Prepare ms-private 0.0.1 release candidate

docs/PLAN.md

@@ -4,14 +4,16 @@
 
 Build a Windows privacy wizard with three browser choices: Tor Browser, Zen and Helium. Its job is to reduce collection and retention, expose tradeoffs, and verify specific settings. It must never present a percentage-anonymous score or claim that a host is untraceable.
 
+The current release-candidate version is 0.0.1. See [ROADMAP.md](ROADMAP.md) for the reconciled open and validation work and [NATIVE-API.md](NATIVE-API.md) for direct API and security-product behavior.
+
 The running Windows installation is the development host. Development and read-only inspection are authorized; this iteration creates the tool and planning artifacts without destructive OS changes or installation of applications on that host.
 
 ## Profiles
 
 | Profile | Default behavior | Availability |
 | --- | --- | --- |
-| Standard | Minimum supported diagnostic policy, no advertising ID, Windows location/camera restrictions, covered app microphone default deny, no cloud speech/clipboard sync/Find My Device/cloud search, DO without peering; updates unchanged | Prototype implements policy configuration on reviewed Pro/Enterprise/Education build families |
-| Strict | Standard plus no clipboard history and DO mode 99 | Prototype implements those added policies; advanced networking is not included yet |
+| Standard | Minimum supported diagnostic policy, no advertising ID, Windows location/camera restrictions, covered app microphone default deny, Activity Feed/upload off, no cloud speech/clipboard sync/Find My Device/cloud search, WER off and DO without peering; updates unchanged | Implements policy configuration on reviewed Pro/Enterprise/Education build families |
+| Strict | Standard plus denied app access to account, calendar, contacts, call history, email, messaging, diagnostics, trusted/unpaired devices and voice activation; no clipboard history; DO mode 99; selected connected/cloud/diagnostic services disabled; future consumer Microsoft app authentication and workplace registration blocked; current Microsoft app sign-ins selected for purge | Default wizard profile. Policies and services are reversible; account-package reset and credential deletion are irreversible and require a separate acknowledgement. |
 | Isolated session | Separate Tails environment; explicit persistence and identity separation | Guidance; not an automated OS installer |
 
 Users can select individual supported IDs with `-Id`. The future UI needs a clear restore action for each restriction so camera/microphone use is possible when wanted. Software permission controls and hardware disconnection must have distinct labels.
@@ -23,18 +25,18 @@ Users can select individual supported IDs with `-Id`. The future UI needs a clea
 | Policy engine | Audit, Plan, Apply, Restore, edition/build gates, readback, recovery journal and transaction tests | VM verification on each supported build/edition; confirm policy consumption after reboot |
 | Browser/app selection | Exact package IDs, optional interactive installer, no default takeover, `-WhatIf` | Verify freshness/publisher manifests in release pipeline; UI choices; detect updates without importing personal profiles |
 | Home edition | Read-only report and explicit manual guide | Supported Settings integration; verify actual toggles rather than pretending Pro policies work |
-| Diagnostics | Supported minimum Windows policy | Separate crash reporting, feedback and app-level controls with sources and side effects |
-| Connected experiences | A small documented subset | Backup/account sync, Phone Link/CDP, Widgets, Start web search, consumer suggestions, application-specific policies; validate edition and deployment mechanism |
-| Network controls | Research and validation specification only | Lab capture, destination attribution, narrow rules, timed recovery and VPN coexistence tests |
-| AI removal | Research and deletion warning | Inventory Recall eligibility and installed Copilot apps; explicit data-deletion preview; dependency-aware uninstall |
-| Debloat | Design only | Exact allowlist of removable apps; distinguish user/provisioned scope; OneDrive data-preservation preflight; Edge/WebView2 separation |
+| Diagnostics | Supported minimum policy, feedback prompts off, WER policy/service off, reviewed endpoint rules and DiagTrack shutdown | Validate effective traffic on each supported build and retain required security/update channels |
+| Connected experiences | Activity upload policies, app capability restrictions, CDPSvc/CDPUserSvc, OneSyncSvc and CloudBackupRestoreSvc reversible shutdown | Validate reboot persistence and effects on Phone Link, Nearby Sharing, Miracast, mail/calendar/contact sync and cloud backup |
+| Network controls | Observe, reviewed optional-FQDN rules, timed default-outbound isolation, explicit confirmation, restore and Pktmon capture | Complete IPv4/IPv6/DNS/DoH/QUIC/VPN and external-gateway lab validation; expand endpoints only with provenance |
+| AI removal | Recall inventory, deletion acknowledgement, supported policy and optional-feature disable/restore | Eligible-device deletion/reboot validation; installed Copilot inventory remains catalog-driven app selection |
+| Debloat | Exact current-user inventory, curated bundled default, personal opt-in, browser-before-removal, OneDrive/Edge handling and protected dependencies | Live package/data/reinstall/new-user validation on every supported build |
 | Updates | Keep, Automatic, Notify, Manual registry choices on eligible editions | Reboot and actual update workflow tests; UI temporary pause uses supported Windows mechanisms; browser/AV updates independent |
-| Sensors | Location/camera policy and limited app microphone policy | Optional hardware-device disablement with reliable recovery and device selection; never disable audio input blindly |
-| Cleanup | Home guide | Storage Sense integration with explicit retention and exclusions; skip busy files; never clean the registry or clear security logs |
-| Lock behavior | Design only | Session-lock trigger, vault integrations, clipboard handling, selected VeraCrypt volumes, busy-volume/error reporting; no generic process kill |
+| Sensors | Location/camera policy, limited app microphone policy and exact selected PnP device disable/restore | Physical camera/microphone/Hello and restoration validation; nothing selected by default |
+| Cleanup | Preview-first allowlisted Temp, WER/crash, Recent/Jump List, thumbnail, PowerShell-history and expired-report cleanup; age threshold; reparse/change/lock checks; optional safe schedule | Live active-installer, locked-cache and long-running schedule validation; browser-owned retention remains separate |
+| Lock behavior | SessionLock scheduled task, current clipboard clear, exact selected VeraCrypt graceful unmount and local result report | Win+L/auto-lock/user-switch/RDP and busy-volume validation; password-manager adapters remain product-specific |
 | Encryption | Guidance only | Read-only encryption status without recovery-key capture; key-custody guide; no automatic encryption/decryption migration |
 | Security software | Preserve existing protections | Optional Bitdefender selection after conflict checks; no automatic Zillya recommendation pending sufficient evidence |
-| Packaging | Local CLI scripts | Signed release, reproducible manifest, checksums, native GUI; optional AME wrapper after VM validation |
+| Packaging | Self-contained x64 WinExe with UAC manifest, hash-manifested embedded runtime and Program Files installation; local CLI, native TUI, tabbed Windows Forms wizard, source ZIP builder and AME wrapper/builder | VM-run executable and AME validation, code signing, reproducible CI artifacts and release provenance |
 
 ## Network design requirements
 
@@ -53,7 +55,7 @@ The requested no-direct-Microsoft-contact option now has a [separate collector a
 2. Detect OS edition/build and managed-device constraints. Show unavailable controls as unavailable.
 3. Choose browsers and optional Mullvad/VeraCrypt; show installation separately from configuration.
 4. Review each setting, its source, expected result, compatibility impact and reversibility. Separate data-deleting actions.
-5. Prepare a local recovery journal, then apply selected actions in small independent groups.
+5. Prepare local recovery journals, then apply selected actions in recorded groups. Continue after an unrelated group fails; skip only a group whose declared prerequisite failed.
 6. Report configured, pending reboot, behavior verified, unsupported, failed and conflict states separately.
 7. Offer rollback by group and show remaining manual checks. A successful registry write never earns a "verified anonymous" badge.