Prepare ms-private 0.0.1 release candidate

docs/ANONYMITY.md

@@ -0,0 +1,34 @@
+# Anonymity is an operating practice
+
+ms-private reduces named Windows collection and local retention. It cannot make a Windows device anonymous by itself. An observer can correlate an IP address, an account, a browser fingerprint, a payment, a document, a writing pattern, a contact graph or behavior even when an operating-system identifier is absent.
+
+## Choose the network model before the preset
+
+For ordinary privacy, keep security updates enabled, use a reputable encrypted connection on untrusted networks, and inspect the traffic that remains. A VPN moves trust from the access network to the VPN provider; it does not remove account identity or browser identifiers.
+
+For unlinkable web sessions, use an unmodified Tor Browser and keep those sessions separate from everyday accounts. Tor Browser only routes its own traffic. Signing into an identifying account, opening downloaded documents in networked external applications, installing extensions or changing fingerprint-sensitive settings can link the session. Follow the [Tor Project's safety guidance](https://support.torproject.org/tor-browser/security/using-tb-safely/).
+
+For a Windows environment that must make no direct Internet connections, use ms-private's timed isolation only after preparing local recovery. Obtain signed updates on a separate maintained collector, verify them, and transfer them offline. This model trades cloud reputation, simple servicing and live certificate checks for containment. The collector still contacts publishers.
+
+## Separate identities deliberately
+
+- Use different OS users or virtual machines for identities that must not be linked. A different browser profile is a convenience boundary, not a strong isolation boundary.
+- Do not sign into the same email, social, Microsoft, payment or recovery accounts across identities.
+- Keep phone numbers, recovery addresses, usernames, avatars, writing patterns, contacts and posting schedules in the threat model.
+- Remove document metadata and review visible content before publishing. Screenshots can reveal account names, notifications, time zone, language, monitor layout and other context.
+- Use unique passwords and phishing-resistant MFA. CISA's Scattered Spider advisory shows that identity recovery and help-desk social engineering can defeat strong endpoint controls when human processes remain weak.
+
+## Keep security evidence and maintenance
+
+Do not delete Defender, firewall, authentication or Windows Update event channels as routine privacy cleanup. Those logs help detect account takeover and malware, and deleting them does not recall data already transmitted. Restrict access and retention according to the threat model instead.
+
+Preserve Defender, the firewall, Secure Boot, TPM-backed protections, BitLocker or device encryption, browser updates and Windows security updates. Run `Security.ps1` after applying a preset and after every major Windows update. Use `Network.ps1 -Mode Validate` and a short packet capture to measure the result on the exact Windows build.
+
+## Publish claims that the evidence supports
+
+- **Selected**: the control is in a plan.
+- **Applied**: Windows accepted the change and a local readback matched.
+- **Observed**: a controlled capture or external test measured the expected behavior.
+- **Not observed**: a test did not see a flow during its limited window; this is not proof that it can never occur.
+
+Identifier rotation is not an anonymity control in ms-private. A server can restore an identifier, correlate a series of values, or use hardware, account and network signals. Randomly rewriting an undocumented value can also break identity, licensing or updates. The project disables documented channels, removes selected account state, narrows outbound connections, and asks for packet-capture evidence instead.