43 lines
6.3 KiB
Markdown
43 lines
6.3 KiB
Markdown
# Delivery status — 2026-09-24
|
|
|
|
The update architecture and implementation pass was completed on 2026-09-20. The product is named ms-private. Local OS inventory, offline bundle verification, the graphical and terminal wizards, app/debloat flows, Microsoft app-account purge, network enforcement and capture, reversible privacy-service shutdown, Recall, exact sensors, privacy-artifact cleanup, lock handling, security status and AME packaging are implemented or prepared as described below. No real package download, app removal, account purge, policy write, service mutation, firewall change, device disable, cleanup or Recall deletion was performed.
|
|
|
|
A sourced blog draft and pinned-revision GDID research review are included. Workbook formulas were recalculated and tested with temporary status edits, then restored; rendered sheets and exported structure were inspected. No Excel desktop execution was performed.
|
|
|
|
The supplied script was parsed without execution. Three isolated in-memory probes reproduced its marker mismatch, malformed-marker truncation and ASCII conversion defect. No new OS policy, service, hosts-file, cache, firewall or application mutation was performed. The added repositories remain research leads, not independently validated identifier suppression.
|
|
|
|
## Delivered
|
|
|
|
- Research and threat model with primary sources, implementation plan and release validation protocol.
|
|
- Three browser choices: Tor Browser, Zen and Helium; optional Mullvad and VeraCrypt installers.
|
|
- Local PowerShell policy engine: read-only audit, plan, explicit apply, recovery journal and conflict-aware restore.
|
|
- Home edition Settings assistant and manual guide; no unsupported policy enforcement claims.
|
|
- Tabbed Windows Forms wizard that reuses the PowerShell scripts, plus the arrow/Space/Enter terminal interface.
|
|
- Six-preset catalog with age-aware recommendation. Windows and profile ages of seven days or less select Fresh Install and its complete removal workflow; older/unknown installations select Established PC with no destructive groups. Gentle, Medium, Strong and Maximum remain manually selectable. Exact review and one final approval precede mutation.
|
|
- Complete-preset operation runner that records every selected group, continues with independent groups after a failure, skips only failed prerequisites and writes a local run summary without secrets.
|
|
- Exact current-user app inventory, protected dependency rules, default curated debloat, OneDrive/Edge ordering and Tor/Zen/Helium browser prerequisites.
|
|
- Optional network FQDN enforcement across 19 reviewed feature/telemetry endpoints, protected update/security endpoint rejection, explicit timed isolation, journal validation, post-check confirmation, Pktmon capture conversion and point-in-time socket inventory.
|
|
- Strict service engine for DiagTrack, dmwappushservice, CDPSvc/CDPUserSvc, OneSyncSvc, CloudBackupRestoreSvc, lfsvc and WerSvc, with original-state journals, instance shutdown and conflict-aware restore. Update, Defender, firewall, certificate, licensing, identity and Store security services are protected by catalog validation.
|
|
- Irreversible current-user Microsoft app-account purge: exact Store/Xbox/Microsoft 365/Teams/account-broker package resets plus allowlisted Credential Manager deletion, with account names and credential targets omitted from reports. Strict policy blocks future consumer app authentication and new workplace registration without disabling the Windows logon identity.
|
|
- Recall eligibility/policy/feature workflow with an irreversible-deletion acknowledgement.
|
|
- Exact selected PnP sensor disable/restore; allowlisted Temp, crash-report, Recent/Jump List, thumbnail, PowerShell-history and expired-report cleanup; scheduling; and SessionLock clipboard/VeraCrypt handling.
|
|
- Read-only BitLocker/device-encryption, Defender/cloud posture, firewall, Secure Boot, TPM, VBS/Credential Guard, LSA, UAC, SMB/SMB1, remote-access and protected-service status without recovery keys, account names, Defender exclusions or secrets.
|
|
- AME wrapper source and builder that launch the same graphical wizard without disabling Defender or Windows Update.
|
|
- Self-contained x64 `ms-private-0.0.5.exe` launcher with a `requireAdministrator` manifest, embedded hash-manifested runtime, exact-file verification, tamper repair and protected Program Files installation.
|
|
|
|
## Verification performed
|
|
|
|
- 120 tests pass in PowerShell 7 and Windows PowerShell 5.1: 25 policy/transaction, 29 app/menu, 19 offline-bundle and 47 feature/package/security/service/account/preset/operation-runner checks. The runner writes real populated and empty reports during regression testing. GUI child-script invocation and deferred atomic writers are exercised across the same nested module boundaries used by Apply.
|
|
- Ten native launcher tests pass for archive and installed-manifest integrity, installation validation, modified/extra-file repair, path traversal, bad hashes and undeclared entries. Managed PE inspection verifies AMD64 GUI format, the UAC manifest, version, checksum and signature state.
|
|
- Shared journal/report create, flush, atomic-replace and parse tests passed using temporary workspace files.
|
|
- All PowerShell source files parsed successfully during verification.
|
|
- Real read-only service and policy planning completed in both PowerShell engines. On this Windows Home (`Core`) build 26200, seven documented direct registry controls are eligible and 45 managed-edition policies remain unsupported.
|
|
- Installer previews used `-WhatIf`; no package installation occurred.
|
|
- Live operating-system policy mutation, app uninstallation, firewall changes and telemetry suppression were not performed or claimed.
|
|
|
|
Compatibility testing found and corrected PowerShell 5.1 array enumeration differences and null-path behavior in journal replacement. Mock registry tests do not prove operating-system enforcement, privacy guarantees or absence of network traffic.
|
|
|
|
## Remaining release work
|
|
|
|
The requested modules are implemented or packaged as explicit prepared controls. Production validation remains open: VM policy behavior, live app uninstall/reinstall, physical sensors and Windows Hello, network enforcement across IPv4/IPv6/DNS/DoH/QUIC/VPN, Pktmon/gateway comparison, Recall deletion/reboot, lock trigger paths, busy VeraCrypt volumes, cleanup with active installers, GUI accessibility/DPI, and AME execution. No broad deployment or anonymity certification is implied by this release candidate.
|