10 KiB
Validation and privacy acceptance protocol
Completed checks
Unreleased audit, 2026-09-26: seven new cleanup regressions pass in Windows PowerShell 5.1, covering a side-effect-free preview, unchanged-file deletion, timestamp and length changes, locked files, invalid timestamps and the real cleanup entry script with a mocked clipboard. The operation runner also tests differently capitalized dependency names. The Windows PowerShell 5.1 component suites total 128 passing checks. PowerShell 7 reported an antivirus block in the replacement cleanup catalog; that new suite is not validated in that engine. No security exclusions or bypasses were added. Changed-file detection uses size and modification time; it does not detect identical metadata or eliminate the filesystem race between checking and deleting a file.
All 48 feature tests also pass in PowerShell 7. The previous v0.0.5 Gitea job ended as Canceled after 0s; it provides no remote test evidence. The local validation results above remain distinct from server CI status.
Release-candidate update, 2026-09-24: 120 tests pass in each of Windows PowerShell 5.1 and PowerShell 7 (25 policy/transaction, 29 app/menu, 19 offline-bundle, 47 feature/package/security/service/account/preset/operation-runner). The policy tests include current-user registry scope, Home direct-control selection and managed-edition exclusion, and Enterprise-only selection. The app tests include aggressive all-removable-app and explicit Store selection, safe skipping of ambiguous desktop registrations, protection of security/dependency applications, completeness of FreshInstall/Medium/Strong/Maximum and the non-destructive EstablishedSafe preset, the reported JSON catalog failure and journal callback scope failure, browser-before-removal sequencing, installer errors, stale inventory, partial failure, bundle deduplication, group selection, keyboard navigation, filtering and terminal layout limits. Feature tests cover real populated and empty operation-runner reports, captured GUI child-script invocation and deferred atomic JSON writers across nested module boundaries, cleanup report finalization, invoker path-traversal refusal, fresh/established/unknown install-age decisions, continued execution of independent groups after a failure, dependency skipping, preset schema refusal, shared Recall apply/skip/conflict decisions, atomic JSON replacement, malformed or duplicate policy/service/account/network catalogs, protected update-endpoint refusal, untrusted registry-hive refusal, network journal recovery, cleanup-root and protected-log refusal, recovery-journal exclusion, browser-cache scope, protected-service exclusion, service disable/restore, forged service-plan rejection, exact account-package reset, credential allowlisting, report redaction, VeraCrypt volume validation, versioned secret-free security audit behavior and AME manifest structure. Native arrow/Space/Enter/Esc browser selection was also exercised in a real Windows PowerShell console. Live host inventory, service planning and account planning were read-only. No real uninstall, account purge, policy or service write, reboot, firewall change, capture, device disable, Recall deletion or update installation was performed.
The .NET launcher has ten passing tests for valid archive acceptance, installed payload and manifest verification, repair after modified files, rejection and repair of undeclared installed files, manifest path traversal refusal, bad-hash refusal and undeclared archive-entry refusal. Build-Executable.ps1 must also produce exactly one x64 self-contained executable plus its checksum. Its managed PE inspection verifies AMD64 and GUI headers, the embedded requireAdministrator manifest, version, checksum and signature state. Before publishing, launch the GUI in a clean VM, alter and add runtime files to confirm repair, and test a Program Files access failure.
These checks support a release candidate, not a production-validation claim. Run the matrix below before advertising a stable release. The Gitea Actions workflow requires a Windows runner labelled windows-latest; a remote workflow result does not replace the live matrix.
The offline-bundle module adds 19 passing synthetic-file tests in PowerShell 7 and 5.1: mismatched hashes and targets, unsafe paths, unknown fields, missing/duplicate packages, dependency ordering, provenance URL validation, invalid dates and reparse-point refusal. These are integrity/validation tests, not real update or network-containment tests. Its host inventory was run read-only.
The transaction test suite uses an in-memory registry adapter, never production policy writes. It covers edition gates, diagnostic choices, unsupported builds, update modes, microphone exceptions, original value types, read failures, exact restoration, reapply, journal failures, mid-apply failures, writes that fail after mutation, restore conflicts, interrupted operations, repeated restore, untrusted journal entries, installation mismatch and stale plans.
Run ./tests/Run-All.ps1 with both PowerShell 7 and Windows PowerShell 5.1. This includes source parsing and all suites. Run the real host audit read-only and preview app installation using -WhatIf. These tests verify software behavior, not Windows policy enforcement.
VM matrix required before release
| OS | Test |
|---|---|
| Windows 11 Home 24H2/25H2 | Seven documented direct registry controls apply transactionally; managed-edition policies remain unsupported; manual guide matches current Settings |
| Windows 11 Pro 24H2/25H2 | Standard/Strict policy and service apply, readback, reboot, behavioral checks and restore |
| Windows 11 Enterprise/Education 24H2/25H2 | Same, including actual diagnostic policy effect |
| Unknown/future build | No automatic mutation until separately reviewed |
| Domain/MDM managed device | Apply/Restore decline; no competing policies |
| Non-admin / 32-bit process | Read-only operations work where possible; real mutation declines |
| App operations: 19045 / 22631 / 26100 / 26200 | Verify exact selected uninstall scope, app-data behavior, browser installation and reboot. Use a supported servicing arrangement for Windows 10. |
| Edge: supported / restricted removal | Verify successful uninstall where supported; otherwise report failure, preserve WebView2 and permit a revised keep-Edge plan. |
| OneDrive: local / cloud-only / unsynced content | Confirm warnings, normal uninstall, unchanged sync folders and recovery using official installers. |
| WinGet: missing / first-run / offline / cancelled installer | Abort safely; never misreport browser availability or proceed after a failed prerequisite. |
Use snapshot-backed clean VMs, then repeat relevant tests on physical hardware. A VM does not validate real microphones, cameras, TPM behavior or physical network adapters. Never use production credentials in the test matrix.
Behavior checks
After apply and reboot, verify each supported setting in Windows UI and through representative workflows. Confirm camera denial and restoration, packaged microphone denial plus desktop limitations, activity upload, app capabilities, clipboard sync/history behavior, location-dependent applications, cloud speech and cloud search. Verify DiagTrack, CDPSvc, CDPUserSvc instances, cloud sync/backup and WER before and after reboot and restore. Confirm update scan/download/install, certificate refresh, Store revocation and Defender updates still work.
Restore original registry types/values and absence; compare with the preflight snapshot. Keep externally changed settings intact and report conflicts. Test interruption before the first write, between writes, during journal replacement and during restore. Test a filled/read-only journal filesystem, registry permission denial and competing changes.
Configured means the catalogued value matches. Only behavioral verification can show the intended feature effect. Policy precedence, MDM, user policy and Windows changes may produce different effective behavior.
Network checks
Use an external lab gateway capture plus a local process-attribution view when needed. Keep the capture start time, build, chosen controls, workflow and duration. Avoid personal accounts; keep raw captures local. No TLS interception is required or installed.
Compare baseline and configured runs across boot/login, 15 minutes idle, browser launch, start search, deliberate update check, app installation, account sign-in, reboot and restore. Repeat with and without VPN. Classify observed destinations; distinguish optional diagnostics from security maintenance and user-requested cloud features.
For VPN/strict-egress testing, include IPv4, IPv6, DNS, application DoH, TCP, UDP/QUIC, network changes, sleep/wake, connection loss, app exit, tunnel reconnect and split-tunnel exceptions. Verify recovery without network access. Do not accept a single IP-check website as a complete leak test.
Document: "During these workflows, on this build, over this interval, the following traffic was observed/blocked." Do not conclude that an encrypted payload contains no identifier or that an unobserved connection can never occur later.
Package and browser checks
Verify exact WinGet package ID, publisher download domain, installer version/hash and available architecture against each official project release. Preserve hash verification. Report nonzero installation exits and reboot requirements. An installer finishing does not establish account login, VPN connection, browser permissions or encryption configuration.
Tor must remain on official update channels with stock fingerprinting protections. Zen and Helium need a current browser-security update check, visible sync/crash/permission decisions and tests that default-browser/profile import remain user-controlled.
Data deletion and lock checks
Require a separate preview for Recall snapshot removal, app data deletion and cleanup. Exclude Downloads/documents by default. Skip locked files, junctions and filesystem reparse points. Never recursively follow arbitrary paths in a cleanup tool.
For lock handling, exercise Win+L, automatic screen lock, user switching and remote-session disconnection. Busy VeraCrypt volumes, unsaved files and unavailable vault APIs must produce explicit failures. Verify clipboard history/sync separately from the current clipboard. Never report a complete RAM wipe.