Prepare workflow intake reports for consultant review and sharing

.github/workflows/dotnet.yml

@@ -13,6 +13,7 @@ jobs:
   build-test:
     name: Build and test
     runs-on: windows-latest
+    timeout-minutes: 25
 
     steps:
       - name: Checkout
@@ -30,7 +31,16 @@ jobs:
         run: dotnet build AppLensDesktop.sln --configuration Release --no-restore
 
       - name: Test
-        run: dotnet test AppLensDesktop.sln --configuration Release --no-restore
+        run: dotnet test AppLensDesktop.sln --configuration Release --no-build --no-restore --logger trx --results-directory artifacts/test-results
+
+      - name: Retain Windows test evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-test-results-${{ github.sha }}
+          path: artifacts/test-results/*.trx
+          if-no-files-found: warn
+          retention-days: 14
 
       - name: Test Windows initial snapshot
         shell: powershell
@@ -40,3 +50,30 @@ jobs:
         shell: powershell
         run: .\tests\Script.Tests\Test-StoreConfiguration.ps1
 
+      - name: Build unsigned Store candidate
+        shell: pwsh
+        run: |
+          $candidate = Join-Path $env:GITHUB_WORKSPACE 'artifacts/release-candidate'
+          dotnet publish src/AppLens.Desktop/AppLens.Desktop.csproj -c Release -p:Platform=x64 -p:GenerateAppxPackageOnBuild=true -p:AppxPackageSigningEnabled=false "-p:AppxPackageDir=$candidate/msix/" "-p:AppxPackageTestDir=$candidate/install/"
+          if ($LASTEXITCODE -ne 0) { throw 'Unsigned candidate build failed.' }
+          $bundles = @(Get-ChildItem "$candidate/install" -Recurse -Filter '*.msixbundle')
+          if ($bundles.Count -ne 1) { throw 'Expected exactly one unsigned candidate bundle.' }
+          [ordered]@{
+            commit = '${{ github.sha }}'
+            run = '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+            status = 'Unsigned candidate; installation, sharing and certification are not verified'
+            file = $bundles[0].Name
+            bytes = $bundles[0].Length
+            sha256 = (Get-FileHash $bundles[0].FullName -Algorithm SHA256).Hash
+          } | ConvertTo-Json | Set-Content "$candidate/candidate.json" -Encoding utf8
+
+      - name: Retain unsigned candidate for acceptance
+        uses: actions/upload-artifact@v4
+        with:
+          name: installed-unsigned-candidate-${{ github.sha }}
+          path: |
+            artifacts/release-candidate/install/**/*.msixbundle
+            artifacts/release-candidate/candidate.json
+          if-no-files-found: error
+          retention-days: 14
+

.gitignore

@@ -25,3 +25,6 @@ desktop.ini
 /AppLens-*.md
 /AppLens-*.json
 /AppLens-*.html
+/Installed-*.md
+/Installed-*.json
+/Installed-*.html

AGENTS.md

@@ -1,8 +1,10 @@
 # AppLens Agent Instructions
 
-Installed (formerly AppLens) v1 is a lightweight Windows client for guided screen-share sessions:
-scan -> review/filter apps and storage -> approve supported uninstalls -> verify
-results -> save a local report. Keep communication concise and plain-English.
+Installed (formerly AppLens) v1 is a lightweight Windows client for workflow-consultation intake:
+open -> read-only scan -> review PC specifications and installed tools -> share a
+report with the consultant. Optional client goals, services and constraints are
+statements, not scanned facts. Existing confirmed uninstall/history features remain
+secondary. Keep communication concise and plain-English.
 
 The Store product is Installed (9PBPFLL6JVVV). Keep AppLens repository, namespaces,
 legacy storage paths and DPAPI purpose identifiers stable; renaming those can
@@ -20,9 +22,11 @@ break history compatibility. AppLens-Tune remains a separate deferred component.
 - Scans are read-only. System changes require explicit confirmation, supported
   mechanisms and recorded outcomes. Preserve Windows approval/policy controls;
   do not add automatic remediation, forced deletion or automatic restarts.
-- Keep the approved local-only privacy design: no accounts, telemetry or uploads;
+- Keep the approved local-only privacy design: no accounts, telemetry or automatic uploads;
   Windows current-user protection for new history without plaintext duplicates;
-  readable reports redacted by default. Preserve legacy evidence unchanged.
+  readable reports redacted by default. User-reviewed reports may be handed to
+  Windows sharing; the user chooses the app and recipient. Never claim delivery
+  from opening the share UI. Preserve legacy evidence unchanged.
 
 ## Working rules
 

PRIVACY.md

@@ -1,11 +1,32 @@
-# AppLens-desktop Privacy Notice
+# Installed desktop privacy notice
 
-AppLens-desktop is local-first and operator-controlled. Scanner and default diagnostic scans collect local workstation inventory and readiness evidence without changing the machine.
+Installed (the AppLens Windows client) collects PC specifications and installed
+application information locally. A read-only scan starts when you open the app;
+you can cancel it or start another scan. The scan does not change system settings.
 
-Tune actions can change system state only after explicit user approval, through narrow executor paths, and with blackboard records for the proposal, approval, execution result, and follow-up verification. The app does not upload data, create accounts, or run background monitoring. Reports are exported only when the user chooses to export them.
+Collected information includes Windows version, manufacturer/model, processor and
+graphics names, memory and disk readings, installed app names/versions/publishers,
+installation identities and locations, computer name and Windows username.
+Optional workflow goals, services and constraints are text you supply. Do not
+include passwords or access keys. The client does not collect credentials or run
+the deferred AppLens-Tune diagnostics. It has no accounts, telemetry, automatic
+uploads or background monitoring.
 
-Scans may include installed app names, app versions, computer name, Windows username, OS details, top processes, startup entries, selected service states, storage hotspot paths/sizes, repo placement paths, and local tool summaries for WSL, Docker, and Ollama when available.
+Reports include the complete captured inventory, optional notes and recorded
+actions even when display filters hide rows. Known computer/user identifiers and
+the current user's profile path are redacted by default; you may explicitly
+include them. App names and notes can still contain sensitive information.
 
-Default exports redact user, computer, and profile path details. Users may explicitly choose to include raw local details when exporting.
+Download report writes a readable file only to a destination you select. Send
+report first shows a review, then hands that report to Windows sharing. You choose
+the sharing app and recipient; their handling of the report is subject to their
+own practices. Installed does not choose a recipient or verify email delivery.
+The app supplies a streamed attachment without writing an additional export file;
+Windows and the selected sharing app may cache or retain the shared content.
 
-For production Microsoft Store submission, replace this file with a hosted privacy policy URL owned by CSI.
+Supported uninstall actions require separate confirmation. New action history is
+protected for the current Windows user; older development history is preserved.
+Exported/shared reports are readable and are not protected by that history
+encryption. See the [full privacy draft](docs/AppLens-Privacy-Draft.md) for history
+and retention limitations. The release requires a verified hosted policy and
+contact details; this repository notice is not evidence of Store publication.

README.md

@@ -5,7 +5,7 @@
 <h1 align="center">AppLens</h1>
 
 <p align="center">
-  CSI's local control board for managing workstation apps, agents, evidence, and approvals.
+  Understand a client's PC and installed tools before designing their workflow.
 </p>
 
 <p align="center">
@@ -16,11 +16,14 @@
 
 ## Overview
 
-AppLens is CSI's mobile-OS-inspired local control board. It gives a workstation one place to see apps, agents, evidence, proposed actions, and operator approvals.
+AppLens is CSI's local technical intake tool for workflow consultations. A client
+opens the Windows app, reviews their PC specifications and installed tools, then
+shares the report with their consultant. The Store product name is **Installed**.
 
-The first Store release is now centered on a quick client-session workflow:
-install AppLens, scan, review a sortable app table, approve supported uninstalls,
-and verify the result. Its approved launch target is **Windows 11 x64**; Windows 10
+The first Store release centers on **open → scan → review → send a workflow intake
+report**. Optional client goals, services and constraints complement the scan.
+Existing confirmed uninstalls and verification remain available. Its approved
+launch target is **Windows 11 x64**; Windows 10
 and native ARM64 support are deferred. The scripts/platform work below has a
 broader scope than this Store client. See [Product Vision](docs/AppLens-Product-Vision.md) for the
 current product direction and proposed client design. The broader platform below
@@ -46,15 +49,19 @@ AppLens is local-first and operator-controlled:
 - read-only scans by default
 - approval-gated actions
 - no automatic remediation without an explicit grant
-- no telemetry, accounts, or cloud upload
+- no telemetry, accounts, or automatic upload
 - user-controlled report export
+- reviewed report sharing through the user's chosen Windows sharing app
 - default report redaction for user, machine, and profile-path details
 
 ## AppLens-desktop
 
 AppLens is the WinUI 3 inventory client. It provides storage and device readings,
 a searchable/sortable app table, confirmed Windows/vendor uninstall routes,
-verification, local action history, and full JSON/Markdown/HTML downloads.
+verification, local action history, and full JSON/Markdown/HTML downloads. It
+starts a read-only scan on opening and puts workflow intake facts first. Send
+report reviews a frozen export before opening Windows sharing; it does not verify
+email delivery. Download report is available when a sharing app is unavailable.
 See the [uninstall route contract](docs/AppLens-Uninstall-Routes.md) and
 [Store readiness](docs/Store-Readiness-Checklist.md) for verification limits.
 

docs/AppLens-Privacy-Draft.md

@@ -1,9 +1,12 @@
 # Installed privacy policy — publication draft
 
-Installed collects information locally when you start a scan. This includes installed
+Installed starts a read-only local scan when you open the app; you can cancel it
+or start another scan. It collects installed
 app names, versions, publishers, installation identities and locations, reported
 sizes, removal information, local disk capacity and usage, Windows/device details,
 processor and graphics names, memory usage, uptime, computer name and Windows username.
+Optional workflow goals, online services and constraints are statements you enter,
+not facts verified by the scan. Do not include passwords or access keys.
 
 Installed v1 does not collect top-process rankings or run the deferred AppLens-Tune
 diagnostics. It does not include accounts, telemetry, automatic uploads, cloud
@@ -17,13 +20,17 @@ completion can leave an unknown outcome; review it in Windows and run a fresh sc
 Uninstalling an app can delete that app's data. Installed does not provide an undo
 facility for third-party uninstalls.
 
-Reports are saved only when you choose a local destination. They contain the full
+Downloaded reports are saved only when you choose a local destination. They contain the full
 captured inventory and recorded actions, including entries hidden by display
 filters. Computer/user identifiers and profile paths are redacted by default.
-You can explicitly include personal identifiers. Redaction is not a guarantee
+Reports also contain your optional notes. You can explicitly include personal identifiers. Redaction is not a guarantee
 that a report contains no sensitive information; review it before sharing.
-Installed does not send the report to a consultant or AI service. Any sharing you
-perform afterward is your choice and is subject to the recipient's practices.
+Send report shows a review before handing a frozen report to Windows sharing.
+You choose a sharing app and recipient and complete sending there. Installed
+neither chooses the recipient nor verifies delivery. It supplies the attachment
+as a stream without creating an extra export file; Windows and the selected app
+may cache or retain the content. Sharing is subject to that app's and recipient's
+practices. Download report remains available for manual attachments.
 
 Local history and saved reports remain on your device until removed by you or by
 Windows' applicable app-data handling. Exported files are separate from the app.

docs/AppLens-Product-Vision.md

@@ -1,7 +1,24 @@
-# AppLens v1: executable task list
+# AppLens v1: workflow consultation intake
 
-Build a lightweight Microsoft Store app for a guided screen-share session:
-**scan -> review apps and storage -> approve removals -> download results for AI review.**
+Build a lightweight Microsoft Store app that answers a consultant's request for
+the client's PC setup: **open -> scan -> review -> send a workflow intake report.**
+
+The consultant uses the report to architect workflows around the client's hardware,
+operating system, installed applications and runtimes. It supplies observations,
+not an automatic compatibility verdict. Optional goals, online services and
+constraints are labeled client statements. Missing readings and coverage stay
+visible; installed software does not prove licensing, sign-in or working access.
+
+The Windows client begins a read-only scan on opening. Review report shows a
+plain-language summary with the complete export available to inspect; Send report
+opens review before handing the frozen file to Windows
+sharing. The client chooses a sharing app and recipient. Download report remains
+available for email attachments and AI review in Markdown, JSON and HTML. No email
+credentials, fixed recipient or automatic delivery are introduced. Existing
+confirmed removal and history features remain available as secondary workflows.
+
+Multi-device collection over SSH and remote execution remain future scope. This
+change does not add Linux collector parity or publish a Store package.
 
 ## AppLens v1 implementation boundary
 
@@ -14,7 +31,8 @@ Build a lightweight Microsoft Store app for a guided screen-share session:
 - Use a silver, restrained metallic client with crisp edges, matte-black type,
   one main app table, and secondary device details/action history.
 - Keep scans read-only and local. No accounts, telemetry, automatic uploads,
-  automatic remediation, forced deletion, or automatic restarts.
+  automatic remediation, forced deletion, or automatic restarts. Explicit,
+  user-reviewed Windows sharing is a handoff to the user's selected app.
 - Preserve existing AppLens-Tune in `future/AppLens-Tune/`; core v1 must have no
   runtime or build dependency on it. Keep shared infrastructure in the backend.
   Defer startup/service optimization, top-process rankings, deeper diagnostics,

docs/AppLens-Release-Validation.md

@@ -1,5 +1,52 @@
 # AppLens release validation — COP-241
 
+## Intake maintenance checks — 2026-11-06
+
+All 25 focused local redaction/intake/scan tests pass after correcting short-name
+redaction and marker collisions. Eight new regression cases cover the correction.
+Git ignore checks cover both Installed export naming conventions and legacy
+AppLens reports while retaining source/docs. First-scan cancellation copy and
+the active submission plan were corrected. See the current
+[handoff](AppLens-v1-Handoff.md#intake-maintenance--2026-11-06); earlier Windows CI
+and package evidence below belongs to the prior revision. The updated revision
+requires fresh Windows CI; installed Windows 11 acceptance and WACK remain open.
+
+## Native Windows CI and package inspection — 2026-11-06
+
+[PR #14](https://github.com/CSI-Platform/AppLens/pull/14) remains a draft.
+[Windows CI](https://github.com/CSI-Platform/AppLens/actions/runs/42317507257)
+passed the native build, all 149 tests, script snapshot checks, Store configuration
+and unsigned candidate packaging. Downloaded artifact/bundle checksums matched;
+actual payload inspection confirmed official identity, x64 only, Windows 11
+minimum, bundled .NET/ProtectedData, compiled resources, runFullTrust only and no
+Tune or workstation evidence. Debug symbols were omitted with a tooling warning.
+
+Candidate and full inspection details are in the current
+[handoff](AppLens-v1-Handoff.md#windows-ci-candidate-verified--2026-11-06) and local
+`artifacts/release-intake-42317507257/`. This closes the Linux-host build/test gap;
+it does not establish installed client behavior. Windows 11 install/launch,
+sharing receipt/cancellation/fallback, clean-PC lifecycle/accessibility/privacy
+and WACK remain release blockers. No merge or Store publication occurred.
+
+## Workflow intake release gate — 2026-11-06
+
+The new intake flow has 60 passing local checks (43 selected backend, 17 desktop
+presentation) and a successful C# source/API compilation check. Three existing
+tests and native XAML compilation require Windows. These local results do not
+establish installed launch, sharing or Store acceptance.
+
+Release configuration evaluation confirms Windows 11 x64 only, bundled .NET,
+Store-managed Windows App SDK, unsigned MSIX and the existing official identity.
+The current NuGet audit found no known vulnerable direct/transitive packages in
+the four core projects. Privacy, support and Store listing drafts now describe
+automatic read-only startup scanning, optional client notes and reviewed sharing.
+
+The source branch is prepared in GitHub. After an initial automatic approval
+review rejection, the owner explicitly authorized the draft PR and Windows CI,
+including test-result and unsigned-candidate artifact uploads. See the current
+[handoff](AppLens-v1-Handoff.md) for commit and branch details. Final Windows
+acceptance, candidate inspection, clean-PC lifecycle and WACK remain release gates.
+
 ## Installed name and Store identity — 2026-09-23
 
 The owner reserved Installed and approved applying the name and official identity.