0x000/ms-private
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

Prepare ms-private 0.0.1 release candidate

Browse Source
This commit is contained in:
0x000 committed 2026-09-22 21:21:41 -04:00
1 parent 7aacc0b63f
commit a515538438
75 files changed
+3957 -3484
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/ANONYMITY.md
+34
View File
@@ -0,0 +1,34 @@
# Anonymity is an operating practice
ms-private reduces named Windows collection and local retention. It cannot make a Windows device anonymous by itself. An observer can correlate an IP address, an account, a browser fingerprint, a payment, a document, a writing pattern, a contact graph or behavior even when an operating-system identifier is absent.
## Choose the network model before the preset
For ordinary privacy, keep security updates enabled, use a reputable encrypted connection on untrusted networks, and inspect the traffic that remains. A VPN moves trust from the access network to the VPN provider; it does not remove account identity or browser identifiers.
For unlinkable web sessions, use an unmodified Tor Browser and keep those sessions separate from everyday accounts. Tor Browser only routes its own traffic. Signing into an identifying account, opening downloaded documents in networked external applications, installing extensions or changing fingerprint-sensitive settings can link the session. Follow the [Tor Project's safety guidance](https://support.torproject.org/tor-browser/security/using-tb-safely/).
For a Windows environment that must make no direct Internet connections, use ms-private's timed isolation only after preparing local recovery. Obtain signed updates on a separate maintained collector, verify them, and transfer them offline. This model trades cloud reputation, simple servicing and live certificate checks for containment. The collector still contacts publishers.
## Separate identities deliberately
- Use different OS users or virtual machines for identities that must not be linked. A different browser profile is a convenience boundary, not a strong isolation boundary.
- Do not sign into the same email, social, Microsoft, payment or recovery accounts across identities.
- Keep phone numbers, recovery addresses, usernames, avatars, writing patterns, contacts and posting schedules in the threat model.
- Remove document metadata and review visible content before publishing. Screenshots can reveal account names, notifications, time zone, language, monitor layout and other context.
- Use unique passwords and phishing-resistant MFA. CISA's Scattered Spider advisory shows that identity recovery and help-desk social engineering can defeat strong endpoint controls when human processes remain weak.
## Keep security evidence and maintenance
Do not delete Defender, firewall, authentication or Windows Update event channels as routine privacy cleanup. Those logs help detect account takeover and malware, and deleting them does not recall data already transmitted. Restrict access and retention according to the threat model instead.
Preserve Defender, the firewall, Secure Boot, TPM-backed protections, BitLocker or device encryption, browser updates and Windows security updates. Run `Security.ps1` after applying a preset and after every major Windows update. Use `Network.ps1 -Mode Validate` and a short packet capture to measure the result on the exact Windows build.
## Publish claims that the evidence supports
- **Selected**: the control is in a plan.
- **Applied**: Windows accepted the change and a local readback matched.
- **Observed**: a controlled capture or external test measured the expected behavior.
- **Not observed**: a test did not see a flow during its limited window; this is not proof that it can never occur.
Identifier rotation is not an anonymity control in ms-private. A server can restore an identifier, correlate a series of values, or use hardware, account and network signals. Randomly rewriting an undocumented value can also break identity, licensing or updates. The project disables documented channels, removes selected account state, narrows outbound connections, and asks for packet-capture evidence instead.
docs/BLOG.md
+102
View File
@@ -0,0 +1,102 @@
# Why I started taking Windows privacy more seriously
> “There is a sacred realm of privacy for every man and woman where he makes his choices and decisions—a realm of his own essential rights and liberties into which the law … must not intrude.”
Those are the words of Geoffrey Fisher, quoted by Patrick Devlin in *The Enforcement of Morals*, Chapter 7, “Mill on Liberty in Morals.”
Recently I began reading more material from [CISA](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a), the [U.S. Department of Justice](https://www.justice.gov/usao-ndil/pr/alleged-member-criminal-cyber-hacking-group-scattered-spider-arrested-finland-and) and [MITRE ATT&CK](https://attack.mitre.org/versions/v17/groups/G1015/). What pushed me further was a vx-underground post about Peter Stokes, an alleged member of Scattered Spider, and the court papers behind it.
The case made me think less about the privacy switches Windows shows to users and more about the records that exist behind those switches.
The criminal complaint is an allegation, not evidence of guilt. Stokes is presumed innocent unless proven guilty. That legal distinction matters, and so does the technical distinction between what one investigation describes and what every Windows computer necessarily does.
## The identifier that caught my attention
The [federal complaint](https://www.justice.gov/usao-ndil/media/1450651/dl?inline=) describes Microsoft records that associated an installation identifier with URLs, IP addresses and timestamps. The identifier was referred to as GDID, or Global Device Identifier.
I had barely heard of GDID before this. It sounded like one more obscure value hidden somewhere inside Windows, but the important part was the association: an identifier becomes much more revealing when it is connected to network addresses, activity and time.
Microsoft does publicly document a `GlobalDeviceId` field in its Delivery Optimization reporting schema. The same table includes fields such as device name, ISP, approximate location derived from IP address and the last time the device sent data to Microsoft. Microsoft describes the field as an identifier used internally. [Microsoft UCDOStatus reference](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/ucdostatus).
That official documentation proves that a Microsoft global device identifier exists in at least that reporting context. It does not prove that the UCDOStatus table produced the web records described in the complaint, or that every Windows installation reports the same information in the same way.
While looking for more information, I found [gdid-reversal](https://github.com/SmtimesIWndr/gdid-reversal), its follow-up [We-running-GDID-back](https://github.com/SmtimesIWndr/We-running-GDID-back), and the [ZeroTrace Lab GDID article](https://www.zerotracelab.com/blog/gdid-windows-tracking). These projects discuss local LID values, PUID formatting, Microsoft identity services and possible hardware associations.
They are useful reverse-engineering leads, but they are not Microsoft specifications. Their results should be reproduced on controlled Windows builds before being turned into universal claims.
### My current GDID understanding
| Question | Current answer |
| --- | --- |
| Does Microsoft use something called GlobalDeviceId? | Yes. Microsoft documents the field in its reporting schema. |
| Is GDID just one registry value? | The independent research identifies a local LID representation, but the local value should not be treated as the complete server-side identity. |
| Can changing that value make a device anonymous? | There is no evidence that changing it alone removes Microsoft’s backend associations. A service may restore it or correlate the device through other signals. |
| Would generating a new value every minute help? | Only if every relevant service trusted the new value and discarded every other signal. That has not been demonstrated, and continuous mutation could damage authentication, licensing or updates. |
| Can a reinstall or virtual machine guarantee a fresh identity? | It can change local observations, but it does not prove that a remote provider cannot recognize the physical device, account or network. |
| Can previously collected records be deleted locally? | No. Local cleanup cannot recall records already transmitted to a provider. |
The most defensible conclusion is that GDID is one signal inside a larger identity and telemetry system. Treating it as a single registry switch would give me more confidence than evidence.
## GDID is only one part of the problem
Microsoft’s own optional-diagnostics documentation says covered data can include browser IDs, URLs and search terms, page titles, notification text, and processed typing, inking or speech context. The browsing examples are scoped to Microsoft browsers and the data is described as pseudonymized. Those qualifications matter, but so does the breadth of the documented categories. [Optional diagnostic data](https://learn.microsoft.com/en-us/windows/privacy/optional-diagnostic-data).
Windows also uses other installation, hardware, account, network and event-correlation fields. Connected experiences, cloud synchronization, application analytics and security services have different data paths. Turning off an advertising ID or one diagnostic setting cannot address all of them.
Some of the strongest identifiers are also the least mysterious. An email account, phone number, payment, recovery address, browser synchronization profile or repeated username can join activity more reliably than an obscure operating-system field.
## Privacy without abandoning security
I want to reduce unnecessary collection without turning the computer into an unmaintained target.
Windows Update, browser updates, antivirus, the firewall, disk encryption and supported boot protections still matter. A large blocklist can look impressive while silently breaking certificate maintenance, malware reputation, application updates or operating-system servicing.
There is no way to download an update directly from Microsoft while sending literally nothing to Microsoft. The connection itself exposes an address and timing, and the request contains information needed to deliver the correct package. A VPN changes who sees the source connection, but it does not erase identifying content carried inside a request.
A machine that must make no direct Internet connections needs a different operating model: another maintained computer downloads reviewed, signed packages and transfers them for offline installation. That model has costs. It needs a repeatable process for Windows, Defender, browsers, certificates, firmware and recovery components. It also gives up live reputation and cloud-analysis features.
Privacy controls should therefore state what they disable, what they preserve and what evidence would show that they worked.
## The person remains part of the system
The more I read about Scattered Spider, the more obvious it became that endpoint settings are only part of the threat model. CISA describes social engineering, SIM swapping, stolen personal information and help-desk manipulation as central parts of the group’s operations.
People reveal information through conversations, screenshots, documents, usernames, writing style, posting times, contacts and account-recovery choices. Reusing the same identities across supposedly separate environments reconnects them. Signing into a personal account through Tor identifies the session to that account even if the network path is hidden.
This does not make technical privacy controls pointless. It means my habits, account boundaries and published content must be reviewed alongside the operating system.
Before publishing a screenshot or document, I now want to ask:
- Does it contain account names, notifications, metadata or a unique directory path?
- Does the language, time zone or posting schedule connect it to another identity?
- Am I reusing an email address, phone number, recovery account, avatar or username?
- Will opening a downloaded file cause another application to connect outside the protected browser?
- Am I about to describe a privacy result that I configured but never measured?
## A small tool grew out of the research
I started building **ms-private** to turn this research into a reviewable Windows configuration instead of another opaque “disable everything” script. It has an automatic Fresh Install or conservative Established PC starting point plus four manual intensity presets, a graphical wizard, an arrow-key terminal interface, exact app and sensor selection, recovery journals, network capture, cleanup and security-preservation checks. The normal release is one elevated Windows executable with the reviewed runtime embedded and verified before launch.
The tool reduces documented collection, connected features, application identity state and local retention. It can remove selected applications, purge current-user Microsoft application sign-ins, disable reviewed privacy services, apply supported policies, restrict optional endpoints, disable exact sensors and use timed network isolation. It does not claim to delete Microsoft’s server-side GDID records or make Windows anonymous.
The detailed presets, commands, recovery behavior, GDID scope and validation status live in the separate [ms-private tool breakdown](../../docs/TOOL-BREAKDOWN.md). Keeping that material outside this post lets the article remain about why I started the project and what the evidence changed in my thinking.
## What I took from this
Privacy is not one button, one browser or one identifier. It is a maintained boundary between the information a device produces, the services it contacts, the accounts I use and the details I reveal myself.
My goal is not to promise invisibility. It is to remove collection I do not need, reduce local traces I can responsibly control, keep the machine secure, separate identities where that matters, and describe every result with enough precision that someone else can test it.
## Sources
- [U.S. v. Peter Stokes — superseding complaint](https://www.justice.gov/usao-ndil/media/1450651/dl?inline=)
- [DOJ announcement concerning Peter Stokes](https://www.justice.gov/usao-ndil/pr/alleged-member-criminal-cyber-hacking-group-scattered-spider-arrested-finland-and)
- [CISA/FBI Scattered Spider advisory AA23-320A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a)
- [MITRE ATT&CK Scattered Spider entry](https://attack.mitre.org/versions/v17/groups/G1015/)
- [Microsoft UCDOStatus schema](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/ucdostatus)
- [Microsoft optional diagnostic data documentation](https://learn.microsoft.com/en-us/windows/privacy/optional-diagnostic-data)
- [Microsoft Windows 11 connection endpoints](https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints)
- [gdid-reversal](https://github.com/SmtimesIWndr/gdid-reversal)
- [We-running-GDID-back](https://github.com/SmtimesIWndr/We-running-GDID-back)
- [ZeroTrace Lab: GDID — The Windows Global Device Identifier](https://www.zerotracelab.com/blog/gdid-windows-tracking)
- [vx-underground post that prompted the investigation](https://x.com/vxunderground/status/2073427396535963967)
docs/GDID-SCRIPT-REVIEW.md
+1 -1
View File
@@ -37,7 +37,7 @@ Microsoft's [per-user services documentation](https://learn.microsoft.com/en-us/
## Verification performed
PowerShell parsed the attachment without executing it. Three isolated in-memory probes confirmed: the real marker fails the script's search pattern; an unmatched start marker drops trailing synthetic entries; ASCII conversion changes a synthetic Unicode comment. No service, policy, hosts file, cache or network setting was modified. Results are in `reports/upstream-review/pasted-script-static-probes.json`.
PowerShell parsed the attachment without executing it. Three isolated in-memory probes confirmed: the real marker fails the script's search pattern; an unmatched start marker drops trailing synthetic entries; ASCII conversion changes a synthetic Unicode comment. No service, policy, hosts file, cache or network setting was modified. The findings are summarized here; transient local probe reports are intentionally excluded from the repository.
## Integration decision
docs/HOME-GUIDE.md
+6 -4
View File
@@ -1,6 +1,6 @@
# Windows Home and browser setup guide
These are manual controls, not a claim that the prototype has applied them. Open Windows Settings and use the pages below. Labels vary by Windows build. Keep this guide open while configuring; the tool does not automatically open pages, install applications or alter this host.
These are Settings-backed controls; the machine-policy engine does not pretend to enforce them on Home. Run `Home.ps1 -Page <name>` or use the graphical wizard's Home tab to open the supported Windows Settings page. Labels vary by Windows build, so verify the visible toggle and representative behavior. ms-private does not automate localized clicks or mark a setting complete merely because it opened the page.
| Page / URI | Recommended choice | Verify |
| --- | --- | --- |
@@ -19,7 +19,9 @@ These are manual controls, not a claim that the prototype has applied them. Open
Also review Windows backup/settings sync, Phone Link, Widgets, online account use, notifications on the lock screen, browser location permissions and installed OEM utilities. A local Windows account reduces account coupling but is not an anonymity guarantee. Do not disable encryption or antivirus for performance/privacy presets.
On eligible devices, Recall settings are under Privacy & security > Recall & snapshots. Review deletion effects before disabling by policy or removing the feature. Existing snapshot data is not backed up by Wind.
Use `Accounts.ps1 -Mode Plan -Scope AllAppAccounts` to preview current-user Microsoft application sign-outs. Apply permanently resets the listed app packages and deletes matching stored application credentials; it does not convert or remove the Windows logon account. Existing work or school registration must be reviewed under **Settings > Accounts > Access work or school** because ms-private refuses changes on a managed device.
On eligible devices, Recall settings are under Privacy & security > Recall & snapshots. Review deletion effects before disabling by policy or removing the feature. Existing snapshot data is not backed up by ms-private.
## Browser choices
@@ -34,7 +36,7 @@ Install only the selected browsers; none becomes the default automatically:
./Install-Apps.ps1 -App Tor,Zen,Helium
```
WinGet contacts its community source and publisher download infrastructure and can produce local logs. WinGet and publisher installers have their own diagnostic/privacy settings; this installer wrapper does not override them. These installation connections are separate from Wind's offline policy engine. Verify displayed package identity/version/publisher before accepting installer prompts. WinGet manifests are community-maintained; their presence is not a security audit.
WinGet contacts its community source and publisher download infrastructure and can produce local logs. WinGet and publisher installers have their own diagnostic/privacy settings; this installer wrapper does not override them. These installation connections are separate from ms-private's offline policy engine. Verify displayed package identity/version/publisher before accepting installer prompts. WinGet manifests are community-maintained; their presence is not a security audit.
## Mullvad and storage
@@ -42,4 +44,4 @@ Mullvad installation is optional: `./Install-Apps.ps1 -App Mullvad`. It needs an
VeraCrypt installation is optional: `./Install-Apps.ps1 -App VeraCrypt`. Configure containers and unmount behavior within VeraCrypt. Keep system encryption and recovery keys; do not decrypt the OS as a prerequisite. Win+L does not wipe all RAM or revoke every session token.
The source-backed rationale and limitations are in [RESEARCH.md](RESEARCH.md). All recommendations need practical verification on the actual Windows build and hardware.
The source-backed rationale and limitations are in [PRIVACY.md](PRIVACY.md). Verify controls on the actual Windows build and hardware.
docs/NATIVE-API.md
+19
View File
@@ -0,0 +1,19 @@
# Native API and security-tool interaction
ms-private does not directly import `kernel32.dll`. An earlier read-only executable-inspection test used `LoadLibraryEx` and related `kernel32` resource functions; Microsoft Defender blocked that dynamically compiled inspection code. The test now parses PE headers and resources with managed byte operations, so those imports were removed rather than allowlisted or hidden.
The .NET runtime, Windows PowerShell and Windows themselves ultimately call native operating-system libraries. Avoiding the word `kernel32` cannot guarantee that a process never reaches those libraries, and ordinary use of a Windows API is not by itself a malware signal. The relevant questions are which privileged behavior is requested, whether the target is exact, whether the user approved it, and whether recovery and verification exist.
## Direct native bridge retained
`src/MsPrivate.Accounts.psm1` uses the documented WinCred functions in `advapi32.dll` to enumerate Credential Manager metadata and delete only targets matching `config/accounts.json`. The bridge is initialized only when account planning or purge is requested. Reports replace matching target names with stable local action IDs and never write account names, target strings or credential secrets.
The bridge remains because Windows PowerShell has no built-in, locale-independent cmdlet for exact generic Credential Manager enumeration and deletion. Replacing it with parsed `cmdkey.exe` output would make targeting depend on localized text. It must receive clean-VM Defender acceptance testing before public release; third-party EDR compatibility is optional and ms-private will not create antivirus exclusions or weaken AMSI to make it run.
Clipboard clearing now uses the managed WPF `PresentationCore` API. No direct `user32.dll` bridge remains.
## Changes that security products can observe
Applying a Medium, Strong or Maximum preset performs behaviors that security software may monitor: service configuration, policy and registry writes, firewall-rule creation, Appx or desktop uninstallation, Credential Manager deletion, scheduled-task creation, device disablement, Recall feature changes and file cleanup. UAC is expected. Defender or another EDR can warn, block or quarantine an unsigned administrative tool even when its intent is legitimate.
The project does not suppress those products. Release acceptance therefore includes testing the final executable with Defender enabled, no exclusions, every mutation group applied separately, recovery exercised, and detections recorded. Code signing, timestamping and release provenance remain roadmap items; signing can improve identity and reputation but does not guarantee that security software will allow privileged behavior.
docs/PLAN.md
+14 -12
View File
@@ -4,14 +4,16 @@
Build a Windows privacy wizard with three browser choices: Tor Browser, Zen and Helium. Its job is to reduce collection and retention, expose tradeoffs, and verify specific settings. It must never present a percentage-anonymous score or claim that a host is untraceable.
The current release-candidate version is 0.0.1. See [ROADMAP.md](ROADMAP.md) for the reconciled open and validation work and [NATIVE-API.md](NATIVE-API.md) for direct API and security-product behavior.
The running Windows installation is the development host. Development and read-only inspection are authorized; this iteration creates the tool and planning artifacts without destructive OS changes or installation of applications on that host.
## Profiles
| Profile | Default behavior | Availability |
| --- | --- | --- |
| Standard | Minimum supported diagnostic policy, no advertising ID, Windows location/camera restrictions, covered app microphone default deny, no cloud speech/clipboard sync/Find My Device/cloud search, DO without peering; updates unchanged | Prototype implements policy configuration on reviewed Pro/Enterprise/Education build families |
| Strict | Standard plus no clipboard history and DO mode 99 | Prototype implements those added policies; advanced networking is not included yet |
| Standard | Minimum supported diagnostic policy, no advertising ID, Windows location/camera restrictions, covered app microphone default deny, Activity Feed/upload off, no cloud speech/clipboard sync/Find My Device/cloud search, WER off and DO without peering; updates unchanged | Implements policy configuration on reviewed Pro/Enterprise/Education build families |
| Strict | Standard plus denied app access to account, calendar, contacts, call history, email, messaging, diagnostics, trusted/unpaired devices and voice activation; no clipboard history; DO mode 99; selected connected/cloud/diagnostic services disabled; future consumer Microsoft app authentication and workplace registration blocked; current Microsoft app sign-ins selected for purge | Default wizard profile. Policies and services are reversible; account-package reset and credential deletion are irreversible and require a separate acknowledgement. |
| Isolated session | Separate Tails environment; explicit persistence and identity separation | Guidance; not an automated OS installer |
Users can select individual supported IDs with `-Id`. The future UI needs a clear restore action for each restriction so camera/microphone use is possible when wanted. Software permission controls and hardware disconnection must have distinct labels.
@@ -23,18 +25,18 @@ Users can select individual supported IDs with `-Id`. The future UI needs a clea
| Policy engine | Audit, Plan, Apply, Restore, edition/build gates, readback, recovery journal and transaction tests | VM verification on each supported build/edition; confirm policy consumption after reboot |
| Browser/app selection | Exact package IDs, optional interactive installer, no default takeover, `-WhatIf` | Verify freshness/publisher manifests in release pipeline; UI choices; detect updates without importing personal profiles |
| Home edition | Read-only report and explicit manual guide | Supported Settings integration; verify actual toggles rather than pretending Pro policies work |
| Diagnostics | Supported minimum Windows policy | Separate crash reporting, feedback and app-level controls with sources and side effects |
| Connected experiences | A small documented subset | Backup/account sync, Phone Link/CDP, Widgets, Start web search, consumer suggestions, application-specific policies; validate edition and deployment mechanism |
| Network controls | Research and validation specification only | Lab capture, destination attribution, narrow rules, timed recovery and VPN coexistence tests |
| AI removal | Research and deletion warning | Inventory Recall eligibility and installed Copilot apps; explicit data-deletion preview; dependency-aware uninstall |
| Debloat | Design only | Exact allowlist of removable apps; distinguish user/provisioned scope; OneDrive data-preservation preflight; Edge/WebView2 separation |
| Diagnostics | Supported minimum policy, feedback prompts off, WER policy/service off, reviewed endpoint rules and DiagTrack shutdown | Validate effective traffic on each supported build and retain required security/update channels |
| Connected experiences | Activity upload policies, app capability restrictions, CDPSvc/CDPUserSvc, OneSyncSvc and CloudBackupRestoreSvc reversible shutdown | Validate reboot persistence and effects on Phone Link, Nearby Sharing, Miracast, mail/calendar/contact sync and cloud backup |
| Network controls | Observe, reviewed optional-FQDN rules, timed default-outbound isolation, explicit confirmation, restore and Pktmon capture | Complete IPv4/IPv6/DNS/DoH/QUIC/VPN and external-gateway lab validation; expand endpoints only with provenance |
| AI removal | Recall inventory, deletion acknowledgement, supported policy and optional-feature disable/restore | Eligible-device deletion/reboot validation; installed Copilot inventory remains catalog-driven app selection |
| Debloat | Exact current-user inventory, curated bundled default, personal opt-in, browser-before-removal, OneDrive/Edge handling and protected dependencies | Live package/data/reinstall/new-user validation on every supported build |
| Updates | Keep, Automatic, Notify, Manual registry choices on eligible editions | Reboot and actual update workflow tests; UI temporary pause uses supported Windows mechanisms; browser/AV updates independent |
| Sensors | Location/camera policy and limited app microphone policy | Optional hardware-device disablement with reliable recovery and device selection; never disable audio input blindly |
| Cleanup | Home guide | Storage Sense integration with explicit retention and exclusions; skip busy files; never clean the registry or clear security logs |
| Lock behavior | Design only | Session-lock trigger, vault integrations, clipboard handling, selected VeraCrypt volumes, busy-volume/error reporting; no generic process kill |
| Sensors | Location/camera policy, limited app microphone policy and exact selected PnP device disable/restore | Physical camera/microphone/Hello and restoration validation; nothing selected by default |
| Cleanup | Preview-first allowlisted Temp, WER/crash, Recent/Jump List, thumbnail, PowerShell-history and expired-report cleanup; age threshold; reparse/change/lock checks; optional safe schedule | Live active-installer, locked-cache and long-running schedule validation; browser-owned retention remains separate |
| Lock behavior | SessionLock scheduled task, current clipboard clear, exact selected VeraCrypt graceful unmount and local result report | Win+L/auto-lock/user-switch/RDP and busy-volume validation; password-manager adapters remain product-specific |
| Encryption | Guidance only | Read-only encryption status without recovery-key capture; key-custody guide; no automatic encryption/decryption migration |
| Security software | Preserve existing protections | Optional Bitdefender selection after conflict checks; no automatic Zillya recommendation pending sufficient evidence |
| Packaging | Local CLI scripts | Signed release, reproducible manifest, checksums, native GUI; optional AME wrapper after VM validation |
| Packaging | Self-contained x64 WinExe with UAC manifest, hash-manifested embedded runtime and Program Files installation; local CLI, native TUI, tabbed Windows Forms wizard, source ZIP builder and AME wrapper/builder | VM-run executable and AME validation, code signing, reproducible CI artifacts and release provenance |
## Network design requirements
@@ -53,7 +55,7 @@ The requested no-direct-Microsoft-contact option now has a [separate collector a
2. Detect OS edition/build and managed-device constraints. Show unavailable controls as unavailable.
3. Choose browsers and optional Mullvad/VeraCrypt; show installation separately from configuration.
4. Review each setting, its source, expected result, compatibility impact and reversibility. Separate data-deleting actions.
5. Prepare a local recovery journal, then apply selected actions in small independent groups.
5. Prepare local recovery journals, then apply selected actions in recorded groups. Continue after an unrelated group fails; skip only a group whose declared prerequisite failed.
6. Report configured, pending reboot, behavior verified, unsupported, failed and conflict states separately.
7. Offer rollback by group and show remaining manual checks. A successful registry write never earns a "verified anonymous" badge.
docs/PRIVACY.md
+23
View File
@@ -0,0 +1,23 @@
# Privacy scope and sources
Reviewed 2026-09-20. ms-private reduces selected collection and connected features. It cannot establish device anonymity. Optional diagnostics, required service data, signed-in accounts and third-party apps are separate channels. [Microsoft essential services](https://learn.microsoft.com/en-us/windows/privacy/essential-services-and-connected-experiences).
GDID appears in the Stokes complaint alongside URL records and corroborating account/IP evidence. The complaint does not identify the exact collection mechanism or prove every browser is monitored. Local identifier replacement is not evidence of unlinkability. ms-private disables CDPSvc, the CDPUserSvc template and current instances, Connected User Experiences and Telemetry, cloud sync/backup, location and WER in Strict mode; it also blocks the reviewed diagnostic endpoint catalog. This reduces plausible channels but is labelled “GDID mitigated, verification pending” until controlled packet captures demonstrate the effect. ms-private does not rotate an undocumented identifier. [Complaint, paragraphs 25-30](https://www.justice.gov/usao-ndil/media/1450651/dl?inline=), [Microsoft per-user services](https://learn.microsoft.com/en-us/windows/application-management/per-user-services-in-windows), [Windows endpoints](https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints).
The Windows advertising ID is not interchangeable with GDID, a Microsoft account ID, hardware identifiers or a browser fingerprint. Individual policy sources and impacts live in [policies.json](../config/policies.json). On Pro the diagnostic minimum used here retains required diagnostics; policy configuration is subject to edition and precedence. [Windows diagnostics](https://learn.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization).
Strict mode blocks new consumer Microsoft authentication by applications and new workplace registration. Its separate account purge resets exact current-user Store, Xbox, packaged Microsoft 365/Teams and shared account-broker packages, then deletes only matching stored Microsoft application credentials. Resetting a package permanently removes its current-user data and sign-in details. Reports omit identity names, emails, credential targets and secrets. The Windows logon identity and existing organizational registration are not removed. [Microsoft account authentication policy](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-msapolicy), [MSIX reset behavior](https://learn.microsoft.com/en-us/windows/msix/desktop/managing-your-msix-reset-and-repair).
Uninstalling OneDrive does not download cloud-only files. Make needed files available locally and back them up first. ms-private does not erase cloud records or manually remove synchronized folders. [OneDrive removal](https://support.microsoft.com/en-us/onedrive/turn-off-disable-or-uninstall-onedrive).
Edge removal is limited by Windows and regional support. Its enterprise uninstall policy is not a universal consumer-PC bypass. WebView2 remains because applications use it as a separate runtime. [Edge update policy](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-update-policies#uninstall), [WebView2 distribution](https://learn.microsoft.com/en-us/microsoft-edge/webview2/concepts/distribution).
Appx package removal is scoped to the current user; the general data-preservation switch is not available for normal installed Store packages. Desktop removal is delegated to the registered product through WinGet with product-code/scope filtering. [Remove-AppxPackage](https://learn.microsoft.com/en-us/powershell/module/appx/remove-appxpackage), [WinGet uninstall](https://learn.microsoft.com/en-us/windows/package-manager/winget/uninstall).
Online updates necessarily send requests. An isolated PC can receive separately collected offline packages, but loses live cloud services. The offline bundle verifier proves only agreement with supplied hashes and metadata, not publisher authenticity or update completeness. See [offline updates](OFFLINE-UPDATES.md).
Local deletion and network anonymity are separate. ms-private can preview and remove selected WER/crash data, Recent Items, Jump Lists, thumbnail caches, known Zen/Tor/Helium cache subdirectories, PowerShell history, temporary files and expired toolkit reports. Browser cleanup retains cookies, passwords, bookmarks, sessions and settings. It does not clear security, Defender, update, firewall or authentication event logs. Those records help detect compromise and do not prevent an identifier or account token from being sent before deletion. File deletion is not a reliable physical-erasure guarantee on SSDs, backups or synchronized storage.
`Security.ps1` reports BitLocker/device-encryption protection, Defender and cloud-protection posture, firewall, Secure Boot, TPM, VBS/Credential Guard, LSA, UAC, SMB/SMB1, remote access and protected-service state. It deliberately omits recovery keys, account names, Defender exclusions and secrets. Encryption protects data at rest; it does not hide network identifiers while the machine is unlocked and online.
Tor Browser, Zen and Helium serve different browsing needs. Installing a browser or VPN does not separate personal accounts, clear provider records or hide everything an endpoint sends. Avoid mixing identities and retain browser/security updates.
docs/RESEARCH.md
+15 -1
View File
@@ -110,6 +110,20 @@ Exclude registry cleaners, blanket log clearing, SSD free-space wiping and RAM t
WinUtil provides useful UI, app installation and reversible settings, but every preset needs review and version pinning. Do not chain multiple debloat tools on a machine. This prototype uses its own small, documented policy catalog, not an unreviewed execution of WinUtil. [WinUtil tweak guidance](https://github.com/ChrisTitusTech/winutil/blob/main/docs/src/content/docs/guides/tweaks.mdx).
AME is a delivery mechanism. Its Privacy+ methodology describes removal of Windows Update, conflicting with the requirement for reversible update choices. A future Wind AME wrapper should invoke the same tested engine rather than duplicate settings or remove security services. [Privacy+ methodology](https://download.amelabs.net/Privacy%2B%20Testing%20Methodology.pdf).
AME is a delivery mechanism. Its Privacy+ methodology describes removal of Windows Update, conflicting with the requirement for reversible update choices. The ms-private AME wrapper invokes the same tested engine rather than duplicating settings or removing security services. [Privacy+ methodology](https://download.amelabs.net/Privacy%2B%20Testing%20Methodology.pdf).
For sessions requiring an amnesic environment, prefer a separate Tails USB over promises about making ordinary Windows forget everything. Persistence must remain an explicit choice. Tails still cannot guarantee safety against malicious hardware or identifying user behavior. [How Tails works](https://tails.net/about/index.en.html).
## 9. Documented but easy-to-miss channels and security checks
The September 2026 review found more documented surfaces that belong in a privacy model. Microsoft lists separate connections for device metadata, downloadable fonts, Windows location, Widgets and Spotlight. The optional-diagnostics schema says optional data can include browser IDs, URLs and search terms, page titles, notification text, processed typing context and recognized ink. These are not evidence of a secret backdoor; they show why one telemetry switch or one identifier cannot describe the complete data surface. [Windows 11 endpoints](https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints), [optional diagnostic data](https://learn.microsoft.com/en-us/windows/privacy/optional-diagnostic-data).
The policy catalog now covers tailored experiences and implicit ink/typing collection for the current user; search location and dynamic highlights; Widgets; device metadata and font streaming; MSRT infection reports; and packaged-app access to location, foreground text, gaze, screen capture, human-presence sensing, motion, notifications, phone state, radios and background execution. Per-app allow overrides are treated as conflicts because a global-default label would otherwise overstate coverage. Spotlight and consumer-experience controls are selected only on Enterprise/Education, matching Microsoft's current edition support. [Privacy Policy CSP](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy), [Search Policy CSP](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-search), [Experience Policy CSP](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience), [Widgets policy](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-newsandinterests).
Strict mode disables LLMNR through the documented DNS Client policy. This reduces a local name-resolution spoofing and credential-relay surface, but it can break legacy discovery and name resolution for printers or peer devices. mDNS, NetBIOS, WPAD, file sharing and discovery remain separate research and compatibility decisions; they are not silently disabled under the Microsoft-telemetry label. [DNS Client policy](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-dnsclient#pol-llmnr).
The security audit now observes Defender real-time, behavior, IOAV, network-inspection and cloud settings; TPM and Secure Boot; VBS/Credential Guard; LSA protection; UAC; SMB1, signing and guest-related configuration; remote access; and the update, certificate, Defender, firewall and event-log services. It excludes Defender exclusions, account names, keys and secrets. LSA protection and Credential Guard defend credentials, while current Windows 11 releases also strengthen SMB signing. These controls need compatibility testing before enforcement, so the release audits them instead of forcing settings that might cut off NAS, domain or accessibility workflows. [Advanced credential protection](https://learn.microsoft.com/en-us/windows/security/book/identity-protection-advanced-credential-protection), [Credential Guard](https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/how-it-works/), [SMB hardening](https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-security-hardening).
The network catalog adds exact feature endpoints for location inference, metadata, font streaming, Widgets and Spotlight. It rejects target names under Windows Update, update delivery, Defender, SmartScreen, Store revocation and WNS families. NCSI, certificate revocation, root certificate maintenance, Windows Update, Defender and notification infrastructure remain available because blocking them can create false offline state or weaken security. A reset or feature update can also communicate before local policy is reapplied, so a high-assurance no-direct-contact design needs offline policy application or a physically/network-isolated Windows system plus a separate update collector. [Manage Windows connections](https://learn.microsoft.com/en-gb/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services).
Historical forensic research found hardware serials, external-storage traces and process-execution traces in older Windows telemetry resource files. That is a useful lab lead, not proof that the same artifacts or transmissions exist on every current build. Current claims require a named Windows build, a repeatable workflow, local and external capture, and redacted evidence. ETW patching, TLS interception and deletion of security logs are excluded because they impair defenses or create a new interception risk rather than proving privacy. [Forensic analysis of Windows telemetry](https://arxiv.org/abs/2002.12506).
docs/ROADMAP.md
+25
View File
@@ -0,0 +1,25 @@
# ms-private 0.0.1 roadmap
Version 0.0.1 is an unpublished release candidate. Implementation exists for the graphical and terminal interfaces, presets, policy engine, debloat, account purge, service control, network modes, Recall, sensors, cleanup, lock handling, security audit, source/AME packaging and the self-contained executable. The remaining work is mostly live acceptance, release provenance and the separately designed offline-maintenance system.
## Open work
| ID | Priority | Work still required |
| --- | --- | --- |
| R01 | P0 | Run the complete Windows Home, Pro, Enterprise and Education VM matrix, including supported Windows 10 servicing and reviewed Windows 11 builds. |
| R03 | P0 | Record controlled baseline and configured traffic at the host and an external gateway across boot, idle, browsing, updates, VPN and restore. |
| R13 | P1 | Build a versioned third-party application privacy register with publisher sources and separate update/security decisions. |
| R18 | P2 | Repeat validation after Windows feature/security updates and browser, VPN or installer changes. |
| R20 | P1 | Reproduce context-specific GDID/PUID, Widgets and Store observations with disposable identities and redacted evidence. |
| R21 | P0 | Validate the offline update design end to end on an isolated target. |
| R22 | P0 | Implement and validate the signed offline Windows Update Agent catalog scanner. |
| R23 | P0 | Cover Defender engine/platform/intelligence, certificate trust, browsers, applications, drivers and firmware in offline maintenance. |
| R24 | P1 | Authenticate collector downloads and transferred packages with publisher signatures, current catalogs and protected manifests. |
| R25 | P0 | Add Authenticode signing, trusted timestamping, SBOM/provenance output and a controlled release pipeline. |
| R26 | P0 | Exercise every privileged action with the built-in Defender protections enabled and no exclusions; optionally record third-party EDR compatibility without adding bypasses. |
## Implementation complete; live acceptance remains
R02, R04–R12 and R14–R17 have working code or prepared material, but their acceptance evidence is incomplete. This includes security-preservation checks, endpoint provenance, timed firewall recovery, real registry/service restoration, Home Settings verification, physical sensor testing, Recall and app-removal recovery, cleanup and lock-event testing, GDID research reproduction, pinned upstream artifacts, browser/VPN acceptance, GUI accessibility, AME execution and the final editorial check.
R19 is complete: the unsafe supplied-script patterns were reviewed and were not integrated. ms-private uses exact targets, write-ahead recovery records, protected components, readback and explicit destructive acknowledgements instead.
docs/STATUS.md
+20 -8
View File
@@ -1,6 +1,6 @@
# Delivery status — 2026-09-18
# Delivery status — 2026-09-19
Update architecture supplement completed 2026-09-19: local OS inventory and offline bundle verification are implemented in `Offline-Updates.ps1` and `src/Wind.OfflineUpdates.psm1`. Nineteen new tests passed in PowerShell 7 and Windows PowerShell 5.1. Real host inventory returned only OS version/edition/architecture. No real package download, authenticity validation, applicability scan, installation or network isolation was performed. The register now contains 85 controls/decisions, 21 identifier/data-channel entries, 19 tool/research entries, 20 claims, 24 remaining tasks, 12 supplied-script findings and a separate update-maintenance sheet. See `docs/OFFLINE-UPDATES.md` and `docs/ADDITIONAL-CHANNELS.md`.
The update architecture and implementation pass was completed on 2026-09-20. The product is named ms-private. Local OS inventory, offline bundle verification, the graphical and terminal wizards, app/debloat flows, Microsoft app-account purge, network enforcement and capture, reversible privacy-service shutdown, Recall, exact sensors, privacy-artifact cleanup, lock handling, security status and AME packaging are implemented or prepared as described below. No real package download, app removal, account purge, policy write, service mutation, firewall change, device disable, cleanup or Recall deletion was performed.
A sourced blog draft and pinned-revision GDID research review are included. Workbook formulas were recalculated and tested with temporary status edits, then restored; rendered sheets and exported structure were inspected. No Excel desktop execution was performed.
@@ -11,15 +11,27 @@ The supplied script was parsed without execution. Three isolated in-memory probe
- Research and threat model with primary sources, implementation plan and release validation protocol.
- Three browser choices: Tor Browser, Zen and Helium; optional Mullvad and VeraCrypt installers.
- Local PowerShell policy engine: read-only audit, plan, explicit apply, recovery journal and conflict-aware restore.
- Home edition manual guide; no unsupported policy enforcement claims.
- Home edition Settings assistant and manual guide; no unsupported policy enforcement claims.
- Tabbed Windows Forms wizard that reuses the PowerShell scripts, plus the arrow/Space/Enter terminal interface.
- Six-preset catalog with age-aware recommendation. Windows and profile ages of seven days or less select Fresh Install and its complete removal workflow; older/unknown installations select Established PC with no destructive groups. Gentle, Medium, Strong and Maximum remain manually selectable. Exact review and one final approval precede mutation.
- Complete-preset operation runner that records every selected group, continues with independent groups after a failure, skips only failed prerequisites and writes a local run summary without secrets.
- Exact current-user app inventory, protected dependency rules, default curated debloat, OneDrive/Edge ordering and Tor/Zen/Helium browser prerequisites.
- Optional network FQDN enforcement across 19 reviewed feature/telemetry endpoints, protected update/security endpoint rejection, explicit timed isolation, journal validation, post-check confirmation, Pktmon capture conversion and point-in-time socket inventory.
- Strict service engine for DiagTrack, dmwappushservice, CDPSvc/CDPUserSvc, OneSyncSvc, CloudBackupRestoreSvc, lfsvc and WerSvc, with original-state journals, instance shutdown and conflict-aware restore. Update, Defender, firewall, certificate, licensing, identity and Store security services are protected by catalog validation.
- Irreversible current-user Microsoft app-account purge: exact Store/Xbox/Microsoft 365/Teams/account-broker package resets plus allowlisted Credential Manager deletion, with account names and credential targets omitted from reports. Strict policy blocks future consumer app authentication and new workplace registration without disabling the Windows logon identity.
- Recall eligibility/policy/feature workflow with an irreversible-deletion acknowledgement.
- Exact selected PnP sensor disable/restore; allowlisted Temp, crash-report, Recent/Jump List, thumbnail, PowerShell-history and expired-report cleanup; scheduling; and SessionLock clipboard/VeraCrypt handling.
- Read-only BitLocker/device-encryption, Defender/cloud posture, firewall, Secure Boot, TPM, VBS/Credential Guard, LSA, UAC, SMB/SMB1, remote-access and protected-service status without recovery keys, account names, Defender exclusions or secrets.
- AME wrapper source and builder that launch the same graphical wizard without disabling Defender or Windows Update.
- Self-contained x64 `ms-private-0.0.1.exe` launcher with a `requireAdministrator` manifest, embedded hash-manifested runtime, exact-file verification, tamper repair and protected Program Files installation.
## Verification performed
- 23 transaction/recovery tests passed in PowerShell 7.6.5.
- The same 23 tests passed in Windows PowerShell 5.1.
- Real journal create/atomic-replace/parse test passed using workspace files.
- 114 tests pass in PowerShell 7 and Windows PowerShell 5.1: 25 policy/transaction, 29 app/menu, 19 offline-bundle and 41 feature/package/security/service/account/preset/operation-runner checks.
- Ten native launcher tests pass for archive and installed-manifest integrity, installation validation, modified/extra-file repair, path traversal, bad hashes and undeclared entries. Managed PE inspection verifies AMD64 GUI format, the UAC manifest, version, checksum and signature state.
- Shared journal/report create, flush, atomic-replace and parse tests passed using temporary workspace files.
- All PowerShell source files parsed successfully during verification.
- Real read-only audit on this Windows Home (`Core`) build 26200 reported all 10 Standard profile controls as unsupported for automatic policy enforcement.
- Real read-only service planning completed in both PowerShell engines. Policy enforcement remains audit-only on this Windows Home (`Core`) build 26200.
- Installer previews used `-WhatIf`; no package installation occurred.
- Live operating-system policy mutation, app uninstallation, firewall changes and telemetry suppression were not performed or claimed.
@@ -27,4 +39,4 @@ Compatibility testing found and corrected PowerShell 5.1 array enumeration diffe
## Remaining release work
The full wizard is not complete. VM policy behavior tests, physical sensor checks, measured network enforcement, GUI/AME packaging, data-preserving debloating, cleanup automation and lock-event integration are still pending as detailed in [PLAN.md](PLAN.md). No broad deployment or anonymity certification is implied by the prototype.
The requested modules are implemented or packaged as explicit prepared controls. Production validation remains open: VM policy behavior, live app uninstall/reinstall, physical sensors and Windows Hello, network enforcement across IPv4/IPv6/DNS/DoH/QUIC/VPN, Pktmon/gateway comparison, Recall deletion/reboot, lock trigger paths, busy VeraCrypt volumes, cleanup with active installers, GUI accessibility/DPI, and AME execution. No broad deployment or anonymity certification is implied by this release candidate.
docs/TOOL-BREAKDOWN.md
+133
View File
@@ -0,0 +1,133 @@
# ms-private tool breakdown
ms-private is a local Windows privacy and debloat toolkit. It builds an exact plan from the current machine, shows the plan before mutation, applies supported actions, and records local recovery or outcome data. It does not claim that Windows becomes anonymous or that Microsoft deletes previously collected records.
## Interfaces
| Interface | Entry point | Use |
| --- | --- | --- |
| Single-file Windows release | `ms-private-0.0.1.exe` | Recommended launch path. Requests UAC, verifies and installs the embedded runtime, then opens the graphical wizard. |
| Graphical wizard | `ms-private-GUI.ps1` | Tabbed Windows Forms interface with one exact-plan review and final approval. |
| Terminal wizard | `ms-private.ps1` | Arrow, Space, Enter and Esc navigation with searchable app selection. |
| Complete preset CLI | `Preset.ps1` | Auto-detect or plan/apply EstablishedSafe, FreshInstall, Gentle, Medium, Strong or Maximum without navigating the UI. |
| Component CLIs | `Services.ps1`, `Accounts.ps1`, `Manage-Apps.ps1`, `Network.ps1`, `Hardware.ps1`, `Recall.ps1`, `Cleanup.ps1`, `Lock.ps1`, `Security.ps1` | Audit, plan, apply or restore one area. |
## Automatic presets
| Preset | Automatic selection |
| --- | --- |
| Established PC | Selected when Windows or the current profile is older than seven days, or age evidence is unavailable. Applies Standard policy only and keeps apps, accounts, services, devices, Recall, files, network and updates unchanged. |
| Fresh Install | Selected only when Windows and the current profile are both no more than seven days old. Runs the complete Strict removal and privacy workflow with Zen/Tor, Mullvad, VeraCrypt and detected sensors. |
| Gentle | Standard privacy policies and curated promotional-app removal. Keeps personal apps, Store, Edge, OneDrive, Microsoft app accounts, sensors and networking. |
| Medium | Strict policies and eight privacy-service templates, Microsoft app-account purge, Recall deletion/removal where supported, 19 reviewed optional endpoint rules, privacy cleanup, scheduled Temp cleanup, lock handling, Mullvad, VeraCrypt, and every unambiguously removable Microsoft or third-party app including Store, Edge and OneDrive. |
| Strong | Medium plus Tor Browser and exact selection of detected cameras, microphones and sensor devices. |
| Maximum | Strong plus Zen and Helium and timed default-outbound firewall isolation. The isolation rollback remains scheduled until the user confirms or restores the journal. |
Unsupported settings are shown as skipped. Conflicting registry types, stale app identities, forged plans and unavailable recovery mechanisms stop the affected workflow.
## Privacy policy engine
The policy catalog contains 56 reviewed controls. Standard and Strict cover diagnostic level, advertising ID, tailored experiences, feedback, Windows Error Reporting, activity history, online speech, typing and inking collection, cloud clipboard, cloud search, Microsoft app authentication, workplace registration, Widgets, search highlights, device metadata, downloadable fonts, Delivery Optimization, location and packaged-app access to camera, microphone, foreground text, screen capture, presence, gaze, motion, notifications, phones, radios and background execution.
Update choices are separate: Keep, Automatic, Notify and Manual. The update engine, Update Orchestrator, BITS, Cryptographic Services and servicing infrastructure remain installed.
The engine checks Windows edition and build, refuses domain or MDM-managed devices, journals original values before writing, reads back changes, rolls back partial failures and preserves later conflicting edits during restoration. Home and unreviewed builds receive an explicit unsupported result and the Settings guide.
## Services and GDID-related reduction
Strict mode disables and stops these reviewed service templates:
- `DiagTrack`
- `dmwappushservice`
- `CDPSvc`
- `CDPUserSvc`
- `OneSyncSvc`
- `CloudBackupRestoreSvc`
- `lfsvc`
- `WerSvc`
Windows Update, Update Orchestrator, BITS, Cryptographic Services, Defender, firewall, Event Log, identity, licensing and security services are rejected if they enter a service-disable plan.
For GDID, ms-private reduces known or suspected transmission paths by disabling CDP and diagnostic services, removing connected applications, purging selected Microsoft app identity state, restricting optional endpoints and supporting packet capture. It does not rewrite the local `IdentityCRL\ExtendedProperties\LID`, rotate identifiers or claim server-side deletion. The accurate project status is **GDID transmission paths reduced; complete suppression unverified**.
## Applications, accounts and browsers
Gentle uses the curated package names in `config/debloat.json`. Fresh Install, Medium and stronger enumerate the installed inventory and select every unambiguously removable current-user Appx or registered desktop application. Established PC selects no application action.
The removal engine:
- Installs and verifies every selected replacement browser before the first removal.
- Uses exact Appx package identities or exact desktop product registrations.
- Rechecks name, version, publisher, scope and target immediately before removal.
- Removes ordinary apps before Store and Edge.
- Skips duplicate desktop name/scope registrations because they cannot be delegated safely to WinGet.
- Protects WebView2, drivers, firmware, runtimes, servicing, security products, authentication components, browsers, Mullvad, VeraCrypt and recovery infrastructure.
Appx removal applies to the current user. It does not silently deprovision packages for every future user. Desktop uninstallers follow their registered user or machine scope.
Account purge resets exact current-user Store, Xbox, packaged Microsoft 365/Teams and shared account-broker packages, then deletes only Credential Manager targets matching the reviewed Microsoft allowlist. Reports store action IDs and results without account names, email addresses, credential targets or secrets. The Windows logon identity and existing work/school enrollment remain separate.
Available browsers are Tor Browser, Zen and Helium. Tor Browser should remain unmodified and isolated from identifying accounts when unlinkability matters. Zen and Helium are everyday browser choices and do not create a separate identity merely because they are installed.
## Network controls
`Observe` changes nothing. `BlockOptionalTelemetry` creates dynamic-FQDN outbound rules for 19 reviewed Windows optional-feature or telemetry endpoints. Catalog validation rejects Windows Update, Defender, SmartScreen, certificate/revocation and WNS families that the project preserves.
`Isolate` schedules a local SYSTEM rollback first, then sets the default outbound action to Block for Domain, Private and Public firewall profiles. Existing explicit allow rules can still permit traffic. Confirming isolation removes the timer; restoring the journal returns the saved profile defaults.
Pktmon capture is explicit and local. Stop converts the trace to PCAPNG. Captures can expose private addresses and DNS names. Encrypted payloads remain encrypted, and one quiet capture cannot prove that an identifier is never sent.
## Recall and sensors
Recall planning checks edition, build, policy type and optional-feature state. Applying the supported disable policy deletes existing snapshots, so the workflow requires the deletion acknowledgement. Feature removal may require a reboot. Unsupported Recall actions are reported and skipped by complete presets; conflicting values remain a hard stop.
Hardware control operates on exact PnP instance IDs. Strong and Maximum automatically select detected cameras, microphones and sensors that report an enabled state. Disabling these devices can affect conferencing, Windows Hello and accessibility features. A journal records original device states for restoration.
## Cleanup and lock handling
Cleanup uses named allowlisted locations and rejects arbitrary roots. Categories cover aged Temp content, Windows Error Reporting queues and crash dumps, Recent Items and Jump Lists, unlocked thumbnail caches, PowerShell interactive history, known Zen/Tor/Helium cache subdirectories and expired non-journal ms-private reports. It checks reparse points, file age, changes and locks before deletion.
Cookies, passwords, bookmarks, sessions, Documents, Downloads, credential stores, recovery journals and Defender, firewall, authentication, update and Windows event logs remain protected. Ordinary deletion cannot guarantee physical erasure from an SSD, backup or synchronized provider.
The lock task clears the current clipboard and can request graceful unmount of selected non-system VeraCrypt drive letters. It does not terminate arbitrary applications or claim to wipe all secrets from RAM.
## Security and update preservation
`Security.ps1` audits BitLocker or device-encryption state, Defender and cloud protection, firewall profiles, Secure Boot, TPM, VBS/Credential Guard, LSA protection, UAC, SMB/SMB1, remote access and protected services. It does not read recovery keys, account names, Defender exclusions or secrets.
Online mode keeps Windows security updates available. A direct update necessarily sends connection and request metadata to Microsoft. The isolated update design uses a separate maintained collector, publisher-signed packages, an offline manifest and local integrity verification. The included verifier does not itself download, authenticate or install updates.
## Reports and recovery
Journals and reports are stored below `%LOCALAPPDATA%\MsPrivate`. Policy, service, network and device changes have restoration records. App removal, account-package reset, Recall snapshot deletion, credential deletion and cache deletion are not undone by those journals.
A complete preset also writes a run summary below `%LOCALAPPDATA%\MsPrivate\runs`. It records each group as succeeded, failed or skipped because a prerequisite failed. A failure in one group does not suppress unrelated groups; the summary never converts a partial run into a success.
Reports are local and have no automatic upload. Installed-app inventories and network captures can still be sensitive and should not be published without review.
## Running a reviewed download
For a normal release, verify `ms-private-0.0.1.exe.sha256` and launch `ms-private-0.0.1.exe`. The executable is self-contained for Windows x64 and requests administrator rights through its application manifest. It embeds the source runtime, verifies the archive manifest and every file hash, extracts beneath `%ProgramFiles%\ms-private\runtime`, revalidates that copy at every launch, and repairs modifications or undeclared files. It is not code-signed yet, so the publisher warning is expected until a signing and provenance pipeline is added.
The PowerShell implementation remains visible in the source release and inside the hash-manifested payload. Moving the policy, recovery, Appx, WinGet and firewall logic into another language would not itself improve privacy; the native launcher supplies one-file delivery, elevation and runtime integrity while retaining the tested engine.
For source development from the extracted ZIP:
```powershell
Get-ChildItem -LiteralPath . -Recurse -File | Where-Object { $_.Extension -in '.ps1', '.psm1' } | Unblock-File; Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned -Force; .\ms-private-GUI.ps1
```
The command unblocks scripts below the current reviewed directory, changes execution policy only for that PowerShell process, and starts the GUI. It does not fetch or execute changing network content.
Complete preset planning and application:
```powershell
.\Preset.ps1 -Mode Plan -Preset Medium
.\Preset.ps1 -Mode Apply -Preset Medium -AcknowledgeDestructivePreset
```
## Validation status
The automated suites cover policy transactions, app identity and sequencing, preset validation, Recall applicability, network recovery, protected paths and services, account redaction, offline-bundle integrity, security audits and AME structure in both Windows PowerShell 5.1 and PowerShell 7. Ten native tests cover payload and manifest integrity, exact-file enforcement, tamper repair, traversal refusal and undeclared archive entries. PE inspection checks architecture, GUI subsystem, UAC manifest, version, checksum and signature state. CI also publishes the one-file executable. GUI startup and read-only host preflights are exercised.
Automated tests establish code behavior against synthetic backends. Production claims still require destructive testing and recovery on the supported Windows edition/build matrix, reboot testing, real Store and Edge recovery, security-update acceptance, sensor hardware checks and controlled network observation.
docs/VALIDATION.md
+14 -4
View File
@@ -2,28 +2,38 @@
## Completed checks
Release-candidate update, 2026-09-22: 114 tests pass in each of Windows PowerShell 5.1 and PowerShell 7 (25 policy/transaction, 29 app/menu, 19 offline-bundle, 41 feature/package/security/service/account/preset/operation-runner). The policy tests include current-user registry scope and Enterprise-only selection. The app tests include aggressive all-removable-app and explicit Store selection, safe skipping of ambiguous desktop registrations, protection of security/dependency applications, completeness of FreshInstall/Medium/Strong/Maximum and the non-destructive EstablishedSafe preset, the reported JSON catalog failure and journal callback scope failure, browser-before-removal sequencing, installer errors, stale inventory, partial failure, bundle deduplication, group selection, keyboard navigation, filtering and terminal layout limits. Feature tests cover fresh/established/unknown install-age decisions, continued execution of independent groups after a failure, dependency skipping, preset schema refusal, shared Recall apply/skip/conflict decisions, atomic JSON replacement, malformed or duplicate policy/service/account/network catalogs, protected update-endpoint refusal, untrusted registry-hive refusal, network journal recovery, cleanup-root and protected-log refusal, recovery-journal exclusion, browser-cache scope, protected-service exclusion, service disable/restore, forged service-plan rejection, exact account-package reset, credential allowlisting, report redaction, VeraCrypt volume validation, versioned secret-free security audit behavior and AME manifest structure. Native arrow/Space/Enter/Esc browser selection was also exercised in a real Windows PowerShell console. Live host inventory, service planning and account planning were read-only. No real uninstall, account purge, policy or service write, reboot, firewall change, capture, device disable, Recall deletion or update installation was performed.
The .NET launcher has ten passing tests for valid archive acceptance, installed payload and manifest verification, repair after modified files, rejection and repair of undeclared installed files, manifest path traversal refusal, bad-hash refusal and undeclared archive-entry refusal. `Build-Executable.ps1` must also produce exactly one x64 self-contained executable plus its checksum. Its managed PE inspection verifies AMD64 and GUI headers, the embedded `requireAdministrator` manifest, version, checksum and signature state. Before publishing, launch the GUI in a clean VM, alter and add runtime files to confirm repair, and test a Program Files access failure.
These checks support a release candidate, not a production-validation claim. Run the matrix below before advertising a stable release. The GitLab pipeline requires a Windows runner tagged `windows`; a remote pipeline result does not replace the live matrix.
The offline-bundle module adds 19 passing synthetic-file tests in PowerShell 7 and 5.1: mismatched hashes and targets, unsafe paths, unknown fields, missing/duplicate packages, dependency ordering, provenance URL validation, invalid dates and reparse-point refusal. These are integrity/validation tests, not real update or network-containment tests. Its host inventory was run read-only.
The transaction test suite uses an in-memory registry adapter, never production policy writes. It covers edition gates, diagnostic choices, unsupported builds, update modes, microphone exceptions, original value types, read failures, exact restoration, reapply, journal failures, mid-apply failures, writes that fail after mutation, restore conflicts, interrupted operations, repeated restore, untrusted journal entries, installation mismatch and stale plans.
Run `./tests/Run-Tests.ps1` with both PowerShell 7 and Windows PowerShell 5.1. Parse all `.ps1` / `.psm1` files with the PowerShell parser. Run the real host audit read-only and preview app installation using `-WhatIf`. These tests verify software behavior, not Windows policy enforcement.
Run `./tests/Run-All.ps1` with both PowerShell 7 and Windows PowerShell 5.1. This includes source parsing and all suites. Run the real host audit read-only and preview app installation using `-WhatIf`. These tests verify software behavior, not Windows policy enforcement.
## VM matrix required before release
| OS | Test |
| --- | --- |
| Windows 11 Home 24H2/25H2 | Audit reports unsupported machine policies; Apply makes no changes; manual guide matches current Settings |
| Windows 11 Pro 24H2/25H2 | Standard/Strict apply, readback, reboot, behavioral checks and restore |
| Windows 11 Pro 24H2/25H2 | Standard/Strict policy and service apply, readback, reboot, behavioral checks and restore |
| Windows 11 Enterprise/Education 24H2/25H2 | Same, including actual diagnostic policy effect |
| Unknown/future build | No automatic mutation until separately reviewed |
| Domain/MDM managed device | Apply/Restore decline; no competing policies |
| Non-admin / 32-bit process | Read-only operations work where possible; real mutation declines |
| App operations: 19045 / 22631 / 26100 / 26200 | Verify exact selected uninstall scope, app-data behavior, browser installation and reboot. Use a supported servicing arrangement for Windows 10. |
| Edge: supported / restricted removal | Verify successful uninstall where supported; otherwise report failure, preserve WebView2 and permit a revised keep-Edge plan. |
| OneDrive: local / cloud-only / unsynced content | Confirm warnings, normal uninstall, unchanged sync folders and recovery using official installers. |
| WinGet: missing / first-run / offline / cancelled installer | Abort safely; never misreport browser availability or proceed after a failed prerequisite. |
Use snapshot-backed clean VMs, then repeat relevant tests on physical hardware. A VM does not validate real microphones, cameras, TPM behavior or physical network adapters. Never use production credentials in the test matrix.
## Behavior checks
After apply and reboot, verify each supported setting in Windows UI and through representative workflows. Confirm camera denial and restoration, packaged microphone denial plus desktop limitations, clipboard sync/history behavior, location-dependent applications, cloud speech and cloud search. Confirm update scan/download/install and Defender updates still work in the normal profile.
After apply and reboot, verify each supported setting in Windows UI and through representative workflows. Confirm camera denial and restoration, packaged microphone denial plus desktop limitations, activity upload, app capabilities, clipboard sync/history behavior, location-dependent applications, cloud speech and cloud search. Verify DiagTrack, CDPSvc, CDPUserSvc instances, cloud sync/backup and WER before and after reboot and restore. Confirm update scan/download/install, certificate refresh, Store revocation and Defender updates still work.
Restore original registry types/values and absence; compare with the preflight snapshot. Keep externally changed settings intact and report conflicts. Test interruption before the first write, between writes, during journal replacement and during restore. Test a filled/read-only journal filesystem, registry permission denial and competing changes.
@@ -45,7 +55,7 @@ Verify exact WinGet package ID, publisher download domain, installer version/has
Tor must remain on official update channels with stock fingerprinting protections. Zen and Helium need a current browser-security update check, visible sync/crash/permission decisions and tests that default-browser/profile import remain user-controlled.
## Data deletion and lock checks for future modules
## Data deletion and lock checks
Require a separate preview for Recall snapshot removal, app data deletion and cleanup. Exclude Downloads/documents by default. Skip locked files, junctions and filesystem reparse points. Never recursively follow arbitrary paths in a cleanup tool.
docs/Windows-privacy-register.xlsx
BIN
View File
Binary file not shown.
docs/build-privacy-register.mjs
-432
View File
@@ -1,432 +0,0 @@
import fs from 'node:fs/promises';
import path from 'node:path';
import { Workbook, SpreadsheetFile, FileBlob } from '@oai/artifact-tool';
const root = path.resolve(import.meta.dirname, '..');
const out = path.join(root, 'outputs', '01a0b6c2-22ad-7b62-9a5a-4a09014a9b42');
await fs.mkdir(out, {recursive:true});
const reviewed = new Date('2026-09-18T12:00:00Z');
const resumed = new Date('2026-09-19T12:00:00Z');
const S = {
diagnostics:'https://learn.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization',
events:'https://learn.microsoft.com/en-us/windows/privacy/required-diagnostic-events-fields-windows-11-24h2',
optional:'https://learn.microsoft.com/en-us/windows/privacy/optional-diagnostic-data',
services:'https://learn.microsoft.com/en-us/windows/privacy/essential-services-and-connected-experiences',
endpoints:'https://learn.microsoft.com/en-us/windows/privacy/manage-windows-11-endpoints',
cdp:'https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-connectivity#allowconnecteddevices',
gdid:'https://learn.microsoft.com/en-us/windows/deployment/update/wufb-reports-schema-ucdostatus',
reversal:'https://github.com/SmtimesIWndr/gdid-reversal/blob/dd4dd5dfcd5e1af24592ccbce44dac7cf5b38d2d/README.md',
sequel:'https://github.com/SmtimesIWndr/We-running-GDID-back/blob/b4daa443d73433127b59ad6f006eb507072848b3/README.md',
case:'https://www.justice.gov/usao-ndil/media/1450651/dl?inline=',
defender:'https://learn.microsoft.com/en-us/defender-endpoint/cloud-protection-microsoft-antivirus-sample-submission',
smart:'https://learn.microsoft.com/en-us/deployedge/microsoft-edge-security-smartscreen',
edge:'https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies/urldiagnosticdataenabled',
recall:'https://learn.microsoft.com/en-us/windows/client-management/manage-recall',
ai:'https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis',
activity:'https://support.microsoft.com/en-us/windows/privacy/windows-activity-history-and-your-privacy',
search:'https://support.microsoft.com/en-us/windows/privacy/windows-search-and-privacy',
sensors:'https://support.microsoft.com/en-us/windows/privacy/windows-camera-microphone-and-privacy',
location:'https://support.microsoft.com/en-us/windows/privacy/windows-location-service-and-privacy',
storage:'https://support.microsoft.com/en-us/windows/experience/storage-filemanagement/manage-drive-space-with-storage-sense',
ram:'https://veracrypt.io/en/Unencrypted%20Data%20in%20RAM.html',
working:'https://learn.microsoft.com/en-us/windows/win32/memory/working-set',
firewall:'https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/rules',
updates:'https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings',
life:'https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/windows-10-support-has-ended-on-october-14-2025',
tor:'https://support.torproject.org/tor-browser/security/using-tb-safely/',
vpnTor:'https://support.torproject.org/tor-browser/general/vpn-with-tor/',
zen:'https://zen-browser.app/privacy-policy/',
helium:'https://helium.computer/privacy',
mullvad:'https://mullvad.net/en/help/using-mullvad-vpn-app',
mullvadLogs:'https://mullvad.net/en/help/no-logging-data-policy',
tails:'https://tails.net/about/index.en.html',
appprivacy:'https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy',
winutil:'https://github.com/ChrisTitusTech/winutil',
winutilSupport:'https://github.com/ChrisTitusTech/winutil/blob/main/docs/src/content/docs/guides/getting-started.mdx',
debloat:'https://github.com/Raphire/Win11Debloat/wiki/Features',
privacy:'https://github.com/undergroundwires/privacy.sexy',
sophia:'https://github.com/farag2/Sophia-Script-for-Windows',
sophiapp:'https://github.com/Sophia-Community/SophiApp',
xd:'https://github.com/builtbybel/xd-AntiSpy',
simple:'https://github.com/henrypp/simplewall',
spy:'https://github.com/crazy-max/WindowsSpyBlocker',
legacy:'https://github.com/W4RH4WK/Debloat-Windows-10',
sycnex:'https://github.com/Sycnex/Windows10Debloater',
bleach:'https://github.com/bleachbit/bleachbit',
port:'https://github.com/safing/portmaster',
portfaq:'https://docs.safing.io/portmaster/faq',
atlas:'https://github.com/Atlas-OS/Atlas',
ame:'https://download.amelabs.net/Privacy%2B%20Testing%20Methodology.pdf',
local:'Local project: docs/STATUS.md; config/policies.json; tests/Run-Tests.ps1',
design:'Project engineering decision; not a verified Windows guarantee'
};
// Separate software delivery from host application and observed effectiveness.
const policies = JSON.parse(await fs.readFile(path.join(root,'config/policies.json'),'utf8'));
const controls = policies.map(p => [p.Id, p.Title, 'Windows policy', p.Standard !== null ? 'Default' : p.Strict !== null ? 'Strict' : 'Optional', 'Implemented', 'Not applied', 'Pending',
p.Impact, `HKLM\\${p.Path}\\${p.Name}. Standard=${p.Standard ?? 'unchanged'}; Strict=${p.Strict ?? 'unchanged'}${p.EnterpriseValue !== null ? '; Enterprise/Education='+p.EnterpriseValue : ''}.`,
'Reviewed Windows 11 Pro/Enterprise/Education builds 26100/26200. Home audit only. Windows 10 not validated.',
'Engine tests passed; reboot and effective-policy VM tests pending. Journal restores prior value; no network guarantee.', '', p.Source, reviewed]);
function c(id,name,area,choice,stage,action,limit,test,source='design') {
controls.push([id,name,area,choice,stage,'Not applied','Pending',action,limit,'Edition/build and installed-feature checks required unless stated otherwise.',test,'',S[source]??source,reviewed]);
}
c('tailored','Personalized offers and diagnostic personalization','Diagnostics','Default','Planned','Turn off personalized offers based on diagnostics.','Separate from diagnostic collection; names and availability vary by build.','Verify Settings and effective policy after reboot.','diagnostics');
c('feedback','Feedback prompts','Diagnostics','Optional','Planned','Suppress unsolicited feedback requests.','Does not disable diagnostic transport.','Check supported setting on each edition.','diagnostics');
c('crash-upload','Optional crash and error submissions','Diagnostics','Default','Planned','Reduce optional diagnostic crash uploads; review Windows Error Reporting separately.','Dumps may contain user content. Preserve useful local troubleshooting and security records.','Test app crash handling and retention without uploading real user documents.','optional');
c('edge-url','Edge optional URL diagnostics','Browser','Default','Planned','If Edge remains, disable optional URL/per-page diagnostics using its policy.','This is separate from SmartScreen, browsing sync and Windows diagnostics.','Check edge://policy and a lab traffic baseline; keep browser updates.','edge');
c('recall','Recall snapshot retention','AI','Default','Planned','Detect eligibility; turn off snapshot saving with supported controls.','Some Recall policies delete existing snapshots. Present deletion separately; rollback cannot recover them.','Test eligible hardware/VM where supported; confirm setting and storage outcome.','ai');
c('recall-export','Recall export and Click to Do','AI','Default','Research','Review export settings and Click to Do separately from Recall saving.','Feature, region and edition restrictions apply. Click to Do policy does not control its Recall integration.','Inventory availability and verify each supported control.','recall');
c('copilot','Copilot and application AI features','AI','Optional','Planned','Offer per-app removal and cloud-AI settings for unused features.','One Copilot toggle does not cover Office, Edge, search, Recall and third-party AI.','Inventory exact packages; preserve shared runtimes; test reinstall.','debloat');
c('cdp','Connected Devices Platform','Connected features','Optional','Research','Evaluate documented AllowConnectedDevices deployment; reboot required.','No invented registry mapping. Suppressing CDP has not been shown here to eliminate GDID.','Test supported CSP/management route and cross-device breakage in a VM.','cdp');
c('phone-link','Phone Link and cross-device experiences','Connected features','Optional','Planned','Unlink and uninstall unused Phone Link features through supported interfaces.','Account-side records and other devices remain separate.','Test phone integration removal and restoration.','services');
c('windows-backup','Windows Backup and settings sync','Connected features','Optional','Planned','Disable unwanted account backup and sync after reviewing recovery needs.','Do not silently delete recovery keys or existing backups.','Verify local data availability and supported recovery path.','services');
c('local-account','Local Windows account','Accounts','Optional','Planned','Offer a local account where supported; avoid unnecessary Microsoft sign-in.','A local account is not proof of no device identifier; app sign-ins remain independent.','Preserve account access and recovery before any migration.','design');
c('cloud-records','Existing provider records','Accounts','Optional','Planned','Provide links to account privacy/export/deletion controls.','Local toggles cannot delete provider logs, retained records or other people\'s copies.','Document provider-specific deletion scope and retained categories.','services');
c('activity-history','Local activity history','Retention','Optional','Planned','Stop local activity history and separately offer clear history.','Cloud upload option was deprecated on patched Windows 10/11 in January 2024. Avoid obsolete spying claims.','Check actual build and Settings; distinguish future retention from deletion.','activity');
c('start-web','Start web search and suggestions','Connected features','Optional','Research','Review Start/Bing web queries independently from cloud-source search.','AllowCloudSearch alone does not establish that web queries stop.','Find supported edition-specific policy and test actual queries.','search');
c('widgets','Widgets, weather and news','Connected features','Optional','Planned','Disable or remove unused Widgets through supported controls.','Changes functionality and may affect bundled app packages.','Test update/reinstall and taskbar behavior.','debloat');
c('recommendations','Consumer suggestions and promotional content','Connected features','Default','Planned','Review Start suggestions, Settings offers and Spotlight content individually.','Different settings and edition support; no single total-advertising switch.','Check visible result plus policy after feature updates.','debloat');
c('typing','Typing, inking and personal dictionary','Input','Optional','Research','Reduce online personalization and review local dictionary retention.','Local and cloud settings differ; existing cloud-speech policy covers only one route.','Check language/accessibility impact and supported controls.','appprivacy');
c('app-permissions','Contacts, calendar, messages and account information','Permissions','Default','Planned','Review covered app permissions and deny unused access.','Packaged-app controls do not constrain every desktop program.','Test covered apps and exceptions; do not report hardware isolation.','appprivacy');
c('sensor-hardware','Camera and microphone hardware control','Sensors','Optional','Planned','Offer device-wide settings, physical disconnect or hardware switches.','Software disablement is reversible by privileged software; some cameras support Windows Hello.','Test desktop apps, browsers, conferencing and authentication.','sensors');
c('radio','Bluetooth, nearby sharing and Wi-Fi discovery','Network','Optional','Research','Disable unused discovery and review Wi-Fi MAC randomization support.','May disconnect input devices; MAC changes concern local networks, not global anonymity.','Inventory adapters; test reconnect and recovery without disabling active input.','design');
c('remote','Remote access and file sharing','Network','Optional','Planned','Review unnecessary RDP, Remote Assistance and sharing exposure.','Managed devices and legitimate remote support need separate treatment.','Test reachability, account access and rollback in lab.','design');
c('onedrive','OneDrive removal','Debloat','Optional','Planned','Offer unlink/uninstall after local-copy and folder-redirection preflight.','Cloud-only files must be downloaded or separately backed up first; removal does not delete cloud copies.','Open sampled files offline; verify backup and known-folder paths.','design');
c('edge-removal','Edge removal','Debloat','Optional','Research','Use supported uninstall only where available; otherwise configure privacy.','Keep WebView2 separate. Do not force-delete servicing files to remove the browser.','Validate OS region/build, dependent apps and future security updates.','design');
c('app-removal','Unused consumer and OEM applications','Debloat','Optional','Planned','Inventory and select exact packages; distinguish current-user and provisioned removal.','Keep dependencies, Store/update infrastructure and accessibility tools unless explicitly selected.','Preview removals; test reinstall and new-user provisioning.','design');
c('third-party','OEM, GPU, game-launcher and application analytics','Third parties','Default','Research','Audit each installed app\'s analytics, sync, crash and advertising controls.','Windows settings do not govern all third parties; anti-cheat and drivers need individual review.','Record app/version/publisher and official setting; observe residual connections.','design');
c('office','Office and productivity cloud experiences','Third parties','Optional','Research','Review diagnostics and optional connected experiences in each product.','Account sync, licensing and collaborative features have separate dependencies.','Use product-specific policy docs before implementation.','design');
c('storage-sense','Temporary-file retention','Cleanup','Default','Planned','Use Storage Sense with explicit retention; skip active files.','Exclude Downloads by default; recycle-bin deletion gets its own choice. This is housekeeping, not sanitization.','Preview candidates and exclusions; verify no deletion outside selected directories.','storage');
c('browser-retention','Browser cookies, cache and history','Cleanup','Optional','Planned','Use browser-owned retention and clear-on-exit options.','Clearing cookies signs users out; downloaded files, sync and server records remain.','Test each browser; preserve passwords/bookmarks unless separately selected.','design');
c('recent-files','Recent items, thumbnails and application MRUs','Cleanup','Optional','Research','Minimize retention and offer scoped, app-specific cleanup.','Deleting caches is irreversible and they can reappear. No sweeping registry cleanup.','Inventory selected cache schema and test with disposable data.','design');
c('temp-script','Scoped temporary-folder cleanup fallback','Cleanup','Optional','Planned','If needed, build preview-first cleaner with age threshold and literal allowed roots.','Skip junctions/reparse points, locked files and active installer data; no recursive arbitrary paths.','Tests must prove no traversal outside approved directories.','design');
c('registry-cleaner','Registry cleaner','Cleanup','Reject','Excluded','Do not include a general registry cleaner.','Unrelated registry deletion has no demonstrated identifier-blocking benefit here and can break software.','Use exact documented setting changes with a recovery journal.','design');
c('no-logs','Blanket Windows log deletion','Retention','Reject','Excluded','Retain security, update and recovery logs; minimize toolkit data collection instead.','No-logs is not a credible OS-wide promise; disabling records harms diagnosis and incident response.','Ensure toolkit contains no analytics, browsing data, keys or identifiers.','design');
c('ssd-wipe','Routine SSD free-space wiping','Cleanup','Reject','Excluded','Do not use as routine privacy cleanup.','Wear, remapped blocks, backups and prior copies defeat simple erasure claims.','Use appropriate device sanitization procedures only for a separate disposal task.','design');
c('ram-cleaner','RAM trimming and generic memory cleaners','Memory','Reject','Excluded','Do not include as an anonymization feature.','Working-set reduction is not proof that sensitive memory was erased.','Use application lock/unmount and protected storage.','working');
c('lock-actions','Actions on session lock','Memory','Optional','Planned','Lock password manager, clear clipboard and gracefully unmount selected non-system containers.','Win+L does not erase all keys, tokens or keystrokes. Do not kill LSASS or arbitrary apps.','Test every session-lock path, busy volumes, unsaved work and visible failure on unlock.','ram');
c('sleep-shutdown','Sleep, hibernation and shutdown choices','Memory','Optional','Research','Explain that a locked running OS can retain secrets; offer an intentional full-shutdown workflow.','Shutdown is not a guarantee of instantaneous physical RAM erasure; hibernation uses storage.','Test Fast Startup/hibernation behavior and preserve encryption/recovery.','ram');
c('disk-encryption','System disk encryption','Security','Keep','Planned','Keep or enable supported system encryption and review recovery-key custody.','Do not disable BitLocker/device encryption as a debloat tweak. Never collect recovery secrets in reports.','Verify encryption status and recovery access without logging keys.','design');
c('veracrypt','VeraCrypt containers','Applications','Optional','Prepared','Optional interactive installer is ready; containers and lock integration remain manual.','Installed does not mean encrypted; mounted data and other apps can retain plaintext.','Verify package publisher; create/test disposable container and graceful unmount.','ram');
c('tor-browser','Tor Browser','Applications','Optional','Prepared','Installer prepared; use stock protections for sessions requiring unlinkability.','Protects its configured browser traffic; personal logins identify a session.','Verify official release, connection and no profile import or added extensions.','tor');
c('zen-browser','Zen','Applications','Optional','Prepared','Installer prepared for everyday Firefox-based browsing.','Privacy policy acknowledges external requests; settings and releases require review.','Test updates, permissions, sync choices and retention.','zen');
c('helium-browser','Helium','Applications','Optional','Prepared','Installer prepared for everyday Chromium-based browsing.','Optional crash reports and configured services are separate privacy decisions.','Test updates, extension services, permissions and optional reporting.','helium');
c('mullvad-vpn','Mullvad VPN','Applications','Optional','Prepared','Installer prepared; add funded account, auto-connect and chosen Lockdown behavior.','Installation is not connection. VPN changes network observer and egress IP, not application identifiers.','Test disconnect, DNS, IPv6, reboot, sleep/wake and split-tunnel exceptions.','mullvad');
c('vpn-logs','VPN logging claims','Network','Keep','Research','Describe provider activity-logging policy separately from local app diagnostics.','A provider no-logging policy is not a no-logs Windows guarantee.','Review current policy and local support-bundle contents before sharing.','mullvadLogs');
c('tor-vpn','Automatic VPN plus Tor stacking','Network','Reject','Excluded','Do not turn on this combination by default.','Tor warns against casual VPN combinations; threat model and configuration matter.','Offer separate documented workflows if a user needs the combination.','vpnTor');
c('dns-blocking','DNS tracker blocking','Network','Optional','Planned','Use a reviewed resolver/filter with narrow lists and a clear logging policy.','Direct IP, alternate resolvers and shared domains limit coverage; DNS blocking is not all egress control.','Test false positives and IPv4/IPv6/DoH behavior; version lists and rollback.','design');
c('egress','Application egress control','Network','Optional','Research','Evaluate one network enforcement tool in a VM; start from measured workflows.','Keep recovery access; do not stack competing WFP tools blindly.','Test VPN coexistence, update paths, reconnect, reboot and uninstallation.','simple');
c('denylist','Microsoft endpoint denylist','Network','Optional','Research','Classify optional endpoints by feature, owner, purpose and capture evidence before blocking.','Do not block all Microsoft/Azure/CDN IPs or svchost.exe. Published lists are edition/version-specific.','Prove both reduced traffic and successful security workflows.','endpoints');
c('outbound-default','Strict outbound default policy','Network','Optional','Research','For an advanced profile, use default-block with reviewed required allowances.','Explicit block rules override conflicting allows. Existing allows and all network profiles must be audited.','Disposable VM first; timed recovery and firewall-export rollback.','firewall');
c('defender','Antivirus and cloud-delivered protection','Security','Keep','Planned','Keep active antivirus, tamper protection and cloud protection in the standard design.','Some security metadata leaves the device; this is an explicit retained security tradeoff.','Verify provider status, signatures and vendor-supported protection checks.','defender');
c('sample-consent','Antivirus file sample submission','Security','Optional','Research','Expose supported submission choices with their security cost.','Turning samples off can impair block-at-first-sight; metadata can still be sent.','Test exact edition/product behavior. Never label samples-off as cloud-off.','defender');
c('smartscreen','SmartScreen and reputation checks','Security','Keep','Planned','Keep reputation protection in the standard design.','Security URL checks differ from optional URL diagnostics and browser sync.','Use vendor demonstration checks, not live malware; test after network restrictions.','smart');
c('trust','Certificate trust, revocation and time','Security','Keep','Planned','Preserve certificate trust/revocation, time sync, activation and servicing dependencies.','An endpoint may support essential security; broad domain blocking risks silent failures.','Verify TLS trust and OS servicing after restrictions.','services');
c('patching','Security update workflow','Security','Keep','Planned','Default to current update behavior; optional notify/manual choice remains visible.','Manual has missed-patch risk. Do not remove servicing components or disable all update services.','Install actual cumulative update and AV/browser updates; reboot and rescan.','updates');
c('windows10','Windows 10 coverage','Security','Keep','Research','Require supported edition or verified ESU enrollment before deployment.','Standard support ended 2025-10-14. Consumer page currently lists 2027-10-12; verify region/program at release.','Record exact SKU, coverage and installed security update. Windows 10 engine support is pending.','life');
c('boot-hardening','Secure Boot, TPM, VBS and exploit mitigations','Security','Keep','Planned','Preserve supported hardware and OS security protections.','Do not trade them for a privacy or performance preset; firmware updates remain necessary.','Inventory status and compatibility before any optional change.','design');
c('third-party-av','Bitdefender or Zillya','Security','Optional','Research','Do not replace working Defender automatically; evaluate a chosen product separately.','This project has not established a comparative privacy/security advantage or tested these vendors.','Review current privacy policy, independent protection tests, update support and uninstall behavior.','design');
c('identifier-spoof','GDID, MachineGuid and hardware-ID spoofing','Identifiers','Reject','Excluded','Do not ship undocumented identifier edits or a universal ID reset.','Changing one value cannot prove unlinkability and may break licensing or apps.','Investigate mechanisms in a disposable lab without exporting actual personal identifiers.','design');
c('tails','Separate amnesic environment','Isolation','Optional','Planned','Document Tails USB for a separate session with explicit persistence choice.','Does not protect against malicious hardware or voluntary identity disclosure.','Verify official image and usable hardware/network before relying on it.','tails');
c('identity-habits','Accounts, posts and shared metadata','Behavior','Default','Planned','Reduce unnecessary disclosure; separate contexts and review document/photo metadata before publishing.','Reused accounts, shared content and personal details can reconnect sessions despite device settings.','Use a practical publishing checklist; never promise technical anonymity.','design');
c('tool-retention','Toolkit data minimization','Toolkit','Default','Implemented','No analytics added; local settings journal supports restoration.','A recovery journal exists, so the tool is not literally log-free. Audit deliberately avoids GDID and recovery keys.','Review code and generated audit; document optional journal removal after recovery window.','local');
const identifiers = [
['GDID / GlobalDeviceId','Installation/device linkage','Microsoft reports and case records','Do not equate with advertising ID. No verified universal reset control here.','Investigate feature paths and effective network reductions in lab.','Documented field; collection path incomplete',S.gdid],
['PCFP','Hardware-derived identifier','Windows 11 required diagnostic schema','Documented as an identifier calculated from hardware identifiers.','Use supported diagnostic minimum; do not assume reinstall removes hardware correlation.','Documented schema; emission not measured',S.events],
['CensusId','Hardware identifier','Appraiser RunContext schema','Documented hardware identifier in compatibility-related events.','Preserve compatibility/update testing; no verified per-field suppression in this project.','Documented schema; emission not measured',S.events],
['Advertising ID','Advertising personalization','Windows and participating applications','One specific advertising identifier; disabling it does not disable other IDs.','Implemented catalog control; not applied to host.','Official policy',policies.find(p=>p.Id==='advertising-id').Source],
['Microsoft account / app accounts','Account identity','Signed-in services','Local Windows account does not sign every application out.','Minimize unnecessary sign-in and sync; preserve recovery access.','Architecture / design assessment',S.services],
['MachineGuid / serials / TPM identity','Local and service-specific identifiers','OS, firmware and application-dependent','No evidence here that one registry edit removes all remote identification.','Avoid collecting them; no spoofing feature.','Scope limitation, not a measured traffic claim',S.design],
['Public IP / timestamps','Network correlation','Destination services and network intermediaries','VPN changes visible egress but not IDs inside app traffic.','Mullvad configuration and leak tests; minimize account linkage.','Network design assessment',S.mullvad],
['Wi-Fi MAC','Local radio/network identity','Nearby Wi-Fi infrastructure','Not normally the same identifier as a remote website sees.','Evaluate supported MAC randomization; retain network compatibility.','Design item; adapter testing pending',S.design],
['Cookies / browser storage / fingerprint','Web session linkage','Websites and embedded third parties','Multiple browsers do not automatically separate identities.','Tor stock protections; appropriate retention and account separation.','Browser threat-model guidance',S.tor],
['Optional browser URL diagnostics','Browsing data','Optional Microsoft browser diagnostics','Windows optional-data documentation includes Microsoft browser activity; not proof for every browser.','Disable optional collection; Edge URL policy separately.','Official documentation',S.optional],
['Crash dumps','Potential memory contents','Diagnostic collection and local storage','Optional crash reports can contain portions of documents or pages.','Minimize uploads and retention without discarding all troubleshooting logs.','Official documentation',S.diagnostics],
['Defender security metadata','File, process and network context','Cloud protection services','Metadata may still be sent with sample submission disabled.','Keep standard protection; explain data flow and optional tradeoff.','Official documentation',S.defender],
['Recall snapshots','Local visual history / optional export','Eligible Recall installations','Distinct from Copilot chat; export and retention have separate controls.','Disable unused snapshot saving; preview irreversible deletion.','Official documentation',S.recall],
['Activity history','Local activity record','Supported Windows feature','Patched Windows deprecated its cloud-upload option in January 2024.','Control local retention; avoid repeating outdated upload claims.','Official documentation',S.activity],
['Third-party app identifiers','Product-specific telemetry','OEM utilities, browsers, launchers and apps','Requires app-specific evidence; no blanket Windows toggle.','Inventory publishers/settings and measure each application.','Research task',S.design]
].map((r,i)=>[`I${String(i+1).padStart(2,'0')}`,...r.slice(0,6),'',r[6],reviewed]);
const toolsData = [
['Chris Titus WinUtil','Tweaks and app deployment','Current docs: Windows 11; Windows 10 unsupported','Useful UI and selective settings reference.','Inspect exact tweaks; exclude security/BitLocker reductions and blanket presets.','Candidate reference; not executed',S.winutil,S.winutilSupport],
['Raphire Win11Debloat','Selective debloat and settings','Windows 10/11 project; exact build still needs testing','Per-app selection, previews and current feature catalog.','Exclude encryption-disabling choices; distinguish default restoration from original-state rollback.','Candidate for selected debloat; not executed','https://github.com/Raphire/Win11Debloat',S.debloat],
['privacy.sexy','Generated privacy scripts','Windows catalog; validate each script/build','Source-linked scripts and individual selection help review.','Do not select all scripts. Review reversals and license before code reuse.','Reference library; not executed',S.privacy,S.privacy],
['Sophia Script','PowerShell customization','Version-specific Windows 10/11 variants','Function-by-function design and corresponding default functions.','Default functions are not proof of restoring every original user value.','Selective reference; not executed',S.sophia,S.sophia],
['SophiApp','Graphical tweak tool','Repository warns about deprecated 1.0.97','Related GUI project; inspect current supported replacement.','Do not deploy deprecated build based on a promised future version.','Legacy build excluded; recheck release',S.sophiapp,S.sophiapp],
['xd-AntiSpy','Privacy/settings UI','Windows 11 focus; Windows 10 partial','Readable choices and plugin-based configuration.','Plugins expand trust surface; check exact changes and reversals.','Candidate for review; not executed',S.xd,S.xd],
['simplewall','WFP application filtering','Windows 10/11 included','Useful per-app egress enforcement candidate.','Its filters can remain after uninstall unless removed/disabled. Test temporary filtering and recovery.','Lab candidate; not installed',S.simple,S.simple],
['WindowsSpyBlocker','Traffic research and blocklists','Windows-oriented; current endpoint validation required','Traffic classification is useful input for lab analysis.','Treat lists as hypotheses, not permanent safe blocks. Separate update dependencies.','Research input; no rules imported',S.spy,'https://crazymax.dev/WindowsSpyBlocker/'],
['Portmaster','Application firewall and DNS filtering','Windows/Linux; verify current installer compatibility','Alternative to simplewall for evaluation.','WFP/VPN coexistence and uninstall connectivity need testing. Avoid stacking both by default.','Alternative lab candidate; not installed',S.port,S.portfaq],
['BleachBit','Local cleanup','Windows/Linux','Preview and app-specific cleaners can support optional retention work.','Deletion is irreversible; no secure-SSD or internet anonymity guarantee.','Optional cleanup candidate; not run',S.bleach,S.bleach],
['W4RH4WK Debloat-Windows-10','Legacy debloat scripts','Archived 2025-09-23; deprecated','Historical examples only.','Not a maintained deployment choice for current Windows.','Excluded',S.legacy,S.legacy],
['Sycnex Windows10Debloater','Legacy Windows 10 debloat','Windows 10 project; Windows 11 not established here','Historical app-removal patterns.','Do not infer current build support or exact-original restoration.','Excluded from current deployment',S.sycnex,S.sycnex],
['Atlas','Windows modification playbook','Version-specific Windows deployment','Reviewable playbook architecture.','Broad OS changes exceed a small privacy profile; test each release rather than rely on old reputation.','Comparison only; not applied',S.atlas,S.atlas],
['AME / Privacy+','Playbook delivery / privacy changes','Depends on playbook and target build','AME could eventually package the reviewed Wind engine.','Privacy+ methodology includes Windows Update removal, conflicting with this project\'s patching requirement.','Do not adopt Privacy+ wholesale',S.ame,S.ame],
['gdid-reversal','Independent reverse-engineering research','Reported observations; not reproduced here','Suggests identity/CDP/Delivery Optimization investigation paths.','Not a validated anonymizer. Separate static findings, observations and hypotheses.','Research lead only',S.reversal,S.reversal]
].map((r,i)=>[`T${String(i+1).padStart(2,'0')}`,...r.slice(0,6),'',...r.slice(6),reviewed]);
// Case-derived text is deliberately short and attributed, not asserted as a universal OS property.
const claims = [
['Microsoft tracked Stokes through GDID','Supported as allegation','Complaint associates the identifier with attributed activity.','Affidavit paragraphs 25–29; this is not a conviction.',S.case],
['Assigned per install; survives updates; changes on reinstall','Attributed description','The affidavit attributes this lifecycle to a Microsoft representative.','Paragraph 25. Do not infer reinstall guarantees unlinkability.',S.case],
['Unique to physical device','Overstated','The description includes physical and virtual Windows installations.','Installation identity and immutable hardware identity differ.',S.case],
['Ngrok, URLs, IPs and timestamps','Supported for this case','The complaint describes these associations.','Paragraphs 26–28 do not specify every collection component.',S.case],
['It records every game played','Overstated','Growtopia login activity was correlated with Ubisoft records.','Paragraph 29 does not establish a complete installed-game history.',S.case],
['Only documented in one obscure page','Unsupported absolute','GlobalDeviceId appears in published Microsoft reporting schemas.','Documentation of a field is not a complete explanation of collection.',S.gdid],
['UCDOStatus proves universal web-history collection','Not established','UCDOStatus is a Delivery Optimization reporting schema.','A named field does not prove that this table records all URLs.',S.gdid],
['Every browser on every Windows PC reports every URL','Not established','Neither cited source demonstrates this universal claim.','Do not present it as the blog\'s conclusion.',S.case],
['Local account guarantees no Microsoft identifier','Not established','Independent research reports a path without Microsoft-account sign-in.','Useful lead; not independently reproduced by this project.',S.reversal],
['GDID is the only persistent identifier worth checking','False simplification','Microsoft also documents PCFP and CensusId in required diagnostic schemas.','Documented fields do not prove emission on this host.',S.events],
['Disabling advertising ID blocks GDID','Not established','The advertising-ID policy governs a different identifier.','Use exact scope labels and lab measurements.',policies.find(p=>p.Id==='advertising-id').Source],
['No telemetry toggle means no Microsoft traffic','False simplification','Essential services and connected experiences have separate data flows.','Preserve agreed security dependencies and document residual traffic.',S.services],
['Win+L erases all secrets from memory','Unsupported','Locking is not a general memory-erasure mechanism.','Plan app-specific locking and graceful unmount; do not claim total erasure.',S.ram],
['Humans can identify themselves despite privacy tools','Design principle','Accounts, posts and shared content can reconnect contexts.','A practical privacy plan includes disclosure habits.',S.design]
].map((r,i)=>[`C${String(i+1).padStart(2,'0')}`,...r.slice(0,4),'',r[4],reviewed]);
const roadmap = [
['P0','VM support matrix','Pro, Enterprise, Education and Home; reviewed Windows 11 builds; separate Windows 10 ESU track','Effective setting after reboot and update, not just registry readback.','Policy behavior','Open'],
['P0','Security preservation baseline','Record antivirus, firewall, boot/encryption and update status without secrets','Cumulative update installs; AV signatures and browser updates succeed; protection checks pass.','Security','Open'],
['P0','Network baseline','Disposable VM, documented workflows, Windows build, network path and capture duration','Compare before/after idle, reboot, browsing, sync and update traffic; no universal absence claim.','Network','Open'],
['P0','Endpoint provenance register','Process/service attribution, hostname/IP, purpose, evidence, expiry and rollback','No unknown destination becomes a default block; validate DNS/IPv6/VPN behavior.','Network','Open'],
['P0','Recoverability of networking','Local recovery access and exported firewall configuration','Timed recovery and uninstall restore connectivity; explicit block precedence tested.','Network','Open'],
['P0','Original-state recovery engine','Existing mock and file journal tests; real Windows registry test in disposable VM','Crash/interruption, conflicting external changes and restoration verified.','Engine','Open'],
['P1','Home Settings workflow','Current host is Core/Home build 26200','Guide accurately maps real Settings; no unsupported policy-enforcement labels.','Compatibility','Open'],
['P1','Sensor verification','Camera/mic devices and covered vs desktop app permissions','Conferencing, browser access and Windows Hello tested; hardware state labelled separately.','Sensors','Open'],
['P1','AI and debloat inventory','Package dependencies and Recall eligibility','Data-deletion preview, OneDrive offline-copy checks and reinstall path pass.','Apps','Open'],
['P1','Retention implementation','Storage Sense first; browser/app-owned cleanup; scoped fallback only','Exclusions, age cutoff, reparse-point protection and active-file handling tested.','Cleanup','Open'],
['P1','Lock-session integration','Password manager adapters and selected non-system volumes','Unsaved work protected; busy-volume failure reported; no system-process killing.','Memory','Open'],
['P1','Identifier investigation','Documented fields plus independent GDID/CDP research','Reproducible lab notes; no claim of a suppression mechanism without measured evidence.','Research','Open'],
['P1','Third-party application register','Installed publishers, versions, controls and official privacy sources','Each app has separate collection/update decisions; no silent global disablement.','Research','Open'],
['P1','Pin upstream artifacts','Selected repository commit, release signature/hash and license review','No download-and-execute one-liners; reviewed local content only.','Supply chain','Open'],
['P1','Browser and VPN acceptance','Tor, Zen, Helium, Mullvad selected individually','Update, publisher, profile separation and leak/Lockdown tests pass.','Applications','Open'],
['P2','Graphical wizard / AME wrapper','Use same reviewed engine and recovery model','UI shows intended change, compatibility, deletion and restoration limits.','Delivery','Open'],
['P2','Blog publication check','Re-read primary case and current product documentation','Claims retain attribution; screenshots and logs contain no private identifiers.','Editorial','Open'],
['P2','Revalidation after Windows updates','Repeat on feature/security updates and changed app releases','Record build/version, deviations and regression outcomes before widening support.','Maintenance','Open']
].map((r,i)=>[`R${String(i+1).padStart(2,'0')}`,...r,'Unassigned',null,'']);
const delivered = [
['D01','Policy catalog','Implemented',13,'config/policies.json','Includes two optional update entries; Standard selects 10, Strict 11.','Not applied'],
['D02','Audit / plan / apply / restore engine','Implemented',1,'Wind.ps1; src/Wind.Core.psm1','Edition/build gates, journal and conflict-aware restoration.','Not applied'],
['D03','Transaction and recovery tests','Passed',23,'tests/Run-Tests.ps1; docs/STATUS.md','Same suite passed in PowerShell 7.6.5 and Windows PowerShell 5.1. Mock registry plus file journal checks.','Not an OS enforcement test'],
['D04','Host read-only audit','Completed',1,'reports/host-audit.json','Core/Home build 26200. Automatic policy enforcement declined. No private IDs collected.','Read only'],
['D05','Interactive app choices','Prepared',5,'config/apps.json; Install-Apps.ps1','Tor, Zen, Helium, Mullvad, VeraCrypt. Installer previews only.','Not installed'],
['D06','Research, Home guide and validation plan','Prepared',1,'docs/RESEARCH.md; docs/HOME-GUIDE.md; docs/VALIDATION.md','Implementation scope and known limits documented.','Documents only'],
['D07','GitHub comparison and control workbook','Prepared',1,'Windows-privacy-register.xlsx','Sources reviewed 2026-09-18; repository execution and lab validation remain pending.','Documents only'],
['D08','Blog draft','Prepared',1,'Windows-privacy-blog-draft.md','Evidence, motivation, privacy choices and honest completion status.','Not published']
];
// Resume additions retain previous evidence dates and identify newly reviewed material.
for (const [id,name,action,limit,test,src] of [
['cdp-experiment','Experimental CDP restrictions','Investigate CDP independently from other identity consumers.','Supplied script is not integration-ready; review records status and rollback defects.','Reproduce effects in disposable Windows environments; no host deployment.','sequel'],
['wns-review','WNS notification blocking','Keep general WNS blocking out of the default design.','Notifications and management may be affected; a hosts entry is not a complete egress block.','Verify exact consumer and retained security functionality before any narrow restriction.','endpoints'],
['store-id-review','Store identifier path','Investigate Store requests separately; preserve app security updates.','Do not block the entire Store or edit its identifier based on one report.','Lab observation with disposable accounts and redacted evidence.','sequel']
]) { c(id,name,'Identifiers','Optional','Research',action,limit,test,src);controls.at(-1)[13]=resumed; }
identifiers.push(
['I16','Multiple device PUIDs','Context-specific identity','Independent follow-up research','Author reports several device PUIDs on one installation.','Extend lab scope beyond the interactive user.','Reported; not reproduced here','',S.sequel,resumed],
['I17','Widgets identifier emission','Additional application path','Independent follow-up research','Author reports Widgets sending a SYSTEM-context identifier.','Test Widgets independently from CDP.','Reported; not reproduced here','',S.sequel,resumed],
['I18','SQMClient MachineID / Store','Separate identifier family','Independent follow-up research','Author reports a matching Store request identifier.','Preserve Store updates; investigate separately.','Reported; not reproduced here','',S.sequel,resumed]
);
toolsData.push(['T16','We-running-GDID-back','Follow-up identifier research','Pinned b4daa443; Windows 11 observations','Expands the investigation beyond one CDP identifier.','Client symbols and token scopes alone do not prove backend reconciliation or every transmission.','Research lead only','',S.sequel,S.sequel,resumed]);
claims[1][4]='Paragraph 25 attribution; follow-up research raises additional lifecycle/context questions.';
claims.push(
['C15','One identifier per installation is the complete model','Incomplete','Follow-up research reports multiple device PUIDs.','Treat as a lab hypothesis; retain court attribution separately.','',S.sequel,resumed],
['C16','Disabling CDP proves all device IDs stopped','Not established','No test here establishes complete identifier suppression.','Test each emitting feature and retained service separately.','',S.sequel,resumed],
['C17','An ETW HTTPS URL means cleartext on the wire','Incorrect inference','Local instrumentation can reveal data before transport encryption.','Differentiate local visibility, destination visibility and network-observer visibility.','',S.design,resumed]
);
roadmap.push(
['R19','P0','Replace unsafe pasted-script patterns','See Script review findings and pinned source revisions','No integration until exact-state rollback, honest status and independent cleanup pass tests.','Engine','Open','Unassigned',null,''],
['R20','P1','Reproduce follow-up identifier findings','Disposable accounts; context-specific identifiers; Widgets and Store independently','Record observed flows without raw IDs/tokens in reports; retain update/security acceptance tests.','Research','Open','Unassigned',null,'']
);
delivered.push(['D09','Pasted script and follow-up research','Reviewed',1,'docs/GDID-SCRIPT-REVIEW.md','Static review, parse check and three in-memory defect probes. No supplied script executed.','Read only']);
const scriptReview = [
['S01','High','False status result','24–25; 120','Writes GDID-BLOCKER but searches GDID-BLOCK.','Match constants exactly; verify entries and effective behavior.','Confirmed in-memory'],
['S02','High','False success after partial failure','19; 49–64; 132; 138','Continues after errors and ignores native exit codes.','Check every result and effective service state; report partial failures.','Static finding'],
['S03','High','Policy rollback destroys prior state','68; 72','Overwrites three values then deletes them on enable.','Journal original presence/type/value and detect conflicts.','Static finding'],
['S04','High','Per-user service template handling','44; 49; 52','Template inventory differs from generated service instances.','Use documented template handling; test sign-in and reboot.','Official docs + static review'],
['S05','Medium','Incomplete service restoration','44; 57–64','Does not preserve delayed-start metadata or running state.','Record exact state; do not guess Manual or always start.','Static finding'],
['S06','High','Nontransactional hosts edits','76–97','Backup is not used by enable; whole file is rewritten.','Preserve bytes/encoding, journal, atomically replace and detect concurrent edits.','Static finding'],
['S07','High','Malformed marker removes other entries','79–84; 90–95','Missing end marker drops every following line.','Reject unmatched or duplicate markers before mutation.','Confirmed in-memory'],
['S08','Medium','ASCII conversion changes content','86; 96','Non-ASCII comments do not survive.','Preserve detected encoding and original bytes.','Confirmed in-memory'],
['S09','High','Irreversible cache deletion / user scope','100–105','Targets elevated LOCALAPPDATA; enable cannot restore deleted data.','Separate explicit deletion; resolve intended profile and reject path escapes.','Static finding'],
['S10','High','Hosts list overclaims suppression','30–38','Exact names do not prove all paths or identifiers are blocked.','Measured per-feature controls and residual-traffic reporting.','Design limitation'],
['S11','Medium','Notification side effects','34–37','WNS is shared infrastructure, not a GDID-only endpoint.','Keep default notifications intact pending narrow tests.','Official endpoint docs'],
['S12','Medium','Status elevates and creates state','11–27','Read-only mode enters the mutation setup path.','Audit without elevation or filesystem writes.','Static finding']
].map(r=>[...r,'Not integrated','',r[0]==='S04'?'https://learn.microsoft.com/en-us/windows/application-management/per-user-services-in-windows':r[0]==='S11'?S.endpoints:'User attachment Pasted text.txt; SHA256 0603A1073072CCC55B78692ACC93FAED4363CCFC0AF700472FBC862788B97E13',resumed]);
const U={
checkpoint:'https://learn.microsoft.com/en-us/windows/deployment/update/catalog-checkpoint-cumulative-updates',
scan:'https://learn.microsoft.com/en-us/windows/win32/wua_sdk/using-wua-to-scan-for-updates-offline',
av:'https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-updates',
trust:'https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/configure-trusted-roots-disallowed-certificates',
ncsi:'https://learn.microsoft.com/en-us/windows-server/networking/ncsi/ncsi-overview',
wer:'https://learn.microsoft.com/en-us/windows/win32/wer/windows-error-reporting',
local:'Local project: Offline-Updates.ps1; src/Wind.OfflineUpdates.psm1; docs/OFFLINE-UPDATES.md'
};
for(const [id,name,area,choice,stage,action,limit,test,source]of[
['offline-verifier','Offline bundle integrity verifier','Update architecture','Optional','Implemented','Verify local manifest, hashes, target build/architecture and declared dependency order.','Authenticity, applicability, coverage and containment remain unverified. No downloads or installation.','19 synthetic-package tests passed in PowerShell 7 and 5.1; real host inventory read.',U.local],
['update-collector','Separate update collector','Update architecture','Optional','Planned','Download generic publisher packages on another machine for controlled transfer.','Collector still contacts publishers. Do not forward protected-PC requests or credentials.','Authenticate sources, packages and current revocation state; test transfer and supply chain.',U.checkpoint],
['offline-scan','Offline Windows Update Agent scan','Update architecture','Optional','Planned','Use a fresh signed scan CAB and explicit offline search in an isolated lab.','Scan catalog is metadata, not update binaries or complete third-party coverage.','Verify temporary service cleanup, freshness, missing-update scope and external isolation.',U.scan],
['isolation','No direct Internet from protected Windows','Update architecture','Optional','Research','Use a disconnected Windows environment and a separate maintenance/browsing environment.','Online cloud protection and reputation queries are unavailable. A denylist is not proof of isolation.','No attached VM NIC or physical disconnection; independent verification and local recovery.',S.design],
['ncsi','Connectivity probes','Connected features','Optional','Research','Review NCSI; consider supported private probes on managed networks.','Turning off probes can affect perceived connectivity and applications.','Test captive portals, network changes and update behavior.',U.ncsi],
['offline-trust','Offline certificate trust maintenance','Update architecture','Keep','Planned','Provide trusted/disallowed certificate-list maintenance for the isolated profile.','Never disable certificate validation; offline revocation knowledge can become stale.','Verify provenance, freshness and package trust after transfer.',U.trust],
['patch-coverage','Whole-system patch coverage','Update architecture','Keep','Planned','Track Windows, .NET, Defender, browsers, firmware, drivers and recovery separately.','Current OS build or a zero-result scan does not establish full patch coverage.','Record actual installed versions, reboot outcomes and emergency-update process.',U.av],
['local-discovery','Local-network identity disclosure','Local network','Optional','Research','Inventory hostname discovery, LLMNR/mDNS, NetBIOS and sharing.','These are not automatically Microsoft-bound flows; disabling discovery can break local devices.','Use disposable network captures and test printers/sharing before restrictions.',S.design],
['credential-exclusion','Exclude credential stores from cleanup','Cleanup','Default','Planned','Keep identity caches, login tokens, recovery material and servicing stores out of generic cleanup.','Deleting a cache does not establish deletion of remote records and may break login or updates.','Verify exclusions and exact allowed roots before implementing cleanup.',S.design]
]) {c(id,name,area,choice,stage,action,limit,test,source);controls.at(-1)[13]=resumed;}
for(const [id,name,purpose,platform,use,limit,decision,url]of[
['T17','Win-Debloat-Tools','Legacy debloat','Archived 2025-10-03; last documented builds limited','Historical reference.','Removal may not be easily reversed; not a current supported deployment base.','Excluded','https://github.com/LeDragoX/Win-Debloat-Tools'],
['T18','Harden-Windows-Security','Security hardening','Current Windows security focus; exact app requirements need review','Individual security controls can inform preservation tests.','Connected-service recommendations are not our privacy profile; do not import all defaults.','Selective reference only','https://github.com/HotCakeX/Harden-Windows-Security'],
['T19','wumgr','Update management','Project described for Windows 10','Update-management UI comparison.','Does not create a no-contact boundary. Current Windows 11/ESU behavior unvalidated.','Evaluation only','https://github.com/DavidXanatos/wumgr']
])toolsData.push([id,name,purpose,platform,use,limit,decision,'',url,url,resumed]);
identifiers.push(
['I19','Connectivity probes','IP / timing at probe destination','Microsoft NCSI documentation','Connectivity detection is another independent network function.','Optional control with compatibility tests.','Documented; host traffic not captured','',U.ncsi,resumed],
['I20','Update request metadata','Requests / network metadata','Online update architecture','Direct downloads need outbound protocol traffic.','Separate collector for no direct protected-PC contact.','Protocol constraint / design','',U.checkpoint,resumed],
['I21','Windows Error Reporting','Fault reporting','Microsoft WER documentation','Separate from third-party application reporters.','Review reporting and local retention individually.','Documented; host traffic not captured','',U.wer,resumed]
);
claims.push(
['C18','Download directly from Microsoft while sending it nothing','Not technically achievable','Requests and transport traffic are needed for a direct download.','Use a separate collector if the protected PC must not contact Microsoft.','',S.design,resumed],
['C19','A proxy or VPN removes identifiers from update requests','Not established','Relaying a request does not necessarily alter its contents.','Only a reviewed design that serves pre-fetched content avoids forwarding those requests.','',S.design,resumed],
['C20','Offline patches retain every online security capability','Incorrect','Online cloud analysis and reputation checks require connectivity.','Preserve local protections and explain the cloud-security tradeoff.','',S.defender,resumed]
);
roadmap.push(
['R21','P0','Validate offline update end to end','Separate collector; authentic packages; isolated target; supported edition','Install known applicable updates and prerequisites; reboot and rescan; verify no target WAN access.','Updates','Open','Unassigned',null,''],
['R22','P0','Implement offline WUA scanner','Signed current catalog, explicit offline search, temporary service registration','No online search or fallback; cleanup on failure; no full-coverage claim from empty results.','Updates','Open','Unassigned',null,''],
['R23','P0','Offline security-maintenance coverage','Defender platform/engine/intelligence, trust lists, apps and firmware','Each required component has a tested source, freshness policy and installation evidence.','Security','Open','Unassigned',null,''],
['R24','P1','Collector authenticity and transfer workflow','Publisher signatures and package catalogs; protect manifest and files','Hashes never stand in for publisher identity; reverify immediately before execution.','Supply chain','Open','Unassigned',null,'']
);
delivered.push(['D10','Offline bundle verifier and OS inventory','Implemented',1,'Offline-Updates.ps1; src/Wind.OfflineUpdates.psm1','19 tests passed in PowerShell 7 and 5.1. No download, scan, installation or isolation applied.','Read only']);
delivered[6][5]='Sources reviewed 2026-09-18/19; execution and lab validation remain pending.';
const maintenance=[
['U01','Windows cumulative / .NET','Normal supported online servicing','Reviewed Catalog packages and required checkpoints','Authenticity, applicability, order, installed KB/build and reboot','Workflow prepared','',U.checkpoint,resumed],
['U02','Defender intelligence / engine / platform','Keep normal cloud and update services','Supported offline package distribution for all three components','Versions and freshness; cloud capability explicitly unavailable','Workflow prepared','',U.av,resumed],
['U03','Trusted / disallowed certificates','Retain trust-list and revocation maintenance','Plan authenticated local trust-list refresh','Current provenance and revocation limitations; validation remains enabled','Research','',U.trust,resumed],
['U04','Tor / Zen / Helium / apps','Keep publisher security update channels','Transfer authenticated installers and dependencies','Versions, signatures and browser launch/security behavior','Research','',S.design,resumed],
['U05','Firmware / drivers / Secure Boot / WinRE','Retain vendor and OS maintenance','Separate vendor-supported offline methods','Per-component coverage; OS build alone is insufficient','Research','',S.design,resumed],
['U06','Offline scan metadata','Online scan remains available','Fresh signed Wsusscn2.cab with offline WUA search','Catalog date, limited scope, temporary registration cleanup','Scanner planned','',U.scan,resumed],
['U07','Bundle integrity','Local verifier available','Same verifier; no network calls or installers invoked','19 synthetic tests; hashes do not establish publisher authenticity','Implemented','',U.local,resumed],
['U08','Isolation boundary','Online traffic intentionally permitted','Disconnected protected Windows; separate connected collector','External verification; online cloud protection unavailable','Not deployed','',S.design,resumed]
];
// Preserve the user's editable progress fields when regenerating this owned workbook.
const existingPath=path.join(out,'Windows-privacy-register.xlsx');
try{
const prior=await SpreadsheetFile.importXlsx(await FileBlob.load(existingPath));
const oldControls=prior.worksheets.getItem('Controls').getUsedRange().values;
const progress=new Map(oldControls.slice(5).filter(r=>r[0]).map(r=>[r[0],r]));
for(const r of controls){const old=progress.get(r[0]);if(old){r[5]=old[5];r[6]=old[6];}}
const oldRoadmap=prior.worksheets.getItem('Roadmap').getUsedRange().values;
const tasks=new Map(oldRoadmap.slice(5).filter(r=>r[0]).map(r=>[r[0],r]));
for(const r of roadmap){const old=tasks.get(r[0]);if(old)for(let i=6;i<=9;i++)r[i]=old[i]??null;}
}catch(e){if(e.code!=='ENOENT')throw e;}
const wb=Workbook.create();
const colors={navy:'#17324D',teal:'#136F73',ink:'#25364A',muted:'#546678',pale:'#EDF3F7',line:'#D8E2EA',input:'#EEF5FF',amber:'#FFF0CE'};
const sheets={};
function col(n){let t='';for(n++;n;n=Math.floor((n-1)/26))t=String.fromCharCode(65+(n-1)%26)+t;return t;}
function base(name,title,subtitle,headers,rows,widths){
const sh=wb.worksheets.add(name);sheets[name]=sh;sh.showGridLines=false;sh.tabColor=colors.teal;
const end=col(headers.length-1),last=rows.length+5;
sh.getRange(`A1:${end}${last}`).format={font:{name:'Arial',size:11,color:colors.ink},verticalAlignment:'top',wrapText:true};
const titleEnd=col(Math.min(4,headers.length-1));
sh.getRange('A2').values=[[title]];sh.getRange(`A2:${titleEnd}2`).merge();sh.getRange(`A2:${titleEnd}2`).format={fill:colors.navy,font:{name:'Arial',size:16,bold:true,color:'#FFFFFF'},rowHeight:32};
sh.getRange('A3').values=[[subtitle]];sh.getRange(`A3:${titleEnd}3`).merge();sh.getRange(`A3:${titleEnd}3`).format={font:{name:'Arial',size:11,color:colors.muted},rowHeight:46,wrapText:true};
sh.getRange(`A5:${end}5`).values=[headers];
sh.getRange(`A6:${end}${last}`).values=rows;
const gap=headers.indexOf(' ');
const tableEnd=gap>=0?col(gap-1):end;
const table=sh.tables.add(`A5:${tableEnd}${last}`,true,name.replaceAll(' ','')+'Table');table.showFilterButton=true;
sh.getRange(`A5:${end}5`).format={fill:colors.navy,font:{name:'Arial',size:11,bold:true,color:'#FFFFFF'},rowHeight:32,wrapText:true};
for(let i=0;i<widths.length;i++)sh.getRange(`${col(i)}1:${col(i)}${last}`).format.columnWidth=widths[i];
for(let i=0;i<rows.length;i++){
const r=i+6;
if(i%2===1)sh.getRange(`A${r}:${end}${r}`).format.fill=colors.pale;
let lines=1;rows[i].forEach((v,j)=>{if(typeof v==='string')lines=Math.max(lines,v.split('\n').reduce((n,x)=>n+Math.ceil(x.length/Math.max(5,widths[j]-3)),0));});
sh.getRange(`A${r}:${end}${r}`).format.rowHeight=Math.min(165,Math.max(50,lines*15+12));
}
sh.freezePanes.freezeRows(5);sh.freezePanes.freezeColumns(2);
if(gap>=0){sh.getRange(`${col(gap)}5:${col(gap)}${last}`).values=[['']];sh.getRange(`${col(gap)}5:${col(gap)}${last}`).format.fill='#FFFFFF';}
return {sh,last};
}
const overview=wb.worksheets.add('Overview');sheets.Overview=overview;
const cr=base('Controls','Windows privacy control register','Implementation describes the software. Applied and verification describe this project\'s changes to the host. Blue status cells can be updated after testing.',
['ID','Control','Area','Choice','Implementation','Applied on host','Effect verified','Intended behavior','Limits / mechanism','Compatibility','Verification / rollback',' ','Reference','Reviewed'],controls,[23,32,21,13,17,18,17,54,58,44,54,3,66,14]);
cr.sh.getRange(`F6:G${cr.last}`).format.fill=colors.input;
cr.sh.getRange(`F6:F${cr.last}`).dataValidation={rule:{type:'list',values:['Not applied','Applied','Restored']}};
cr.sh.getRange(`G6:G${cr.last}`).dataValidation={rule:{type:'list',values:['Pending','Verified','Failed']}};
cr.sh.getRange(`D6:D${cr.last}`).conditionalFormats.add('containsText',{text:'Reject',format:{fill:'#FCE9E7',font:{color:'#963E33'}}});
cr.sh.getRange(`G6:G${cr.last}`).conditionalFormats.add('containsText',{text:'Failed',format:{fill:'#FCE9E7'}});
cr.sh.getRange(`N6:N${cr.last}`).setNumberFormat('yyyy-mm-dd');
const ir=base('Identifiers','Identifiers and data channels','A documented field is evidence of a schema, not proof that it was emitted by this host. No personal identifier values are included.',
['ID','Identifier / channel','Privacy relevance','Where documented / observed','What it means','Proposed response','Evidence classification',' ','Reference','Reviewed'],identifiers,[10,29,29,41,54,53,40,3,66,14]);
ir.sh.getRange(`J6:J${ir.last}`).setNumberFormat('yyyy-mm-dd');
const tr=base('Tools','GitHub tools and playbooks','Documentation and selected configuration review. None executed on this host. Candidate means worth controlled evaluation, not certified safe.',
['ID','Project','Purpose','Platform / status','Useful part','Main limitation / test','Decision',' ','Repository / publisher','Supporting reference','Reviewed'],toolsData,[10,28,28,43,48,56,38,3,65,65,14]);
tr.sh.getRange(`K6:K${tr.last}`).setNumberFormat('yyyy-mm-dd');
const cl=base('Claims','Screenshot fact-check','Case statements are allegations from a complaint. The screenshot is an input to verify; it is not an instruction or a complete technical description.',
['ID','Claim / question','Assessment','Evidence / finding','Publication wording / limit',' ','Reference','Reviewed'],claims,[10,43,26,53,57,3,70,14]);
cl.sh.getRange(`H6:H${cl.last}`).setNumberFormat('yyyy-mm-dd');
const rr=base('Roadmap','Implementation and validation work','Change blue fields as work progresses. No task is completed merely because a setting was written or a connection was not seen during one capture.',
['ID','Priority','Task','Scope / prerequisites','Acceptance evidence','Area','Status','Owner','Target date','Evidence / result'],roadmap,[10,11,33,57,67,20,16,22,16,50]);
rr.sh.getRange(`G6:J${rr.last}`).format.fill=colors.input;
rr.sh.getRange(`G6:G${rr.last}`).dataValidation={rule:{type:'list',values:['Open','In progress','Done','Deferred']}};
rr.sh.getRange(`I6:I${rr.last}`).setNumberFormat('yyyy-mm-dd');
const dr=base('Delivered','What has actually been delivered','Software and documents are prepared. These records do not claim policy enforcement, app installation or network blocking on the development host.',
['ID','Deliverable','Status','Count','Local evidence','Scope / result','Host effect'],delivered,[10,38,18,11,52,66,30]);
const sr=base('Script review','Supplied GDID script review','Attachment treated as source to review, not instructions to execute. Native Windows policy/service/hosts/cache mutations were not performed.',
['ID','Priority','Finding','Attachment lines','Problem','Required change','Evidence','Disposition',' ','Reference','Reviewed'],scriptReview,[10,12,35,20,56,57,30,23,3,66,14]);
sr.sh.getRange(`K6:K${sr.last}`).setNumberFormat('yyyy-mm-dd');
const ur=base('Update maintenance','Online and isolated update maintenance','Direct downloads require outbound requests. The separate collector design avoids direct protected-PC contact only while its isolation boundary holds.',
['ID','Component','Online profile','Isolated profile','Required verification','Status',' ','Reference','Reviewed'],maintenance,[10,34,49,56,63,24,3,66,14]);
ur.sh.getRange(`I6:I${ur.last}`).setNumberFormat('yyyy-mm-dd');
overview.showGridLines=false;overview.tabColor=colors.navy;
overview.getRange('A1:H36').format={font:{name:'Arial',size:11,color:colors.ink},wrapText:true,verticalAlignment:'top'};
overview.getRange('A1:A36').format.columnWidth=3;
overview.getRange('B1:B36').format.columnWidth=42;overview.getRange('C1:C36').format.columnWidth=15;overview.getRange('D1:D36').format.columnWidth=3;
overview.getRange('E1:H36').format.columnWidth=23;
overview.getRange('B2:H2').merge();overview.getRange('B2').values=[['Windows privacy research and delivery register']];
overview.getRange('B2:H2').format={fill:colors.navy,font:{name:'Arial',size:16,bold:true,color:'#FFFFFF'},rowHeight:36};
overview.getRange('B3:H3').merge();overview.getRange('B3').values=[['Reviewed 18–19 September 2026. Preserve security while reducing unnecessary collection and retention.']];overview.getRange('B3:H3').format.rowHeight=30;
overview.getRange('B5:C5').values=[['Measure','Count']];overview.getRange('B5:C5').format={fill:colors.navy,font:{bold:true,color:'#FFFFFF'},rowHeight:26};
overview.getRange('B6:B12').values=[['Controls and design decisions'],['Implemented catalog / toolkit items'],['Prepared application choices'],['Applied to this host by the project'],['Applied and effect verified'],['Tools / playbooks reviewed'],['Open roadmap tasks']];
overview.getRange('C6:C12').formulas=[
[`=COUNTA(Controls!A6:A${cr.last})`],
[`=COUNTIF(Controls!E6:E${cr.last},"Implemented")`],
[`=COUNTIF(Controls!E6:E${cr.last},"Prepared")`],
[`=COUNTIF(Controls!F6:F${cr.last},"Applied")`],
[`=COUNTIFS(Controls!F6:F${cr.last},"Applied",Controls!G6:G${cr.last},"Verified")`],
[`=COUNTA(Tools!A6:A${tr.last})`],
[`=COUNTIF(Roadmap!G6:G${rr.last},"Open")`]
];
overview.getRange('B6:C12').format.rowHeight=29;overview.getRange('C6:C12').setNumberFormat('0');overview.getRange('C6:C12').format.font={size:15,bold:true,color:colors.teal};
const notes=[
['E5:H5','Current host'],['E6:H8','Windows 11 Home (Core), build 26200. The prototype declines automatic policy enforcement here. No policy changes, firewall blocks or app installs were performed by this project.'],
['E10:H10','Security boundary'],['E11:H13','Online mode retains cloud protection. Isolated mode uses transferred updates and loses online cloud/reputation capabilities. Both preserve local protections. The verifier does not establish isolation or complete patching.'],
['B15:H15','Recommended direction'],['B16:H18','Use the small reviewed Wind catalog as the base. Borrow selected ideas from maintained tools only after source review and VM tests. Evaluate one network filter separately. Avoid chaining debloat presets or claiming a universal GDID reset.'],
['B20:H20','How to use this workbook'],['B21:H23','Controls separates implementation, application and verification. Identifiers, Tools and Claims track evidence. Roadmap and Delivered track progress. Script review assesses the attachment. Update maintenance compares online and isolated operation. Scroll right for sources.'],
['B25:H25','What the labels mean'],['B26:H28','Default = proposed standard behavior; Strict/Optional = explicit choice; Keep = preserve a protection; Reject = excluded approach. Implemented = code exists, not deployment approval. Prepared = installer or setup path exists. Planned/Research = further work required.'],
['B30:H30','Evidence and maintenance'],['B31:H34','Sources are adjacent to their claims and dated. Publisher documentation is not an independent audit. Network payloads and backend correlation remain partly unknown. Editable blue status fields require evidence before marking Applied or Verified. Recheck Windows and application versions before publishing or deploying.']
];
for(const [r,t]of notes){overview.getRange(r).merge();overview.getRange(r.split(':')[0]).values=[[t]];if(/^\w+\d+:\w+\d+$/.test(r)&&r.match(/\d+/g)[0]===r.match(/\d+/g)[1])overview.getRange(r).format={fill:colors.navy,font:{bold:true,color:'#FFFFFF'},rowHeight:24};else overview.getRange(r).format.fill=colors.pale;}
overview.getRange('B31:H34').format.fill='#FFF4DB';overview.freezePanes.freezeRows(3);
// Formula sensitivity check. The test edit is restored before export.
const savedStatus=cr.sh.getRange('F6:G6').values;
const baseApplied=controls.filter(r=>r[5]==='Applied').length;
const baseVerified=controls.filter(r=>r[5]==='Applied'&&r[6]==='Verified').length;
cr.sh.getRange('F6:G6').values=[['Applied','Verified']];
if(overview.getRange('C9').values[0][0]!==baseApplied+(savedStatus[0][0]==='Applied'?0:1)||overview.getRange('C10').values[0][0]!==baseVerified+(savedStatus[0][0]==='Applied'&&savedStatus[0][1]==='Verified'?0:1))throw new Error('Summary formulas did not react to status edits.');
cr.sh.getRange('F6:G6').values=savedStatus;
wb.recalculate();
if(overview.getRange('C9').values[0][0]!==baseApplied||overview.getRange('C10').values[0][0]!==baseVerified)throw new Error('Test status was not restored.');
const checks=await wb.inspect({kind:'match',searchTerm:'#REF!|#DIV/0!|#VALUE!|#NAME\\?|#N/A|#NUM!|#NULL!|#SPILL!|#CALC!',options:{useRegex:true,maxResults:100},maxChars:5000});
console.log('Formula error scan:',checks.ndjson);
console.log((await wb.inspect({kind:'region',sheetId:'Overview',range:'B5:C12',maxChars:4000,tableMaxRows:10,tableMaxCols:2})).ndjson);
await (await SpreadsheetFile.exportXlsx(wb)).save(path.join(out,'Windows-privacy-register.xlsx'));
for(const [name,range,suffix]of [['Overview','A1:H35',''],['Controls','A82:K86','offline'],['Identifiers','A24:G26','offline'],['Tools','A22:G24','offline'],['Claims','A23:E25','offline'],['Roadmap','A26:G29','offline'],['Delivered','A14:G15','offline'],['Update maintenance','A2:F13','']]){
const blob=await wb.render({sheetName:name,range,scale:1,format:'png'});await fs.writeFile(path.join(out,`preview-${name}${suffix?'-'+suffix:''}.png`),new Uint8Array(await blob.arrayBuffer()));
}
await fs.writeFile(path.join(out,'register-data.json'),JSON.stringify({reviewed:'2026-09-18/19',counts:{controls:controls.length,tools:toolsData.length,identifiers:identifiers.length,claims:claims.length,todos:roadmap.length,scriptFindings:scriptReview.length},controls,identifiers,tools:toolsData,claims,roadmap,delivered,scriptReview,maintenance},null,2));
console.log(JSON.stringify({output:path.join(out,'Windows-privacy-register.xlsx'),controls:controls.length,tools:toolsData.length,identifiers:identifiers.length,claims:claims.length,todos:roadmap.length}));