2.7 KiB
ms-private 0.0.6 roadmap
Version 0.0.6 is a prerelease. Implementation exists for the graphical and terminal interfaces, presets, policy engine, debloat, account purge, service control, network modes, Recall, sensors, cleanup, lock handling, security audit, source/AME packaging and the self-contained executable. The remaining work is mostly live acceptance, signing provenance and the separately designed offline-maintenance system.
Open work
| ID | Priority | Work still required |
|---|---|---|
| R01 | P0 | Run the complete Windows Home, Pro, Enterprise and Education VM matrix, including supported Windows 10 servicing and reviewed Windows 11 builds. |
| R03 | P0 | Record controlled baseline and configured traffic at the host and an external gateway across boot, idle, browsing, updates, VPN and restore. |
| R13 | P1 | Build a versioned third-party application privacy register with publisher sources and separate update/security decisions. |
| R18 | P2 | Repeat validation after Windows feature/security updates and browser, VPN or installer changes. |
| R20 | P1 | Reproduce context-specific GDID/PUID, Widgets and Store observations with disposable identities and redacted evidence. |
| R21 | P0 | Validate the offline update design end to end on an isolated target. |
| R22 | P0 | Implement and validate the signed offline Windows Update Agent catalog scanner. |
| R23 | P0 | Cover Defender engine/platform/intelligence, certificate trust, browsers, applications, drivers and firmware in offline maintenance. |
| R24 | P1 | Authenticate collector downloads and transferred packages with publisher signatures, current catalogs and protected manifests. |
| R25 | P0 | Add Authenticode signing, trusted timestamping, SBOM/provenance output and a controlled release pipeline. |
| R26 | P0 | Exercise every privileged action with the built-in Defender protections enabled and no exclusions; optionally record third-party EDR compatibility without adding bypasses. |
Implementation complete; live acceptance remains
R02, R04–R12 and R14–R17 have working code or prepared material, but their acceptance evidence is incomplete. This includes security-preservation checks, endpoint provenance, timed firewall recovery, real registry/service restoration, Home Settings verification, physical sensor testing, Recall and app-removal recovery, cleanup and lock-event testing, GDID research reproduction, pinned upstream artifacts, browser/VPN acceptance, GUI accessibility, AME execution and the final editorial check.
R19 is complete: the unsafe supplied-script patterns were reviewed and were not integrated. ms-private uses exact targets, write-ahead recovery records, protected components, readback and explicit destructive acknowledgements instead.