store device availability before submission. Reuse completed failure/ +timeout/closure/UAC results unless behavior changes or a new failure requires more. + +## Retained 2026-09-14 evidence + +The 2026-09-14 source/release review is complete without desktop control: +[release validation and remaining hands-on decisions](AppLens-Release-Validation.md). +Fresh core/Tune tests, x64/ARM64 builds, dependency and snapshot checks passed. +Store settings now bundle .NET; a regression checks the evaluated release +properties without generating a package. Store reviewer instructions are drafted. +Evidence: `artifacts/cop241-source-20260914-1e406cb1/` (local, not pushed). +The fresh backend smoke had 433 entries and complete coverage at ~0.52 seconds. +It writes a new scan and does not reload desktop action history; retain the +earlier seven-action UI export as that evidence. + +At the time of the retained 2026-09-14 evidence, launch scope still included Windows +10/ARM64. The 2026-09-16 Windows 11 x64-first decision above supersedes that scope; +the older cross-build and installed-package records remain valid historical evidence. + +**Computer use resumed with the owner's permission on 2026-09-14.** Run unattended +AppLens checks first and reserve native approval prompts for the owner's return. +Original Custom theme, 100% text size and high contrast off remain the baseline. +Native UAC must be approved by the user; broad administrator authorization does +not bypass Windows' secure-desktop approval. See release validation for new evidence. + +Latest unattended checks passed: real exit-code failure, the production three- +minute timeout and retry guard, NoRemove protection, and closing/reopening the +client during an action. The downloaded JSON retains all ten history records, +including Failed, Still running and Outcome unknown; identifiers are redacted. +The four owned registrations were removed after verification; helper processes +exited naturally. No display settings changed. Evidence: +`artifacts/cop241-live-63a8a7fdb352457da74b8b70569b5fb3/`. +A fresh development package was installed after the owner's native approval: +`artifacts/removal-preflight-d51377dddcd24574bab23311c5b823dd/installation-plan.json`. +Installed scan, filtering, self-protection, disposable-package removal, Downloads +picker cancellation and JSON save passed. The latest report has 434 entries and +eleven actions; its hash and ledger survived the usage interruption. The client +remains installed but closed; its disposable package is absent. Do not confuse +this bundled-runtime test identity with final Store delivery. Actual Narrator +speech remains untested; include keyboard focus after picker cancellation in +that pass (an automated Alt+D attempt did not reopen it; the button worked). + +## Product and completed implementation + +AppLens v1 is the local C#/.NET 10 WinUI client: fast inventory → disk/app table +→ exact-target approved removal → verification → local report download for AI +review. Silver/metallic visual design, no accounts/telemetry/upload or automatic +remediation. Reported app size is an estimate; disk deltas are observations, +not guaranteed space recovered from an app. + +Tune-specific code/scripts/tests/docs are preserved in `future/AppLens-Tune/` +with a move-time hash manifest and README. Core build/launch/scan/export were +exercised with that directory unavailable. Shared evidence contracts remain in +the backend; core `InventorySnapshot` and reports contain no Tune diagnostics. + +The table preserves installation identities, searches names/publishers, sorts +names/publishers/numeric sizes, and filters scope/type/removal route. Unknown +sizes sort last. Ordinary apps are the default; components remain available. +MSI scope comes from Windows Installer context, not HKLM alone. Details, disk +readings, status, history and JSON/Markdown/HTML reports use the shared scan data. +Filters do not truncate exports; personal identifiers are redacted by default. + +Removal uses conservative vendor-EXE parsing, typed MSI GUID commands with +/norestart, current-user MSIX, revalidation and single-use confirmation tokens, +Windows approval, independent presence checks and persistent action outcomes. +Ambiguous routes open Windows for review; protected components/self-removal are +blocked. Never execute commands imported from a report. + +COP-239's final fixes keep the virtualized list visible when large text and open +panels need page scrolling, align wrapped table headers/rows, expose meaningful +row/action accessibility names, and start the save picker in Downloads using the +current user's known-folder path. No framework/language rewrite or SDK upgrade. + +## Verification to retain + +[Client verification](AppLens-Client-Verification.md) maps each COP-239 requirement +to local evidence and lists the later computer-use checks. + +- Final x64 and ARM64 desktop builds succeeded with zero warnings/errors. + ARM64 cross-compilation is not ARM64 runtime verification. +- Latest core run: **94 passed** (82 backend, 12 presentation). TRXs are under + `artifacts/cop239-client-26922a8cb41d482db372f2590b9c386e/final-tests/`. +- Live Windows 11 x64 client: 433 inventory entries, 158 ordinary apps; latest + complete scan 0.52 s on this developer PC. No clean-PC timing guarantee. +- Keyboard navigation, real duplicate names/suite entries, unknown-size ordering, + 1280×880/960×760 layouts, 100%/225% text, Night sky/Desert high contrast, + UI Automation names, confirmation cancellation and native save/cancel passed. +- Latest zero-visible-row JSON export contains all 433 entries and seven actions + (four Removed, three Cancelled), matching the ledger with identifiers redacted. + See `final-report-verification.json` and `client-export-zero-visible.json` in + that same artifact directory. Original report remains in Downloads as + `AppLens-20260913-174908-731.json`; its hash is recorded in the verification file. +- Original display settings and owned registry-fixture cleanup are documented in + `display-restored.json` and `ui-fixture-cleanup.json`. No working app was removed + in COP-239. The extra fixture cancellation is intentionally kept in the ledger. +- Earlier validation: 58 preserved Tune tests, five Windows snapshot check groups, + no known NuGet vulnerabilities reported, and physical Tune-independence checks. + These are earlier evidence, not fresh release/certification results. + +COP-240 evidence is preserved under +`artifacts/cop240-live-6e40495c2ab845f89db8f4373f6ef81b/`: + +- The initially installed WinUI wrapper failed to launch because its resource + index was absent/wrongly identified. `Build-DevelopmentProbe.ps1` now indexes + compiled XAML for the test package identity. The resource regression failed + against the original payload and passed for corrected packages. +- Corrected packaged client launched unelevated from WindowsApps with only + runFullTrust. Real Store confirmation cancellation/approval and all-user MSI + native UAC denial/approval were independently verified. Denial kept the fixture; + approval removed it and refreshed table/disk/history. MSI/vendor tests also passed. +- Report verification found and fixed history reload choosing an approval from a + newest-first query. RemovalService now prioritizes the recorded completion; + the BlackboardStore regression failed before the fix. That run had 93 tests; + the additional COP-239 accessible-name test brings the current total to 94. +- Final development plan: + `artifacts/removal-preflight-644303be956d47be8208d88d1bdedecb/installation-plan.json`. + The package was installed/tested and then removed. All six owned package + identities and the all-user MSI were verified absent during cleanup. No owned + client process remained. The six-action report in COP-240 is historical; + COP-239's seven-action report is newer. Do not rewrite either or the ledger. +- Use `machine-fixture-plan-verified.json` for the generated MSI hash; its earlier + incomplete record hit a COM file lock. Keep failed/superseded raw artifacts. + +## COP-241: short execution order + +1. Read this handoff, release/client verification and Store checklist; inspect + the branch/status. Reuse completed evidence, and rerun checks only for a changed build, + changed behavior or an unresolved failure. Review final source/package choices. +2. When desktop control is available, validate a final installed candidate on a + clean standard-user PC: offline scan → filter → disposable uninstall → verify + → download/read report. Downloads now passed in the latest development package; + retain a final-candidate spot check. Check actual screen-reader audio + and modal focus recovery. Real failed/slow, NoRemove protection and app closure + now passed on the developer PC; a genuine managed-policy denial remains. + Include final-profile history recovery, cross-user protection and AppLens + uninstall/reinstall retention, using test data only. +3. Validate the approved Windows 11 x64 configuration on the clean test system. + Windows 10/native ARM64 are deferred. Measure launch/first-results/completion, + download size, installed + footprint and prerequisites for the actual distribution. Earlier 86.89 MiB + compressed / ~217.49 MiB payload figures describe a development package only. +4. Finish owner inputs: Partner Center name/publisher/identity, artwork and private- + data-free screenshots, contact and real privacy/support URLs. Drafts exist; + `CSI.AppLensDesktop` / `CN=CSI` is still a placeholder. SQLite bundle is 2.1.13 + (observed native SQLite 3.53.3). Recheck current Microsoft policies when preparing + release. Local candidate builds are already authorized. Hosting/submission/ + publication still need explicit approval; run WACK on the final candidate with + the owner operating required native approvals and record its result. + Store download/install is verified only after authorized publication. + +Do not mark COP-241 Done based on local builds. WACK exists on this machine but +has not been run against a final package. No clean-PC, Windows 10 or ARM64 live +result, final prerequisite/footprint measurement or Store certification is claimed. + +## Commands and references + +Run from the worktree above: + +```powershell +dotnet restore AppLensDesktop.sln +dotnet build AppLensDesktop.sln -c Release +dotnet test AppLensDesktop.sln -c Release --no-build +powershell -NoProfile -ExecutionPolicy Bypass -File tests/Script.Tests/Test-StoreConfiguration.ps1 +``` + +To review that exact x64 Release build when desktop control resumes: + +```powershell +& .\src\AppLens.Desktop\bin\x64\Release\net10.0-windows10.0.22000.0\win-x64\AppLens.Desktop.exe +``` + +`tools/Run-AppLensDesktop.ps1` launches Debug, which can be stale unless rebuilt. +Use a unique test-results directory/logger filename; do not overwrite earlier TRXs. +Builds do not scan the PC; `tools/AppLens.Smoke` explicitly scans and writes evidence. +Development-package instructions: [RemovalProbe README](../tools/AppLens.RemovalProbe/README.md). +`Build-StoreCandidate.ps1` is authorized for local preparation by the owner's +2026-09-16 delegation; final identity and native test trust/approvals are still needed. + +[Build and keyboard guidance](AppLensDesktop-Build.md) · +[Uninstall routes](AppLens-Uninstall-Routes.md) · +[Store checklist](Store-Readiness-Checklist.md) · +[Product scope](AppLens-Product-Vision.md). diff --git a/docs/AppLensDesktop-Build.md b/docs/AppLensDesktop-Build.md index ad26458..b7ece0e 100644 --- a/docs/AppLensDesktop-Build.md +++ b/docs/AppLensDesktop-Build.md @@ -1,42 +1,69 @@ -# AppLens-desktop Build Notes +# AppLens desktop build -AppLens-desktop is the Windows platform shell for AppLens. It is a packaged WinUI 3 / Windows App SDK desktop app with a native C# backend, local Scanner/Tune collectors, module status, blackboard records, and export surfaces. +The active WinUI 3 client scans installed apps, disks and basic device information, +presents a sortable table, supports confirmed removal routes, and saves reports +locally. It has no build/runtime dependency on future/AppLens-Tune. -## Requirements - -- Windows 10/11 build 19041 or later. -- .NET SDK 10. -- Visual Studio 2022 with Windows App SDK / MSIX packaging tooling for Store packaging workflows. - -The backend and tests can build with the .NET SDK alone. Store packaging may require Visual Studio or Windows SDK tooling on the build machine. - -## Build +## Build and run +The approved first-release target is Windows 11 x64 (minimum build 22000). +Development requires .NET 10 SDK and compatible Windows SDK tooling. The desktop +project and Store bundle target x64 only; Windows 10 and native ARM64 are deferred. +Shared backend/test projects retain their earlier API target; that is not a +desktop support claim. The Windows App SDK/build-tool package versions are unchanged. ```powershell dotnet restore AppLensDesktop.sln -dotnet build AppLensDesktop.sln -dotnet test AppLensDesktop.sln +dotnet build AppLensDesktop.sln -c Release +dotnet test AppLensDesktop.sln -c Release --no-build +& .\src\AppLens.Desktop\bin\x64\Release\net10.0-windows10.0.22000.0\win-x64\AppLens.Desktop.exe ``` -## Package Smoke Build +Build the solution, or specify -p:Platform=x64 when building the desktop project +directly. The solution's x64 executable is under +src/AppLens.Desktop/bin/x64/Release/net10.0-windows10.0.22000.0/win-x64/. +A direct project build without Platform can use a different output directory. +`tools/Run-AppLensDesktop.ps1` starts the Debug build, creating it only if absent; rebuild +Debug explicitly before using that launcher to review source changes. +## Using the client +Alt+S starts a scan; Alt+D opens Download report after completion. Tab/Shift+Tab +move through controls and row actions. Choose Markdown, JSON or HTML before +downloading. The Windows picker starts in Downloads; choose another folder if +needed. Cancelling keeps the results. Exports include the complete scan even when +filters hide rows, and personal identifiers are redacted by default. + +At smaller window sizes or larger Windows text sizes, scroll the table +horizontally and the page vertically to reach all columns and expanded panels. +See [client verification](AppLens-Client-Verification.md) for observed coverage and +the [continuation handoff](AppLens-v1-Handoff.md) for remaining release work. + +## Focused verification ```powershell -dotnet publish src\AppLens.Desktop\AppLens.Desktop.csproj ` - -c Release ` - -p:GenerateAppxPackageOnBuild=true ` - -p:AppxPackageSigningEnabled=false +powershell -NoProfile -ExecutionPolicy Bypass -File tests\Script.Tests\Test-AppLensSnapshot.ps1 +powershell -NoProfile -ExecutionPolicy Bypass -File tests\Script.Tests\Test-StoreConfiguration.ps1 +dotnet test future\AppLens-Tune\tests\AppLens.Tune.Tests.csproj -c Release +dotnet run --project tools\AppLens.Smoke\AppLens.Smoke.csproj -c Release +dotnet list AppLensDesktop.sln package --vulnerable --include-transitive ``` -The project is configured for MSIX tooling, Windows 10/11 19041+, and app version `0.1.0.0`. Store submission should use Partner Center-managed signing for the final package. +The smoke command explicitly runs a read-only scan and writes a new evidence +directory. Normal builds do not scan the workstation. Preserved Tune tests run +separately and are not part of the core solution. + +## Development packages and release +Store build settings bundle the .NET runtime and use Store-managed Windows App +SDK framework dependencies. Development builds have separate settings; neither +their size nor this configuration check proves a clean-PC Store installation. +See [release validation](AppLens-Release-Validation.md) for the configuration +regression and remaining hands-on acceptance checks. -## Packaging Guardrails +[Removal probe instructions](../tools/AppLens.RemovalProbe/README.md) describe +disposable, uniquely identified Windows 11 unsigned test packages. Their install +needs native Windows administrator approval. They neither change certificate +trust nor enable Developer Mode. They are not distribution packages. -- Local-first evidence collection. -- No telemetry or cloud upload by default. -- Exports are user-triggered. -- System-changing Tune actions must be explicit, approved, and blackboard-recorded. -- Admin-required actions must stay visibly separate from standard-user actions. -- The baseline scan should not shell out to PowerShell. -- No telemetry or cloud upload. -- Exports are user-triggered. -- Baseline scan does not shell out to PowerShell. +Use `tools/Build-StoreCandidate.ps1` for local package preparation under the +authorization recorded in the [handoff](AppLens-v1-Handoff.md). It is not proof +of WACK/Store certification or a clean-PC install. Customer installation must +work without these developer commands; shortcut, update and Store-delivery +acceptance is tracked in [Store readiness](Store-Readiness-Checklist.md). diff --git a/docs/Store-Listing-Draft.md b/docs/Store-Listing-Draft.md index f74bad0..d827129 100644 --- a/docs/Store-Listing-Draft.md +++ b/docs/Store-Listing-Draft.md @@ -1,56 +1,92 @@ -# Microsoft Store Listing Draft +# Microsoft Store listing draft -## App Name +Publication draft; the Partner Center draft has not been submitted for certification. +Use the [submission preparation packet](AppLens-Store-Submission-Plan.md) for exact +Partner Center inputs, screenshot dimensions/captions and the final test session. -AppLens-desktop +## App name +Installed. Reserved Store ID: `9PBPFLL6JVVV`; publisher: Copper State Intelligence. +The repository, assemblies and legacy storage paths retain the AppLens name. -## Short Description - -Local control board for workstation inventory, diagnostics, module status, and operator-controlled actions. +## Short description +Review installed apps and disk usage, approve supported uninstalls, and download a local report. ## Description - -AppLens-desktop is CSI's local control board for understanding and managing a Windows workstation before workflow, automation, or AI-readiness work begins. - -The app scans locally and generates a workstation readiness view covering installed applications, startup entries, top processes, selected services, storage hotspots, developer tooling probes, and repo placement. It also shows module status, Tune diagnostics, and local blackboard records for evidence, proposed actions, approvals, and verification. - -AppLens-desktop does not upload data, create accounts, run background monitoring, or automatically share reports. Any system-changing action must be user-approved and recorded. Reports are exported only when the user chooses to export them. - -## Key Features - -- Local workstation inventory. -- AppLens Tune diagnostics. -- Readiness score and highlights. -- Module status dashboard. -- Local blackboard activity record. -- Operator-controlled Tune action flow. -- JSON, Markdown, and HTML exports. -- Default redaction for user, machine, and profile-path details. -- Optional raw-detail export controlled by the user. - -## Privacy Summary - -All scanning is local. No telemetry, cloud upload, account sign-in, or automatic sharing is included. Exported reports are user-controlled. - -## Screenshot Targets - -- First-run privacy notice. -- Completed dashboard with readiness score. -- Module status dashboard. -- AppLens Tune plan section. -- Blackboard activity section. -- App inventory section. -- Export controls. - -## Category - -Productivity or Utilities & tools. - -## Support URL - -Pending final hosted CSI support page. - -## Privacy Policy URL - -Pending final hosted CSI privacy policy page. +Installed puts your Windows 11 app inventory and storage usage in one simple table. +Run a local scan, search apps or publishers, and sort by name or reported size. +See installation scope, removal restrictions, disk capacity and free space, plus +secondary Windows, processor, graphics and memory details. + +Uninstall eligible desktop and current-user Store apps after confirming the exact +installation. Windows or the vendor may request administrator approval. Installed +respects restrictions, checks the result, and records observed storage changes. +App data can be deleted by an uninstall; save your work and review the confirmation. + +Download the full inventory and action history as Markdown, JSON or HTML for +review or sharing. Personal identifiers and profile paths are redacted by +default, with an explicit option to include them. Installed saves locally; you +choose whether and how to send the report. + +## Features +- Local app inventory and disk total/used/free readings. +- Search and size/name/publisher sorting; scope/type/removal filters. +- Explicit supported uninstall actions, Windows approval, and result verification. +- Local action history and downloadable reports. +- No accounts, telemetry, automatic uploads, or background optimization. + +## Limits to describe accurately +Reported app sizes can be missing or differ from recoverable space. System and +shared components are separated from ordinary apps. Some uninstaller commands +and restricted apps require review in Windows Installed Apps. That handoff is +not a verified removal. Current-user MSIX removal does not remove other users' +registrations. Scan speed varies; do not advertise a universal one-second +completion time. AppLens-Tune is deferred and is not included in this release. + +## First-release system requirements +Windows 11 on an x64 PC (minimum Windows build 22000). Windows 10 and native ARM64 +are deferred. ARM64 emulation has not been validated; confirm actual Store device +availability before submission rather than implying the x64 package blocks it. + +## Listing fields requiring owner/Store input +- Reserved name: Installed; publisher: Copper State Intelligence; Store ID: 9PBPFLL6JVVV. +- Category choice: Utilities & tools or Productivity, according to available Store categories. +- Age-rating questionnaire and supported markets. +- Verified, published privacy policy and support URLs. +- Review final screenshots and artwork before submission. + +## Screenshot subjects +The finished app table, largest-first storage review, exact-target confirmation, +and download/history controls. Use reviewed screenshots without personal data; +internal development captures are not automatically Store listing assets. + +## Certification notes +The app runs as an ordinary medium-integrity WinUI desktop process. runFullTrust +supports local registry/WMI inventory and supported Windows/vendor uninstall +mechanisms. No packageManagement or allowElevation capability is requested. +Installed itself remains unelevated; Windows handles explicit administrator +handoffs. Explain and demonstrate each supported removal route in certification. + +### Reviewer walkthrough (final identity/build to be supplied) +No login, account or server is required. Launch Installed and select Scan this PC. +Search by app/publisher, choose Largest first, and inspect an app's scope/details. +Unknown sizes mean unavailable metadata, not zero disk usage. + +Use a disposable app in the certification test environment for removal. Installed +revalidates the selected installation before showing its confirmation. Cancel +leaves it installed. Supported routes are Windows Installer for an exact product +GUID, a validated registered vendor EXE, or current-user package removal through +Windows PackageManager. All-user desktop routes can request a Windows admin +handoff. Installed stays unelevated and does not bypass denied approval or policy. +Restricted components stay disabled; Windows Settings handoffs are labeled as +handoffs and do not claim removal. No arbitrary commands are read from a report. + +After an approved fixture removal, inspect refreshed inventory and action history, +then download JSON, Markdown or HTML. The report includes the complete capture +even if the table is filtered. Personal identifiers are off by default. Close and +reopen to verify history. Uninstall Installed itself through Windows Installed Apps. + +Final package identity, supported platforms, delivery size and prerequisite +behavior must be filled from the tested submission candidate. The package is +configured to include .NET and use Store-managed Windows App SDK dependencies; +the clean-PC installation has not yet verified their delivery. diff --git a/docs/Store-Readiness-Checklist.md b/docs/Store-Readiness-Checklist.md index 60b3a99..e40140f 100644 --- a/docs/Store-Readiness-Checklist.md +++ b/docs/Store-Readiness-Checklist.md @@ -1,89 +1,104 @@ -# Microsoft Store Readiness Checklist - -Store packaging is a distribution track for the AppLens platform shell. It should validate installability, privacy posture, export control, and user trust. It is not the product scope. - -## App Package - -- App name: `AppLens-desktop` -- Package identity placeholder: `CSI.AppLensDesktop` -- Version: `0.1.0.0` -- Target: Windows Desktop, minimum version `10.0.19041.0` -- Package type: MSIX / packaged WinUI 3 desktop app -- Trust level: medium integrity full-trust desktop app, using `runFullTrust` - -## Implemented In The Current Shell - -- WinUI 3 packaged app scaffold. -- Native C# Scanner and Tune collectors. -- App inventory, diagnostics, readiness score, and tune plan. -- Blackboard event and store primitives. -- Module status and dashboard read models. -- JSON, Markdown, and local HTML exports. -- Default redaction with explicit raw-detail export option. -- Unit tests for backend behavior and dashboard presentation. -- MSIX package smoke build. -- Local run script and Store candidate build script under `tools/`. - -## Code-Ready - -- Local-first scan and Tune workflows are user-triggered. -- Tune actions are explicit, approval-gated, and blackboard-recorded. -- Backend and desktop presentation tests are included in `AppLensDesktop.sln`. -- CI runs solution-level Release tests. -- Local Windows `desktop.ini` files are ignored. -- Export defaults keep raw user, machine, and path details redacted unless the user opts in. - -## Packaging-Ready - -- MSIX project configuration exists for Windows desktop target `10.0.19041.0`. -- `tools\Build-StoreCandidate.ps1` runs restore, Release solution tests, unsigned package generation, artifact listing, and WACK detection. -- Latest local smoke generated `artifacts\install\AppLens.Desktop_0.1.0.0_x64_ARM64.msixbundle`. -- Store listing copy is drafted. -- Privacy and support documents exist in-repo for hosted publication. - -## Submission-Blocked - -- Reserve final app name in Partner Center. -- Replace placeholder CSI logo assets with final owned/licensed assets. -- Replace placeholder publisher identity with Partner Center identity. -- Publish production privacy policy URL. -- Publish support/contact URL. -- Capture Store screenshots from the final UI. -- Complete age rating questionnaire. -- Install missing Windows SDK symbol tooling for symbols package generation if symbols are required. -- Run Windows App Certification Kit on the final package. -- Produce Partner Center-signed upload package. - -## Drafted - -- Store listing draft: [Store-Listing-Draft.md](Store-Listing-Draft.md) -- Tomorrow handoff: [Tomorrow-Handoff.md](Tomorrow-Handoff.md) - -## Privacy Position - -The Store build should remain local-first and operator-controlled. It collects workstation inventory and diagnostics only after the user runs a scan. It does not upload data, create accounts, run background services, or automatically share reports. Reports are exported only when the user chooses export. - -System-changing actions must remain explicit, approval-gated, and blackboard-recorded. If any action path is not ready for Store submission, disable it in the Store build and keep the read-only plan visible. - -Collected data may include: - -- computer name and Windows username -- OS/device summary -- installed applications -- startup entries -- top processes -- selected service states -- storage hotspot paths and sizes -- repo placement paths -- WSL, Docker, and Ollama command summaries - -Default exports redact user, machine, and profile path details. The UI has an explicit raw-detail export option. - -## Certification Notes - -- Keep any Store-submitted action path explicit, approved, and documented. -- Avoid admin prompts. -- Avoid driver/service installation. -- Avoid automatic upload or telemetry. -- Do not claim Microsoft certification or affiliation. -- Note in certification comments that probes are local and user-triggered. +# Microsoft Store readiness + +The active v1 flow is inventory -> storage/app table -> approved removal -> +verification -> local report. AppLens-Tune is preserved outside the core build. +The implementation plan is [Product Vision](AppLens-Product-Vision.md); changing +work status is tracked in Linear, not duplicated here. +For completed source checks and a condensed keep/defer list of hands-on work, +see [release validation](AppLens-Release-Validation.md). +The [submission preparation packet](AppLens-Store-Submission-Plan.md) lists exact +owner inputs, screenshot requirements and the coordinated final-candidate test. + +## Confirmed delivery direction + +Owner decision, 2026-09-18: continue with Microsoft Store distribution and a website +installation entry point. Customers need a normal installed app they can open by +double-clicking a desktop icon. A separate direct-download installer is outside +this release plan. See the submission packet for the conditional Store Web +Installer option; choosing the Store does not decide free/paid pricing or authorize +submission/publication. + +## Package and runtime +- Native C#/.NET 10, WinUI 3 / Windows App SDK. +- Medium-integrity desktop app; only runFullTrust is declared. +- Owner-approved first release: Windows 11 x64, minimum build 22000. Project, + manifest and bundle settings match. Windows 10 and native ARM64 are deferred. +- Source identity now matches Installed, Store ID 9PBPFLL6JVVV; see the + submission packet for exact Partner Center values and candidate evidence. +- Store configuration bundles .NET and uses Store-managed Windows App SDK + frameworks; actual clean-PC prerequisite delivery is still unverified. +- Display name Installed; existing angular-A artwork needs replacement/review. +- Developer executable builds and unsigned development test packages are not a + Store installation, distribution approval or certification result. +- Owner delegated privacy and local packaging decisions on 2026-09-16. A new + unsigned x64 candidate is built and inspected with the official Installed identity; + exact artifact/hash evidence is in [release validation](AppLens-Release-Validation.md). +- New v1 action history uses Windows current-user data protection, with no + plaintext index. Legacy evidence stays unchanged and reports stay readable. + +## Release acceptance +Local evidence already covers keyboard navigation, row/action accessible names, +100%/225% text, normal and two high-contrast themes, resizing and save/cancel: +[COP-239 client verification](AppLens-Client-Verification.md). COP-240 also covers +packaged Store/MSI/vendor fixtures and native UAC denial/approval. These results +inform the final installed review; they do not check off clean-PC certification. +The 2026-09-14 development-package pass also covers Downloads picker cancel/save, +failed/slow processes, NoRemove protection, and closure/reopening during an action. +Actual Narrator speech, keyboard focus after picker cancellation, genuine managed +policy denial and final-candidate/clean-PC behavior remain open. See the +[handoff](AppLens-v1-Handoff.md). The current session has no native desktop control; +this is a tooling limit, not a renewed owner pause. + +- [ ] Complete the installed customer flow on a clean standard-user Windows PC, + including native/package dependencies and offline scan/export. +- [ ] Complete and verify desktop-shortcut creation and double-click launch, + reopening without developer tools, and a controlled same-identity update + preserving launch access and readable history. +- [x] Retain developer-PC evidence for all-user removal, denied/approved UAC, + cancellation, NoRemove protection, failed/slow uninstallers and app closure. +- [ ] Verify genuine managed-policy denial and the clean-PC administrator handoff. +- [x] Retain COP-239 keyboard, accessible-name, text scaling, high-contrast, + small-window and large-inventory evidence. +- [ ] Verify actual Narrator speech and installed picker focus recovery; perform + the final-package spot check without repeating unchanged full matrices. +- [ ] Verify the approved Windows 11 x64 target on the clean test system. Windows + 10/native ARM64 tests are deferred by the 2026-09-16 scope decision, not passed. + Review actual Store device availability; x64 can be emulated on ARM64. +- [ ] Measure launch, first results and completion, package download, installed + footprint, and first-install prerequisites for the actual distribution. +- [x] Refresh Microsoft policy/capability/submission guidance on 2026-09-16; + distinguish effective 7.19 from 7.20 effective 2026-10-22. +- [x] Implement the delegated local-history protection decision, including + same-user recovery, corrupted-history refusal and legacy preservation tests. +- [ ] Complete installed-profile/cross-user protection and uninstall/reinstall + retention checks; verify final privacy/contact disclosures against policy + 10.5.4. Local encryption tests do not establish certification or compliance. +- [ ] Run Windows App Certification Kit against the final package. +- [ ] Verify Store download/install only after authorized publication. +- [ ] Verify the website's Store installation entry point after authorized + publication; verify actual Store update delivery when an approved update + is available. Local package upgrades do not establish Store delivery. + +Use [Uninstall routes](AppLens-Uninstall-Routes.md) for the chosen APIs, evidence +and limitations. Application identifiers, unavailable values, action outcomes and +scope evidence must remain consistent in the table and all report formats. +No automatic restart, forced deletion or bypass of administrator/policy controls. + +## Materials to finalize +- [ ] Reserve the final AppLens name and use Partner Center's package/publisher identity. +- [ ] Owner review of original AppLens artwork and final screenshots without private data. +- [ ] Publish and verify the [privacy draft](AppLens-Privacy-Draft.md) at a real URL. +- [ ] Publish and verify the [support draft](AppLens-Support-Draft.md) with a real contact. +- [ ] Complete category, age-rating, market and certification fields using the + [listing draft](Store-Listing-Draft.md). +- [ ] Produce the final upload package using the authorized signing/submission process. +- [ ] Prepare the website installation button using the final Store ID. Prefer + the official Direct-mode badge when eligible; otherwise link the Store + listing. Website implementation/hosting approval remains separate. +- [ ] Verify manual publishing hold before any later authorized certification + submission when public release has not separately been approved. + +Local candidate preparation is authorized by the 2026-09-16 delegation. Hosting +changes, Store submission and publication still require explicit authorization. +No final identity or approval of native Windows prompts is inferred from this +checklist. diff --git a/AppLens-Tune.ps1 b/future/AppLens-Tune/AppLens-Tune.ps1 similarity index 100% rename from AppLens-Tune.ps1 rename to future/AppLens-Tune/AppLens-Tune.ps1 diff --git a/AppLens-Tune.py b/future/AppLens-Tune/AppLens-Tune.py similarity index 100% rename from AppLens-Tune.py rename to future/AppLens-Tune/AppLens-Tune.py diff --git a/future/AppLens-Tune/README.md b/future/AppLens-Tune/README.md new file mode 100644 index 0000000..0eeae08 --- /dev/null +++ b/future/AppLens-Tune/README.md @@ -0,0 +1,44 @@ +# AppLens-Tune — deferred, preserved + +This is the existing AppLens-Tune implementation, set aside while AppLens v1 +delivers fast inventory, storage review, uninstall, and report download. +Do not reconnect these diagnostics to core launch or scan. + +## Contents and entry points + +- `AppLens-Tune.ps1` and `Run-AppLens-Tune.bat`: Windows audit script. +- `AppLens-Tune.py` and `Run-AppLens-Tune.sh`: macOS/Linux audit script. +- `src/AppLens.Tune.csproj`: native diagnostics, rules, readiness, Tune plan, + approval-gated executor, `TuneAuditService`, and `TuneReportWriter`. +- `tests/AppLens.Tune.Tests.csproj`: preserved native tests; run explicitly: + `dotnet test future/AppLens-Tune/tests/AppLens.Tune.Tests.csproj -c Release`. +- `desktop/`: former dashboard window source. It is preserved as reference; + there is no active Tune desktop project. Reintegrating it requires a deliberate + separate desktop project and review after v1, not copying it into the core UI. +- `docs/`: original product/LLM/thesis material. Treat its roadmap as deferred. + +## Shared dependencies + +The native project references the normal core backend; core never references this +project. Machine collection, formatting/redaction, approval-loop interfaces, ledger, +module infrastructure, and existing serialized evidence contracts remain shared. +Historical `AuditSnapshot`/Tune-shaped evidence models stay in the backend for +existing platform/ledger compatibility. V1 uses `InventorySnapshot` and exports no +Tune fields. `ITuneActionExecutor` breaks the old concrete executor dependency. +Service-control implementation and its package dependency are confined here. + +## Preservation and verification + +`preservation-manifest.json` records source/destination paths and SHA-256 before +relocation. Files were hash-checked immediately after moving. Subsequent edits are +limited to renaming the legacy audit/report classes, adapting references/tests, +implementing the shared executor interface, and delegating machine reads to the +shared collector. Diagnostic/optimization logic was not redesigned. + +The separated native project currently passes all 58 preserved tests. This does +not prove every real Tune action or OS probe works. The scripts and old dashboard +have not been live-validated after separation. An earlier Windows script audit +stalled; its cause remains unidentified. Do not run it as a v1 readiness check. + +Resume only after v1: read the preserved docs, run the explicit tests, investigate +the stalled script independently, and establish a dedicated UI entry point. diff --git a/Run-AppLens-Tune.bat b/future/AppLens-Tune/Run-AppLens-Tune.bat similarity index 100% rename from Run-AppLens-Tune.bat rename to future/AppLens-Tune/Run-AppLens-Tune.bat diff --git a/Run-AppLens-Tune.sh b/future/AppLens-Tune/Run-AppLens-Tune.sh similarity index 100% rename from Run-AppLens-Tune.sh rename to future/AppLens-Tune/Run-AppLens-Tune.sh diff --git a/future/AppLens-Tune/desktop/MainWindow.xaml b/future/AppLens-Tune/desktop/MainWindow.xaml new file mode 100644 index 0000000..b406386 --- /dev/null +++ b/future/AppLens-Tune/desktop/MainWindow.xaml @@ -0,0 +1,657 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +