# Validation and privacy acceptance protocol

## Completed checks

The offline-bundle module adds 19 passing synthetic-file tests in PowerShell 7 and 5.1: mismatched hashes and targets, unsafe paths, unknown fields, missing/duplicate packages, dependency ordering, provenance URL validation, invalid dates and reparse-point refusal. These are integrity/validation tests, not real update or network-containment tests. Its host inventory was run read-only.

The transaction test suite uses an in-memory registry adapter, never production policy writes. It covers edition gates, diagnostic choices, unsupported builds, update modes, microphone exceptions, original value types, read failures, exact restoration, reapply, journal failures, mid-apply failures, writes that fail after mutation, restore conflicts, interrupted operations, repeated restore, untrusted journal entries, installation mismatch and stale plans.

Run `./tests/Run-Tests.ps1` with both PowerShell 7 and Windows PowerShell 5.1. Parse all `.ps1` / `.psm1` files with the PowerShell parser. Run the real host audit read-only and preview app installation using `-WhatIf`. These tests verify software behavior, not Windows policy enforcement.

## VM matrix required before release

| OS | Test |
| --- | --- |
| Windows 11 Home 24H2/25H2 | Audit reports unsupported machine policies; Apply makes no changes; manual guide matches current Settings |
| Windows 11 Pro 24H2/25H2 | Standard/Strict apply, readback, reboot, behavioral checks and restore |
| Windows 11 Enterprise/Education 24H2/25H2 | Same, including actual diagnostic policy effect |
| Unknown/future build | No automatic mutation until separately reviewed |
| Domain/MDM managed device | Apply/Restore decline; no competing policies |
| Non-admin / 32-bit process | Read-only operations work where possible; real mutation declines |

Use snapshot-backed clean VMs, then repeat relevant tests on physical hardware. A VM does not validate real microphones, cameras, TPM behavior or physical network adapters. Never use production credentials in the test matrix.

## Behavior checks

After apply and reboot, verify each supported setting in Windows UI and through representative workflows. Confirm camera denial and restoration, packaged microphone denial plus desktop limitations, clipboard sync/history behavior, location-dependent applications, cloud speech and cloud search. Confirm update scan/download/install and Defender updates still work in the normal profile.

Restore original registry types/values and absence; compare with the preflight snapshot. Keep externally changed settings intact and report conflicts. Test interruption before the first write, between writes, during journal replacement and during restore. Test a filled/read-only journal filesystem, registry permission denial and competing changes.

`Configured` means the catalogued value matches. Only behavioral verification can show the intended feature effect. Policy precedence, MDM, user policy and Windows changes may produce different effective behavior.

## Network checks

Use an external lab gateway capture plus a local process-attribution view when needed. Keep the capture start time, build, chosen controls, workflow and duration. Avoid personal accounts; keep raw captures local. No TLS interception is required or installed.

Compare baseline and configured runs across boot/login, 15 minutes idle, browser launch, start search, deliberate update check, app installation, account sign-in, reboot and restore. Repeat with and without VPN. Classify observed destinations; distinguish optional diagnostics from security maintenance and user-requested cloud features.

For VPN/strict-egress testing, include IPv4, IPv6, DNS, application DoH, TCP, UDP/QUIC, network changes, sleep/wake, connection loss, app exit, tunnel reconnect and split-tunnel exceptions. Verify recovery without network access. Do not accept a single IP-check website as a complete leak test.

Document: "During these workflows, on this build, over this interval, the following traffic was observed/blocked." Do not conclude that an encrypted payload contains no identifier or that an unobserved connection can never occur later.

## Package and browser checks

Verify exact WinGet package ID, publisher download domain, installer version/hash and available architecture against each official project release. Preserve hash verification. Report nonzero installation exits and reboot requirements. An installer finishing does not establish account login, VPN connection, browser permissions or encryption configuration.

Tor must remain on official update channels with stock fingerprinting protections. Zen and Helium need a current browser-security update check, visible sync/crash/permission decisions and tests that default-browser/profile import remain user-controlled.

## Data deletion and lock checks for future modules

Require a separate preview for Recall snapshot removal, app data deletion and cleanup. Exclude Downloads/documents by default. Skip locked files, junctions and filesystem reparse points. Never recursively follow arbitrary paths in a cleanup tool.

For lock handling, exercise Win+L, automatic screen lock, user switching and remote-session disconnection. Busy VeraCrypt volumes, unsaved files and unavailable vault APIs must produce explicit failures. Verify clipboard history/sync separately from the current clipboard. Never report a complete RAM wipe.