commit 831814283ee5f414d0f72eb6b568e77f131626f7
Author: unknown <0x000>
Date:   Sat Sep 19 20:52:28 2026 -0400

    first commit

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..cc5a9b6
--- /dev/null
+++ b/README.md
@@ -0,0 +1,79 @@
+# Wind privacy toolkit
+
+A local Windows privacy configuration tool and an evidence-based implementation plan. Browser choices: **Tor Browser, Zen, Helium**. Research checked 2026-09-18.
+
+**Status: development prototype.** Audit and planning run without elevation. Policy apply/restore is implemented, with transaction tests; Windows behavior and network effects still require VM testing. It does not certify anonymity or zero Microsoft traffic.
+
+## Start here
+
+```powershell
+./Wind.ps1
+./Wind.ps1 -Mode Plan -Profile Strict
+./Wind.ps1 -Mode Guide
+./Install-Apps.ps1 -App Tor,Zen,Helium,Mullvad -WhatIf
+```
+
+The default mode is a read-only policy audit. Guide prints Windows Settings links and browser setup guidance, including the Home edition path. Nothing downloads or executes remote scripts.
+
+On supported Windows 11 Pro/Enterprise/Education editions, from a 64-bit elevated PowerShell:
+
+```powershell
+./Wind.ps1 -Mode Apply -Profile Standard -WhatIf
+./Wind.ps1 -Mode Apply -Profile Standard
+# Optional: notify before downloading updates, preserving the update engine
+./Wind.ps1 -Mode Apply -Profile Standard -Updates Notify
+# Restore using the journal path printed by Apply
+./Wind.ps1 -Mode Restore -Journal 'C:\path\to\journal.json' -WhatIf
+./Wind.ps1 -Mode Restore -Journal 'C:\path\to\journal.json'
+```
+
+Apply is explicit. Standard keeps existing update settings. Updates can be Keep, Automatic, Notify or Manual. Manual disables automatic updates; it does not promise no update network traffic or control browser/Store updates. Re-run Audit after reboot, then follow the behavioral checks in the validation plan.
+
+Windows Home and unreviewed builds are **audit/guide only** for machine policy changes. A registry value being present is not evidence that Windows honors it. The currently reviewed build families are 26100 and 26200; this is a scope gate, not a claim of end-to-end testing.
+
+## Implemented
+
+- Source-linked policy catalog: minimum supported Windows diagnostic level, advertising ID, location, camera, app microphone default, cloud speech, clipboard synchronization, Find My Device, cloud search and Delivery Optimization.
+- Strict adds clipboard history suppression and DO mode 99 (no peering or DO cloud service; updates still contact their own services).
+- Edition/build checks, read errors, app microphone exception detection, and managed-device detection before mutation.
+- Exact DWORD value/absence capture, a journal saved before writes, readback, failure rollback, and conflict-aware restoration. No full registry exports, personal identifiers or browsing contents are collected.
+- Optional package installation with exact WinGet IDs, normal installer/hash checks, no silent license acceptance, no forced restarts, and `-WhatIf`.
+- Tor, Zen and Helium are all available; installing does not select a default or configure the browsers.
+
+## Not implemented yet
+
+Network enforcement, packet-capture validation, a graphical wizard, AME packaging, Home GUI automation, debloating, sensor hardware disablement, Recall removal, automatic cleanup, and lock-event handling are specified in [the implementation plan](docs/PLAN.md). Their status is explicit because an incomplete privacy control must not appear enabled.
+
+Read [the research and threat model](docs/RESEARCH.md), [Home setup guide](docs/HOME-GUIDE.md), and [validation protocol](docs/VALIDATION.md).
+
+The [privacy register](outputs/01a0b6c2-22ad-7b62-9a5a-4a09014a9b42/Windows-privacy-register.xlsx) records 85 controls and decisions, 19 tool/research entries, sources, application status and 24 remaining tasks. The [blog draft](outputs/01a0b6c2-22ad-7b62-9a5a-4a09014a9b42/Windows-privacy-blog-draft.md) explains the motivation and evidence. The [supplied GDID script review](docs/GDID-SCRIPT-REVIEW.md) records 12 findings and the two pinned research revisions. None of these artifacts represents a deployed identifier block.
+
+## Offline update preparation
+
+Direct downloads require outbound requests. For no direct Microsoft contact from the protected PC, use a separate collector and an isolated Windows environment; see [the offline update design](docs/OFFLINE-UPDATES.md). Cloud protection is unavailable while isolated.
+
+```powershell
+# Local version/edition/architecture only; no identifying hardware/account fields.
+./Offline-Updates.ps1 -Json
+
+# Check an explicitly prepared local bundle. Does not download or install.
+./Offline-Updates.ps1 -Mode Verify -Manifest 'D:\Updates\bundle.json' -Json
+```
+
+Populate `config/offline-bundle.example.json` with reviewed packages and actual hashes first. The verifier checks integrity against an unsigned manifest, target build/architecture and declared prerequisite order. It does not establish publisher authenticity, complete prerequisites, applicability, coverage or isolation. Run `./tests/Run-OfflineUpdateTests.ps1` for its synthetic tests.
+
+## Recovery and boundaries
+
+Journals go into `%LOCALAPPDATA%\WindPrivacy\journals` by default and contain only the selected policy values, build/edition and a local random installation marker. Keep them private and restore on the originating Windows installation. No journal is uploaded. Apply/restore use a shared mutex to prevent overlapping Wind transactions. Domain/MDM detection is best effort; do not use on an organization-managed device.
+
+Restore changes only catalogued values whose current value still matches what Wind wrote. It reports conflicts instead of overwriting subsequent changes. Repeated restore is safe. Empty registry keys created by Apply may remain. Restoring policy settings cannot recover data already deleted by Windows or third-party programs.
+
+The core does not change Defender, firewall, encryption, Secure Boot, UAC, update services, licensing, device identifiers, logs, browser data or user files. No hosts blocklist, RAM cleaner, registry cleaner, `irm | iex`, or security exclusions are used.
+
+## Tests
+
+```powershell
+./tests/Run-Tests.ps1
+```
+
+The tests run the transaction engine against an isolated memory store. They do not change Windows policies. The read-only audit can separately be run on the host. Passing these tests is not a substitute for VM and network validation.